mirrors/versitygw
1
0
Fork 0
mirror of https://github.com/versity/versitygw.git synced 2026-08-18 13:16:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1713 from versity/test/get_bucket_policy_status

Browse Source 
Test/get bucket policy status
This commit is contained in:
Ben McClelland
2026-01-03 20:48:40 -08:00
committed by GitHub
parent f235b62b70 841b3d61a4
commit 01552b78c7
12 changed files with 267 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/system.yml
+14
View File
@@ -79,6 +79,20 @@ jobs:
DELETE_BUCKETS_AFTER_TEST: "true"
BACKEND: "posix"
AWS_REGION: "us-west-1"
- set: "REST, posix, static, rest-get-bucket-policy-status, folder IAM"
IAM_TYPE: folder
RUN_SET: "rest-get-bucket-policy-status"
RECREATE_BUCKETS: "false"
DELETE_BUCKETS_AFTER_TEST: "false"
BACKEND: "posix"
AWS_REGION: "us-east-1"
- set: "REST, posix, non-static, rest-get-bucket-policy-status, folder IAM"
IAM_TYPE: folder
RUN_SET: "rest-put-bucket-tagging,rest-get-bucket-location,rest-put-object-tagging,rest-get-object-tagging,rest-list-object-versions"
RECREATE_BUCKETS: "true"
DELETE_BUCKETS_AFTER_TEST: "true"
BACKEND: "posix"
AWS_REGION: "us-west-1"
- set: "s3, posix, non-file count, non-static, folder IAM"
IAM_TYPE: folder
RUN_SET: "s3-non-file-count"
tests/commands/put_bucket_policy.sh
+16 -1
View File
@@ -30,7 +30,7 @@ put_bucket_policy() {
elif [[ $1 == 'mc' ]]; then
policy=$(send_command mc --insecure anonymous set-json "$3" "$MC_ALIAS/$2" 2>&1) || put_policy_result=$?
elif [ "$1" == 'rest' ]; then
put_bucket_policy_rest "$2" "$3" || put_policy_result=$?
put_bucket_policy_rest_200_or_204 "$2" "$3" || put_policy_result=$?
return $put_policy_result
else
log 2 "command 'put bucket policy' not implemented for '$1'"
@@ -77,3 +77,18 @@ put_bucket_policy_rest() {
fi
return 0
}
put_bucket_policy_rest_200_or_204() {
if ! check_param_count "put_bucket_policy_rest" "bucket, policy file" 2 $#; then
return 1
fi
if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" POLICY_FILE="$2" OUTPUT_FILE="$TEST_FILE_FOLDER/result.txt" ./tests/rest_scripts/put_bucket_policy.sh); then
log 2 "error putting bucket policy: $result"
return 1
fi
if [ "$result" != "200" ] && [ "$result" != "204" ]; then
log 2 "expected '200' or '204', was '$result' ($(cat "$TEST_FILE_FOLDER/result.txt"))"
return 1
fi
return 0
}
tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh
+41
View File
@@ -0,0 +1,41 @@
#!/usr/bin/env bats
# Copyright 2025 Versity Software
# This file is licensed under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
source ./tests/drivers/xml.sh
check_policy_status() {
if ! check_param_count_v2 "data file" 1 $#; then
return 1
fi
log 5 "data: $(cat "$1")"
if ! check_xml_element "$1" "$expected_policy_status" "PolicyStatus" "IsPublic"; then
log 2 "error checking policy status"
return 1
fi
return 0
}
get_and_check_policy_status() {
if ! check_param_count_v2 "bucket, expected status" 2 $#; then
return 1
fi
expected_policy_status="$2"
if ! send_rest_go_command_callback "200" "check_policy_status" "-bucketName" "$1" "-query" "policyStatus="; then
log 2 "error sending REST go command or checking callback"
return 1
fi
return 0
}
tests/drivers/put_bucket_policy/put_bucket_policy.sh
+31
View File
@@ -0,0 +1,31 @@
#!/usr/bin/env bats
# Copyright 2025 Versity Software
# This file is licensed under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
put_and_check_for_malformed_policy() {
