feat: implement read only option for posix/scoutfs

Fixes #484. When read only option selected, backend will return
AccessDenied for any operations that would update data or metadata
in the backend. This include creating and deleting objects and
buckets as well as updating object metadata.

This will still allow admin to change bucket owner since read only
is mainly intended for s3 api only.

.github/workflows/system.yml

@@ -8,7 +8,7 @@ jobs:
       - name: Check out code into the Go module directory
         uses: actions/checkout@v4
 
-      - name: Install ShellCheck and md5
+      - name: Install ShellCheck
         run: sudo apt-get install shellcheck
 
       - name: Run ShellCheck
@@ -51,7 +51,7 @@ jobs:
           export WORKSPACE=$GITHUB_WORKSPACE
           openssl genpkey -algorithm RSA -out versitygw.pem -pkeyopt rsa_keygen_bits:2048
           openssl req -new -x509 -key versitygw.pem -out cert.pem -days 365 -subj "/C=US/ST=California/L=San Francisco/O=Versity/OU=Software/CN=versity.com"
-          mkdir cover iam
+          mkdir cover
           VERSITYGW_TEST_ENV=./tests/.env.default ./tests/run_all.sh
 
       #- name: Build and run, s3 backend
@@ -66,7 +66,7 @@ jobs:
       #    export AWS_ACCESS_KEY_ID_TWO=ABCDEFGHIJKLMNOPQRST
       #    export AWS_SECRET_ACCESS_KEY_TWO=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmn
       #    export WORKSPACE=$GITHUB_WORKSPACE
-      #    VERSITYGW_TEST_ENV=./tests/.env.s3 GOCOVERDIR=/tmp/cover ./tests/run_all.sh
+      #    VERSITYGW_TEST_ENV=./tests/.env.s3.default GOCOVERDIR=/tmp/cover ./tests/run_all.sh
 
       - name: Coverage report
         run: |

.gitignore

@@ -47,15 +47,5 @@ tests/.secrets*
 users.json
 
 # env files for testing
-**/.env*
-**/!.env.default
-
-# s3cmd config files (testing)
-tests/s3cfg.local*
-tests/!s3cfg.local.default
-
-# keys
-*.pem
-
-# patches
-*.patch
+.env*
+!.env.default

Dockerfile.dev

@@ -6,7 +6,7 @@ COPY go.mod ./
 RUN go mod download
 
 COPY ./ ./
-COPY ./tests/certs/* /etc/pki/tls/certs/
+COPY certs/* /etc/pki/tls/certs/
 
 ARG IAM_DIR=/tmp/vgw
 ARG SETUP_DIR=/tmp/vgw

Dockerfile_test_bats

@@ -61,6 +61,8 @@ USER tester
 COPY --chown=tester:tester . /home/tester
 
 WORKDIR /home/tester
+#RUN cp tests/.env.docker.s3.default tests/.env.docker.s3
+RUN cp tests/s3cfg.local.default tests/s3cfg.local
 RUN make
 
 RUN . $SECRETS_FILE && \

README.md

@@ -14,16 +14,8 @@ Download [latest release](https://github.com/versity/versitygw/releases)
  |:-----------:|:-----------:|:-----------:|:-----------:|:---------:|:---------:|
  |    ✔️    |  ✔️  |   ✔️   |  ✔️   |  ✔️   |  ✔️   |
  
-### Use Cases
-* Turn your local filesystem into an S3 server with a single command!
-* Proxy S3 requests to S3 storage
-* Simple to deploy S3 server with a single command
-* Protocol compatibility in `posix` allows common access to files via posix or S3
-* Simplified interface for adding new storage system support
-
 ### News
-* New performance (scale up) analysis article [https://github.com/versity/versitygw/wiki/Performance](https://github.com/versity/versitygw/wiki/Performance)
-* New performance (scale out) Part 2 analysis article [https://github.com/versity/versitygw/wiki/Performance-Part-2](https://github.com/versity/versitygw/wiki/Performance-Part-2)
+* New performance analysis article [https://github.com/versity/versitygw/wiki/Performance](https://github.com/versity/versitygw/wiki/Performance)
 
 ### Mailing List
 Keep up to date with latest gateway announcements by signing up to the [versitygw mailing list](https://www.versity.com/products/versitygw#signup).
@@ -36,6 +28,12 @@ Ask questions in the [community discussions](https://github.com/versity/versityg
 <br>
 Contact [Versity Sales](https://www.versity.com/contact/) to discuss enterprise support.
 
+### Use Cases
+* Share filesystem directory via S3 protocol
+* Proxy S3 requests to S3 storage
+* Simple to deploy S3 server with a single command
+* Protocol compatibility in `posix` allows common access to files via posix or S3 
+
 ### Overview
 Versity Gateway, a simple to use tool for seamless inline translation between AWS S3 object commands and storage systems. The Versity Gateway bridges the gap between S3-reliant applications and other storage systems, enabling enhanced compatibility and integration while offering exceptional scalability.
 
@@ -69,7 +67,7 @@ The command format is
 ```
 versitygw [global options] command [command options] [arguments...]
 ```
-The [global options](https://github.com/versity/versitygw/wiki/Global-Options) are specified before the backend type and the backend options are specified after.
+The global options are specified before the backend type and the backend options are specified after.
 
 ***
 

auth/acl.go

@@ -17,7 +17,6 @@ package auth
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"strings"
 
@@ -280,15 +279,9 @@ type AccessOptions struct {
 	Bucket        string
 	Object        string
 	Action        Action
-	Readonly      bool
 }
 
 func VerifyAccess(ctx context.Context, be backend.Backend, opts AccessOptions) error {
-	if opts.Readonly {
-		if opts.AclPermission == types.PermissionWrite || opts.AclPermission == types.PermissionWriteAcp {
-			return s3err.GetAPIError(s3err.ErrAccessDenied)
-		}
-	}
 	if opts.IsRoot {
 		return nil
 	}
@@ -299,17 +292,17 @@ func VerifyAccess(ctx context.Context, be backend.Backend, opts AccessOptions) e
 		return nil
 	}
 
-	policy, policyErr := be.GetBucketPolicy(ctx, opts.Bucket)
-	if policyErr != nil && !errors.Is(policyErr, s3err.GetAPIError(s3err.ErrNoSuchBucketPolicy)) {
-		return policyErr
+	policy, err := be.GetBucketPolicy(ctx, opts.Bucket)
+	if err != nil {
+		return err
 	}
 
 	// If bucket policy is not set and the ACL is default, only the owner has access
-	if errors.Is(policyErr, s3err.GetAPIError(s3err.ErrNoSuchBucketPolicy)) && opts.Acl.ACL == "" && len(opts.Acl.Grantees) == 0 {
+	if len(policy) == 0 && opts.Acl.ACL == "" && len(opts.Acl.Grantees) == 0 {
 		return s3err.GetAPIError(s3err.ErrAccessDenied)
 	}
 
-	if err := VerifyBucketPolicy(policy, opts.Acc.Access, opts.Bucket, opts.Object, opts.Action); err != nil {
+	if err := verifyBucketPolicy(policy, opts.Acc.Access, opts.Bucket, opts.Object, opts.Action); err != nil {
 		return err
 	}
 	if err := verifyACL(opts.Acl, opts.Acc.Access, opts.AclPermission); err != nil {

auth/bucket_policy.go

@@ -115,9 +115,9 @@ func ValidatePolicyDocument(policyBin []byte, bucket string, iam IAMService) err
 	return nil
 }
 
-func VerifyBucketPolicy(policy []byte, access, bucket, object string, action Action) error {
+func verifyBucketPolicy(policy []byte, access, bucket, object string, action Action) error {
 	// If bucket policy is not set
-	if policy == nil {
+	if len(policy) == 0 {
 		return nil
 	}
 
@@ -131,6 +131,7 @@ func VerifyBucketPolicy(policy []byte, access, bucket, object string, action Act
 		resource += "/" + object
 	}
 
+	fmt.Println(access, action, resource)
 	if !bucketPolicy.isAllowed(access, action, resource) {
 		return s3err.GetAPIError(s3err.ErrAccessDenied)
 	}

auth/bucket_policy_actions.go

@@ -23,97 +23,79 @@ import (
 type Action string
 
 const (
-	GetBucketAclAction                     Action = "s3:GetBucketAcl"
-	CreateBucketAction                     Action = "s3:CreateBucket"
-	PutBucketAclAction                     Action = "s3:PutBucketAcl"
-	DeleteBucketAction                     Action = "s3:DeleteBucket"
-	PutBucketVersioningAction              Action = "s3:PutBucketVersioning"
-	GetBucketVersioningAction              Action = "s3:GetBucketVersioning"
-	PutBucketPolicyAction                  Action = "s3:PutBucketPolicy"
-	GetBucketPolicyAction                  Action = "s3:GetBucketPolicy"
-	DeleteBucketPolicyAction               Action = "s3:DeleteBucketPolicy"
-	AbortMultipartUploadAction             Action = "s3:AbortMultipartUpload"
-	ListMultipartUploadPartsAction         Action = "s3:ListMultipartUploadParts"
-	ListBucketMultipartUploadsAction       Action = "s3:ListBucketMultipartUploads"
-	PutObjectAction                        Action = "s3:PutObject"
-	GetObjectAction                        Action = "s3:GetObject"
-	DeleteObjectAction                     Action = "s3:DeleteObject"
-	GetObjectAclAction                     Action = "s3:GetObjectAcl"
-	GetObjectAttributesAction              Action = "s3:GetObjectAttributes"
-	PutObjectAclAction                     Action = "s3:PutObjectAcl"
-	RestoreObjectAction                    Action = "s3:RestoreObject"
-	GetBucketTaggingAction                 Action = "s3:GetBucketTagging"
-	PutBucketTaggingAction                 Action = "s3:PutBucketTagging"
-	GetObjectTaggingAction                 Action = "s3:GetObjectTagging"
-	PutObjectTaggingAction                 Action = "s3:PutObjectTagging"
-	DeleteObjectTaggingAction              Action = "s3:DeleteObjectTagging"
-	ListBucketVersionsAction               Action = "s3:ListBucketVersions"
-	ListBucketAction                       Action = "s3:ListBucket"
-	GetBucketObjectLockConfigurationAction Action = "s3:GetBucketObjectLockConfiguration"
-	PutBucketObjectLockConfigurationAction Action = "s3:PutBucketObjectLockConfiguration"
-	GetObjectLegalHoldAction               Action = "s3:GetObjectLegalHold"
-	PutObjectLegalHoldAction               Action = "s3:PutObjectLegalHold"
-	GetObjectRetentionAction               Action = "s3:GetObjectRetention"
-	PutObjectRetentionAction               Action = "s3:PutObjectRetention"
-	BypassGovernanceRetentionAction        Action = "s3:BypassGovernanceRetention"
-	AllActions                             Action = "s3:*"
+	GetBucketAclAction               Action = "s3:GetBucketAcl"
+	CreateBucketAction               Action = "s3:CreateBucket"
+	PutBucketAclAction               Action = "s3:PutBucketAcl"
+	DeleteBucketAction               Action = "s3:DeleteBucket"
+	PutBucketVersioningAction        Action = "s3:PutBucketVersioning"
+	GetBucketVersioningAction        Action = "s3:GetBucketVersioning"
+	PutBucketPolicyAction            Action = "s3:PutBucketPolicy"
+	GetBucketPolicyAction            Action = "s3:GetBucketPolicy"
+	DeleteBucketPolicyAction         Action = "s3:DeleteBucketPolicy"
+	AbortMultipartUploadAction       Action = "s3:AbortMultipartUpload"
+	ListMultipartUploadPartsAction   Action = "s3:ListMultipartUploadParts"
+	ListBucketMultipartUploadsAction Action = "s3:ListBucketMultipartUploads"
+	PutObjectAction                  Action = "s3:PutObject"
+	GetObjectAction                  Action = "s3:GetObject"
+	DeleteObjectAction               Action = "s3:DeleteObject"
+	GetObjectAclAction               Action = "s3:GetObjectAcl"
+	GetObjectAttributesAction        Action = "s3:GetObjectAttributes"
+	PutObjectAclAction               Action = "s3:PutObjectAcl"
+	RestoreObjectAction              Action = "s3:RestoreObject"
+	GetBucketTaggingAction           Action = "s3:GetBucketTagging"
+	PutBucketTaggingAction           Action = "s3:PutBucketTagging"
+	GetObjectTaggingAction           Action = "s3:GetObjectTagging"
+	PutObjectTaggingAction           Action = "s3:PutObjectTagging"
+	DeleteObjectTaggingAction        Action = "s3:DeleteObjectTagging"
+	ListBucketVersionsAction         Action = "s3:ListBucketVersions"
+	ListBucketAction                 Action = "s3:ListBucket"
+	AllActions                       Action = "s3:*"
 )
 
 var supportedActionList = map[Action]struct{}{
-	GetBucketAclAction:                     {},
-	CreateBucketAction:                     {},
-	PutBucketAclAction:                     {},
-	DeleteBucketAction:                     {},
-	PutBucketVersioningAction:              {},
-	GetBucketVersioningAction:              {},
-	PutBucketPolicyAction:                  {},
-	GetBucketPolicyAction:                  {},
-	DeleteBucketPolicyAction:               {},
-	AbortMultipartUploadAction:             {},
-	ListMultipartUploadPartsAction:         {},
-	ListBucketMultipartUploadsAction:       {},
-	PutObjectAction:                        {},
-	GetObjectAction:                        {},
-	DeleteObjectAction:                     {},
-	GetObjectAclAction:                     {},
-	GetObjectAttributesAction:              {},
-	PutObjectAclAction:                     {},
-	RestoreObjectAction:                    {},
-	GetBucketTaggingAction:                 {},
-	PutBucketTaggingAction:                 {},
-	GetObjectTaggingAction:                 {},
-	PutObjectTaggingAction:                 {},
-	DeleteObjectTaggingAction:              {},
-	ListBucketVersionsAction:               {},
-	ListBucketAction:                       {},
-	PutBucketObjectLockConfigurationAction: {},
-	GetObjectLegalHoldAction:               {},
-	PutObjectLegalHoldAction:               {},
-	GetObjectRetentionAction:               {},
-	PutObjectRetentionAction:               {},
-	BypassGovernanceRetentionAction:        {},
-	AllActions:                             {},
+	GetBucketAclAction:               {},
+	CreateBucketAction:               {},
+	PutBucketAclAction:               {},
+	DeleteBucketAction:               {},
+	PutBucketVersioningAction:        {},
+	GetBucketVersioningAction:        {},
+	PutBucketPolicyAction:            {},
+	GetBucketPolicyAction:            {},
+	DeleteBucketPolicyAction:         {},
+	AbortMultipartUploadAction:       {},
+	ListMultipartUploadPartsAction:   {},
+	ListBucketMultipartUploadsAction: {},
+	PutObjectAction:                  {},
+	GetObjectAction:                  {},
+	DeleteObjectAction:               {},
+	GetObjectAclAction:               {},
+	GetObjectAttributesAction:        {},
+	PutObjectAclAction:               {},
+	RestoreObjectAction:              {},
+	GetBucketTaggingAction:           {},
+	PutBucketTaggingAction:           {},
+	GetObjectTaggingAction:           {},
+	PutObjectTaggingAction:           {},
+	DeleteObjectTaggingAction:        {},
+	ListBucketVersionsAction:         {},
+	ListBucketAction:                 {},
+	AllActions:                       {},
 }
 
 var supportedObjectActionList = map[Action]struct{}{
-	AbortMultipartUploadAction:      {},
-	ListMultipartUploadPartsAction:  {},
-	PutObjectAction:                 {},
-	GetObjectAction:                 {},
-	DeleteObjectAction:              {},
-	GetObjectAclAction:              {},
-	GetObjectAttributesAction:       {},
-	PutObjectAclAction:              {},
-	RestoreObjectAction:             {},
-	GetObjectTaggingAction:          {},
-	PutObjectTaggingAction:          {},
-	DeleteObjectTaggingAction:       {},
-	GetObjectLegalHoldAction:        {},
-	PutObjectLegalHoldAction:        {},
-	GetObjectRetentionAction:        {},
-	PutObjectRetentionAction:        {},
-	BypassGovernanceRetentionAction: {},
-	AllActions:                      {},
+	AbortMultipartUploadAction:     {},
+	ListMultipartUploadPartsAction: {},
+	PutObjectAction:                {},
+	GetObjectAction:                {},
+	DeleteObjectAction:             {},
+	GetObjectAclAction:             {},
+	GetObjectAttributesAction:      {},
+	PutObjectAclAction:             {},
+	RestoreObjectAction:            {},
+	GetObjectTaggingAction:         {},
+	PutObjectTaggingAction:         {},
+	DeleteObjectTaggingAction:      {},
+	AllActions:                     {},
 }
 
