diff --git a/auth/access-control.go b/auth/access-control.go index 95fcfb72..53daae36 100644 --- a/auth/access-control.go +++ b/auth/access-control.go @@ -79,6 +79,7 @@ type AccessOptions struct { Action Action Readonly bool IsPublicRequest bool + DisableACL bool } func VerifyAccess(ctx context.Context, be backend.Backend, opts AccessOptions) error { @@ -107,7 +108,7 @@ func VerifyAccess(ctx context.Context, be backend.Backend, opts AccessOptions) e return VerifyBucketPolicy(policy, opts.Acc.Access, opts.Bucket, opts.Object, opts.Action) } - if err := verifyACL(opts.Acl, opts.Acc.Access, opts.AclPermission); err != nil { + if err := verifyACL(opts.Acl, opts.Acc.Access, opts.AclPermission, opts.DisableACL); err != nil { return err } diff --git a/auth/acl.go b/auth/acl.go index a69c4270..9ce0c60e 100644 --- a/auth/acl.go +++ b/auth/acl.go @@ -414,7 +414,17 @@ func splitUnique(s, divider string) []string { return result } -func verifyACL(acl ACL, access string, permission Permission) error { +func verifyACL(acl ACL, access string, permission Permission, disableACL bool) error { + if disableACL { + // only the bucket owner should have access to the bucket + // as bucket ACLs are disabled and no grantee check is necessary + if acl.Owner != access { + return s3err.GetAPIError(s3err.ErrAccessDenied) + } + + return nil + } + grantee := Grantee{ Access: access, Permission: permission, diff --git a/cmd/versitygw/main.go b/cmd/versitygw/main.go index bfcc1b22..d09e743d 100644 --- a/cmd/versitygw/main.go +++ b/cmd/versitygw/main.go @@ -100,6 +100,7 @@ var ( webuiNoTLS bool webuiGateways []string webuiAdminGateways []string + disableACLs bool ) var ( @@ -341,6 +342,13 @@ func initFlags() []cli.Flag { Destination: &virtualDomain, Aliases: []string{"vd"}, }, + &cli.BoolFlag{ + Name: "disable-acl", + Usage: "disables gateway ACLs, by ignoring all ACL headers", + EnvVars: []string{"VGW_DISABLE_ACL"}, + Destination: &disableACLs, + Aliases: []string{"noacl"}, + }, &cli.StringFlag{ Name: "access-log", Usage: "enable server access logging to specified file", @@ -833,6 +841,9 @@ func runGateway(ctx context.Context, be backend.Backend) error { if keepAlive { opts = append(opts, s3api.WithKeepAlive()) } + if disableACLs { + opts = append(opts, s3api.WithDisableACL()) + } if debug { debuglogger.SetDebugEnabled() } diff --git a/cmd/versitygw/test.go b/cmd/versitygw/test.go index e87363e0..b39b1cbd 100644 --- a/cmd/versitygw/test.go +++ b/cmd/versitygw/test.go @@ -152,6 +152,11 @@ func initTestCommands() []*cli.Command { Usage: "Tests gateway access control with bucket ACLs and Policies", Action: getAction(integration.TestAccessControl), }, + { + Name: "noacl", + Usage: "Tests gateway in ACL-disabled mode", + Action: getAction(integration.TestNoAclMode), + }, { Name: "bench", Usage: "Runs download/upload performance test on the gateway", diff --git a/extra/example.conf b/extra/example.conf index d63d52fa..8be8bd75 100644 --- a/extra/example.conf +++ b/extra/example.conf @@ -111,6 +111,13 @@ ROOT_SECRET_ACCESS_KEY= # operations will be allowed. #VGW_READ_ONLY=false +# Disable ACL support at the gateway level. All ACL headers on requests are +# ignored, and no access control is enforced using bucket ACLs. +# Prefer using bucket policies instead of ACLs for access management. +# PutBucketAcl returns an immediate AccessControlListNotSupported error. +# GetBucketAcl returns a successful response containing the default bucket ACL. +#VGW_DISABLE_ACL=false + # The VGW_VIRTUAL_DOMAIN option enables the virtual host style bucket # addressing. The path style addressing is the default, and remains enabled # even when virtual host style is enabled. The VGW_VIRTUAL_DOMAIN option diff --git a/runtests.sh b/runtests.sh index 48b08dc0..02cf0a24 100755 --- a/runtests.sh +++ b/runtests.sh @@ -5,8 +5,15 @@ rm -rf /tmp/gw mkdir /tmp/gw rm -rf /tmp/covdata mkdir /tmp/covdata -rm -rf /tmp/versioing.covdata +rm -rf /tmp/https.covdata +mkdir /tmp/https.covdata +rm -rf /tmp/versioning.covdata mkdir /tmp/versioning.covdata +rm -rf /tmp/versioning.https.covdata +mkdir /tmp/versioning.https.covdata +rm -rf /tmp/noacl.covdata +mkdir /tmp/noacl.covdata + rm -rf /tmp/versioningdir mkdir /tmp/versioningdir @@ -153,10 +160,74 @@ fi # kill off server kill $GW_VS_HTTPS_PID +ECHO "Running No ACL integration tests" +# run server in background versioning-enabled +# port: 7073 +GOCOVERDIR=/tmp/noacl.covdata ./versitygw -p :7074 -a user -s pass -noacl --iam-dir /tmp/gw posix /tmp/gw & +GW_NO_ACL_PID=$! + +# wait a second for server to start up +sleep 1 + +# check if noacl gateway process is still running +if ! kill -0 $GW_NO_ACL_PID; then + echo "noacl server no longer running" + exit 1 +fi + +if ! ./versitygw test --allow-insecure -a user -s pass -e http://127.0.0.1:7074 noacl; then + echo "No ACL integration tests failed" + kill $GW_NO_ACL_PID + exit 1 +fi + +# kill off server +kill $GW_NO_ACL_PID + exit 0 -# if the above binary was built with -cover enabled (make testbin), -# then the following can be used for code coverage reports: -# go tool covdata percent -i=/tmp/covdata -# go tool covdata textfmt -i=/tmp/covdata -o profile.txt -# go tool cover -html=profile.txt +# ----------------------------------------------------------------------------- +# Coverage Reports (Go 1.20+ Runtime Coverage) +# +# The servers above were started with GOCOVERDIR=, which causes Go to write +# raw coverage artifacts into those directories (covmeta + covcounters.* files). +# These raw files must be processed with "go tool covdata" to generate +# human-readable coverage reports. +# +# You may generate *per-environment* coverage or a *merged full-suite* report. +# +# ----------------------------------------------------------------------------- +# 1) INDIVIDUAL COVERAGE REPORTS +# +# Example for a single environment (e.g. /tmp/covdata): +# +# go tool covdata percent -i=/tmp/covdata +# go tool covdata textfmt -i=/tmp/covdata -o /tmp/profile.txt +# go tool cover -html=/tmp/profile.txt +# +# Repeat using: +# /tmp/covdata +# /tmp/https.covdata +# /tmp/versioning.covdata +# /tmp/versioning.https.covdata +# /tmp/noacl.covdata +# +# This gives you coverage metrics isolated per test suite / server mode. +# +# ----------------------------------------------------------------------------- +# 2) MERGED COVERAGE REPORT (RECOMMENDED) +# +# If you want a unified report combining all environments: +# +# go tool covdata merge \ +# -i=/tmp/covdata,/tmp/https.covdata,/tmp/versioning.covdata,/tmp/versioning.https.covdata,/tmp/noacl.covdata \ +# -o /tmp/allcovdata +# +# go tool covdata percent -i=/tmp/allcovdata +# go tool covdata textfmt -i=/tmp/allcovdata -o /tmp/all_profile.txt +# go tool cover -html=/tmp/all_profile.txt +# +# This produces the full aggregate coverage across all HTTP/HTTPS, +# versioning-enabled, non-versioning, and no-ACL test runs. +# +# ----------------------------------------------------------------------------- diff --git a/s3api/controllers/admin_test.go b/s3api/controllers/admin_test.go index a540f193..fc722263 100644 --- a/s3api/controllers/admin_test.go +++ b/s3api/controllers/admin_test.go @@ -681,7 +681,7 @@ func TestAdminController_CreateBucket(t *testing.T) { }, } - s3api := New(be, iam, nil, nil, nil, false, "") + s3api := New(be, iam, nil, nil, nil, false, false, "") ctrl := AdminController{ iam: iam, diff --git a/s3api/controllers/base.go b/s3api/controllers/base.go index cc8be7eb..80e95188 100644 --- a/s3api/controllers/base.go +++ b/s3api/controllers/base.go @@ -39,6 +39,7 @@ type S3ApiController struct { evSender s3event.S3EventSender mm metrics.Manager readonly bool + disableACL bool virtualDomain string } @@ -59,7 +60,7 @@ var ( xmlhdr = []byte(`` + "\n") ) -func New(be backend.Backend, iam auth.IAMService, logger s3log.AuditLogger, evs s3event.S3EventSender, mm metrics.Manager, readonly bool, virtualDomain string) S3ApiController { +func New(be backend.Backend, iam auth.IAMService, logger s3log.AuditLogger, evs s3event.S3EventSender, mm metrics.Manager, readonly, disableACL bool, virtualDomain string) S3ApiController { return S3ApiController{ be: be, iam: iam, @@ -67,10 +68,19 @@ func New(be backend.Backend, iam auth.IAMService, logger s3log.AuditLogger, evs evSender: evs, readonly: readonly, mm: mm, + disableACL: disableACL, virtualDomain: virtualDomain, } } +func (c S3ApiController) getAclHeaderValue(ctx *fiber.Ctx, key string, defaultValues ...string) string { + if c.disableACL { + return "" + } + + return ctx.Get(key, defaultValues...) +} + // Returns MethodNotAllowed for unmatched routes func (c S3ApiController) HandleErrorRoute(err error) Controller { return func(ctx *fiber.Ctx) (*Response, error) { diff --git a/s3api/controllers/bucket-delete.go b/s3api/controllers/bucket-delete.go index 7b062b0a..20f89cc1 100644 --- a/s3api/controllers/bucket-delete.go +++ b/s3api/controllers/bucket-delete.go @@ -39,6 +39,7 @@ func (c S3ApiController) DeleteBucketTagging(ctx *fiber.Ctx) (*Response, error) Bucket: bucket, Action: auth.PutBucketTaggingAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -72,6 +73,7 @@ func (c S3ApiController) DeleteBucketOwnershipControls(ctx *fiber.Ctx) (*Respons Acc: acct, Bucket: bucket, Action: auth.PutBucketOwnershipControlsAction, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -105,6 +107,7 @@ func (c S3ApiController) DeleteBucketPolicy(ctx *fiber.Ctx) (*Response, error) { Acc: acct, Bucket: bucket, Action: auth.DeleteBucketPolicyAction, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -140,6 +143,7 @@ func (c S3ApiController) DeleteBucketCors(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.PutBucketCorsAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -175,6 +179,7 @@ func (c S3ApiController) DeleteBucket(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.DeleteBucketAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/bucket-get.go b/s3api/controllers/bucket-get.go index aa5194a7..d1e1e7e3 100644 --- a/s3api/controllers/bucket-get.go +++ b/s3api/controllers/bucket-get.go @@ -41,6 +41,7 @@ func (c S3ApiController) GetBucketTagging(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.GetBucketTaggingAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -93,6 +94,7 @@ func (c S3ApiController) GetBucketOwnershipControls(ctx *fiber.Ctx) (*Response, Bucket: bucket, Action: auth.GetBucketOwnershipControlsAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -133,6 +135,7 @@ func (c S3ApiController) GetBucketVersioning(ctx *fiber.Ctx) (*Response, error) Bucket: bucket, Action: auth.GetBucketVersioningAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -175,6 +178,7 @@ func (c S3ApiController) GetBucketCors(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.GetBucketCorsAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -218,6 +222,7 @@ func (c S3ApiController) GetBucketPolicy(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.GetBucketPolicyAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -252,6 +257,7 @@ func (c S3ApiController) GetBucketPolicyStatus(ctx *fiber.Ctx) (*Response, error Bucket: bucket, Action: auth.GetBucketPolicyStatusAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -313,6 +319,7 @@ func (c S3ApiController) ListObjectVersions(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.ListBucketVersionsAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -366,6 +373,7 @@ func (c S3ApiController) GetObjectLockConfiguration(ctx *fiber.Ctx) (*Response, Bucket: bucket, Action: auth.GetBucketObjectLockConfigurationAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -411,6 +419,7 @@ func (c S3ApiController) GetBucketAcl(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.GetBucketAclAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -462,6 +471,7 @@ func (c S3ApiController) ListMultipartUploads(ctx *fiber.Ctx) (*Response, error) Bucket: bucket, Action: auth.ListBucketMultipartUploadsAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -519,6 +529,7 @@ func (c S3ApiController) ListObjectsV2(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.ListBucketAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -576,6 +587,7 @@ func (c S3ApiController) ListObjects(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.ListBucketAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -627,6 +639,7 @@ func (c S3ApiController) GetBucketLocation(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.GetBucketLocationAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/bucket-head.go b/s3api/controllers/bucket-head.go index ed6696f8..4861d507 100644 --- a/s3api/controllers/bucket-head.go +++ b/s3api/controllers/bucket-head.go @@ -42,6 +42,7 @@ func (c S3ApiController) HeadBucket(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.ListBucketAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/bucket-post.go b/s3api/controllers/bucket-post.go index be3d3bd3..52819da9 100644 --- a/s3api/controllers/bucket-post.go +++ b/s3api/controllers/bucket-post.go @@ -47,6 +47,7 @@ func (c S3ApiController) DeleteObjects(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.DeleteObjectAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/bucket-put.go b/s3api/controllers/bucket-put.go index d532131f..47521ba1 100644 --- a/s3api/controllers/bucket-put.go +++ b/s3api/controllers/bucket-put.go @@ -47,6 +47,7 @@ func (c S3ApiController) PutBucketTagging(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.PutBucketTaggingAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -88,6 +89,7 @@ func (c S3ApiController) PutBucketOwnershipControls(ctx *fiber.Ctx) (*Response, Acc: acct, Bucket: bucket, Action: auth.PutBucketOwnershipControlsAction, + DisableACL: c.disableACL, }); err != nil { return &Response{ MetaOpts: &MetaOptions{ @@ -143,6 +145,7 @@ func (c S3ApiController) PutBucketVersioning(ctx *fiber.Ctx) (*Response, error) Bucket: bucket, Action: auth.PutBucketVersioningAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -197,6 +200,7 @@ func (c S3ApiController) PutObjectLockConfiguration(ctx *fiber.Ctx) (*Response, Bucket: bucket, Action: auth.PutBucketObjectLockConfigurationAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }); err != nil { return &Response{ MetaOpts: &MetaOptions{ @@ -238,6 +242,7 @@ func (c S3ApiController) PutBucketCors(ctx *fiber.Ctx) (*Response, error) { Bucket: bucket, Action: auth.PutBucketCorsAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -292,6 +297,7 @@ func (c S3ApiController) PutBucketPolicy(ctx *fiber.Ctx) (*Response, error) { Acc: acct, Bucket: bucket, Action: auth.PutBucketPolicyAction, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -344,6 +350,7 @@ func (c S3ApiController) PutBucketAcl(ctx *fiber.Ctx) (*Response, error) { Acc: acct, Bucket: bucket, Action: auth.PutBucketAclAction, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -353,6 +360,15 @@ func (c S3ApiController) PutBucketAcl(ctx *fiber.Ctx) (*Response, error) { }, err } + if c.disableACL { + debuglogger.Logf("PutBucketAcl is not available, as ACLs are disabled at gateway level") + return &Response{ + MetaOpts: &MetaOptions{ + BucketOwner: parsedAcl.Owner, + }, + }, s3err.GetAPIError(s3err.ErrACLsDisabled) + } + err = auth.ValidateCannedACL(acl) if err != nil { return &Response{ @@ -480,12 +496,12 @@ func (c S3ApiController) PutBucketAcl(ctx *fiber.Ctx) (*Response, error) { func (c S3ApiController) CreateBucket(ctx *fiber.Ctx) (*Response, error) { bucket := ctx.Params("bucket") - acl := types.BucketCannedACL(ctx.Get("X-Amz-Acl")) - grantFullControl := ctx.Get("X-Amz-Grant-Full-Control") - grantRead := ctx.Get("X-Amz-Grant-Read") - grantReadACP := ctx.Get("X-Amz-Grant-Read-Acp") - grantWrite := ctx.Get("X-Amz-Grant-Write") - grantWriteACP := ctx.Get("X-Amz-Grant-Write-Acp") + acl := types.BucketCannedACL(c.getAclHeaderValue(ctx, "X-Amz-Acl")) + grantFullControl := c.getAclHeaderValue(ctx, "X-Amz-Grant-Full-Control") + grantRead := c.getAclHeaderValue(ctx, "X-Amz-Grant-Read") + grantReadACP := c.getAclHeaderValue(ctx, "X-Amz-Grant-Read-Acp") + grantWrite := c.getAclHeaderValue(ctx, "X-Amz-Grant-Write") + grantWriteACP := c.getAclHeaderValue(ctx, "X-Amz-Grant-Write-Acp") lockEnabled := strings.EqualFold(ctx.Get("X-Amz-Bucket-Object-Lock-Enabled"), "true") grants := grantFullControl + grantRead + grantReadACP + grantWrite + grantWriteACP objectOwnership := types.ObjectOwnership(ctx.Get("X-Amz-Object-Ownership")) diff --git a/s3api/controllers/object-delete.go b/s3api/controllers/object-delete.go index 3a3b6ee3..a374e5ab 100644 --- a/s3api/controllers/object-delete.go +++ b/s3api/controllers/object-delete.go @@ -52,6 +52,7 @@ func (c S3ApiController) DeleteObjectTagging(ctx *fiber.Ctx) (*Response, error) Object: key, Action: action, IsPublicRequest: isBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -104,6 +105,7 @@ func (c S3ApiController) AbortMultipartUpload(ctx *fiber.Ctx) (*Response, error) Object: key, Action: auth.AbortMultipartUploadAction, IsPublicRequest: isBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -158,6 +160,7 @@ func (c S3ApiController) DeleteObject(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: action, IsPublicRequest: isBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/object-get.go b/s3api/controllers/object-get.go index 828f085c..4d212110 100644 --- a/s3api/controllers/object-get.go +++ b/s3api/controllers/object-get.go @@ -55,6 +55,7 @@ func (c S3ApiController) GetObjectTagging(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: action, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -121,6 +122,7 @@ func (c S3ApiController) GetObjectRetention(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.GetObjectRetentionAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -177,6 +179,7 @@ func (c S3ApiController) GetObjectLegalHold(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.GetObjectLegalHoldAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -223,6 +226,7 @@ func (c S3ApiController) GetObjectAcl(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.GetObjectAclAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -265,6 +269,7 @@ func (c S3ApiController) ListParts(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.ListMultipartUploadPartsAction, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -336,6 +341,7 @@ func (c S3ApiController) GetObjectAttributes(ctx *fiber.Ctx) (*Response, error) Object: key, Action: action, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -469,6 +475,7 @@ func (c S3ApiController) GetObject(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: action, IsPublicRequest: isPublicBucketRequest, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/object-head.go b/s3api/controllers/object-head.go index 87e6e22c..f4fe4b6e 100644 --- a/s3api/controllers/object-head.go +++ b/s3api/controllers/object-head.go @@ -57,6 +57,7 @@ func (c S3ApiController) HeadObject(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: action, IsPublicRequest: isPublicBucket, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/object-post.go b/s3api/controllers/object-post.go index 1e87274c..3d34dbc3 100644 --- a/s3api/controllers/object-post.go +++ b/s3api/controllers/object-post.go @@ -50,6 +50,7 @@ func (c S3ApiController) RestoreObject(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.RestoreObjectAction, IsPublicRequest: isBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -101,6 +102,7 @@ func (c S3ApiController) SelectObjectContent(ctx *fiber.Ctx) (*Response, error) Object: key, Action: auth.GetObjectAction, IsPublicRequest: isBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -158,7 +160,7 @@ func (c S3ApiController) CreateMultipartUpload(ctx *fiber.Ctx) (*Response, error isRoot := utils.ContextKeyIsRoot.Get(ctx).(bool) parsedAcl := utils.ContextKeyParsedAcl.Get(ctx).