if ! check_param_count "put_and_check_for_malformed_policy" "bucket, policy file" 2 $#; then
return 1
fi
if put_bucket_policy "s3api" "$1" "$2"; then
log 2 "put succeeded despite malformed policy"
return 1
fi
# shellcheck disable=SC2154
if [[ "$put_bucket_policy_error" != *"MalformedPolicy"*"invalid action"* ]]; then
log 2 "invalid policy error: $put_bucket_policy_error"
return 1
fi
return 0
}
tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh
+54
View File
@@ -0,0 +1,54 @@
#!/usr/bin/env bats
# Copyright 2025 Versity Software
# This file is licensed under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
put_simple_bucket_policy() {
if ! check_param_count_v2 "bucket" 1 $#; then
return 1
fi
if [ "$DIRECT" == "true" ]; then
user_id="$DIRECT_S3_ROOT_ACCOUNT_NAME"
else
user_id="$AWS_ACCESS_KEY_ID"
fi
if ! setup_policy_with_single_statement "$TEST_FILE_FOLDER/policy_file" "2012-10-17" "Allow" "$user_id" "s3:*" "arn:aws:s3:::$1"; then
log 2 "error setting up policy"
return 1
fi
log 5 "policy: $TEST_FILE_FOLDER/policy_file"
if ! put_bucket_policy_rest "$1" "$TEST_FILE_FOLDER/policy_file"; then
log 2 "error putting policy"
return 1
fi
return 0
}
put_public_bucket_policy() {
if ! check_param_count_v2 "bucket" 1 $#; then
return 1
fi
if ! setup_policy_with_single_statement "$TEST_FILE_FOLDER/policy_file" "2012-10-17" "Allow" "*" "s3:*" "arn:aws:s3:::$1"; then
log 2 "error setting up policy"
return 1
fi
if ! put_bucket_policy_rest "$1" "$TEST_FILE_FOLDER/policy_file"; then
log 2 "error putting policy"
return 1
fi
return 0
}
tests/rest_scripts/put_bucket_policy.sh
+1 -1
View File
@@ -41,7 +41,7 @@ $payload_hash"
# shellcheck disable=SC2119
create_canonical_hash_sts_and_signature
curl_command+=(curl -ks -w "\"%{http_code}\"" -X PUT "$AWS_ENDPOINT_URL/$bucket_name?policy="
curl_command+=(curl -iks -w "\"%{http_code}\"" -X PUT "$AWS_ENDPOINT_URL/$bucket_name?policy="
-H "\"Authorization: AWS4-HMAC-SHA256 Credential=$aws_access_key_id/$year_month_day/$aws_region/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=$signature\""
-H "\"x-amz-content-sha256: $payload_hash\""
-H "\"x-amz-date: $current_date_time\""
tests/run.sh
+7 -1
View File
@@ -67,7 +67,7 @@ handle_param() {
rest-create-bucket|rest-head-bucket|rest-list-buckets|rest-not-implemented|\
rest-put-object|rest-versioning|rest-bucket|rest-multipart|rest-delete-bucket-ownership-controls|\
rest-delete-bucket-tagging|setup-remove-static|rest-put-bucket-tagging|rest-get-bucket-location|\
rest-put-object-tagging|rest-get-object-tagging|rest-list-object-versions)
rest-put-object-tagging|rest-get-object-tagging|rest-list-object-versions|rest-get-bucket-policy-status)
run_suite "$1"
;;
*) # Handle unrecognized options or positional arguments
@@ -180,6 +180,8 @@ run_suite() {
exit_code=1
elif ! "$HOME"/bin/bats ./tests/test_rest_get_bucket_location.sh; then
exit_code=1
elif ! "$HOME"/bin/bats ./tests/test_rest_get_bucket_policy_status.sh; then
exit_code=1
elif ! "$HOME"/bin/bats ./tests/test_rest_get_object_tagging.sh; then
exit_code=1
elif ! "$HOME"/bin/bats ./tests/test_rest_head_bucket.sh; then
@@ -240,6 +242,10 @@ run_suite() {
echo "Running REST get bucket location tests ..."
"$HOME"/bin/bats ./tests/test_rest_get_bucket_location.sh || exit_code=$?
;;
rest-get-bucket-policy-status)
echo "Running REST get bucket policy status tests ..."
"$HOME"/bin/bats ./tests/test_rest_get_bucket_policy_status.sh || exit_code=$?
;;
rest-get-object-tagging)
echo "Running REST get object tagging tests ..."