 // Validates Action: it should either wildcard match with supported actions list or be in it

auth/bucket_policy_principals.go

@@ -28,13 +28,7 @@ func (p Principals) Add(key string) {
 // Override UnmarshalJSON method to decode both []string and string properties
 func (p *Principals) UnmarshalJSON(data []byte) error {
 	ss := []string{}
-	var s string
-	var k struct {
-		AWS string
-	}
-
 	var err error
-
 	if err = json.Unmarshal(data, &ss); err == nil {
 		if len(ss) == 0 {
 			return fmt.Errorf("principals can't be empty")
@@ -43,35 +37,14 @@ func (p *Principals) UnmarshalJSON(data []byte) error {
 		for _, s := range ss {
 			p.Add(s)
 		}
-		return nil
-	} else if err = json.Unmarshal(data, &s); err == nil {
-		if s == "" {
-			return fmt.Errorf("principals can't be empty")
-		}
-		*p = make(Principals)
-		p.Add(s)
-
-		return nil
-	} else if err = json.Unmarshal(data, &k); err == nil {
-		if k.AWS == "" {
-			return fmt.Errorf("principals can't be empty")
-		}
-		*p = make(Principals)
-		p.Add(k.AWS)
-
-		return nil
 	} else {
-		var sk struct {
-			AWS []string
-		}
-		if err = json.Unmarshal(data, &sk); err == nil {
-			if len(sk.AWS) == 0 {
+		var s string
+		if err = json.Unmarshal(data, &s); err == nil {
+			if s == "" {
 				return fmt.Errorf("principals can't be empty")
 			}
 			*p = make(Principals)
-			for _, s := range sk.AWS {
-				p.Add(s)
-			}
+			p.Add(s)
 		}
 	}
 

auth/iam.go

@@ -30,11 +30,12 @@ const (
 
 // Account is a gateway IAM account
 type Account struct {
-	Access  string `json:"access"`
-	Secret  string `json:"secret"`
-	Role    Role   `json:"role"`
-	UserID  int    `json:"userID"`
-	GroupID int    `json:"groupID"`
+	Access    string `json:"access"`
+	Secret    string `json:"secret"`
+	Role      Role   `json:"role"`
+	UserID    int    `json:"userID"`
+	GroupID   int    `json:"groupID"`
+	ProjectID int    `json:"projectID"`
 }
 
 // IAMService is the interface for all IAM service implementations

auth/iam_internal.go

@@ -135,11 +135,12 @@ func (s *IAMServiceInternal) ListUserAccounts() ([]Account, error) {
 	var accs []Account
 	for _, k := range keys {
 		accs = append(accs, Account{
-			Access:  k,
-			Secret:  conf.AccessAccounts[k].Secret,
-			Role:    conf.AccessAccounts[k].Role,
-			UserID:  conf.AccessAccounts[k].UserID,
-			GroupID: conf.AccessAccounts[k].GroupID,
+			Access:    k,
+			Secret:    conf.AccessAccounts[k].Secret,
+			Role:      conf.AccessAccounts[k].Role,
+			UserID:    conf.AccessAccounts[k].UserID,
+			GroupID:   conf.AccessAccounts[k].GroupID,
+			ProjectID: conf.AccessAccounts[k].ProjectID,
 		})
 	}
 

auth/iam_ldap.go

@@ -1,17 +1,3 @@
-// Copyright 2023 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
 package auth
 
 import (
@@ -36,7 +22,7 @@ func NewLDAPService(url, bindDN, pass, queryBase, accAtr, secAtr, roleAtr, objCl
 	if url == "" || bindDN == "" || pass == "" || queryBase == "" || accAtr == "" || secAtr == "" || roleAtr == "" || objClasses == "" {
 		return nil, fmt.Errorf("required parameters list not fully provided")
 	}
-	conn, err := ldap.DialURL(url)
+	conn, err := ldap.Dial("tcp", url)
 	if err != nil {
 		return nil, fmt.Errorf("failed to connect to LDAP server: %w", err)
 	}

auth/iam_s3_object.go

@@ -148,11 +148,12 @@ func (s *IAMServiceS3) ListUserAccounts() ([]Account, error) {
 	var accs []Account
 	for _, k := range keys {
 		accs = append(accs, Account{
-			Access:  k,
-			Secret:  conf.AccessAccounts[k].Secret,
-			Role:    conf.AccessAccounts[k].Role,
-			UserID:  conf.AccessAccounts[k].UserID,
-			GroupID: conf.AccessAccounts[k].GroupID,
+			Access:    k,
+			Secret:    conf.AccessAccounts[k].Secret,
+			Role:      conf.AccessAccounts[k].Role,
+			UserID:    conf.AccessAccounts[k].UserID,
+			GroupID:   conf.AccessAccounts[k].GroupID,
+			ProjectID: conf.AccessAccounts[k].ProjectID,
 		})
 	}
 

auth/iam_single.go

@@ -32,7 +32,7 @@ func (IAMServiceSingle) CreateAccount(account Account) error {
 
 // GetUserAccount no accounts in single tenant mode
 func (IAMServiceSingle) GetUserAccount(access string) (Account, error) {
-	return Account{}, ErrNoSuchUser
+	return Account{}, ErrNotSupported
 }
 
 // DeleteUserAccount no accounts in single tenant mode

auth/object_lock.go

@@ -1,258 +0,0 @@
-// Copyright 2023 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package auth
-
-import (
-	"context"
-	"encoding/json"
-	"encoding/xml"
-	"errors"
-	"fmt"
-	"time"
-
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
-	"github.com/versity/versitygw/backend"
-	"github.com/versity/versitygw/s3err"
-)
-
-type BucketLockConfig struct {
-	Enabled          bool
-	DefaultRetention *types.DefaultRetention
-	CreatedAt        *time.Time
-}
-
-func ParseBucketLockConfigurationInput(input []byte) ([]byte, error) {
-	var lockConfig types.ObjectLockConfiguration
-	if err := xml.Unmarshal(input, &lockConfig); err != nil {
-		return nil, s3err.GetAPIError(s3err.ErrMalformedXML)
-	}
-
-	if lockConfig.ObjectLockEnabled != "" && lockConfig.ObjectLockEnabled != types.ObjectLockEnabledEnabled {
-		return nil, s3err.GetAPIError(s3err.ErrMalformedXML)
-	}
-
-	config := BucketLockConfig{
-		Enabled: lockConfig.ObjectLockEnabled == types.ObjectLockEnabledEnabled,
-	}
-
-	if lockConfig.Rule != nil && lockConfig.Rule.DefaultRetention != nil {
-		retention := lockConfig.Rule.DefaultRetention
-
-		if retention.Mode != types.ObjectLockRetentionModeCompliance && retention.Mode != types.ObjectLockRetentionModeGovernance {
-			return nil, s3err.GetAPIError(s3err.ErrMalformedXML)
-		}
-		if retention.Years != nil && retention.Days != nil {
-			return nil, s3err.GetAPIError(s3err.ErrMalformedXML)
-		}
-
-		if retention.Days != nil && *retention.Days <= 0 {
-			return nil, s3err.GetAPIError(s3err.ErrObjectLockInvalidRetentionPeriod)
-		}
-		if retention.Years != nil && *retention.Years <= 0 {
-			return nil, s3err.GetAPIError(s3err.ErrObjectLockInvalidRetentionPeriod)
-		}
-
-		config.DefaultRetention = retention
-		now := time.Now()
-		config.CreatedAt = &now
-	}
-
-	return json.Marshal(config)
-}
-
-func ParseBucketLockConfigurationOutput(input []byte) (*types.ObjectLockConfiguration, error) {
-	var config BucketLockConfig
-	if err := json.Unmarshal(input, &config); err != nil {
-		return nil, fmt.Errorf("parse object lock config: %w", err)
-	}
-
-	result := &types.ObjectLockConfiguration{
-		Rule: &types.ObjectLockRule{
-			DefaultRetention: config.DefaultRetention,
-		},
-	}
-
-	if config.Enabled {
-		result.ObjectLockEnabled = types.ObjectLockEnabledEnabled
-	}
-
-	return result, nil
-}
-
-func ParseObjectLockRetentionInput(input []byte) ([]byte, error) {
-	var retention types.ObjectLockRetention
-	if err := xml.Unmarshal(input, &retention); err != nil {
-		return nil, s3err.GetAPIError(s3err.ErrInvalidRequest)
-	}
-
-	if retention.RetainUntilDate == nil || retention.RetainUntilDate.Before(time.Now()) {
-		return nil, s3err.GetAPIError(s3err.ErrPastObjectLockRetainDate)
-	}
-	switch retention.Mode {
-	case types.ObjectLockRetentionModeCompliance:
-	case types.ObjectLockRetentionModeGovernance:
-	default:
-		return nil, s3err.GetAPIError(s3err.ErrMalformedXML)
-	}
-
-	return json.Marshal(retention)
-}
-
-func ParseObjectLockRetentionOutput(input []byte) (*types.ObjectLockRetention, error) {
-	var retention types.ObjectLockRetention
-	if err := json.Unmarshal(input, &retention); err != nil {
-		return nil, fmt.Errorf("parse object lock retention: %w", err)
-	}
-
-	return &retention, nil
-}
-
-func ParseObjectLegalHoldOutput(status *bool) *types.ObjectLockLegalHold {
-	if status == nil {
-		return nil
-	}
-
-	if *status {
-		return &types.ObjectLockLegalHold{
-			Status: types.ObjectLockLegalHoldStatusOn,
-		}
-	}
-
-	return &types.ObjectLockLegalHold{
-		Status: types.ObjectLockLegalHoldStatusOff,
-	}
-}
-
-func CheckObjectAccess(ctx context.Context, bucket, userAccess string, objects []string, bypass bool, be backend.Backend) error {
-	data, err := be.GetObjectLockConfiguration(ctx, bucket)
-	if err != nil {
-		if errors.Is(err, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)) {
-			return nil
-		}
-
-		return err
-	}
-
-	var bucketLockConfig BucketLockConfig
-	if err := json.Unmarshal(data, &bucketLockConfig); err != nil {
-		return fmt.Errorf("parse object lock config: %w", err)
-	}
-
-	if !bucketLockConfig.Enabled {
-		return nil
-	}
-
-	checkDefaultRetention := false
-
-	if bucketLockConfig.DefaultRetention != nil && bucketLockConfig.CreatedAt != nil {
-		expirationDate := *bucketLockConfig.CreatedAt
-		if bucketLockConfig.DefaultRetention.Days != nil {
-			expirationDate = expirationDate.AddDate(0, 0, int(*bucketLockConfig.DefaultRetention.Days))
-		}
-		if bucketLockConfig.DefaultRetention.Years != nil {
-			expirationDate = expirationDate.AddDate(int(*bucketLockConfig.DefaultRetention.Years), 0, 0)
-		}
-
-		if expirationDate.After(time.Now()) {
-			checkDefaultRetention = true
-		}
-	}
-
-	for _, obj := range objects {
-		checkRetention := true
-		retentionData, err := be.GetObjectRetention(ctx, bucket, obj, "")
-		if errors.Is(err, s3err.GetAPIError(s3err.ErrNoSuchKey)) {
-			continue
-		}
-		if errors.Is(err, s3err.GetAPIError(s3err.ErrNoSuchObjectLockConfiguration)) {
-			checkRetention = false
-		}
-		if err != nil && checkRetention {
-			return err
-		}
-
-		if checkRetention {
-			retention, err := ParseObjectLockRetentionOutput(retentionData)
-			if err != nil {
-				return err
-			}
-
-			if retention.Mode != "" && retention.RetainUntilDate != nil {
-				if retention.RetainUntilDate.After(time.Now()) {
-					switch retention.Mode {
-					case types.ObjectLockRetentionModeGovernance:
-						if !bypass {
-							return s3err.GetAPIError(s3err.ErrObjectLocked)
-						} else {
-							policy, err := be.GetBucketPolicy(ctx, bucket)
-							if errors.Is(err, s3err.GetAPIError(s3err.ErrNoSuchBucketPolicy)) {
-								return s3err.GetAPIError(s3err.ErrObjectLocked)
-							}
-							if err != nil {
-								return err
-							}
-							err = VerifyBucketPolicy(policy, userAccess, bucket, obj, BypassGovernanceRetentionAction)
-							if err != nil {
-								return s3err.GetAPIError(s3err.ErrObjectLocked)
-							}
-						}
-					case types.ObjectLockRetentionModeCompliance:
-						return s3err.GetAPIError(s3err.ErrObjectLocked)
-					}
-				}
-			}
-		}
-
-		checkLegalHold := true
-
-		status, err := be.GetObjectLegalHold(ctx, bucket, obj, "")
-		if err != nil {
-			if errors.Is(err, s3err.GetAPIError(s3err.ErrNoSuchObjectLockConfiguration)) {
-				checkLegalHold = false
-			} else {
-				return err
-			}
-		}
-
-		if checkLegalHold && *status {
-			return s3err.GetAPIError(s3err.ErrObjectLocked)
-		}
-
-		if checkDefaultRetention {
-			switch bucketLockConfig.DefaultRetention.Mode {
-			case types.ObjectLockRetentionModeGovernance:
-				if !bypass {
-					return s3err.GetAPIError(s3err.ErrObjectLocked)
-				} else {
-					policy, err := be.GetBucketPolicy(ctx, bucket)
-					if errors.Is(err, s3err.GetAPIError(s3err.ErrNoSuchBucketPolicy)) {
-						return s3err.GetAPIError(s3err.ErrObjectLocked)
-					}
-					if err != nil {
-						return err
-					}
-					err = VerifyBucketPolicy(policy, userAccess, bucket, obj, BypassGovernanceRetentionAction)
-					if err != nil {
-						return s3err.GetAPIError(s3err.ErrObjectLocked)
-					}
-				}
-			case types.ObjectLockRetentionModeCompliance:
-				return s3err.GetAPIError(s3err.ErrObjectLocked)
-			}
-		}
-	}
-
-	return nil
-}

backend/azure/azure.go

@@ -20,7 +20,6 @@ import (
 	"encoding/base64"
 	"encoding/binary"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"math"
@@ -46,17 +45,10 @@ import (
 // When getting container metadata with GetProperties method the sdk returns
 // the first letter capital, when accessing the metadata after listing the containers
 // it returns the first letter lower
-type key string
+type aclKey string
 