(auth.ACL) - err := utils.ValidateNoACLHeaders(ctx) + err := utils.ValidateNoACLHeaders(ctx, c.disableACL) if err != nil { return &Response{ MetaOpts: &MetaOptions{ @@ -177,6 +179,7 @@ func (c S3ApiController) CreateMultipartUpload(ctx *fiber.Ctx) (*Response, error Bucket: bucket, Object: key, Action: auth.PutObjectAction, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -261,6 +264,7 @@ func (c S3ApiController) CompleteMultipartUpload(ctx *fiber.Ctx) (*Response, err Object: key, Action: auth.PutObjectAction, IsPublicRequest: isBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/controllers/object-put.go b/s3api/controllers/object-put.go index caccab47..7dc3d484 100644 --- a/s3api/controllers/object-put.go +++ b/s3api/controllers/object-put.go @@ -57,6 +57,7 @@ func (c S3ApiController) PutObjectTagging(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: action, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -116,6 +117,7 @@ func (c S3ApiController) PutObjectRetention(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.PutObjectRetentionAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -191,6 +193,7 @@ func (c S3ApiController) PutObjectLegalHold(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.PutObjectLegalHoldAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -269,6 +272,7 @@ func (c S3ApiController) UploadPart(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.PutObjectAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -383,6 +387,7 @@ func (c S3ApiController) UploadPartCopy(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.PutObjectAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ @@ -510,7 +515,7 @@ func (c S3ApiController) CopyObject(ctx *fiber.Ctx) (*Response, error) { isRoot := utils.ContextKeyIsRoot.Get(ctx).(bool) parsedAcl := utils.ContextKeyParsedAcl.Get(ctx).(auth.ACL) - err := utils.ValidateNoACLHeaders(ctx) + err := utils.ValidateNoACLHeaders(ctx, c.disableACL) if err != nil { return &Response{ MetaOpts: &MetaOptions{ @@ -668,7 +673,7 @@ func (c S3ApiController) PutObject(ctx *fiber.Ctx) (*Response, error) { parsedAcl := utils.ContextKeyParsedAcl.Get(ctx).(auth.ACL) IsBucketPublic := utils.ContextKeyPublicBucket.IsSet(ctx) - err := utils.ValidateNoACLHeaders(ctx) + err := utils.ValidateNoACLHeaders(ctx, c.disableACL) if err != nil { return &Response{ MetaOpts: &MetaOptions{ @@ -703,6 +708,7 @@ func (c S3ApiController) PutObject(ctx *fiber.Ctx) (*Response, error) { Object: key, Action: auth.PutObjectAction, IsPublicRequest: IsBucketPublic, + DisableACL: c.disableACL, }) if err != nil { return &Response{ diff --git a/s3api/router.go b/s3api/router.go index 8816f496..04c0fd46 100644 --- a/s3api/router.go +++ b/s3api/router.go @@ -27,141 +27,159 @@ import ( ) type S3ApiRouter struct { - WithAdmSrv bool - Ctrl controllers.S3ApiController + WithAdmSrv bool + app *fiber.App + be backend.Backend + iam auth.IAMService + logger s3log.AuditLogger + aLogger s3log.AuditLogger + evs s3event.S3EventSender + mm metrics.Manager + root middlewares.RootUserConfig + Ctrl controllers.S3ApiController + readonly bool + disableACL bool + region string + virtualDomain string + corsAllowOrigin string } -func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMService, logger s3log.AuditLogger, aLogger s3log.AuditLogger, evs s3event.S3EventSender, mm metrics.Manager, readonly bool, region, virtualDomain string, root middlewares.RootUserConfig, corsAllowOrigin string) { - ctrl := controllers.New(be, iam, logger, evs, mm, readonly, virtualDomain) +func (sa *S3ApiRouter) Init() { + ctrl := controllers.New(sa.be, sa.iam, sa.logger, sa.evs, sa.mm, sa.readonly, sa.disableACL, sa.virtualDomain) sa.Ctrl = ctrl adminServices := &controllers.Services{ - Logger: aLogger, + Logger: sa.aLogger, + } + + // initialize global host-style parser middleware if virtual domain is specified + if sa.virtualDomain != "" { + sa.app.Use(middlewares.HostStyleParser(sa.virtualDomain)) } if sa.WithAdmSrv { - adminController := controllers.NewAdminController(iam, be, aLogger, ctrl) + adminController := controllers.NewAdminController(sa.iam, sa.be, sa.aLogger, ctrl) // CreateUser admin api - app.Patch("/create-user", + sa.app.Patch("/create-user", controllers.ProcessHandlers(adminController.CreateUser, metrics.ActionAdminCreateUser, adminServices, - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.IsAdmin(metrics.ActionAdminCreateUser), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), )) - app.Options("/create-user", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/create-user", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) // DeleteUsers admin api - app.Patch("/delete-user", + sa.app.Patch("/delete-user", controllers.ProcessHandlers(adminController.DeleteUser, metrics.ActionAdminDeleteUser, adminServices, - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.IsAdmin(metrics.ActionAdminDeleteUser), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), )) - app.Options("/delete-user", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/delete-user", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) // UpdateUser admin api - app.Patch("/update-user", + sa.app.Patch("/update-user", controllers.ProcessHandlers(adminController.UpdateUser, metrics.ActionAdminUpdateUser, adminServices, - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.IsAdmin(metrics.ActionAdminUpdateUser), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), )) - app.Options("/update-user", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/update-user", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) // ListUsers admin api - app.Patch("/list-users", + sa.app.Patch("/list-users", controllers.ProcessHandlers(adminController.ListUsers, metrics.ActionAdminListUsers, adminServices, - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.IsAdmin(metrics.ActionAdminListUsers), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), )) - app.Options("/list-users", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/list-users", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) // ChangeBucketOwner admin api - app.Patch("/change-bucket-owner", + sa.app.Patch("/change-bucket-owner", controllers.ProcessHandlers(adminController.ChangeBucketOwner, metrics.ActionAdminChangeBucketOwner, adminServices, - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.IsAdmin(metrics.ActionAdminChangeBucketOwner), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), )) - app.Options("/change-bucket-owner", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/change-bucket-owner", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) // ListBucketsAndOwners admin api - app.Patch("/list-buckets", + sa.app.Patch("/list-buckets", controllers.ProcessHandlers(adminController.ListBuckets, metrics.ActionAdminListBuckets, adminServices, - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.IsAdmin(metrics.ActionAdminListBuckets), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), )) - app.Options("/list-buckets", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/list-buckets", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) // CreateBucket admin api - app.Patch("/:bucket/create", + sa.app.Patch("/:bucket/create", controllers.ProcessHandlers(adminController.CreateBucket, metrics.ActionAdminCreateBucket, adminServices, - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.IsAdmin(metrics.ActionAdminCreateBucket), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), )) - app.Options("/:bucket/create", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/:bucket/create", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) } services := &controllers.Services{ - Logger: logger, - EventSender: evs, - MetricsManager: mm, + Logger: sa.logger, + EventSender: sa.evs, + MetricsManager: sa.mm, } // ListBuckets action // copy source is not allowed on '/' - app.Get("/", middlewares.MatchHeader("X-Amz-Copy-Source"), + sa.app.Get("/", middlewares.MatchHeader("X-Amz-Copy-Source"), controllers.ProcessHandlers( ctrl.HandleErrorRoute(s3err.GetAPIError(s3err.ErrCopySourceNotAllowed)), metrics.ActionUndetected, services, - middlewares.ApplyDefaultCORS(corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ), ) - app.Get("/", + sa.app.Get("/", controllers.ProcessHandlers( ctrl.ListBuckets, metrics.ActionListAllMyBuckets, services, - middlewares.ApplyDefaultCORS(corsAllowOrigin), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListAllMyBuckets, "", auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListAllMyBuckets, "", auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), )) - app.Options("/", - middlewares.ApplyDefaultCORSPreflight(corsAllowOrigin), - middlewares.ApplyDefaultCORS(corsAllowOrigin), + sa.app.Options("/", + middlewares.ApplyDefaultCORSPreflight(sa.corsAllowOrigin), + middlewares.ApplyDefaultCORS(sa.corsAllowOrigin), ) - bucketRouter := app.Group("/:bucket") - objectRouter := app.Group("/:bucket/*") + bucketRouter := sa.app.Group("/:bucket") + objectRouter := sa.app.Group("/:bucket/*") // PUT bucket operations bucketRouter.Put("", @@ -171,12 +189,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketTagging, services, middlewares.BucketObjectNameValidator(), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketTagging, auth.PutBucketTaggingAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketTagging, auth.PutBucketTaggingAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, true, true), - middlewares.ParseAcl(be), + middlewares.ParseAcl(sa.be), )) bucketRouter.Put("", middlewares.MatchQueryArgs("ownershipControls"), @@ -185,12 +203,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketOwnershipControls, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketOwnershipControls, auth.PutBucketOwnershipControlsAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketOwnershipControls, auth.PutBucketOwnershipControlsAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, true, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Put("", middlewares.MatchQueryArgs("versioning"), @@ -199,12 +217,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketVersioning, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketVersioning, auth.PutBucketVersioningAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketVersioning, auth.PutBucketVersioningAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, true, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Put("", middlewares.MatchQueryArgs("object-lock"), @@ -213,12 +231,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutObjectLockConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutObjectLockConfiguration, auth.PutBucketObjectLockConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectLockConfiguration, auth.PutBucketObjectLockConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, true, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Put("", middlewares.MatchQueryArgs("cors"), @@ -227,12 +245,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketCors, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketCors, auth.PutBucketCorsAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketCors, auth.PutBucketCorsAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, true, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Put("", middlewares.MatchQueryArgs("policy"), @@ -241,12 +259,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketPolicy, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketPolicy, auth.PutBucketPolicyAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketPolicy, auth.PutBucketPolicyAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Put("", middlewares.MatchQueryArgs("acl"), @@ -255,12 +273,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketAcl, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketAcl, auth.PutBucketAclAction, auth.PermissionWriteAcp, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketAcl, auth.PutBucketAclAction, auth.PermissionWriteAcp, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Put("", middlewares.MatchQueryArgs("analytics"), @@ -269,10 +287,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketAnalyticsConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketAnalyticsConfiguration, auth.PutAnalyticsConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketAnalyticsConfiguration, auth.PutAnalyticsConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -282,10 +300,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketEncryption, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketEncryption, auth.PutEncryptionConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketEncryption, auth.PutEncryptionConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -295,10 +313,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketIntelligentTieringConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketIntelligentTieringConfiguration, auth.PutIntelligentTieringConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketIntelligentTieringConfiguration, auth.PutIntelligentTieringConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -308,10 +326,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketInventoryConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketInventoryConfiguration, auth.PutInventoryConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketInventoryConfiguration, auth.PutInventoryConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -321,10 +339,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketLifecycleConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketLifecycleConfiguration, auth.PutLifecycleConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketLifecycleConfiguration, auth.PutLifecycleConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -334,10 +352,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketLogging, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketLogging, auth.PutBucketLoggingAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketLogging, auth.PutBucketLoggingAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -347,10 +365,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketRequestPayment, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketRequestPayment, auth.PutBucketRequestPaymentAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketRequestPayment, auth.PutBucketRequestPaymentAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -360,10 +378,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketMetricsConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketMetricsConfiguration, auth.PutMetricsConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketMetricsConfiguration, auth.PutMetricsConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -373,10 +391,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketReplication, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketReplication, auth.PutReplicationConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketReplication, auth.PutReplicationConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -386,10 +404,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutPublicAccessBlock, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutPublicAccessBlock, auth.PutBucketPublicAccessBlockAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutPublicAccessBlock, auth.PutBucketPublicAccessBlockAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -399,10 +417,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketNotificationConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketNotificationConfiguration, auth.PutBucketNotificationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketNotificationConfiguration, auth.PutBucketNotificationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -412,10 +430,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketAccelerateConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketAccelerateConfiguration, auth.PutAccelerateConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketAccelerateConfiguration, auth.PutAccelerateConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -425,10 +443,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutBucketWebsite, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutBucketWebsite, auth.PutBucketWebsiteAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketWebsite, auth.PutBucketWebsiteAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Put("", @@ -437,11 +455,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionCreateBucket, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionCreateBucket, auth.CreateBucketAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionCreateBucket, auth.CreateBucketAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), )) // HeadBucket action @@ -457,11 +475,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionHeadBucket, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionHeadBucket, auth.ListBucketAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionHeadBucket, auth.ListBucketAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, false), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // DELETE bucket operations @@ -478,11 +496,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketTagging, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketTagging, auth.PutBucketTaggingAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketTagging, auth.PutBucketTaggingAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", middlewares.MatchQueryArgs("ownershipControls"), @@ -491,11 +509,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketOwnershipControls, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketOwnershipControls, auth.PutBucketOwnershipControlsAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketOwnershipControls, auth.PutBucketOwnershipControlsAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", middlewares.MatchQueryArgs("policy"), @@ -504,11 +522,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketPolicy, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketPolicy, auth.PutBucketPolicyAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketPolicy, auth.PutBucketPolicyAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", middlewares.MatchQueryArgs("cors"), @@ -517,11 +535,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketCors, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketCors, auth.PutBucketCorsAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketCors, auth.PutBucketCorsAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", middlewares.MatchQueryArgs("analytics"), @@ -530,10 +548,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketAnalyticsConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketAnalyticsConfiguration, auth.PutAnalyticsConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketAnalyticsConfiguration, auth.PutAnalyticsConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -543,10 +561,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketEncryption, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketEncryption, auth.PutEncryptionConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketEncryption, auth.PutEncryptionConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -556,10 +574,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketIntelligentTieringConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketIntelligentTieringConfiguration, auth.PutIntelligentTieringConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketIntelligentTieringConfiguration, auth.PutIntelligentTieringConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -569,10 +587,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketInventoryConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketInventoryConfiguration, auth.PutInventoryConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketInventoryConfiguration, auth.PutInventoryConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -582,10 +600,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketLifecycle, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketLifecycle, auth.PutLifecycleConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketLifecycle, auth.PutLifecycleConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -595,10 +613,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketMetricsConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketMetricsConfiguration, auth.PutMetricsConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketMetricsConfiguration, auth.PutMetricsConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -608,10 +626,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketReplication, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketReplication, auth.PutReplicationConfigurationAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketReplication, auth.PutReplicationConfigurationAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -621,10 +639,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeletePublicAccessBlock, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeletePublicAccessBlock, auth.PutBucketPublicAccessBlockAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeletePublicAccessBlock, auth.PutBucketPublicAccessBlockAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -634,10 +652,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucketWebsite, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucketWebsite, auth.PutBucketWebsiteAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketWebsite, auth.PutBucketWebsiteAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Delete("", @@ -646,11 +664,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteBucket, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteBucket, auth.DeleteBucketAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucket, auth.DeleteBucketAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // GET bucket operations @@ -667,11 +685,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketLocation, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketLocation, auth.GetBucketLocationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketLocation, auth.GetBucketLocationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -681,11 +699,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketTagging, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketTagging, auth.GetBucketTaggingAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketTagging, auth.GetBucketTaggingAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("ownershipControls"), @@ -694,11 +712,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketOwnershipControls, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketOwnershipControls, auth.GetBucketOwnershipControlsAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketOwnershipControls, auth.GetBucketOwnershipControlsAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("versioning"), @@ -707,11 +725,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketVersioning, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketVersioning, auth.GetBucketVersioningAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketVersioning, auth.GetBucketVersioningAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("policy"), @@ -720,11 +738,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketPolicy, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketPolicy, auth.GetBucketPolicyAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketPolicy, auth.GetBucketPolicyAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("cors"), @@ -733,11 +751,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketCors, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketCors, auth.GetBucketCorsAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketCors, auth.GetBucketCorsAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("object-lock"), @@ -746,11 +764,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetObjectLockConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetObjectLockConfiguration, auth.GetBucketObjectLockConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectLockConfiguration, auth.GetBucketObjectLockConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("acl"), @@ -759,11 +777,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketAcl, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketAcl, auth.GetBucketAclAction, auth.PermissionReadAcp, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketAcl, auth.GetBucketAclAction, auth.PermissionReadAcp, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, false), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("uploads"), @@ -772,11 +790,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListMultipartUploads, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListMultipartUploads, auth.ListBucketMultipartUploadsAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListMultipartUploads, auth.ListBucketMultipartUploadsAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("versions"), @@ -785,11 +803,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListObjectVersions, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListObjectVersions, auth.ListBucketVersionsAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListObjectVersions, auth.ListBucketVersionsAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("policyStatus"), @@ -798,11 +816,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketPolicyStatus, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketPolicyStatus, auth.GetBucketPolicyStatusAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketPolicyStatus, auth.GetBucketPolicyStatusAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", middlewares.MatchQueryArgs("analytics", "id"), @@ -811,10 +829,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketAnalyticsConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketAnalyticsConfiguration, auth.GetAnalyticsConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketAnalyticsConfiguration, auth.GetAnalyticsConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -824,10 +842,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListBucketAnalyticsConfigurations, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListBucketAnalyticsConfigurations, auth.GetAnalyticsConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListBucketAnalyticsConfigurations, auth.GetAnalyticsConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -837,10 +855,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketEncryption, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketEncryption, auth.GetEncryptionConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketEncryption, auth.GetEncryptionConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -850,10 +868,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketIntelligentTieringConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketIntelligentTieringConfiguration, auth.GetIntelligentTieringConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketIntelligentTieringConfiguration, auth.GetIntelligentTieringConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -863,10 +881,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListBucketIntelligentTieringConfigurations, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListBucketIntelligentTieringConfigurations, auth.GetIntelligentTieringConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListBucketIntelligentTieringConfigurations, auth.GetIntelligentTieringConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -876,10 +894,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketInventoryConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketInventoryConfiguration, auth.GetInventoryConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketInventoryConfiguration, auth.GetInventoryConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -889,10 +907,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListBucketInventoryConfigurations, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListBucketInventoryConfigurations, auth.GetInventoryConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListBucketInventoryConfigurations, auth.GetInventoryConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -902,10 +920,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketLifecycleConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketLifecycleConfiguration, auth.GetLifecycleConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketLifecycleConfiguration, auth.GetLifecycleConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -915,10 +933,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketLogging, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketLogging, auth.GetBucketLoggingAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketLogging, auth.GetBucketLoggingAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -928,10 +946,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketRequestPayment, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketRequestPayment, auth.GetBucketRequestPaymentAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketRequestPayment, auth.GetBucketRequestPaymentAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -941,10 +959,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketMetricsConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketMetricsConfiguration, auth.GetMetricsConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketMetricsConfiguration, auth.GetMetricsConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -954,10 +972,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListBucketMetricsConfigurations, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListBucketMetricsConfigurations, auth.GetMetricsConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListBucketMetricsConfigurations, auth.GetMetricsConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -967,10 +985,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketReplication, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketReplication, auth.GetReplicationConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketReplication, auth.GetReplicationConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -980,10 +998,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetPublicAccessBlock, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetPublicAccessBlock, auth.GetBucketPublicAccessBlockAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetPublicAccessBlock, auth.GetBucketPublicAccessBlockAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -993,10 +1011,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketNotificationConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketNotificationConfiguration, auth.GetBucketNotificationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketNotificationConfiguration, auth.GetBucketNotificationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -1006,10 +1024,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketAccelerateConfiguration, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketAccelerateConfiguration, auth.GetAccelerateConfigurationAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketAccelerateConfiguration, auth.GetAccelerateConfigurationAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -1019,10 +1037,10 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetBucketWebsite, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetBucketWebsite, auth.GetBucketWebsiteAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketWebsite, auth.GetBucketWebsiteAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), ), ) bucketRouter.Get("", @@ -1032,11 +1050,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListObjectsV2, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListObjectsV2, auth.ListBucketAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListObjectsV2, auth.ListBucketAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", controllers.ProcessHandlers( @@ -1044,11 +1062,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListObjects, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListObjects, auth.ListBucketAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListObjects, auth.ListBucketAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // bucket POST operation is not allowed with uploadId and copy source @@ -1066,12 +1084,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteObjects, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteObjects, auth.DeleteObjectAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteObjects, auth.DeleteObjectAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, true, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // object HEAD operation is not allowed with copy source @@ -1087,11 +1105,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionHeadObject, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionHeadObject, auth.GetObjectAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionHeadObject, auth.GetObjectAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, false), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // GET object operations @@ -1121,11 +1139,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetObjectTagging, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetObjectTagging, auth.GetObjectTaggingAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectTagging, auth.GetObjectTaggingAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Get("", middlewares.MatchQueryArgs("retention"), @@ -1134,11 +1152,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetObjectRetention, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetObjectRetention, auth.GetObjectRetentionAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectRetention, auth.GetObjectRetentionAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Get("", middlewares.MatchQueryArgs("legal-hold"), @@ -1147,11 +1165,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetObjectLegalHold, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetObjectLegalHold, auth.GetObjectLegalHoldAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectLegalHold, auth.GetObjectLegalHoldAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Get("", middlewares.MatchQueryArgs("acl"), @@ -1160,11 +1178,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetObjectAcl, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetObjectAcl, auth.GetObjectAclAction, auth.PermissionReadAcp, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectAcl, auth.GetObjectAclAction, auth.PermissionReadAcp, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Get("", middlewares.MatchQueryArgs("attributes"), @@ -1173,11 +1191,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetObjectAttributes, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetObjectAttributes, auth.GetObjectAttributesAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectAttributes, auth.GetObjectAttributesAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Get("", middlewares.MatchQueryArgs("uploadId"), @@ -1186,11 +1204,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionListParts, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionListParts, auth.ListMultipartUploadPartsAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListParts, auth.ListMultipartUploadPartsAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Get("", controllers.ProcessHandlers( @@ -1198,11 +1216,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionGetObject, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionGetObject, auth.GetObjectAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObject, auth.GetObjectAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // DELETE object operations @@ -1220,11 +1238,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteObjectTagging, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteObjectTagging, auth.DeleteObjectTaggingAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteObjectTagging, auth.DeleteObjectTaggingAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Delete("", middlewares.MatchQueryArgs("uploadId"), @@ -1233,11 +1251,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionAbortMultipartUpload, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionAbortMultipartUpload, auth.AbortMultipartUploadAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionAbortMultipartUpload, auth.AbortMultipartUploadAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Delete("", controllers.ProcessHandlers( @@ -1245,11 +1263,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionDeleteObject, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionDeleteObject, auth.DeleteObjectAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteObject, auth.DeleteObjectAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // object POST operations @@ -1268,12 +1286,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionRestoreObject, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionRestoreObject, auth.RestoreObjectAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionRestoreObject, auth.RestoreObjectAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Post("", middlewares.MatchQueryArgs("select"), @@ -1283,12 +1301,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionSelectObjectContent, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionSelectObjectContent, auth.GetObjectAction, auth.PermissionRead, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionSelectObjectContent, auth.GetObjectAction, auth.PermissionRead, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Post("", middlewares.MatchQueryArgs("uploadId"), @@ -1297,11 +1315,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionCompleteMultipartUpload, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionCompleteMultipartUpload, auth.PutObjectAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionCompleteMultipartUpload, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Post("", middlewares.MatchQueryArgs("uploads"), @@ -1310,11 +1328,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionCreateMultipartUpload, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionCreateMultipartUpload, auth.PutObjectAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionCreateMultipartUpload, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // PUT object operations @@ -1325,12 +1343,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutObjectTagging, services, middlewares.BucketObjectNameValidator(), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutObjectTagging, auth.PutObjectTaggingAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectTagging, auth.PutObjectTaggingAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, true, false), - middlewares.ParseAcl(be), + middlewares.ParseAcl(sa.be), )) objectRouter.Put("", middlewares.MatchQueryArgs("retention"), @@ -1339,12 +1357,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutObjectRetention, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutObjectRetention, auth.PutObjectRetentionAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectRetention, auth.PutObjectRetentionAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Put("", middlewares.MatchQueryArgs("legal-hold"), @@ -1353,12 +1371,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutObjectLegalHold, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutObjectLegalHold, auth.PutObjectLegalHoldAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectLegalHold, auth.PutObjectLegalHoldAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Put("", middlewares.MatchQueryArgs("acl"), @@ -1367,12 +1385,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutObjectAcl, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutObjectAcl, auth.PutObjectAclAction, auth.PermissionWriteAcp, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectAcl, auth.PutObjectAclAction, auth.PermissionWriteAcp, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), middlewares.VerifyChecksums(false, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Put("", middlewares.MatchQueryArgs("uploadId", "partNumber"), @@ -1382,11 +1400,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionUploadPartCopy, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionUploadPartCopy, auth.PutObjectAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionUploadPartCopy, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) objectRouter.Put("", middlewares.MatchQueryArgs("uploadId", "partNumber"), @@ -1395,12 +1413,12 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionUploadPart, services, middlewares.BucketObjectNameValidator(), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionUploadPart, auth.PutObjectAction, auth.PermissionWrite, region, true), - middlewares.VerifyPresignedV4Signature(root, iam, region, true), - middlewares.VerifyV4Signature(root, iam, region, true, true), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionUploadPart, auth.PutObjectAction, auth.PermissionWrite, sa.region, true), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, true, true), middlewares.VerifyChecksums(true, false, false), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.ParseAcl(sa.be), )) // return error if partNumber is used without uploadId @@ -1421,11 +1439,11 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionCopyObject, services, middlewares.BucketObjectNameValidator(), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionCopyObject, auth.PutObjectAction, auth.PermissionWrite, region, false), - middlewares.VerifyPresignedV4Signature(root, iam, region, false), - middlewares.VerifyV4Signature(root, iam, region, false, true), - middlewares.ParseAcl(be), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionCopyObject, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true), + middlewares.ParseAcl(sa.be), )) objectRouter.Put("", controllers.ProcessHandlers( @@ -1433,30 +1451,30 @@ func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMServ metrics.ActionPutObject, services, middlewares.BucketObjectNameValidator(), - middlewares.ApplyBucketCORS(be, corsAllowOrigin), - middlewares.AuthorizePublicBucketAccess(be, metrics.ActionPutObject, auth.PutObjectAction, auth.PermissionWrite, region, true), - middlewares.VerifyPresignedV4Signature(root, iam, region, true), - middlewares.VerifyV4Signature(root, iam, region, true, true), + middlewares.ApplyBucketCORS(sa.be, sa.corsAllowOrigin), + middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObject, auth.PutObjectAction, auth.PermissionWrite, sa.region, true), + middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, true), + middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, true, true), middlewares.VerifyChecksums(true, false, false), - middlewares.ParseAcl(be), + middlewares.ParseAcl(sa.be), )) - app.Options("/:bucket", - middlewares.ApplyBucketCORSPreflightFallback(be, corsAllowOrigin), + sa.app.Options("/:bucket", + middlewares.ApplyBucketCORSPreflightFallback(sa.be, sa.corsAllowOrigin), controllers.ProcessHandlers(ctrl.CORSOptions, metrics.ActionOptions, services, middlewares.BucketObjectNameValidator(), - middlewares.ParseAcl(be), + middlewares.ParseAcl(sa.be), ), ) - app.Options("/:bucket/*", - middlewares.ApplyBucketCORSPreflightFallback(be, corsAllowOrigin), + sa.app.Options("/:bucket/*", + middlewares.ApplyBucketCORSPreflightFallback(sa.be, sa.corsAllowOrigin), controllers.ProcessHandlers(ctrl.CORSOptions, metrics.ActionOptions, services, middlewares.BucketObjectNameValidator(), - middlewares.ParseAcl(be), + middlewares.ParseAcl(sa.be), ), ) // Return MethodNotAllowed for all the unmatched routes - app.All("*", controllers.ProcessHandlers(ctrl.HandleErrorRoute(s3err.GetAPIError(s3err.ErrMethodNotAllowed)), metrics.ActionUndetected, services)) + sa.app.All("*", controllers.ProcessHandlers(ctrl.HandleErrorRoute(s3err.GetAPIError(s3err.ErrMethodNotAllowed)), metrics.ActionUndetected, services)) } diff --git a/s3api/router_cors_test.go b/s3api/router_cors_test.go index e83ca366..b7da5765 100644 --- a/s3api/router_cors_test.go +++ b/s3api/router_cors_test.go @@ -24,7 +24,6 @@ import ( "github.com/gofiber/fiber/v2" "github.com/versity/versitygw/auth" "github.com/versity/versitygw/backend" - "github.com/versity/versitygw/s3api/middlewares" "github.com/versity/versitygw/s3err" ) @@ -60,20 +59,13 @@ func TestS3ApiRouter_ListBuckets_DefaultCORSAllowOrigin(t *testing.T) { origin := "https://example.com" app := fiber.New() - (&S3ApiRouter{}).Init( - app, - backend.BackendUnsupported{}, - &auth.IAMServiceInternal{}, - nil, - nil, - nil, - nil, - false, - "us-east-1", - "", - middlewares.RootUserConfig{}, - origin, - ) + (&S3ApiRouter{ + app: app, + be: backend.BackendUnsupported{}, + iam: &auth.IAMServiceInternal{}, + region: "us-east-1", + corsAllowOrigin: origin, + }).Init() req, err := http.NewRequest(http.MethodGet, "/", nil) if err != nil { @@ -97,20 +89,13 @@ func TestS3ApiRouter_ListBuckets_OptionsPreflight_DefaultCORS(t *testing.T) { origin := "https://example.com" app := fiber.New() - (&S3ApiRouter{}).Init( - app, - backend.BackendUnsupported{}, - &auth.IAMServiceInternal{}, - nil, - nil, - nil, - nil, - false, - "us-east-1", - "", - middlewares.RootUserConfig{}, - origin, - ) + (&S3ApiRouter{ + app: app, + be: backend.BackendUnsupported{}, + iam: &auth.IAMServiceInternal{}, + region: "us-east-1", + corsAllowOrigin: origin, + }).Init() req, err := http.NewRequest(http.MethodOptions, "/", nil) if err != nil { @@ -137,20 +122,13 @@ func TestS3ApiRouter_PutBucketTagging_ErrorStillIncludesFallbackCORS(t *testing. origin := "http://127.0.0.1:9090" app := fiber.New() - (&S3ApiRouter{}).Init( - app, - backendWithCorsOnly{}, - &auth.IAMServiceInternal{}, - nil, - nil, - nil, - nil, - false, - "us-east-1", - "", - middlewares.RootUserConfig{}, - origin, - ) + (&S3ApiRouter{ + app: app, + be: backendWithCorsOnly{}, + iam: &auth.IAMServiceInternal{}, + region: "us-east-1", + corsAllowOrigin: origin, + }).Init() req, err := http.NewRequest(http.MethodPut, "/testing?tagging", nil) if err != nil { @@ -172,20 +150,13 @@ func TestS3ApiRouter_PutObjectTagging_ErrorStillIncludesFallbackCORS(t *testing. origin := "http://127.0.0.1:9090" app := fiber.New() - (&S3ApiRouter{}).Init( - app, - backendWithCorsOnly{}, - &auth.IAMServiceInternal{}, - nil, - nil, - nil, - nil, - false, - "us-east-1", - "", - middlewares.RootUserConfig{}, - origin, - ) + (&S3ApiRouter{ + app: app, + be: backendWithCorsOnly{}, + iam: &auth.IAMServiceInternal{}, + region: "us-east-1", + corsAllowOrigin: origin, + }).Init() req, err := http.NewRequest(http.MethodPut, "/testing/myobj?tagging", nil) if err != nil { @@ -207,20 +178,13 @@ func TestS3ApiRouter_CopyObject_ErrorStillIncludesFallbackCORS(t *testing.T) { origin := "http://127.0.0.1:9090" app := fiber.New() - (&S3ApiRouter{}).Init( - app, - backendWithCorsOnly{}, - &auth.IAMServiceInternal{}, - nil, - nil, - nil, - nil, - false, - "us-east-1", - "", - middlewares.RootUserConfig{}, - origin, - ) + (&S3ApiRouter{ + app: app, + be: backendWithCorsOnly{}, + iam: &auth.IAMServiceInternal{}, + region: "us-east-1", + corsAllowOrigin: origin, + }).Init() req, err := http.NewRequest(http.MethodPut, "/testing/myobj", nil) if err != nil { @@ -243,20 +207,13 @@ func TestS3ApiRouter_PutObject_ErrorStillIncludesFallbackCORS(t *testing.T) { origin := "http://127.0.0.1:9090" app := fiber.New() - (&S3ApiRouter{}).Init( - app, - backendWithCorsOnly{}, - &auth.IAMServiceInternal{}, - nil, - nil, - nil, - nil, - false, - "us-east-1", - "", - middlewares.RootUserConfig{}, - origin, - ) + (&S3ApiRouter{ + app: app, + be: backendWithCorsOnly{}, + iam: &auth.IAMServiceInternal{}, + region: "us-east-1", + corsAllowOrigin: origin, + }).Init() req, err := http.NewRequest(http.MethodPut, "/testing/myobj", nil) if err != nil { @@ -294,20 +251,13 @@ func TestS3ApiRouter_OptionsWithBucketCORS_NoDuplicateHeaders(t *testing.T) { `) app := fiber.New() - (&S3ApiRouter{}).Init( - app, - backendWithBucketCors{corsConfig: corsConfig}, - &auth.IAMServiceInternal{}, - nil, - nil, - nil, - nil, - false, - "us-east-1", - "", - middlewares.RootUserConfig{}, - fallbackOrigin, - ) + (&S3ApiRouter{ + app: app, + be: backendWithBucketCors{corsConfig: corsConfig}, + iam: &auth.IAMServiceInternal{}, + region: "us-east-1", + corsAllowOrigin: fallbackOrigin, + }).Init() req, err := http.NewRequest(http.MethodOptions, "/xyz/upload/test.txt", nil) if err != nil { diff --git a/s3api/router_test.go b/s3api/router_test.go index c54451bb..8c870075 100644 --- a/s3api/router_test.go +++ b/s3api/router_test.go @@ -20,24 +20,16 @@ import ( "github.com/gofiber/fiber/v2" "github.com/versity/versitygw/auth" "github.com/versity/versitygw/backend" - "github.com/versity/versitygw/s3api/middlewares" ) func TestS3ApiRouter_Init(t *testing.T) { - type args struct { - app *fiber.App - be backend.Backend - iam auth.IAMService - } tests := []struct { name string sa *S3ApiRouter - args args }{ { name: "Initialize S3 api router", - sa: &S3ApiRouter{}, - args: args{ + sa: &S3ApiRouter{ app: fiber.New(), be: backend.BackendUnsupported{}, iam: &auth.IAMServiceInternal{}, @@ -46,7 +38,7 @@ func TestS3ApiRouter_Init(t *testing.T) { } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { - tt.sa.Init(tt.args.app, tt.args.be, tt.args.iam, nil, nil, nil, nil, false, "us-east-1", "", middlewares.RootUserConfig{}, "") + tt.sa.Init() }) } } diff --git a/s3api/server.go b/s3api/server.go index dca839df..0e7728b0 100644 --- a/s3api/server.go +++ b/s3api/server.go @@ -42,18 +42,15 @@ const ( ) type S3ApiServer struct { - Router *S3ApiRouter - app *fiber.App - backend backend.Backend - CertStorage *utils.CertStorage - quiet bool - readonly bool - keepAlive bool - health string - virtualDomain string - corsAllowOrigin string - maxConnections int - maxRequests int + Router *S3ApiRouter + app *fiber.App + backend backend.Backend + CertStorage *utils.CertStorage + quiet bool + keepAlive bool + health string + maxConnections int + maxRequests int } func New( @@ -69,7 +66,16 @@ func New( ) (*S3ApiServer, error) { server := &S3ApiServer{ backend: be, - Router: new(S3ApiRouter), + Router: &S3ApiRouter{ + be: be, + iam: iam, + logger: l, + aLogger: adminLogger, + evs: evs, + mm: mm, + root: root, + region: region, + }, } for _, opt := range opts { @@ -88,6 +94,7 @@ func New( }) server.app = app + server.Router.app = app // initialize the panic recovery middleware app.Use(recover.New( @@ -119,17 +126,12 @@ func New( // path unescapes the url app.Use(controllers.WrapMiddleware(middlewares.DecodeURL, l, mm)) - // initialize host-style parser in virtual domain is specified - if server.virtualDomain != "" { - app.Use(middlewares.HostStyleParser(server.virtualDomain)) - } - // initialize the debug logger in debug mode if debuglogger.IsDebugEnabled() { app.Use(middlewares.DebugLogger()) } - server.Router.Init(app, be, iam, l, adminLogger, evs, mm, server.readonly, region, server.virtualDomain, root, server.corsAllowOrigin) + server.Router.Init() return server, nil } @@ -158,12 +160,14 @@ func WithHealth(health string) Option { } func WithReadOnly() Option { - return func(s *S3ApiServer) { s.readonly = true } + return func(s *S3ApiServer) { s.Router.readonly = true } } // WithHostStyle enabled host-style bucket addressing on the server func WithHostStyle(virtualDomain string) Option { - return func(s *S3ApiServer) { s.virtualDomain = virtualDomain } + return func(s *S3ApiServer) { + s.Router.virtualDomain = virtualDomain + } } // WithKeepAlive enables the server keep alive @@ -174,7 +178,7 @@ func WithKeepAlive() Option { // WithCORSAllowOrigin sets the default CORS Access-Control-Allow-Origin value. // This is applied when no bucket CORS configuration exists, and for admin APIs. func WithCORSAllowOrigin(origin string) Option { - return func(s *S3ApiServer) { s.corsAllowOrigin = origin } + return func(s *S3ApiServer) { s.Router.corsAllowOrigin = origin } } // WithConcurrencyLimiter sets the server's maximum connection limit @@ -186,6 +190,12 @@ func WithConcurrencyLimiter(maxConnections, maxRequests int) Option { } } +// WithDisableACL disables the s3 api server ACLs, by ignoring all +// bucket/object ACL headers +func WithDisableACL() Option { + return func(s *S3ApiServer) { s.Router.disableACL = true } +} + // ServeMultiPort creates listeners for multiple port specifications and serves // on all of them simultaneously. This supports listening on multiple ports and/or // addresses (e.g., [":7070", "localhost:8080", "0.0.0.0:9090"]). diff --git a/s3api/utils/utils.go b/s3api/utils/utils.go index fdefdaca..da6dd201 100644 --- a/s3api/utils/utils.go +++ b/s3api/utils/utils.go @@ -1011,7 +1011,11 @@ func NewTLSListener(network string, address string, getCertificateFunc func(*tls // since ACL operations are not supported on objects, the presence of any ACL headers // results in a NotImplemented error. It returns nil only when all ACL headers // are absent. -func ValidateNoACLHeaders(ctx *fiber.Ctx) error { +func ValidateNoACLHeaders(ctx *fiber.Ctx, disableACL bool) error { + if disableACL { + return nil + } + for _, header := range []string{ "x-amz-acl", "x-amz-grant-full-control", diff --git a/s3err/s3err.go b/s3err/s3err.go index 7e439efc..9e6e7e3f 100644 --- a/s3err/s3err.go +++ b/s3err/s3err.go @@ -193,6 +193,7 @@ const ( ErrDirectoryNotEmpty ErrQuotaExceeded ErrVersioningNotConfigured + ErrACLsDisabled // Admin api errors ErrAdminAccessDenied @@ -867,6 +868,11 @@ var errorCodeResponse = map[ErrorCode]APIError{ Description: "Versioning has not been configured for the gateway.", HTTPStatusCode: http.StatusNotImplemented, }, + ErrACLsDisabled: { + Code: "AccessControlListNotSupported", + Description: "Access control lists are disabled at the gateway level", + HTTPStatusCode: http.StatusBadRequest, + }, // Admin api errors ErrAdminAccessDenied: { diff --git a/tests/integration/group-tests.go b/tests/integration/group-tests.go index f9863afc..25093bde 100644 --- a/tests/integration/group-tests.go +++ b/tests/integration/group-tests.go @@ -1171,6 +1171,16 @@ func TestSignedStreaminPayloadTrailer(ts *TestState) { } } +func TestNoAclMode(ts *TestState) { + ts.Run(NoAclMode_CreateBucket_with_acl) + ts.Run(NoAclMode_PutObject_with_acl) + ts.Run(NoAclMode_CopyObject_with_acl) + ts.Run(NoAclMode_multipart_upload_with_acl) + ts.Run(NoAclMode_PutBucketAcl) + ts.Run(NoAclMode_PutObjectAcl_not_implemented) + ts.Run(NoAclMode_GetObjectAcl_not_implemented) +} + type IntTest func(s3 *S3Conf) error type IntTests map[string]IntTest @@ -1867,5 +1877,12 @@ func GetIntTests() IntTests { "SignedStreamingPayloadTrailer_invalid_checksum": SignedStreamingPayloadTrailer_invalid_checksum, "SignedStreamingPayloadTrailer_bad_digest": SignedStreamingPayloadTrailer_bad_digest, "SignedStreamingPayloadTrailer_success": SignedStreamingPayloadTrailer_success, + "NoAclMode_CreateBucket_with_acl": NoAclMode_CreateBucket_with_acl, + "NoAclMode_PutObject_with_acl": NoAclMode_PutObject_with_acl, + "NoAclMode_CopyObject_with_acl": NoAclMode_CopyObject_with_acl, + "NoAclMode_multipart_upload_with_acl": NoAclMode_multipart_upload_with_acl, + "NoAclMode_PutBucketAcl": NoAclMode_PutBucketAcl, + "NoAclMode_PutObjectAcl_not_implemented": NoAclMode_PutObjectAcl_not_implemented, + "NoAclMode_GetObjectAcl_not_implemented": NoAclMode_GetObjectAcl_not_implemented, } } diff --git a/tests/integration/no_acl.go b/tests/integration/no_acl.go new file mode 100644 index 00000000..4039e6ab --- /dev/null +++ b/tests/integration/no_acl.go @@ -0,0 +1,245 @@ +// Copyright 2026 Versity Software +// This file is licensed under the Apache License, Version 2.0 +// (the "License"); you may not use this file except in compliance +// with the License. You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, +// software distributed under the License is distributed on an +// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +// KIND, either express or implied. See the License for the +// specific language governing permissions and limitations +// under the License. + +package integration + +import ( + "context" + "fmt" + "strings" + + "github.com/aws/aws-sdk-go-v2/service/s3" + "github.com/aws/aws-sdk-go-v2/service/s3/types" + "github.com/versity/versitygw/s3err" +) + +func NoAclMode_CreateBucket_with_acl(s *S3Conf) error { + testName := "NoAclMode_CreateBucket_with_acl" + return actionHandlerNoSetup(s, testName, func(s3client *s3.Client, bucket string) error { + u := getUser("user") + err := createUsers(s, []user{u}) + if err != nil { + return err + } + + ctx, cancel := context.WithTimeout(context.Background(), shortTimeout) + _, err = s3client.CreateBucket(ctx, &s3.CreateBucketInput{ + Bucket: &bucket, + ACL: types.BucketCannedACLPublicReadWrite, + GrantFullControl: &u.access, + GrantRead: &u.access, + GrantReadACP: &u.access, + GrantWrite: &u.access, + GrantWriteACP: &u.access, + }) + cancel() + if err != nil { + return err + } + + ctx, cancel = context.WithTimeout(context.Background(), shortTimeout) + out, err := s3client.GetBucketAcl(ctx, &s3.GetBucketAclInput{ + Bucket: &bucket, + }) + cancel() + if err != nil { + return err + } + + if getString(out.Owner.ID) != s.awsID { + return fmt.Errorf("expected bucket owner to be %v, instead got %v", + s.awsID, getString(out.Owner.ID)) + } + if len(out.Grants) != 1 { + return fmt.Errorf("expected grants length to be 1, instead got %v", + len(out.Grants)) + } + grt := out.Grants[0] + if grt.Permission != types.PermissionFullControl { + return fmt.Errorf("expected the grantee to have full-control permission, instead got %v", + grt.Permission) + } + if getString(grt.Grantee.ID) != s.awsID { + return fmt.Errorf("expected the grantee id to be %v, instead got %v", + s.awsID, getString(grt.Grantee.ID)) + } + + return teardown(s, bucket) + }) +} + +func NoAclMode_PutObject_with_acl(s *S3Conf) error { + testName := "NoAclMode_PutObject_with_acl" + return actionHandler(s, testName, func(s3client *s3.Client, bucket string) error { + obj := "my-object" + u := getUser("user") + err := createUsers(s, []user{u}) + if err != nil { + return err + } + ctx, cancel := context.WithTimeout(context.Background(), shortTimeout) + _, err = s3client.PutObject(ctx, &s3.PutObjectInput{ + Bucket: &bucket, + Key: &obj, + ACL: types.ObjectCannedACLBucketOwnerFullControl, + GrantFullControl: &u.access, + GrantRead: &u.access, + GrantReadACP: &u.access, + GrantWriteACP: &u.access, + Body: strings.NewReader("dummy data"), + }) + cancel() + + return err + }) +} + +func NoAclMode_CopyObject_with_acl(s *S3Conf) error { + testName := "NoAclMode_CopyObject_with_acl" + return actionHandler(s, testName, func(s3client *s3.Client, bucket string) error { + u := getUser("user") + err := createUsers(s, []user{u}) + if err != nil { + return err + } + + srcObj, dstObj := "source-object", "destination-object" + _, err = putObjectWithData(10, &s3.PutObjectInput{ + Bucket: &bucket, + Key: &srcObj, + ACL: types.ObjectCannedACLAuthenticatedRead, + }, s3client) + if err != nil { + return err + } + + ctx, cancel := context.WithTimeout(context.Background(), shortTimeout) + _, err = s3client.CopyObject(ctx, &s3.CopyObjectInput{ + Bucket: &bucket, + Key: &dstObj, + CopySource: getPtr(fmt.Sprintf("%s/%s", bucket, srcObj)), + }) + cancel() + + return err + }) +} + +func NoAclMode_multipart_upload_with_acl(s *S3Conf) error { + testName := "NoAclMode_CreateMultipartUpload_with_acl" + return actionHandler(s, testName, func(s3client *s3.Client, bucket string) error { + obj := "my-object" + ctx, cancel := context.WithTimeout(context.Background(), shortTimeout) + mp, err := s3client.CreateMultipartUpload(ctx, &s3.CreateMultipartUploadInput{ + Bucket: &bucket, + Key: &obj, + ACL: types.ObjectCannedACLAuthenticatedRead, + GrantFullControl: getPtr("non_existing_user_1"), + GrantRead: getPtr("non_existing_user_2"), + GrantReadACP: getPtr("non_existing_user_3"), + GrantWriteACP: getPtr("non_existing_user_4"), + }) + cancel() + if err != nil { + return err + } + + parts, _, err := uploadParts(s3client, 100, 1, bucket, obj, *mp.UploadId) + if err != nil { + return err + } + + compParts := []types.CompletedPart{} + for _, el := range parts { + compParts = append(compParts, types.CompletedPart{ + ETag: el.ETag, + PartNumber: el.PartNumber, + }) + } + + ctx, cancel = context.WithTimeout(context.Background(), shortTimeout) + _, err = s3client.CompleteMultipartUpload(ctx, &s3.CompleteMultipartUploadInput{ + Bucket: &bucket, + Key: &obj, + UploadId: mp.UploadId, + MultipartUpload: &types.CompletedMultipartUpload{ + Parts: compParts, + }, + }) + cancel() + + return err + }) +} + +func NoAclMode_PutBucketAcl(s *S3Conf) error { + testName := "NoAclMode_PutBucketAcl" + return actionHandler(s, testName, func(s3client *s3.Client, bucket string) error { + ctx, cancel := context.WithTimeout(context.Background(), shortTimeout) + _, err := s3client.PutBucketAcl(ctx, &s3.PutBucketAclInput{ + Bucket: &bucket, + ACL: types.BucketCannedACLPrivate, + }) + cancel() + + return checkApiErr(err, s3err.GetAPIError(s3err.ErrACLsDisabled)) + }) +} + +func NoAclMode_PutObjectAcl_not_implemented(s *S3Conf) error { + testName := "NoAclMode_PutObjectAcl_not_implemented" + return actionHandler(s, testName, func(s3client *s3.Client, bucket string) error { + obj := "my-object" + _, err := putObjectWithData(10, &s3.PutObjectInput{ + Bucket: &bucket, + Key: &obj, + }, s3client) + if err != nil { + return err + } + + ctx, cancel := context.WithTimeout(context.Background(), shortTimeout) + _, err = s3client.PutObjectAcl(ctx, &s3.PutObjectAclInput{ + Bucket: &bucket, + Key: &obj, + ACL: types.ObjectCannedACLAuthenticatedRead, + }) + cancel() + + return checkApiErr(err, s3err.GetAPIError(s3err.ErrNotImplemented)) + }) +} + +func NoAclMode_GetObjectAcl_not_implemented(s *S3Conf) error { + testName := "NoAclMode_GetObjectAcl_not_implemented" + return actionHandler(s, testName, func(s3client *s3.Client, bucket string) error { + obj := "my-object" + _, err := putObjectWithData(10, &s3.PutObjectInput{ + Bucket: &bucket, + Key: &obj, + }, s3client) + if err != nil { + return err + } + + ctx, cancel := context.WithTimeout(context.Background(), shortTimeout) + _, err = s3client.GetObjectAcl(ctx, &s3.GetObjectAclInput{ + Bucket: &bucket, + Key: &obj, + }) + cancel() + + return checkApiErr(err, s3err.GetAPIError(s3err.ErrNotImplemented)) + }) +}