"$HOME"/bin/bats ./tests/test_rest_get_object_tagging.sh || exit_code=$?
tests/test_rest_get_bucket_policy_status.sh
Executable
+65
View File
@@ -0,0 +1,65 @@
#!/usr/bin/env bats
# Copyright 2025 Versity Software
# This file is licensed under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
load ./bats-support/load
load ./bats-assert/load
source ./tests/drivers/create_bucket/create_bucket_rest.sh
source ./tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh
source ./tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh
source ./tests/util/util_public_access_block.sh
source ./tests/setup.sh
@test "REST - GetBucketPolicyStatus" {
if [ "$DIRECT" != "true" ]; then
skip "https://github.com/versity/versitygw/issues/1712"
fi
run get_bucket_name "$BUCKET_ONE_NAME"
assert_success
bucket_name="$output"
run setup_bucket_v2 "$bucket_name"
assert_success
run put_simple_bucket_policy "$bucket_name"
assert_success
run get_and_check_policy_status "$bucket_name" "false"
assert_success
}
@test "REST - GetBucketPolicyStatus true" {
if [ "$DIRECT" != "true" ]; then
skip "https://github.com/versity/versitygw/issues/1712"
fi
run get_bucket_name "$BUCKET_ONE_NAME"
assert_success
bucket_name="$output"
run setup_bucket_v2 "$bucket_name"
assert_success
if [ "$DIRECT" == "true" ]; then
run allow_public_access "$bucket_name"
assert_success
fi
run put_public_bucket_policy "$bucket_name"
assert_success
run get_and_check_policy_status "$bucket_name" "true"
assert_success
}
tests/test_rest_put_bucket_policy.sh
Executable
+34
View File
@@ -0,0 +1,34 @@
#!/usr/bin/env bats
# Copyright 2025 Versity Software
# This file is licensed under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
load ./bats-support/load
load ./bats-assert/load
source ./tests/drivers/create_bucket/create_bucket_rest.sh
source ./tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh
source ./tests/setup.sh
@test "PutBucketPolicy - success returns 204" {
run get_bucket_name "$BUCKET_ONE_NAME"
assert_success
bucket_name="$output"
run setup_bucket_v2 "$bucket_name"
assert_success
run put_simple_bucket_policy "$bucket_name"
assert_success
}
tests/test_s3api_policy_object.sh
+1
View File
@@ -14,6 +14,7 @@
# specific language governing permissions and limitations
# under the License.
source ./tests/drivers/put_bucket_policy/put_bucket_policy.sh
source ./tests/util/util_delete_object.sh
test_s3api_policy_allow_deny() {
tests/util/util_policy.sh
+2 -17
View File
@@ -43,7 +43,8 @@ check_for_empty_policy() {
add_direct_user_to_principal() {
if [ "${principals[$idx]}" == "*" ]; then
modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/$DIRECT_S3_ROOT_ACCOUNT_NAME\""
#modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/$DIRECT_S3_ROOT_ACCOUNT_NAME\""
modified_principal+="\"*\""
else
modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/${principals[$idx]}\""
fi
@@ -238,22 +239,6 @@ check_policy() {
return 0
}
put_and_check_for_malformed_policy() {
if ! check_param_count "put_and_check_for_malformed_policy" "bucket, policy file" 2 $#; then
return 1
fi
if put_bucket_policy "s3api" "$1" "$2"; then
log 2 "put succeeded despite malformed policy"
return 1
fi
# shellcheck disable=SC2154
if [[ "$put_bucket_policy_error" != *"MalformedPolicy"*"invalid action"* ]]; then
log 2 "invalid policy error: $put_bucket_policy_error"
return 1
fi
return 0
}
get_and_check_no_policy_error() {
if ! check_param_count "get_and_check_no_policy_error" "bucket" 1 $#; then
return 1
tests/util/util_public_access_block.sh
+1 -1
View File
@@ -18,7 +18,7 @@ allow_public_access() {
if ! check_param_count_v2 "bucket name" 1 $#; then
return 1
fi
if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" BLOCK_PUBLIC_ACLS="FALSE" IGNORE_PUBLIC_ACLS="FALSE" RESTRICT_PUBLIC_BUCKETS="FALSE" OUTPUT_FILE="$TEST_FILE_FOLDER/response.txt" ./tests/rest_scripts/put_public_access_block.sh 2>&1); then
if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" BLOCK_PUBLIC_ACLS="FALSE" BLOCK_PUBLIC_POLICY="FALSE" IGNORE_PUBLIC_ACLS="FALSE" RESTRICT_PUBLIC_BUCKETS="FALSE" OUTPUT_FILE="$TEST_FILE_FOLDER/response.txt" ./tests/rest_scripts/put_public_access_block.sh 2>&1); then
log 2 "error getting public access block: $result"
return 1
fi