-const (
-	keyAclCapital   key = "Acl"
-	keyAclLower     key = "acl"
-	keyTags         key = "Tags"
-	keyPolicy       key = "Policy"
-	keyBucketLock   key = "Bucket-Lock"
-	keyObjRetention key = "Object_retention"
-	keyObjLegalHold key = "Object_legal_hold"
-)
+const aclKeyCapital aclKey = "Acl"
+const aclKeyLower aclKey = "acl"
 
 type Azure struct {
 	backend.BackendUnsupported
@@ -124,53 +116,9 @@ func (az *Azure) String() string {
 
 func (az *Azure) CreateBucket(ctx context.Context, input *s3.CreateBucketInput, acl []byte) error {
 	meta := map[string]*string{
-		string(keyAclCapital): backend.GetStringPtr(string(acl)),
-	}
-
-	acct, ok := ctx.Value("account").(auth.Account)
-	if !ok {
-		acct = auth.Account{}
-	}
-
-	if input.ObjectLockEnabledForBucket != nil && *input.ObjectLockEnabledForBucket {
-		now := time.Now()
-		defaultLock := auth.BucketLockConfig{
-			Enabled:   true,
-			CreatedAt: &now,
-		}
-
-		defaultLockParsed, err := json.Marshal(defaultLock)
-		if err != nil {
-			return fmt.Errorf("parse default bucket lock state: %w", err)
-		}
-
-		meta[string(keyBucketLock)] = backend.GetStringPtr(string(defaultLockParsed))
+		string(aclKeyCapital): backend.GetStringPtr(string(acl)),
 	}
 	_, err := az.client.CreateContainer(ctx, *input.Bucket, &container.CreateOptions{Metadata: meta})
-	if errors.Is(s3err.GetAPIError(s3err.ErrBucketAlreadyExists), azureErrToS3Err(err)) {
-		client, err := az.getContainerClient(*input.Bucket)
-		if err != nil {
-			return err
-		}
-
-		props, err := client.GetProperties(ctx, nil)
-		if err != nil {
-			return azureErrToS3Err(err)
-		}
-
-		aclPtr, ok := props.Metadata[string(keyAclCapital)]
-		if !ok {
-			return fmt.Errorf("missing acl in the bucket")
-		}
-
-		var acl auth.ACL
-		if err := json.Unmarshal([]byte(*aclPtr), &acl); err != nil {
-			return fmt.Errorf("unmarshal bucket acl: %w", err)
-		}
-		if acl.Owner == acct.Access {
-			return s3err.GetAPIError(s3err.ErrBucketAlreadyOwnedByYou)
-		}
-	}
 	return azureErrToS3Err(err)
 }
 
@@ -233,28 +181,6 @@ func (az *Azure) PutObject(ctx context.Context, po *s3.PutObjectInput) (string,
 		return "", azureErrToS3Err(err)
 	}
 
-	// Set object legal hold
-	if po.ObjectLockLegalHoldStatus == types.ObjectLockLegalHoldStatusOn {
-		if err := az.PutObjectLegalHold(ctx, *po.Bucket, *po.Key, "", true); err != nil {
-			return "", err
-		}
-	}
-
-	// Set object retention
-	if po.ObjectLockMode != "" {
-		retention := types.ObjectLockRetention{
-			Mode:            types.ObjectLockRetentionMode(po.ObjectLockMode),
-			RetainUntilDate: po.ObjectLockRetainUntilDate,
-		}
-		retParsed, err := json.Marshal(retention)
-		if err != nil {
-			return "", fmt.Errorf("parse object lock retention: %w", err)
-		}
-		if err := az.PutObjectRetention(ctx, *po.Bucket, *po.Key, "", true, retParsed); err != nil {
-			return "", err
-		}
-	}
-
 	return string(*uploadResp.ETag), nil
 }
 
@@ -270,17 +196,24 @@ func (az *Azure) PutBucketTagging(ctx context.Context, bucket string, tags map[s
 	}
 
 	if tags == nil {
-		delete(resp.Metadata, string(keyTags))
-	} else {
-		tagsJson, err := json.Marshal(tags)
+		_, err := client.SetMetadata(ctx, &container.SetMetadataOptions{Metadata: map[string]*string{
+			string(aclKeyCapital): resp.Metadata[string(aclKeyCapital)],
+		}})
 		if err != nil {
-			return err
+			return azureErrToS3Err(err)
 		}
 
-		resp.Metadata[string(keyTags)] = backend.GetStringPtr(string(tagsJson))
+		return nil
 	}
 
-	_, err = client.SetMetadata(ctx, &container.SetMetadataOptions{Metadata: resp.Metadata})
+	_, ok := tags[string(aclKeyLower)]
+	if ok {
+		delete(tags, string(aclKeyLower))
+	}
+
+	tags[string(aclKeyCapital)] = *resp.Metadata[string(aclKeyCapital)]
+
+	_, err = client.SetMetadata(ctx, &container.SetMetadataOptions{Metadata: parseMetadata(tags)})
 	if err != nil {
 		return azureErrToS3Err(err)
 	}
@@ -299,17 +232,9 @@ func (az *Azure) GetBucketTagging(ctx context.Context, bucket string) (map[strin
 		return nil, azureErrToS3Err(err)
 	}
 
-	tagsJson, ok := resp.Metadata[string(keyTags)]
-	if !ok {
-		return nil, s3err.GetAPIError(s3err.ErrBucketTaggingNotFound)
-	}
+	delete(resp.Metadata, string(aclKeyCapital))
 
-	var tags map[string]string
-	if json.Unmarshal([]byte(*tagsJson), &tags); err != nil {
-		return nil, err
-	}
-
-	return tags, nil
+	return parseAzMetadata(resp.Metadata), nil
 }
 
 func (az *Azure) DeleteBucketTagging(ctx context.Context, bucket string) error {
@@ -384,61 +309,6 @@ func (az *Azure) HeadObject(ctx context.Context, input *s3.HeadObjectInput) (*s3
 	}, nil
 }
 
-func (az *Azure) GetObjectAttributes(ctx context.Context, input *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error) {
-	data, err := az.HeadObject(ctx, &s3.HeadObjectInput{
-		Bucket: input.Bucket,
-		Key:    input.Key,
-	})
-	if err == nil {
-		return s3response.GetObjectAttributesResult{
-			ETag:         data.ETag,
-			LastModified: data.LastModified,
-			ObjectSize:   data.ContentLength,
-			StorageClass: &data.StorageClass,
-			VersionId:    data.VersionId,
-		}, nil
-	}
-	if !errors.Is(err, s3err.GetAPIError(s3err.ErrNoSuchKey)) {
-		return s3response.GetObjectAttributesResult{}, err
-	}
-
-	resp, err := az.ListParts(ctx, &s3.ListPartsInput{
-		Bucket:           input.Bucket,
-		Key:              input.Key,
-		PartNumberMarker: input.PartNumberMarker,
-		MaxParts:         input.MaxParts,
-	})
-	if errors.Is(err, s3err.GetAPIError(s3err.ErrNoSuchUpload)) {
-		return s3response.GetObjectAttributesResult{}, s3err.GetAPIError(s3err.ErrNoSuchKey)
-	}
-	if err != nil {
-		return s3response.GetObjectAttributesResult{}, err
-	}
-
-	parts := []types.ObjectPart{}
-
-	for _, p := range resp.Parts {
-		partNumber := int32(p.PartNumber)
-		size := p.Size
-
-		parts = append(parts, types.ObjectPart{
-			Size:       &size,
-			PartNumber: &partNumber,
-		})
-	}
-
-	//TODO: handle PartsCount prop
-	return s3response.GetObjectAttributesResult{
-		ObjectParts: &s3response.ObjectParts{
-			IsTruncated:          resp.IsTruncated,
-			MaxParts:             resp.MaxParts,
-			PartNumberMarker:     resp.PartNumberMarker,
-			NextPartNumberMarker: resp.PartNumberMarker,
-			Parts:                parts,
-		},
-	}, nil
-}
-
 func (az *Azure) ListObjects(ctx context.Context, input *s3.ListObjectsInput) (*s3.ListObjectsOutput, error) {
 	pager := az.client.NewListBlobsFlatPager(*input.Bucket, &azblob.ListBlobsFlatOptions{
 		Marker:     input.Marker,
@@ -755,7 +625,7 @@ func (az *Azure) ListParts(ctx context.Context, input *s3.ListPartsInput) (s3res
 	}
 
 	parts := []s3response.Part{}
-	for _, el := range resp.UncommittedBlocks {
+	for _, el := range resp.BlockList.UncommittedBlocks {
 		partNumber, err := decodeBlockId(*el.Name)
 		if err != nil {
 			return s3response.ListPartsResult{}, err
@@ -881,14 +751,11 @@ func (az *Azure) PutBucketAcl(ctx context.Context, bucket string, data []byte) e
 	if err != nil {
 		return err
 	}
-	props, err := client.GetProperties(ctx, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
+	meta := map[string]*string{
+		string(aclKeyCapital): backend.GetStringPtr(string(data)),
 	}
-
-	props.Metadata[string(keyAclCapital)] = backend.GetStringPtr(string(data))
 	_, err = client.SetMetadata(ctx, &container.SetMetadataOptions{
-		Metadata: props.Metadata,
+		Metadata: meta,
 	})
 	if err != nil {
 		return azureErrToS3Err(err)
@@ -906,7 +773,7 @@ func (az *Azure) GetBucketAcl(ctx context.Context, input *s3.GetBucketAclInput)
 		return nil, azureErrToS3Err(err)
 	}
 
-	aclPtr, ok := props.Metadata[string(keyAclCapital)]
+	aclPtr, ok := props.Metadata[string(aclKeyCapital)]
 	if !ok {
 		return nil, s3err.GetAPIError(s3err.ErrInternalError)
 	}
@@ -914,263 +781,6 @@ func (az *Azure) GetBucketAcl(ctx context.Context, input *s3.GetBucketAclInput)
 	return []byte(*aclPtr), nil
 }
 
