diff --git a/s3api/router.go b/s3api/router.go index 11609e28..0f398fa1 100644 --- a/s3api/router.go +++ b/s3api/router.go @@ -363,11 +363,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionPutBucketWebsite, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutBucketWebsite, auth.PutBucketWebsiteAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), ), ) @@ -377,11 +377,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionCreateBucket, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionCreateBucket, auth.CreateBucketAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, false, false), - applyBucketCORS, )) // HeadBucket action @@ -403,10 +403,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionHeadBucket, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionHeadBucket, auth.ListBucketAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, false, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -430,10 +430,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteBucketTagging, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketTagging, auth.PutBucketTaggingAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", @@ -443,10 +443,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteBucketOwnershipControls, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketOwnershipControls, auth.PutBucketOwnershipControlsAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", @@ -456,10 +456,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteBucketPolicy, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketPolicy, auth.PutBucketPolicyAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", @@ -469,10 +469,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteBucketCors, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketCors, auth.PutBucketCorsAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Delete("", @@ -586,10 +586,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteBucketWebsite, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucketWebsite, auth.DeleteBucketWebsiteAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), ), ) @@ -599,10 +599,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteBucket, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteBucket, auth.DeleteBucketAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -626,10 +626,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketLocation, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketLocation, auth.GetBucketLocationAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), ), ) @@ -640,10 +640,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketTagging, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketTagging, auth.GetBucketTaggingAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -653,10 +653,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketOwnershipControls, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketOwnershipControls, auth.GetBucketOwnershipControlsAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -666,10 +666,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketVersioning, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketVersioning, auth.GetBucketVersioningAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -679,10 +679,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketPolicy, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketPolicy, auth.GetBucketPolicyAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -692,10 +692,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketCors, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketCors, auth.GetBucketCorsAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -705,10 +705,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetObjectLockConfiguration, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectLockConfiguration, auth.GetBucketObjectLockConfigurationAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -718,10 +718,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketAcl, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketAcl, auth.GetBucketAclAction, auth.PermissionReadAcp, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, false, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -731,10 +731,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionListMultipartUploads, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListMultipartUploads, auth.ListBucketMultipartUploadsAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -744,10 +744,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionListObjectVersions, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListObjectVersions, auth.ListBucketVersionsAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -757,10 +757,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketPolicyStatus, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketPolicyStatus, auth.GetBucketPolicyStatusAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -978,10 +978,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetBucketWebsite, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetBucketWebsite, auth.GetBucketWebsiteAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), ), ) @@ -992,10 +992,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionListObjectsV2, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListObjectsV2, auth.ListBucketAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) bucketRouter.Get("", @@ -1004,10 +1004,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionListObjects, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListObjects, auth.ListBucketAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -1032,11 +1032,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteObjects, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteObjects, auth.DeleteObjectAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, true, true), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -1046,9 +1046,9 @@ func (sa *S3ApiRouter) Init() { metrics.ActionPostObject, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePostObject(sa.root, sa.iam, sa.region), middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPostObject, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -1071,10 +1071,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionHeadObject, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionHeadObject, auth.GetObjectAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, false, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -1111,10 +1111,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetObjectTagging, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectTagging, auth.GetObjectTaggingAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Get("", @@ -1124,10 +1124,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetObjectRetention, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectRetention, auth.GetObjectRetentionAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Get("", @@ -1137,10 +1137,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetObjectLegalHold, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectLegalHold, auth.GetObjectLegalHoldAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Get("", @@ -1150,10 +1150,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetObjectAcl, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectAcl, auth.GetObjectAclAction, auth.PermissionReadAcp, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Get("", @@ -1163,10 +1163,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetObjectAttributes, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObjectAttributes, auth.GetObjectAttributesAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Get("", @@ -1176,10 +1176,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionListParts, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionListParts, auth.ListMultipartUploadPartsAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Get("", @@ -1188,10 +1188,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionGetObject, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionGetObject, auth.GetObjectAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -1216,10 +1216,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteObjectTagging, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteObjectTagging, auth.DeleteObjectTaggingAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Delete("", @@ -1229,10 +1229,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionAbortMultipartUpload, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionAbortMultipartUpload, auth.AbortMultipartUploadAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Delete("", @@ -1241,10 +1241,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionDeleteObject, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionDeleteObject, auth.DeleteObjectAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -1270,11 +1270,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionRestoreObject, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionRestoreObject, auth.RestoreObjectAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, false, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Post("", @@ -1285,11 +1285,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionSelectObjectContent, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionSelectObjectContent, auth.GetObjectAction, auth.PermissionRead, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, false, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Post("", @@ -1299,10 +1299,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionCompleteMultipartUpload, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionCompleteMultipartUpload, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Post("", @@ -1312,10 +1312,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionCreateMultipartUpload, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionCreateMultipartUpload, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) @@ -1341,11 +1341,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionPutObjectRetention, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectRetention, auth.PutObjectRetentionAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, false, true), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Put("", @@ -1355,11 +1355,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionPutObjectLegalHold, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectLegalHold, auth.PutObjectLegalHoldAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, false, true), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Put("", @@ -1369,11 +1369,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionPutObjectAcl, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionPutObjectAcl, auth.PutObjectAclAction, auth.PermissionWriteAcp, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), middlewares.VerifyChecksums(false, false, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Put("", @@ -1384,10 +1384,10 @@ func (sa *S3ApiRouter) Init() { metrics.ActionUploadPartCopy, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionUploadPartCopy, auth.PutObjectAction, auth.PermissionWrite, sa.region, false), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, false), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, false, true, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), )) objectRouter.Put("", @@ -1397,11 +1397,11 @@ func (sa *S3ApiRouter) Init() { metrics.ActionUploadPart, services, middlewares.BucketObjectNameValidator(), + applyBucketCORS, middlewares.AuthorizePublicBucketAccess(sa.be, metrics.ActionUploadPart, auth.PutObjectAction, auth.PermissionWrite, sa.region, true), middlewares.VerifyPresignedV4Signature(sa.root, sa.iam, sa.region, true), middlewares.VerifyV4Signature(sa.root, sa.iam, sa.region, true, true, false), middlewares.VerifyChecksums(true, false, false), - applyBucketCORS, middlewares.ParseAcl(sa.be), ))