-func (az *Azure) PutBucketPolicy(ctx context.Context, bucket string, policy []byte) error {
-	client, err := az.getContainerClient(bucket)
-	if err != nil {
-		return err
-	}
-
-	props, err := client.GetProperties(ctx, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	if policy == nil {
-		delete(props.Metadata, string(keyPolicy))
-	} else {
-		// Store policy as base64 encoded, because storing raw json causes an SDK error
-		policyEncoded := base64.StdEncoding.EncodeToString(policy)
-		props.Metadata[string(keyPolicy)] = &policyEncoded
-	}
-
-	_, err = client.SetMetadata(ctx, &container.SetMetadataOptions{
-		Metadata: props.Metadata,
-	})
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-	return nil
-}
-
-func (az *Azure) GetBucketPolicy(ctx context.Context, bucket string) ([]byte, error) {
-	client, err := az.getContainerClient(bucket)
-	if err != nil {
-		return nil, err
-	}
-	props, err := client.GetProperties(ctx, nil)
-	if err != nil {
-		return nil, azureErrToS3Err(err)
-	}
-
-	policyPtr, ok := props.Metadata[string(keyPolicy)]
-	if !ok {
-		return nil, s3err.GetAPIError(s3err.ErrNoSuchBucket)
-	}
-
-	policy, err := base64.StdEncoding.DecodeString(*policyPtr)
-	if err != nil {
-		return nil, err
-	}
-
-	return policy, nil
-}
-
-func (az *Azure) DeleteBucketPolicy(ctx context.Context, bucket string) error {
-	return az.PutBucketPolicy(ctx, bucket, nil)
-}
-
-func (az *Azure) PutObjectLockConfiguration(ctx context.Context, bucket string, config []byte) error {
-	client, err := az.getContainerClient(bucket)
-	if err != nil {
-		return err
-	}
-
-	props, err := client.GetProperties(ctx, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	cfg, exists := props.Metadata[string(keyBucketLock)]
-	if !exists {
-		return s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotAllowed)
-	}
-
-	var bucketLockCfg auth.BucketLockConfig
-	if err := json.Unmarshal([]byte(*cfg), &bucketLockCfg); err != nil {
-		return fmt.Errorf("unmarshal object lock config: %w", err)
-	}
-
-	if !bucketLockCfg.Enabled {
-		return s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotAllowed)
-	}
-
-	props.Metadata[string(keyBucketLock)] = backend.GetStringPtr(string(config))
-
-	_, err = client.SetMetadata(ctx, &container.SetMetadataOptions{
-		Metadata: props.Metadata,
-	})
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	return nil
-}
-
-func (az *Azure) GetObjectLockConfiguration(ctx context.Context, bucket string) ([]byte, error) {
-	client, err := az.getContainerClient(bucket)
-	if err != nil {
-		return nil, err
-	}
-	props, err := client.GetProperties(ctx, nil)
-	if err != nil {
-		return nil, azureErrToS3Err(err)
-	}
-
-	config, ok := props.Metadata[string(keyBucketLock)]
-	if !ok {
-		return nil, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)
-	}
-
-	return []byte(*config), nil
-}
-
-func (az *Azure) PutObjectRetention(ctx context.Context, bucket, object, versionId string, bypass bool, retention []byte) error {
-	contClient, err := az.getContainerClient(bucket)
-	if err != nil {
-		return err
-	}
-	contProps, err := contClient.GetProperties(ctx, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	contCfg, ok := contProps.Metadata[string(keyBucketLock)]
-	if !ok {
-		return s3err.GetAPIError(s3err.ErrInvalidBucketObjectLockConfiguration)
-	}
-
-	var bucketLockConfig auth.BucketLockConfig
-	if err := json.Unmarshal([]byte(*contCfg), &bucketLockConfig); err != nil {
-		return fmt.Errorf("parse bucket lock config: %w", err)
-	}
-
-	if !bucketLockConfig.Enabled {
-		return s3err.GetAPIError(s3err.ErrInvalidBucketObjectLockConfiguration)
-	}
-
-	blobClient, err := az.getBlobClient(bucket, object)
-	if err != nil {
-		return err
-	}
-
-	blobProps, err := blobClient.GetProperties(ctx, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	meta := blobProps.Metadata
-	if meta == nil {
-		meta = map[string]*string{
-			string(keyObjRetention): backend.GetStringPtr(string(retention)),
-		}
-	} else {
-		meta[string(keyObjRetention)] = backend.GetStringPtr(string(retention))
-	}
-
-	_, err = blobClient.SetMetadata(ctx, meta, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	return nil
-}
-
-func (az *Azure) GetObjectRetention(ctx context.Context, bucket, object, versionId string) ([]byte, error) {
-	client, err := az.getBlobClient(bucket, object)
-	if err != nil {
-		return nil, err
-	}
-	props, err := client.GetProperties(ctx, nil)
-	if err != nil {
-		return nil, azureErrToS3Err(err)
-	}
-
-	retentionPtr, ok := props.Metadata[string(keyObjRetention)]
-	if !ok {
-		return nil, s3err.GetAPIError(s3err.ErrNoSuchObjectLockConfiguration)
-	}
-
-	return []byte(*retentionPtr), nil
-}
-
-func (az *Azure) PutObjectLegalHold(ctx context.Context, bucket, object, versionId string, status bool) error {
-	contClient, err := az.getContainerClient(bucket)
-	if err != nil {
-		return err
-	}
-	contProps, err := contClient.GetProperties(ctx, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	contCfg, ok := contProps.Metadata[string(keyBucketLock)]
-	if !ok {
-		return s3err.GetAPIError(s3err.ErrInvalidBucketObjectLockConfiguration)
-	}
-
-	var bucketLockConfig auth.BucketLockConfig
-	if err := json.Unmarshal([]byte(*contCfg), &bucketLockConfig); err != nil {
-		return fmt.Errorf("parse bucket lock config: %w", err)
-	}
-
-	if !bucketLockConfig.Enabled {
-		return s3err.GetAPIError(s3err.ErrInvalidBucketObjectLockConfiguration)
-	}
-
-	blobClient, err := az.getBlobClient(bucket, object)
-	if err != nil {
-		return err
-	}
-
-	blobProps, err := blobClient.GetProperties(ctx, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	var statusData string
-	if status {
-		statusData = "1"
-	} else {
-		statusData = "0"
-	}
-
-	meta := blobProps.Metadata
-	if meta == nil {
-		meta = map[string]*string{
-			string(keyObjLegalHold): &statusData,
-		}
-	} else {
-		meta[string(keyObjLegalHold)] = &statusData
-	}
-
-	_, err = blobClient.SetMetadata(ctx, meta, nil)
-	if err != nil {
-		return azureErrToS3Err(err)
-	}
-
-	return nil
-}
-
-func (az *Azure) GetObjectLegalHold(ctx context.Context, bucket, object, versionId string) (*bool, error) {
-	client, err := az.getBlobClient(bucket, object)
-	if err != nil {
-		return nil, err
-	}
-	props, err := client.GetProperties(ctx, nil)
-	if err != nil {
-		return nil, azureErrToS3Err(err)
-	}
-
-	retentionPtr, ok := props.Metadata[string(keyObjLegalHold)]
-	if !ok {
-		return nil, s3err.GetAPIError(s3err.ErrNoSuchObjectLockConfiguration)
-	}
-
-	status := *retentionPtr == "1"
-
-	return &status, nil
-}
-
 func (az *Azure) ChangeBucketOwner(ctx context.Context, bucket, newOwner string) error {
 	client, err := az.getContainerClient(bucket)
 	if err != nil {
@@ -1181,7 +791,7 @@ func (az *Azure) ChangeBucketOwner(ctx context.Context, bucket, newOwner string)
 		return azureErrToS3Err(err)
 	}
 
-	acl, err := getAclFromMetadata(props.Metadata, keyAclCapital)
+	acl, err := getAclFromMetadata(props.Metadata, aclKeyCapital)
 	if err != nil {
 		return err
 	}
@@ -1212,7 +822,7 @@ func (az *Azure) ListBucketsAndOwners(ctx context.Context) (buckets []s3response
 			return buckets, azureErrToS3Err(err)
 		}
 		for _, v := range resp.ContainerItems {
-			acl, err := getAclFromMetadata(v.Metadata, keyAclLower)
+			acl, err := getAclFromMetadata(v.Metadata, aclKeyLower)
 			if err != nil {
 				return buckets, err
 			}
@@ -1389,7 +999,7 @@ func parseRange(rg string) (offset, count int64, err error) {
 	return offset, count - offset + 1, nil
 }
 
-func getAclFromMetadata(meta map[string]*string, key key) (*auth.ACL, error) {
+func getAclFromMetadata(meta map[string]*string, key aclKey) (*auth.ACL, error) {
 	aclPtr, ok := meta[string(key)]
 	if !ok {
 		return nil, s3err.GetAPIError(s3err.ErrInternalError)
@@ -1410,7 +1020,7 @@ func isMetaSame(azMeta map[string]*string, awsMeta map[string]string) bool {
 	}
 
 	for key, val := range azMeta {
-		if key == string(keyAclCapital) || key == string(keyAclLower) {
+		if key == string(aclKeyCapital) || key == string(aclKeyLower) {
 			continue
 		}
 		awsVal, ok := awsMeta[key]

backend/backend.go

@@ -58,7 +58,7 @@ type Backend interface {
 	HeadObject(context.Context, *s3.HeadObjectInput) (*s3.HeadObjectOutput, error)
 	GetObject(context.Context, *s3.GetObjectInput, io.Writer) (*s3.GetObjectOutput, error)
 	GetObjectAcl(context.Context, *s3.GetObjectAclInput) (*s3.GetObjectAclOutput, error)
-	GetObjectAttributes(context.Context, *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error)
+	GetObjectAttributes(context.Context, *s3.GetObjectAttributesInput) (*s3.GetObjectAttributesOutput, error)
 	CopyObject(context.Context, *s3.CopyObjectInput) (*s3.CopyObjectOutput, error)
 	ListObjects(context.Context, *s3.ListObjectsInput) (*s3.ListObjectsOutput, error)
 	ListObjectsV2(context.Context, *s3.ListObjectsV2Input) (*s3.ListObjectsV2Output, error)
@@ -81,14 +81,6 @@ type Backend interface {
 	PutObjectTagging(_ context.Context, bucket, object string, tags map[string]string) error
 	DeleteObjectTagging(_ context.Context, bucket, object string) error
 
-	// object lock operations
-	PutObjectLockConfiguration(_ context.Context, bucket string, config []byte) error
-	GetObjectLockConfiguration(_ context.Context, bucket string) ([]byte, error)
-	PutObjectRetention(_ context.Context, bucket, object, versionId string, bypass bool, retention []byte) error
-	GetObjectRetention(_ context.Context, bucket, object, versionId string) ([]byte, error)
-	PutObjectLegalHold(_ context.Context, bucket, object, versionId string, status bool) error
-	GetObjectLegalHold(_ context.Context, bucket, object, versionId string) (*bool, error)
-
 	// non AWS actions
 	ChangeBucketOwner(_ context.Context, bucket, newOwner string) error
 	ListBucketsAndOwners(context.Context) ([]s3response.Bucket, error)
@@ -173,8 +165,8 @@ func (BackendUnsupported) GetObject(context.Context, *s3.GetObjectInput, io.Writ
 func (BackendUnsupported) GetObjectAcl(context.Context, *s3.GetObjectAclInput) (*s3.GetObjectAclOutput, error) {
 	return nil, s3err.GetAPIError(s3err.ErrNotImplemented)
 }
-func (BackendUnsupported) GetObjectAttributes(context.Context, *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error) {
-	return s3response.GetObjectAttributesResult{}, s3err.GetAPIError(s3err.ErrNotImplemented)
+func (BackendUnsupported) GetObjectAttributes(context.Context, *s3.GetObjectAttributesInput) (*s3.GetObjectAttributesOutput, error) {
+	return nil, s3err.GetAPIError(s3err.ErrNotImplemented)
 }
 func (BackendUnsupported) CopyObject(context.Context, *s3.CopyObjectInput) (*s3.CopyObjectOutput, error) {
 	return nil, s3err.GetAPIError(s3err.ErrNotImplemented)
@@ -237,25 +229,6 @@ func (BackendUnsupported) DeleteObjectTagging(_ context.Context, bucket, object
 	return s3err.GetAPIError(s3err.ErrNotImplemented)
 }
 
-func (BackendUnsupported) PutObjectLockConfiguration(_ context.Context, bucket string, config []byte) error {
-	return s3err.GetAPIError(s3err.ErrNotImplemented)
-}
-func (BackendUnsupported) GetObjectLockConfiguration(_ context.Context, bucket string) ([]byte, error) {
-	return nil, s3err.GetAPIError(s3err.ErrNotImplemented)
-}
-func (BackendUnsupported) PutObjectRetention(_ context.Context, bucket, object, versionId string, bypass bool, retention []byte) error {
-	return s3err.GetAPIError(s3err.ErrNotImplemented)
-}
-func (BackendUnsupported) GetObjectRetention(_ context.Context, bucket, object, versionId string) ([]byte, error) {
-	return nil, s3err.GetAPIError(s3err.ErrNotImplemented)
-}
-func (BackendUnsupported) PutObjectLegalHold(_ context.Context, bucket, object, versionId string, status bool) error {
-	return s3err.GetAPIError(s3err.ErrNotImplemented)
-}
-func (BackendUnsupported) GetObjectLegalHold(_ context.Context, bucket, object, versionId string) (*bool, error) {
-	return nil, s3err.GetAPIError(s3err.ErrNotImplemented)
-}
-
 func (BackendUnsupported) ChangeBucketOwner(_ context.Context, bucket, newOwner string) error {
 	return s3err.GetAPIError(s3err.ErrNotImplemented)
 }

backend/common.go

@@ -92,7 +92,7 @@ func ParseRange(fi fs.FileInfo, acceptRange string) (int64, int64, error) {
 		return 0, 0, errInvalidRange
 	}
 
-	if endOffset <= startOffset {
+	if endOffset < startOffset {
 		return 0, 0, errInvalidRange
 	}
 

backend/meta/meta.go

@@ -1,40 +0,0 @@
-// Copyright 2024 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package meta
-
-// MetadataStorer defines the interface for managing metadata.
-// When object == "", the operation is on the bucket.
-type MetadataStorer interface {
-	// RetrieveAttribute retrieves the value of a specific attribute for an object or a bucket.
-	// Returns the value of the attribute, or an error if the attribute does not exist.
-	RetrieveAttribute(bucket, object, attribute string) ([]byte, error)
-
-	// StoreAttribute stores the value of a specific attribute for an object or a bucket.
-	// If attribute already exists, new attribute should replace existing.
-	// Returns an error if the operation fails.
-	StoreAttribute(bucket, object, attribute string, value []byte) error
-
-	// DeleteAttribute removes the value of a specific attribute for an object or a bucket.
-	// Returns an error if the operation fails.
-	DeleteAttribute(bucket, object, attribute string) error
-
-	// ListAttributes lists all attributes for an object or a bucket.
-	// Returns list of attribute names, or an error if the operation fails.
-	ListAttributes(bucket, object string) ([]string, error)
-
-	// DeleteAttributes removes all attributes for an object or a bucket.
-	// Returns an error if the operation fails.
-	DeleteAttributes(bucket, object string) error
-}

backend/meta/xattr.go

@@ -1,101 +0,0 @@
-// Copyright 2024 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package meta
-
-import (
-	"errors"
-	"fmt"
-	"path/filepath"
-	"strings"
-	"syscall"
-
-	"github.com/pkg/xattr"
-)
-
-const (
-	xattrPrefix = "user."
-)
-
-var (
-	// ErrNoSuchKey is returned when the key does not exist.
-	ErrNoSuchKey = errors.New("no such key")
-)
-
-type XattrMeta struct{}
-
-// RetrieveAttribute retrieves the value of a specific attribute for an object in a bucket.
-func (x XattrMeta) RetrieveAttribute(bucket, object, attribute string) ([]byte, error) {
-	b, err := xattr.Get(filepath.Join(bucket, object), xattrPrefix+attribute)
-	if errors.Is(err, xattr.ENOATTR) {
-		return nil, ErrNoSuchKey
-	}
-	return b, err
-}
-
-// StoreAttribute stores the value of a specific attribute for an object in a bucket.
-func (x XattrMeta) StoreAttribute(bucket, object, attribute string, value []byte) error {
-	return xattr.Set(filepath.Join(bucket, object), xattrPrefix+attribute, value)
-}
-
-// DeleteAttribute removes the value of a specific attribute for an object in a bucket.
-func (x XattrMeta) DeleteAttribute(bucket, object, attribute string) error {
-	err := xattr.Remove(filepath.Join(bucket, object), xattrPrefix+attribute)
-	if errors.Is(err, xattr.ENOATTR) {
-		return ErrNoSuchKey
-	}
-	return err
-}
-
-// DeleteAttributes is not implemented for xattr since xattrs
-// are automatically removed when the file is deleted.
-func (x XattrMeta) DeleteAttributes(bucket, object string) error {
-	return nil
-}
-
-// ListAttributes lists all attributes for an object in a bucket.
-func (x XattrMeta) ListAttributes(bucket, object string) ([]string, error) {
-	attrs, err := xattr.List(filepath.Join(bucket, object))
-	if err != nil {
-		return nil, err
-	}
-	attributes := make([]string, 0, len(attrs))
-	for _, attr := range attrs {
-		if !isUserAttr(attr) {
-			continue
-		}
-		attributes = append(attributes, strings.TrimPrefix(attr, xattrPrefix))
-	}
-	return attributes, nil
-}
-
-func isUserAttr(attr string) bool {
-	return strings.HasPrefix(attr, xattrPrefix)
-}
-
-// Test is a helper function to test if xattrs are supported.
-func (x XattrMeta) Test(path string) error {
-	// check for platform support
-	if !xattr.XATTR_SUPPORTED {
-		return fmt.Errorf("xattrs are not supported on this platform")
-	}
-
-	// check if the filesystem supports xattrs
-	_, err := xattr.Get(path, "user.test")
-	if errors.Is(err, syscall.ENOTSUP) {
-		return fmt.Errorf("xattrs are not supported on this filesystem")
-	}
-
-	return nil
-}

backend/mkdir.go

@@ -1,7 +1,6 @@
 // Copyright 2009 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
-// Copyright 2024 Versity Software
 
 // MkdirAll borrowed from stdlib to add ability to set ownership
 // as directories are created

backend/posix/with_enodata.go

@@ -0,0 +1,24 @@
+// Copyright 2024 Versity Software
+// This file is licensed under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build !freebsd && !openbsd && !netbsd
+// +build !freebsd,!openbsd,!netbsd
+
+package posix
+
+import "syscall"
+
+var (
+	errNoData = syscall.ENODATA
+)

backend/posix/with_otmpfile.go

@@ -50,7 +50,7 @@ var (
 	defaultFilePerm uint32 = 0644
 )
 
-func (p *Posix) openTmpFile(dir, bucket, obj string, size int64, acct auth.Account, dofalloc bool) (*tmpfile, error) {
+func (p *Posix) openTmpFile(dir, bucket, obj string, size int64, acct auth.Account) (*tmpfile, error) {
 	uid, gid, doChown := p.getChownIDs(acct)
 
 	// O_TMPFILE allows for a file handle to an unnamed file in the filesystem.
@@ -81,7 +81,7 @@ func (p *Posix) openTmpFile(dir, bucket, obj string, size int64, acct auth.Accou
 			gid:        gid,
 		}
 		// falloc is best effort, its fine if this fails
-		if size > 0 && dofalloc {
+		if size > 0 {
 			tmp.falloc()
 		}
 
@@ -111,7 +111,7 @@ func (p *Posix) openTmpFile(dir, bucket, obj string, size int64, acct auth.Accou
 	}
 
 	// falloc is best effort, its fine if this fails
-	if size > 0 && dofalloc {
+	if size > 0 {
 		tmp.falloc()
 	}
 
@@ -221,7 +221,3 @@ func (tmp *tmpfile) Write(b []byte) (int, error) {
 func (tmp *tmpfile) cleanup() {
 	tmp.f.Close()
 }
-
-func (tmp *tmpfile) File() *os.File {
-	return tmp.f
-}

backend/posix/without_enodata.go

@@ -0,0 +1,24 @@
+// Copyright 2024 Versity Software
+// This file is licensed under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+//go:build freebsd || openbsd || netbsd
+// +build freebsd openbsd netbsd
+
+package posix
+
+import "syscall"
+
+var (
+	errNoData = syscall.ENOATTR
+)

backend/posix/without_otmpfile.go

@@ -36,7 +36,7 @@ type tmpfile struct {
 	size    int64
 }
 
-func (p *Posix) openTmpFile(dir, bucket, obj string, size int64, acct auth.Account, _ bool) (*tmpfile, error) {
+func (p *Posix) openTmpFile(dir, bucket, obj string, size int64, acct auth.Account) (*tmpfile, error) {
 	uid, gid, doChown := p.getChownIDs(acct)
 
 	// Create a temp file for upload while in progress (see link comments below).
@@ -112,7 +112,3 @@ func (tmp *tmpfile) Write(b []byte) (int, error) {
 func (tmp *tmpfile) cleanup() {
 	tmp.f.Close()
 }
-
-func (tmp *tmpfile) File() *os.File {
-	return tmp.f
-}

backend/s3proxy/s3.go

@@ -33,7 +33,6 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/smithy-go"
-	"github.com/versity/versitygw/auth"
 	"github.com/versity/versitygw/backend"
 	"github.com/versity/versitygw/s3err"
 	"github.com/versity/versitygw/s3response"
@@ -296,41 +295,9 @@ func (s *S3Proxy) GetObject(ctx context.Context, input *s3.GetObjectInput, w io.
 	return output, nil
 }
 
-func (s *S3Proxy) GetObjectAttributes(ctx context.Context, input *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error) {
+func (s *S3Proxy) GetObjectAttributes(ctx context.Context, input *s3.GetObjectAttributesInput) (*s3.GetObjectAttributesOutput, error) {
 	out, err := s.client.GetObjectAttributes(ctx, input)
-
-	parts := s3response.ObjectParts{}
-	objParts := out.ObjectParts
-	if objParts != nil {
-		if objParts.PartNumberMarker != nil {
-			partNumberMarker, err := strconv.Atoi(*objParts.PartNumberMarker)
-			if err != nil {
-				parts.PartNumberMarker = partNumberMarker
-			}
-			if objParts.NextPartNumberMarker != nil {
-				nextPartNumberMarker, err := strconv.Atoi(*objParts.NextPartNumberMarker)
-				if err != nil {
-					parts.NextPartNumberMarker = nextPartNumberMarker
-				}
-			}
-			if objParts.IsTruncated != nil {
-				parts.IsTruncated = *objParts.IsTruncated
-			}
-			if objParts.MaxParts != nil {
-				parts.MaxParts = int(*objParts.MaxParts)
-			}
-			parts.Parts = objParts.Parts
-		}
-	}
-
-	return s3response.GetObjectAttributesResult{
-		ETag:         out.ETag,
-		LastModified: out.LastModified,
-		ObjectSize:   out.ObjectSize,
-		StorageClass: &out.StorageClass,
-		VersionId:    out.VersionId,
-		ObjectParts:  &parts,
-	}, handleError(err)
+	return out, handleError(err)
 }
 
 func (s *S3Proxy) CopyObject(ctx context.Context, input *s3.CopyObjectInput) (*s3.CopyObjectOutput, error) {
@@ -469,129 +436,6 @@ func (s *S3Proxy) DeleteObjectTagging(ctx context.Context, bucket, object string
 	return handleError(err)
 }
 
-func (s *S3Proxy) PutBucketPolicy(ctx context.Context, bucket string, policy []byte) error {
-	_, err := s.client.PutBucketPolicy(ctx, &s3.PutBucketPolicyInput{
-		Bucket: &bucket,
-		Policy: backend.GetStringPtr(string(policy)),
-	})
-	return handleError(err)
-}
-
-func (s *S3Proxy) GetBucketPolicy(ctx context.Context, bucket string) ([]byte, error) {
-	policy, err := s.client.GetBucketPolicy(ctx, &s3.GetBucketPolicyInput{
-		Bucket: &bucket,
-	})
-	if err != nil {
-		return nil, handleError(err)
-	}
-
-	result := []byte{}
-	if policy.Policy != nil {
-		result = []byte(*policy.Policy)
-	}
-
-	return result, nil
-}
-
-func (s *S3Proxy) DeleteBucketPolicy(ctx context.Context, bucket string) error {
-	_, err := s.client.DeleteBucketPolicy(ctx, &s3.DeleteBucketPolicyInput{
-		Bucket: &bucket,
-	})
-	return handleError(err)
-}
-
-func (s *S3Proxy) PutObjectLockConfiguration(ctx context.Context, bucket string, config []byte) error {
-	cfg, err := auth.ParseBucketLockConfigurationOutput(config)
-	if err != nil {
-		return err
-	}
-
-	_, err = s.client.PutObjectLockConfiguration(ctx, &s3.PutObjectLockConfigurationInput{
-		Bucket:                  &bucket,
-		ObjectLockConfiguration: cfg,
-	})
-
-	return handleError(err)
-}
-
-func (s *S3Proxy) GetObjectLockConfiguration(ctx context.Context, bucket string) ([]byte, error) {
-	resp, err := s.client.GetObjectLockConfiguration(ctx, &s3.GetObjectLockConfigurationInput{
-		Bucket: &bucket,
-	})
-	if err != nil {
-		return nil, handleError(err)
-	}
-
-	config := auth.BucketLockConfig{
-		Enabled:          resp.ObjectLockConfiguration.ObjectLockEnabled == types.ObjectLockEnabledEnabled,
-		DefaultRetention: resp.ObjectLockConfiguration.Rule.DefaultRetention,
-	}
-
-	return json.Marshal(config)
-}
-
-func (s *S3Proxy) PutObjectRetention(ctx context.Context, bucket, object, versionId string, bypass bool, retention []byte) error {
-	ret, err := auth.ParseObjectLockRetentionOutput(retention)
-	if err != nil {
-		return err
-	}
-
-	_, err = s.client.PutObjectRetention(ctx, &s3.PutObjectRetentionInput{
-		Bucket:                    &bucket,
-		Key:                       &object,
-		VersionId:                 &versionId,
-		Retention:                 ret,
-		BypassGovernanceRetention: &bypass,
-	})
-	return handleError(err)
-}
-
-func (s *S3Proxy) GetObjectRetention(ctx context.Context, bucket, object, versionId string) ([]byte, error) {
-	resp, err := s.client.GetObjectRetention(ctx, &s3.GetObjectRetentionInput{
-		Bucket:    &bucket,
-		Key:       &object,
-		VersionId: &versionId,
-	})
-	if err != nil {
-		return nil, handleError(err)
-	}
-
-	return json.Marshal(resp.Retention)
-}
-
-func (s *S3Proxy) PutObjectLegalHold(ctx context.Context, bucket, object, versionId string, status bool) error {
-	var st types.ObjectLockLegalHoldStatus
-	if status {
-		st = types.ObjectLockLegalHoldStatusOn
-	} else {
-		st = types.ObjectLockLegalHoldStatusOff
-	}
-
-	_, err := s.client.PutObjectLegalHold(ctx, &s3.PutObjectLegalHoldInput{
-		Bucket:    &bucket,
-		Key:       &object,
-		VersionId: &versionId,
-		LegalHold: &types.ObjectLockLegalHold{
-			Status: st,
-		},
-	})
-	return handleError(err)
-}
-
-func (s *S3Proxy) GetObjectLegalHold(ctx context.Context, bucket, object, versionId string) (*bool, error) {
-	resp, err := s.client.GetObjectLegalHold(ctx, &s3.GetObjectLegalHoldInput{
-		Bucket:    &bucket,
-		Key:       &object,
-		VersionId: &versionId,
-	})
-	if err != nil {
-		return nil, handleError(err)
-	}
-
-	status := resp.LegalHold.Status == types.ObjectLockLegalHoldStatusOn
-	return &status, nil
-}
-
 func (s *S3Proxy) ChangeBucketOwner(ctx context.Context, bucket, newOwner string) error {
 	req, err := http.NewRequest(http.MethodPatch, fmt.Sprintf("%v/change-bucket-owner/?bucket=%v&owner=%v", s.endpoint, bucket, newOwner), nil)
 	if err != nil {

backend/scoutfs/scoutfs.go

@@ -39,6 +39,7 @@ import (
 type ScoutfsOpts struct {
 	ChownUID    bool
 	ChownGID    bool
+	ReadOnly    bool
 	GlacierMode bool
 }
 
@@ -63,6 +64,9 @@ type ScoutFS struct {
 	chownuid bool
 	chowngid bool
 
+	// read only mode prevents any backend modifications
+	readonly bool
+
 	// euid/egid are the effective uid/gid of the running versitygw process
 	// used to determine if chowning is needed
 	euid int
@@ -143,6 +147,10 @@ func (s *ScoutFS) getChownIDs(acct auth.Account) (int, int, bool) {
 // ioctl to not have to read and copy the part data to the final object. This
 // saves a read and write cycle for all mutlipart uploads.
 func (s *ScoutFS) CompleteMultipartUpload(ctx context.Context, input *s3.CompleteMultipartUploadInput) (*s3.CompleteMultipartUploadOutput, error) {
+	if s.readonly {
+		return nil, s3err.GetAPIError(s3err.ErrAccessDenied)
+	}
+
 	acct, ok := ctx.Value("account").(auth.Account)
 	if !ok {
 		acct = auth.Account{}

backend/scoutfs/scoutfs_compat.go

@@ -30,14 +30,14 @@ import (
 	"github.com/versity/scoutfs-go"
 	"github.com/versity/versitygw/auth"
 	"github.com/versity/versitygw/backend"
-	"github.com/versity/versitygw/backend/meta"
 	"github.com/versity/versitygw/backend/posix"
 )
 
 func New(rootdir string, opts ScoutfsOpts) (*ScoutFS, error) {
-	p, err := posix.New(rootdir, meta.XattrMeta{}, posix.PosixOpts{
+	p, err := posix.New(rootdir, posix.PosixOpts{
 		ChownUID: opts.ChownUID,
 		ChownGID: opts.ChownGID,
+		ReadOnly: opts.ReadOnly,
 	})
 	if err != nil {
 		return nil, err
@@ -54,6 +54,7 @@ func New(rootdir string, opts ScoutfsOpts) (*ScoutFS, error) {
 		rootdir:  rootdir,
 		chownuid: opts.ChownUID,
 		chowngid: opts.ChownGID,
+		readonly: opts.ReadOnly,
 	}, nil
 }
 

backend/scoutfs/scoutfs_incompat.go

@@ -42,6 +42,7 @@ func (s *ScoutFS) openTmpFile(_, _, _ string, _ int64, _ auth.Account) (*tmpfile
 	_ = s.chowngid
 	_ = s.euid
 	_ = s.egid
+	_ = s.readonly
 	return nil, errNotSupported
 }
 

cmd/versitygw/admin.go

@@ -17,7 +17,6 @@ package main
 import (
 	"bytes"
 	"crypto/sha256"
-	"crypto/tls"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
@@ -38,7 +37,6 @@ var (
 	adminAccess   string
 	adminSecret   string
 	adminEndpoint string
-	allowInsecure bool
 )
 
 func adminCommand() *cli.Command {
@@ -80,6 +78,11 @@ func adminCommand() *cli.Command {
 						Usage:   "groupID for the new user",
 						Aliases: []string{"gi"},
 					},
+					&cli.IntFlag{
+						Name:    "project-id",
+						Usage:   "projectID for the new user",
+						Aliases: []string{"pi"},
+					},
 				},
 			},
 			{
@@ -151,40 +154,27 @@ func adminCommand() *cli.Command {
 				Required:    true,
 				Destination: &adminEndpoint,
 			},
-			&cli.BoolFlag{
-				Name:        "allow-insecure",
-				Usage:       "disable tls certificate verification for the admin endpoint",
-				EnvVars:     []string{"ADMIN_ALLOW_INSECURE"},
-				Aliases:     []string{"ai"},
-				Destination: &allowInsecure,
-			},
 		},
 	}
 }
 
-func initHTTPClient() *http.Client {
-	tr := &http.Transport{
-		TLSClientConfig: &tls.Config{InsecureSkipVerify: allowInsecure},
-	}
-	return &http.Client{Transport: tr}
-}
-
 func createUser(ctx *cli.Context) error {
 	access, secret, role := ctx.String("access"), ctx.String("secret"), ctx.String("role")
-	userID, groupID := ctx.Int("user-id"), ctx.Int("group-id")
+	userID, groupID, projectID := ctx.Int("user-id"), ctx.Int("group-id"), ctx.Int("projectID")
 	if access == "" || secret == "" {
-		return fmt.Errorf("invalid input parameters for the new user access/secret keys")
+		return fmt.Errorf("invalid input parameters for the new user")
 	}
 	if role != string(auth.RoleAdmin) && role != string(auth.RoleUser) && role != string(auth.RoleUserPlus) {
 		return fmt.Errorf("invalid input parameter for role: %v", role)
 	}
 
 	acc := auth.Account{
-		Access:  access,
-		Secret:  secret,
-		Role:    auth.Role(role),
-		UserID:  userID,
-		GroupID: groupID,
+		Access:    access,
+		Secret:    secret,
+		Role:      auth.Role(role),
+		UserID:    userID,
+		GroupID:   groupID,
+		ProjectID: projectID,
 	}
 
 	accJson, err := json.Marshal(acc)
@@ -209,22 +199,18 @@ func createUser(ctx *cli.Context) error {
 		return fmt.Errorf("failed to sign the request: %w", err)
 	}
 
-	client := initHTTPClient()
+	client := http.Client{}
 
 	resp, err := client.Do(req)
 	if err != nil {
 		return fmt.Errorf("failed to send the request: %w", err)
 	}
-	defer resp.Body.Close()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
-
-	if resp.StatusCode >= 400 {
-		return fmt.Errorf("%s", body)
-	}
+	defer resp.Body.Close()
 
 	fmt.Printf("%s\n", body)
 
@@ -234,7 +220,7 @@ func createUser(ctx *cli.Context) error {
 func deleteUser(ctx *cli.Context) error {
 	access := ctx.String("access")
 	if access == "" {
-		return fmt.Errorf("invalid input parameter for the user access key")
+		return fmt.Errorf("invalid input parameter for the new user")
 	}
 
 	req, err := http.NewRequest(http.MethodPatch, fmt.Sprintf("%v/delete-user?access=%v", adminEndpoint, access), nil)
@@ -254,22 +240,18 @@ func deleteUser(ctx *cli.Context) error {
 		return fmt.Errorf("failed to sign the request: %w", err)
 	}
 
-	client := initHTTPClient()
+	client := http.Client{}
 
 	resp, err := client.Do(req)
 	if err != nil {
 		return fmt.Errorf("failed to send the request: %w", err)
 	}
-	defer resp.Body.Close()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
-
-	if resp.StatusCode >= 400 {
-		return fmt.Errorf("%s", body)
-	}
+	defer resp.Body.Close()
 
 	fmt.Printf("%s\n", body)
 
@@ -294,18 +276,18 @@ func listUsers(ctx *cli.Context) error {
 		return fmt.Errorf("failed to sign the request: %w", err)
 	}
 
-	client := initHTTPClient()
+	client := http.Client{}
 
 	resp, err := client.Do(req)
 	if err != nil {
 		return fmt.Errorf("failed to send the request: %w", err)
 	}
-	defer resp.Body.Close()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
+	defer resp.Body.Close()
 
 	if resp.StatusCode >= 400 {
 		return fmt.Errorf("%s", body)
@@ -333,10 +315,10 @@ const (
 func printAcctTable(accs []auth.Account) {
 	w := new(tabwriter.Writer)
 	w.Init(os.Stdout, minwidth, tabwidth, padding, padchar, flags)
-	fmt.Fprintln(w, "Account\tRole\tUserID\tGroupID")
-	fmt.Fprintln(w, "-------\t----\t------\t-------")
+	fmt.Fprintln(w, "Account\tRole\tUserID\tGroupID\tProjectID")
+	fmt.Fprintln(w, "-------\t----\t------\t-------\t---------")
 	for _, acc := range accs {
-		fmt.Fprintf(w, "%v\t%v\t%v\t%v\n", acc.Access, acc.Role, acc.UserID, acc.GroupID)
+		fmt.Fprintf(w, "%v\t%v\t%v\t%v\t%v\n", acc.Access, acc.Role, acc.UserID, acc.GroupID, acc.ProjectID)
 	}
 	fmt.Fprintln(w)
 	w.Flush()
@@ -361,22 +343,18 @@ func changeBucketOwner(ctx *cli.Context) error {
 		return fmt.Errorf("failed to sign the request: %w", err)
 	}
 
-	client := initHTTPClient()
+	client := http.Client{}
 
 	resp, err := client.Do(req)
 	if err != nil {
 		return fmt.Errorf("failed to send the request: %w", err)
 	}
-	defer resp.Body.Close()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
-
-	if resp.StatusCode >= 400 {
-		return fmt.Errorf("%s", body)
-	}
+	defer resp.Body.Close()
 
 	fmt.Println(string(body))
 
@@ -413,18 +391,18 @@ func listBuckets(ctx *cli.Context) error {
 		return fmt.Errorf("failed to sign the request: %w", err)
 	}
 
-	client := initHTTPClient()
+	client := http.Client{}
 
 	resp, err := client.Do(req)
 	if err != nil {
 		return fmt.Errorf("failed to send the request: %w", err)
 	}
-	defer resp.Body.Close()
 
 	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return err
 	}
+	defer resp.Body.Close()
 
 	if resp.StatusCode >= 400 {
 		return fmt.Errorf("%s", body)

cmd/versitygw/gateway_test.go

@@ -8,7 +8,6 @@ import (
 	"sync"
 	"testing"
 
-	"github.com/versity/versitygw/backend/meta"
 	"github.com/versity/versitygw/backend/posix"
 	"github.com/versity/versitygw/tests/integration"
 )
@@ -57,7 +56,7 @@ func initPosix(ctx context.Context) {
 		log.Fatalf("make temp directory: %v", err)
 	}
 
-	be, err := posix.New(tempdir, meta.XattrMeta{}, posix.PosixOpts{})
+	be, err := posix.New(tempdir, posix.PosixOpts{})
 	if err != nil {
 		log.Fatalf("init posix: %v", err)
 	}

cmd/versitygw/main.go

@@ -27,7 +27,6 @@ import (
 	"github.com/urfave/cli/v2"
 	"github.com/versity/versitygw/auth"
 	"github.com/versity/versitygw/backend"
-	"github.com/versity/versitygw/metrics"
 	"github.com/versity/versitygw/s3api"
 	"github.com/versity/versitygw/s3api/middlewares"
 	"github.com/versity/versitygw/s3event"
@@ -51,7 +50,6 @@ var (
 	debug                                  bool
 	pprof                                  string
 	quiet                                  bool
-	readonly                               bool
 	iamDir                                 string
 	ldapURL, ldapBindDN, ldapPassword      string
 	ldapQueryBase, ldapObjClasses          string
@@ -63,9 +61,6 @@ var (
 	iamCacheDisable                        bool
 	iamCacheTTL                            int
 	iamCachePrune                          int
-	metricsService                         string
-	statsdServers                          string
-	dogstatsServers                        string
 )
 
 var (
@@ -396,33 +391,6 @@ func initFlags() []cli.Flag {
 			EnvVars:     []string{"VGW_HEALTH"},
 			Destination: &healthPath,
 		},
-		&cli.BoolFlag{
-			Name:        "readonly",
-			Usage:       "allow only read operations across all the gateway",
-			EnvVars:     []string{"VGW_READ_ONLY"},
-			Destination: &readonly,
-		},
-		&cli.StringFlag{
-			Name:        "metrics-service-name",
-			Usage:       "service name tag for metrics, hostname if blank",
-			EnvVars:     []string{"VGW_METRICS_SERVICE_NAME"},
-			Aliases:     []string{"msn"},
-			Destination: &metricsService,
-		},
-		&cli.StringFlag{
-			Name:        "metrics-statsd-servers",
-			Usage:       "StatsD server urls comma separated. e.g. 'statsd1.example.com:8125,statsd2.example.com:8125'",
-			EnvVars:     []string{"VGW_METRICS_STATSD_SERVERS"},
-			Aliases:     []string{"mss"},
-			Destination: &statsdServers,
-		},
-		&cli.StringFlag{
-			Name:        "metrics-dogstatsd-servers",
-			Usage:       "DogStatsD server urls comma separated. e.g. '127.0.0.1:8125,dogstats.example.com:8125'",
-			EnvVars:     []string{"VGW_METRICS_DOGSTATS_SERVERS"},
-			Aliases:     []string{"mds"},
-			Destination: &dogstatsServers,
-		},
 	}
 }
 
@@ -474,9 +442,6 @@ func runGateway(ctx context.Context, be backend.Backend) error {
 	if healthPath != "" {
 		opts = append(opts, s3api.WithHealth(healthPath))
 	}
-	if readonly {
-		opts = append(opts, s3api.WithReadOnly())
-	}
 
 	admApp := fiber.New(fiber.Config{
 		AppName:      "versitygw",
@@ -533,15 +498,6 @@ func runGateway(ctx context.Context, be backend.Backend) error {
 		return fmt.Errorf("setup logger: %w", err)
 	}
 
-	metricsManager, err := metrics.NewManager(ctx, metrics.Config{
-		ServiceName:      metricsService,
-		StatsdServers:    statsdServers,
-		DogStatsdServers: dogstatsServers,
-	})
-	if err != nil {
-		return fmt.Errorf("init metrics manager: %w", err)
-	}
-
 	evSender, err := s3event.InitEventSender(&s3event.EventConfig{
 		KafkaURL:             kafkaURL,
 		KafkaTopic:           kafkaTopic,
@@ -558,7 +514,7 @@ func runGateway(ctx context.Context, be backend.Backend) error {
 	srv, err := s3api.New(app, be, middlewares.RootUserConfig{
 		Access: rootUserAccess,
 		Secret: rootUserSecret,
-	}, port, region, iam, logger, evSender, metricsManager, opts...)
+	}, port, region, iam, logger, evSender, opts...)
 	if err != nil {
 		return fmt.Errorf("init gateway: %v", err)
 	}
@@ -621,9 +577,5 @@ Loop:
 		}
 	}
 
-	if metricsManager != nil {
-		metricsManager.Close()
-	}
-
 	return saveErr
 }

cmd/versitygw/posix.go

@@ -18,12 +18,12 @@ import (
 	"fmt"
 
 	"github.com/urfave/cli/v2"
-	"github.com/versity/versitygw/backend/meta"
 	"github.com/versity/versitygw/backend/posix"
 )
 
 var (
 	chownuid, chowngid bool
+	readonly           bool
 )
 
 func posixCommand() *cli.Command {
@@ -54,6 +54,12 @@ will be translated into the file /mnt/fs/gwroot/mybucket/a/b/c/myobject`,
 				EnvVars:     []string{"VGW_CHOWN_GID"},
 				Destination: &chowngid,
 			},
+			&cli.BoolFlag{
+				Name:        "readonly",
+				Usage:       "allow only read operations to backend",
+				EnvVars:     []string{"VGW_READ_ONLY"},
+				Destination: &readonly,
+			},
 		},
 	}
 }
@@ -63,15 +69,10 @@ func runPosix(ctx *cli.Context) error {
 		return fmt.Errorf("no directory provided for operation")
 	}
 
-	gwroot := (ctx.Args().Get(0))
-	err := meta.XattrMeta{}.Test(gwroot)
-	if err != nil {
-		return fmt.Errorf("posix xattr check: %v", err)
-	}
-
-	be, err := posix.New(gwroot, meta.XattrMeta{}, posix.PosixOpts{
+	be, err := posix.New(ctx.Args().Get(0), posix.PosixOpts{
 		ChownUID: chownuid,
 		ChownGID: chowngid,
+		ReadOnly: readonly,
 	})
 	if err != nil {
 		return fmt.Errorf("init posix: %v", err)

cmd/versitygw/scoutfs.go

@@ -23,6 +23,10 @@ import (
 
 var (
 	glacier bool
+
+	// defined in posix.go:
+	// chownuid, chowngid bool
+	// readonly           bool
 )
 
 func scoutfsCommand() *cli.Command {
@@ -63,6 +67,12 @@ move interfaces as well as support for tiered filesystems.`,
 				EnvVars:     []string{"VGW_CHOWN_GID"},
 				Destination: &chowngid,
 			},
+			&cli.BoolFlag{
+				Name:        "readonly",
+				Usage:       "allow only read operations to backend",
+				EnvVars:     []string{"VGW_READ_ONLY"},
+				Destination: &readonly,
+			},
 		},
 	}
 }
@@ -76,6 +86,7 @@ func runScoutfs(ctx *cli.Context) error {
 	opts.GlacierMode = glacier
 	opts.ChownUID = chownuid
 	opts.ChownGID = chowngid
+	opts.ReadOnly = readonly
 
 	be, err := scoutfs.New(ctx.Args().Get(0), opts)
 	if err != nil {

cmd/versitygw/utils.go

@@ -54,21 +54,19 @@ func generateEventFiltersConfig(ctx *cli.Context) error {
 	}
 
 	config := s3event.EventFilter{
-		s3event.EventObjectCreated:              true,
-		s3event.EventObjectCreatedPut:           true,
-		s3event.EventObjectCreatedPost:          true,
-		s3event.EventObjectCreatedCopy:          true,
-		s3event.EventCompleteMultipartUpload:    true,
-		s3event.EventObjectRemoved:              true,
-		s3event.EventObjectRemovedDelete:        true,
-		s3event.EventObjectRemovedDeleteObjects: true,
-		s3event.EventObjectTagging:              true,
-		s3event.EventObjectTaggingPut:           true,
-		s3event.EventObjectTaggingDelete:        true,
-		s3event.EventObjectAclPut:               true,
-		s3event.EventObjectRestore:              true,
-		s3event.EventObjectRestorePost:          true,
-		s3event.EventObjectRestoreCompleted:     true,
+		s3event.EventObjectCreated:           true,
+		s3event.EventObjectCreatedPut:        true,
+		s3event.EventObjectCreatedPost:       true,
+		s3event.EventObjectCreatedCopy:       true,
+		s3event.EventCompleteMultipartUpload: true,
+		s3event.EventObjectDeleted:           true,
+		s3event.EventObjectTagging:           true,
+		s3event.EventObjectTaggingPut:        true,
+		s3event.EventObjectTaggingDelete:     true,
+		s3event.EventObjectAclPut:            true,
+		s3event.EventObjectRestore:           true,
+		s3event.EventObjectRestorePost:       true,
+		s3event.EventObjectRestoreCompleted:  true,
 	}
 
 	configBytes, err := json.Marshal(config)

docker-compose-bats.yml

@@ -1,35 +0,0 @@
-version: '3'
-
-services:
-  no_certs:
-    build:
-      context: .
-      dockerfile: Dockerfile_test_bats
-      args:
-        - CONFIG_FILE=tests/.env.nocerts
-  static_buckets:
-    build:
-      context: .
-      dockerfile: Dockerfile_test_bats
-      args:
-        - CONFIG_FILE=tests/.env.static
-  posix_backend:
-    build:
-      context: .
-      dockerfile: Dockerfile_test_bats
-      args:
-        - CONFIG_FILE=tests/.env.default
-  s3_backend:
-    build:
-      context: .
-      dockerfile: Dockerfile_test_bats
-      args:
-        - CONFIG_FILE=tests/.env.s3
-        - SECRETS_FILE=tests/.secrets.s3
-  direct:
-    build:
-      context: .
-      dockerfile: Dockerfile_test_bats
-      args:
-        - CONFIG_FILE=tests/.env.direct
-        - SECRETS_FILE=tests/.secrets.direct

docker-compose.yml

@@ -31,7 +31,7 @@ services:
     hostname: azurite
     command: "azurite --oauth basic --cert /tests/certs/azurite.pem --key /tests/certs/azurite-key.pem --blobHost 0.0.0.0"
     volumes:
-      - ./tests/certs:/tests/certs
+      - ./certs:/certs
   azuritegw:
     build:
       context: .

extra/example.conf

@@ -254,6 +254,12 @@ ROOT_SECRET_ACCESS_KEY=
 #VGW_CHOWN_UID=false
 #VGW_CHOWN_GID=false
 
+# The VGW_READ_ONLY option will disable all write operations to the backend
+# filesystem. This is useful for creating a read-only gateway for clients.
+# This will prevent any PUT, POST, DELETE, and multipart upload operations
+# for objects and buckets as well as preventing updating metadata for objects.
+#VGW_READ_ONLY=false
+
 ###########
 # scoutfs #
 ###########
@@ -285,6 +291,12 @@ ROOT_SECRET_ACCESS_KEY=
 #VGW_CHOWN_UID=false
 #VGW_CHOWN_GID=false
 
+# The VGW_READ_ONLY option will disable all write operations to the backend
+# filesystem. This is useful for creating a read-only gateway for clients.
+# This will prevent any PUT, POST, DELETE, and multipart upload operations
+# for objects and buckets as well as preventing updating metadata for objects.
+#VGW_READ_ONLY=false
+
 ######
 # s3 #
 ######

go.mod

@@ -1,40 +1,37 @@
 module github.com/versity/versitygw
 
-go 1.21.0
+go 1.21
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1
-	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.2
-	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.2
-	github.com/aws/aws-sdk-go-v2 v1.27.0
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.54.3
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1
+	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1
+	github.com/aws/aws-sdk-go-v2 v1.26.1
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1
 	github.com/aws/smithy-go v1.20.2
-	github.com/go-ldap/ldap/v3 v3.4.8
+	github.com/go-ldap/ldap/v3 v3.4.6
 	github.com/gofiber/fiber/v2 v2.52.4
 	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
-	github.com/nats-io/nats.go v1.35.0
+	github.com/nats-io/nats.go v1.34.1
 	github.com/pkg/xattr v0.4.9
 	github.com/segmentio/kafka-go v0.4.47
-	github.com/smira/go-statsd v1.3.3
-	github.com/urfave/cli/v2 v2.27.2
-	github.com/valyala/fasthttp v1.54.0
+	github.com/urfave/cli/v2 v2.27.1
+	github.com/valyala/fasthttp v1.52.0
 	github.com/versity/scoutfs-go v0.0.0-20240325223134-38eb2f5f7d44
-	golang.org/x/sys v0.20.0
+	golang.org/x/sys v0.19.0
 )
 
 require (
-	github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 // indirect
 	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 // indirect
-	github.com/DataDog/datadog-go/v5 v5.5.0 // indirect
-	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.3 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.20.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.28.10 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
 	github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
@@ -42,26 +39,26 @@ require (
 	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
-	golang.org/x/crypto v0.23.0 // indirect
-	golang.org/x/net v0.25.0 // indirect
-	golang.org/x/text v0.15.0 // indirect
+	golang.org/x/crypto v0.22.0 // indirect
+	golang.org/x/net v0.24.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
 )
 
 require (
 	github.com/andybalholm/brotli v1.1.0 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.27.16
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.16
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.21
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.7 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.7 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.7 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.27.11
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.11
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.9 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.4 // indirect
-	github.com/klauspost/compress v1.17.8 // indirect
+	github.com/klauspost/compress v1.17.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.15 // indirect

go.sum

@@ -1,62 +1,57 @@
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1 h1:E+OJmp2tPvt1W+amx48v1eqbjDYsgN+RzP4q16yV5eM=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.11.1/go.mod h1:a6xsAQUZg+VsS3TJ05SRp524Hs4pZ/AeFSr5ENf0Yjo=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.2 h1:FDif4R1+UUR+00q6wquyX90K7A8dN+R5E8GEadoP7sU=
-github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.2/go.mod h1:aiYBYui4BJ/BJCAIKs92XiPyQfTaBWqvHujDwKb6CBU=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0 h1:jBQA3cKT4L2rWMpgE7Yt3Hwh2aUj8KXjIGLxjHeYNNo=
-github.com/Azure/azure-sdk-for-go/sdk/internal v1.8.0/go.mod h1:4OG6tQ9EOP/MT0NMjDlRzWoVFxfu9rN9B2X+tlSVktg=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1 h1:sO0/P7g68FrryJzljemN+6GTssUXdANk6aJ7T1ZxnsQ=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.5.1/go.mod h1:h8hyGFDsU5HMivxiS2iYFZsgDbU9OnnJ163x5UGVKYo=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2 h1:LqbJ/WzJUwBf8UiaSzgX7aMclParm9/5Vgp+TY51uBQ=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.2/go.mod h1:yInRyqWXAuaPrgI7p70+lDDgh3mlBohis29jGMISnmc=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0 h1:AifHbc4mg0x9zW52WOpKbsHaDKuRhlI7TVl47thgQ70=
 github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage v1.5.0/go.mod h1:T5RfihdXtBDxt1Ch2wobif3TvzTdumDy29kahv6AV9A=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.2 h1:YUUxeiOWgdAQE3pXt2H7QXzZs0q8UBjgRbl56qo8GYM=
-github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.2/go.mod h1:dmXQgZuiSubAecswZE+Sm8jkvEa7kQgTPVRvwL/nd0E=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1 h1:fXPMAmuh0gDuRDey0atC8cXBuKIlqCzCkL8sm1n9Ov0=
+github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.3.1/go.mod h1:SUZc9YRRHfx2+FAQKNDGrssXehqLpxmwRv2mC/5ntj4=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
 github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2 h1:XHOnouVk1mxXfQidrMEnLlPk9UMeRtyBTnEFtxkV0kU=
 github.com/AzureAD/microsoft-authentication-library-for-go v1.2.2/go.mod h1:wP83P5OoQ5p6ip3ScPr0BAq0BvuPAvacpEuSzyouqAI=
-github.com/DataDog/datadog-go/v5 v5.5.0 h1:G5KHeB8pWBNXT4Jtw0zAkhdxEAWSpWH00geHI6LDrKU=
-github.com/DataDog/datadog-go/v5 v5.5.0/go.mod h1:K9kcYBlxkcPP8tvvjZZKs/m1edNAUFzBbdpTUKfCsuw=
-github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
-github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
-github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa h1:LHTHcTQiSGT7VVbI0o4wBRNQIgn917usHWOd6VAffYI=
-github.com/alexbrainman/sspi v0.0.0-20231016080023-1a75b4708caa/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
+github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/andybalholm/brotli v1.1.0 h1:eLKJA0d02Lf0mVpIDgYnqXcUn0GqVmEFny3VuID1U3M=
 github.com/andybalholm/brotli v1.1.0/go.mod h1:sms7XGricyQI9K10gOSf56VKKWS4oLer58Q+mhRPtnY=
-github.com/aws/aws-sdk-go-v2 v1.27.0 h1:7bZWKoXhzI+mMR/HjdMx8ZCC5+6fY0lS5tr0bbgiLlo=
-github.com/aws/aws-sdk-go-v2 v1.27.0/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
+github.com/aws/aws-sdk-go-v2 v1.26.1 h1:5554eUqIYVWpU0YmeeYZ0wU64H2VLBs8TlhRB2L+EkA=
+github.com/aws/aws-sdk-go-v2 v1.26.1/go.mod h1:ffIFB97e2yNsv4aTSGkqtHnppsIJzw7G7BReUZ3jCXM=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2 h1:x6xsQXGSmW6frevwDA+vi/wqhp1ct18mVXYN08/93to=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.2/go.mod h1:lPprDr1e6cJdyYeGXnRaJoP4Md+cDBvi2eOj00BlGmg=
-github.com/aws/aws-sdk-go-v2/config v1.27.16 h1:knpCuH7laFVGYTNd99Ns5t+8PuRjDn4HnnZK48csipM=
-github.com/aws/aws-sdk-go-v2/config v1.27.16/go.mod h1:vutqgRhDUktwSge3hrC3nkuirzkJ4E/mLj5GvI0BQas=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.16 h1:7d2QxY83uYl0l58ceyiSpxg9bSbStqBC6BeEeHEchwo=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.16/go.mod h1:Ae6li/6Yc6eMzysRL2BXlPYvnrLLBg3D11/AmOjw50k=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.3 h1:dQLK4TjtnlRGb0czOht2CevZ5l6RSyRWAnKeGd7VAFE=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.3/go.mod h1:TL79f2P6+8Q7dTsILpiVST+AL9lkF6PPGI167Ny0Cjw=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.21 h1:1v8Ii0MRVGYB/sdhkbxrtolCA7Tp+lGh+5OJTs5vmZ8=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.21/go.mod h1:cxdd1rc8yxCjKz28hi30XN1jDXr2DxZvD44vLxTz/bg=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.7 h1:lf/8VTF2cM+N4SLzaYJERKEWAXq8MOMpZfU6wEPWsPk=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.7/go.mod h1:4SjkU7QiqK2M9oozyMzfZ/23LmUY+h3oFqhdeP5OMiI=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.7 h1:4OYVp0705xu8yjdyoWix0r9wPIRXnIzzOoUpQVHIJ/g=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.7/go.mod h1:vd7ESTEvI76T2Na050gODNmNU7+OyKrIKroYTu4ABiI=
+github.com/aws/aws-sdk-go-v2/config v1.27.11 h1:f47rANd2LQEYHda2ddSCKYId18/8BhSRM4BULGmfgNA=
+github.com/aws/aws-sdk-go-v2/config v1.27.11/go.mod h1:SMsV78RIOYdve1vf36z8LmnszlRWkwMQtomCAI0/mIE=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.11 h1:YuIB1dJNf1Re822rriUOTxopaHHvIq0l/pX3fwO+Tzs=
+github.com/aws/aws-sdk-go-v2/credentials v1.17.11/go.mod h1:AQtFPsDH9bI2O+71anW6EKL+NcD7LG3dpKGMV4SShgo=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1 h1:FVJ0r5XTHSmIHJV6KuDmdYhEpvlHpiSd38RQWhut5J4=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.1/go.mod h1:zusuAeqezXzAB24LGuzuekqMAEgWkVYukBec3kr3jUg=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15 h1:7Zwtt/lP3KNRkeZre7soMELMGNoBrutx8nobg1jKWmo=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.16.15/go.mod h1:436h2adoHb57yd+8W+gYPrrA9U/R/SuAuOO42Ushzhw=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5 h1:aw39xVGeRWlWx9EzGVnhOR4yOjQDHPQ6o6NmBlscyQg=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.5/go.mod h1:FSaRudD0dXiMPK2UjknVwwTYyZMRsHv3TtkabsZih5I=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5 h1:PG1F3OD1szkuQPzDw3CIQsRIrtTlUC3lP84taWzHlq0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.5/go.mod h1:jU1li6RFryMz+so64PpKtudI+QzbKoIEivqdf6LNpOc=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 h1:hT8rVHwugYE2lEfdFE0QWVo81lF7jMrYJVDWI+f+VxU=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0/go.mod h1:8tu/lYfQfFe6IGnaOdrpVgEL2IrrDOf6/m9RQum4NkY=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.7 h1:/FUtT3xsoHO3cfh+I/kCbcMCN98QZRsiFet/V8QkWSs=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.7/go.mod h1:MaCAgWpGooQoCWZnMur97rGn5dp350w2+CeiV5406wE=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5 h1:81KE7vaZzrl7yHBYHVEzYB8sypz11NMOZ40YlWvPxsU=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.5/go.mod h1:LIt2rg7Mcgn09Ygbdh/RdIm0rQ+3BNkbP1gyVMFtRK0=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2 h1:Ji0DY1xUsUr3I8cHps0G+XM3WWU16lP6yG8qu1GAZAs=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.2/go.mod h1:5CsjAbs3NlGQyZNFACh+zztPDI7fU6eW9QsxjfnuBKg=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.9 h1:UXqEWQI0n+q0QixzU0yUUQBZXRd5037qdInTIHFTl98=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.9/go.mod h1:xP6Gq6fzGZT8w/ZN+XvGMZ2RU1LeEs7b2yUP5DN8NY4=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.9 h1:Wx0rlZoEJR7JwlSZcHnEa7CNjrSIyVxMFWGAaXy4fJY=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.9/go.mod h1:aVMHdE0aHO3v+f/iw01fmXV/5DbfQ3Bi9nN7nd9bE9Y=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.7 h1:uO5XR6QGBcmPyo2gxofYJLFkcVQ4izOoGDNenlZhTEk=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.7/go.mod h1:feeeAYfAcwTReM6vbwjEyDmiGho+YgBhaFULuXDW8kc=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.54.3 h1:57NtjG+WLims0TxIQbjTqebZUKDM03DfM11ANAekW0s=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.54.3/go.mod h1:739CllldowZiPPsDFcJHNF4FXrVxaSGVnZ9Ez9Iz9hc=
-github.com/aws/aws-sdk-go-v2/service/sso v1.20.9 h1:aD7AGQhvPuAxlSUfo0CWU7s6FpkbyykMhGYMvlqTjVs=
-github.com/aws/aws-sdk-go-v2/service/sso v1.20.9/go.mod h1:c1qtZUWtygI6ZdvKppzCSXsDOq5I4luJPZ0Ud3juFCA=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.3 h1:Pav5q3cA260Zqez42T9UhIlsd9QeypszRPwC9LdSSsQ=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.24.3/go.mod h1:9lmoVDVLz/yUZwLaQ676TK02fhCu4+PgRSmMaKR1ozk=
-github.com/aws/aws-sdk-go-v2/service/sts v1.28.10 h1:69tpbPED7jKPyzMcrwSvhWcJ9bPnZsZs18NT40JwM0g=
-github.com/aws/aws-sdk-go-v2/service/sts v1.28.10/go.mod h1:0Aqn1MnEuitqfsCNyKsdKLhDUOr4txD/g19EfiUqgws=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7 h1:ZMeFZ5yk+Ek+jNr1+uwCd2tG89t6oTS5yVWpa6yy2es=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.3.7/go.mod h1:mxV05U+4JiHqIpGqqYXOHLPKUC6bDXC44bsUhNjOEwY=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7 h1:ogRAwT1/gxJBcSWDMZlgyFUM962F51A5CRhDLbxLdmo=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.7/go.mod h1:YCsIZhXfRPLFFCl5xxY+1T9RKzOKjCut+28JSX2DnAk=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5 h1:f9RyWNtS8oH7cZlbn+/JNPpjUk5+5fLd5lM9M0i49Ys=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.17.5/go.mod h1:h5CoMZV2VF297/VLhRhO1WF+XYWOzXo+4HsObA4HjBQ=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1 h1:6cnno47Me9bRykw9AEv9zkXE+5or7jz8TsskTTccbgc=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.53.1/go.mod h1:qmdkIIAC+GCLASF7R2whgNrJADz0QZPX+Seiw/i4S3o=
+github.com/aws/aws-sdk-go-v2/service/sso v1.20.5 h1:vN8hEbpRnL7+Hopy9dzmRle1xmDc7o8tmY0klsr175w=
+github.com/aws/aws-sdk-go-v2/service/sso v1.20.5/go.mod h1:qGzynb/msuZIE8I75DVRCUXw3o3ZyBmUvMwQ2t/BrGM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4 h1:Jux+gDDyi1Lruk+KHF91tK2KCuY61kzoCpvtvJJBtOE=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.4/go.mod h1:mUYPBhaF2lGiukDEjJX2BLRRKTmoUSitGDUgM4tRxak=
+github.com/aws/aws-sdk-go-v2/service/sts v1.28.6 h1:cwIxeBttqPN3qkaAjcEcsh8NYr8n2HZPkcKgPAi1phU=
+github.com/aws/aws-sdk-go-v2/service/sts v1.28.6/go.mod h1:FZf1/nKNEkHdGGJP/cI2MoIMquumuRK6ol3QQJNDxmw=
 github.com/aws/smithy-go v1.20.2 h1:tbp628ireGtzcHDDmLT/6ADHidqnwgF57XOXZe6tp4Q=
 github.com/aws/smithy-go v1.20.2/go.mod h1:krry+ya/rV9RDcV/Q16kpu6ypI4K2czasz0NC3qS14E=
 github.com/cpuguy83/go-md2man/v2 v2.0.4 h1:wfIWP927BUkWJb2NmU/kNDYIBTh/ziUX91+lVfRxZq4=
@@ -64,44 +59,28 @@ github.com/cpuguy83/go-md2man/v2 v2.0.4/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46t
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
+github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
 github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-asn1-ber/asn1-ber v1.5.7 h1:DTX+lbVTWaTw1hQ+PbZPlnDZPEIs0SS/GCZAl535dDk=
-github.com/go-asn1-ber/asn1-ber v1.5.7/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
-github.com/go-ldap/ldap/v3 v3.4.8 h1:loKJyspcRezt2Q3ZRMq2p/0v8iOurlmeXDPw6fikSvQ=
-github.com/go-ldap/ldap/v3 v3.4.8/go.mod h1:qS3Sjlu76eHfHGpUdWkAXQTw4beih+cHsco2jXlIXrk=
+github.com/go-ldap/ldap/v3 v3.4.6 h1:ert95MdbiG7aWo/oPYp9btL3KJlMPKnP58r09rI8T+A=
+github.com/go-ldap/ldap/v3 v3.4.6/go.mod h1:IGMQANNtxpsOzj7uUAMjpGBaOVTC4DYyIy8VsTdxmtc=
 github.com/gofiber/fiber/v2 v2.52.4 h1:P+T+4iK7VaqUsq2PALYEfBBo6bJZ4q3FP8cZ84EggTM=
 github.com/gofiber/fiber/v2 v2.52.4/go.mod h1:KEOE+cXMhXG0zHc9d8+E38hoX+ZN7bhOtgeF2oT6jrQ=
 github.com/golang-jwt/jwt/v5 v5.2.1 h1:OuVbFODueb089Lh128TAcimifWaLhJwVflnrgM17wHk=
 github.com/golang-jwt/jwt/v5 v5.2.1/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVIyoH402zdk=
-github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/gorilla/securecookie v1.1.1/go.mod h1:ra0sb63/xPlUeL+yeDciTfxMRAA+MP+HVt/4epWDjd4=
-github.com/gorilla/sessions v1.2.1/go.mod h1:dk2InVEVJ0sfLlnXv9EAgkf6ecYs/i80K/zI+bUmuGM=
-github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
-github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
-github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
-github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
-github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
-github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
-github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
-github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
-github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
-github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
-github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
-github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
-github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
 github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
-github.com/klauspost/compress v1.17.8 h1:YcnTYrq7MikUT7k0Yb5eceMmALQPYBW/Xltxn0NAMnU=
-github.com/klauspost/compress v1.17.8/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
+github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
@@ -111,8 +90,8 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
 github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
-github.com/nats-io/nats.go v1.35.0 h1:XFNqNM7v5B+MQMKqVGAyHwYhyKb48jrenXNxIU20ULk=
-github.com/nats-io/nats.go v1.35.0/go.mod h1:Ubdu4Nh9exXdSz0RVWRFBbRfrbSxOYd26oF0wkWclB8=
+github.com/nats-io/nats.go v1.34.1 h1:syWey5xaNHZgicYBemv0nohUPPmaLteiBEUT6Q5+F/4=
+github.com/nats-io/nats.go v1.34.1/go.mod h1:Ubdu4Nh9exXdSz0RVWRFBbRfrbSxOYd26oF0wkWclB8=
 github.com/nats-io/nkeys v0.4.7 h1:RwNJbbIdYCoClSDNY7QVKZlyb/wfT6ugvFCiKy6vDvI=
 github.com/nats-io/nkeys v0.4.7/go.mod h1:kqXRgRDPlGy7nGaEDMuYzmiJCIAAWDK0IMBtDmGD0nc=
 github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
@@ -122,7 +101,6 @@ github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ
 github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c h1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=
 github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c/go.mod h1:7rwL4CYBLnjLxUqIJNnCWiEdr3bn6IUYi15bNlnbCCU=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/xattr v0.4.9 h1:5883YPCtkSd8LFbs13nXplj9g9tlrwoJRjgpgMu1/fE=
 github.com/pkg/xattr v0.4.9/go.mod h1:di8WF84zAKk8jzR1UBTEWh9AUlIZZ7M/JNt8e9B6ktU=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -134,25 +112,18 @@ github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/segmentio/kafka-go v0.4.47 h1:IqziR4pA3vrZq7YdRxaT3w1/5fvIH5qpCwstUanQQB0=
 github.com/segmentio/kafka-go v0.4.47/go.mod h1:HjF6XbOKh0Pjlkr5GVZxt6CsjjwnmhVOfURM5KMd8qg=
-github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
-github.com/smira/go-statsd v1.3.3 h1:WnMlmGTyMpzto+HvOJWRPoLaLlk5EGfzsnlQBcvj4yI=
-github.com/smira/go-statsd v1.3.3/go.mod h1:RjdsESPgDODtg1VpVVf9MJrEW2Hw0wtRNbmB1CAhu6A=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/urfave/cli/v2 v2.27.2 h1:6e0H+AkS+zDckwPCUrZkKX38mRaau4nL2uipkJpbkcI=
-github.com/urfave/cli/v2 v2.27.2/go.mod h1:g0+79LmHHATl7DAcHO99smiR/T7uGLw84w8Y42x+4eM=
+github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/urfave/cli/v2 v2.27.1 h1:8xSQ6szndafKVRmfyeUMxkNUJQMjL1F2zmsZ+qHpfho=
+github.com/urfave/cli/v2 v2.27.1/go.mod h1:8qnjx1vcq5s2/wpsqoZFndg2CE5tNFyrTvS6SinrnYQ=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.54.0 h1:cCL+ZZR3z3HPLMVfEYVUMtJqVaui0+gu7Lx63unHwS0=
-github.com/valyala/fasthttp v1.54.0/go.mod h1:6dt4/8olwq9QARP/TDuPmWyWcl4byhpvTJ4AAtcz+QM=
+github.com/valyala/fasthttp v1.52.0 h1:wqBQpxH71XW0e2g+Og4dzQM8pk34aFYlA1Ga8db7gU0=
+github.com/valyala/fasthttp v1.52.0/go.mod h1:hf5C4QnVMkNXMspnsUlfM3WitlgYflyhHYoKol/szxQ=
 github.com/valyala/tcplisten v1.0.0 h1:rBHj/Xf+E1tRGZyWIWwJDiRY0zc1Js+CV5DqwacVSA8=
 github.com/valyala/tcplisten v1.0.0/go.mod h1:T0xQ8SeCZGxckz9qRXTfG43PvQ/mcWh7FwZEA7Ioqkc=
 github.com/versity/scoutfs-go v0.0.0-20240325223134-38eb2f5f7d44 h1:Wx1o3pNrCzsHIIDyZ2MLRr6tF/1FhAr7HNDn80QqDWE=
@@ -165,45 +136,28 @@ github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6
 github.com/xdg-go/stringprep v1.0.4/go.mod h1:mPGuuIYwz7CmR2bT9j4GbQqutWS1zV24gijq1dTyGkM=
 github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 h1:+qGGcbkzsfDQNPPe9UDgpxAWQrhbbBXOYJFQDq/dtJw=
 github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913/go.mod h1:4aEEwZQutDLsQv2Deui4iYQ6DWTxR14g6m8Wv88+Xqk=
-github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
+golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
-golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
-golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
-golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
-golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
+golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
-golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
-golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
-golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
-golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
+golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -213,18 +167,16 @@ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
+golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
+golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U=
-golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.18.0/go.mod h1:ILwASektA3OnRv7amZ1xhE/KTR+u50pbXfZ03+6Nx58=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
@@ -232,19 +184,14 @@ golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
-golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=

metrics/actions.go

@@ -1,258 +0,0 @@
-// Copyright 2024 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package metrics
-
-type Action struct {
-	Name    string
-	Service string
-}
-
-var (
-	ActionMap map[string]Action
-)
-
-var (
-	ActionUndetected                 = "ActionUnDetected"
-	ActionAbortMultipartUpload       = "s3_AbortMultipartUpload"
-	ActionCompleteMultipartUpload    = "s3_CompleteMultipartUpload"
-	ActionCopyObject                 = "s3_CopyObject"
-	ActionCreateBucket               = "s3_CreateBucket"
-	ActionCreateMultipartUpload      = "s3_CreateMultipartUpload"
-	ActionDeleteBucket               = "s3_DeleteBucket"
-	ActionDeleteBucketPolicy         = "s3_DeleteBucketPolicy"
-	ActionDeleteBucketTagging        = "s3_DeleteBucketTagging"
-	ActionDeleteObject               = "s3_DeleteObject"
-	ActionDeleteObjectTagging        = "s3_DeleteObjectTagging"
-	ActionDeleteObjects              = "s3_DeleteObjects"
-	ActionGetBucketAcl               = "s3_GetBucketAcl"
-	ActionGetBucketPolicy            = "s3_GetBucketPolicy"
-	ActionGetBucketTagging           = "s3_GetBucketTagging"
-	ActionGetBucketVersioning        = "s3_GetBucketVersioning"
-	ActionGetObject                  = "s3_GetObject"
-	ActionGetObjectAcl               = "s3_GetObjectAcl"
-	ActionGetObjectAttributes        = "s3_GetObjectAttributes"
-	ActionGetObjectLegalHold         = "s3_GetObjectLegalHold"
-	ActionGetObjectLockConfiguration = "s3_GetObjectLockConfiguration"
-	ActionGetObjectRetention         = "s3_GetObjectRetention"
-	ActionGetObjectTagging           = "s3_GetObjectTagging"
-	ActionHeadBucket                 = "s3_HeadBucket"
-	ActionHeadObject                 = "s3_HeadObject"
-	ActionListAllMyBuckets           = "s3_ListAllMyBuckets"
-	ActionListMultipartUploads       = "s3_ListMultipartUploads"
-	ActionListObjectVersions         = "s3_ListObjectVersions"
-	ActionListObjects                = "s3_ListObjects"
-	ActionListObjectsV2              = "s3_ListObjectsV2"
-	ActionListParts                  = "s3_ListParts"
-	ActionPutBucketAcl               = "s3_PutBucketAcl"
-	ActionPutBucketPolicy            = "s3_PutBucketPolicy"
-	ActionPutBucketTagging           = "s3_PutBucketTagging"
-	ActionPutBucketVersioning        = "s3_PutBucketVersioning"
-	ActionPutObject                  = "s3_PutObject"
-	ActionPutObjectAcl               = "s3_PutObjectAcl"
-	ActionPutObjectLegalHold         = "s3_PutObjectLegalHold"
-	ActionPutObjectLockConfiguration = "s3_PutObjectLockConfiguration"
-	ActionPutObjectRetention         = "s3_PutObjectRetention"
-	ActionPutObjectTagging           = "s3_PutObjectTagging"
-	ActionRestoreObject              = "s3_RestoreObject"
-	ActionSelectObjectContent        = "s3_SelectObjectContent"
-	ActionUploadPart                 = "s3_UploadPart"
-	ActionUploadPartCopy             = "s3_UploadPartCopy"
-)
-
-func init() {
-	ActionMap = make(map[string]Action)
-
-	ActionMap[ActionUndetected] = Action{
-		Name:    "ActionUnDetected",
-		Service: "unknown",
-	}
-
-	ActionMap[ActionAbortMultipartUpload] = Action{
-		Name:    "AbortMultipartUpload",
-		Service: "s3",
-	}
-	ActionMap[ActionCompleteMultipartUpload] = Action{
-		Name:    "CompleteMultipartUpload",
-		Service: "s3",
-	}
-	ActionMap[ActionCopyObject] = Action{
-		Name:    "CopyObject",
-		Service: "s3",
-	}
-	ActionMap[ActionCreateBucket] = Action{
-		Name:    "CreateBucket",
-		Service: "s3",
-	}
-	ActionMap[ActionCreateMultipartUpload] = Action{
-		Name:    "CreateMultipartUpload",
-		Service: "s3",
-	}
-	ActionMap[ActionDeleteBucket] = Action{
-		Name:    "DeleteBucket",
-		Service: "s3",
-	}
-	ActionMap[ActionDeleteBucketPolicy] = Action{
-		Name:    "DeleteBucketPolicy",
-		Service: "s3",
-	}
-	ActionMap[ActionDeleteBucketTagging] = Action{
-		Name:    "DeleteBucketTagging",
-		Service: "s3",
-	}
-	ActionMap[ActionDeleteObject] = Action{
-		Name:    "DeleteObject",
-		Service: "s3",
-	}
-	ActionMap[ActionDeleteObjectTagging] = Action{
-		Name:    "DeleteObjectTagging",
-		Service: "s3",
-	}
-	ActionMap[ActionDeleteObjects] = Action{
-		Name:    "DeleteObjects",
-		Service: "s3",
-	}
-	ActionMap[ActionGetBucketAcl] = Action{
-		Name:    "GetBucketAcl",
-		Service: "s3",
-	}
-	ActionMap[ActionGetBucketPolicy] = Action{
-		Name:    "GetBucketPolicy",
-		Service: "s3",
-	}
-	ActionMap[ActionGetBucketTagging] = Action{
-		Name:    "GetBucketTagging",
-		Service: "s3",
-	}
-	ActionMap[ActionGetBucketVersioning] = Action{
-		Name:    "GetBucketVersioning",
-		Service: "s3",
-	}
-	ActionMap[ActionGetObject] = Action{
-		Name:    "GetObject",
-		Service: "s3",
-	}
-	ActionMap[ActionGetObjectAcl] = Action{
-		Name:    "GetObjectAcl",
-		Service: "s3",
-	}
-	ActionMap[ActionGetObjectAttributes] = Action{
-		Name:    "GetObjectAttributes",
-		Service: "s3",
-	}
-	ActionMap[ActionGetObjectLegalHold] = Action{
-		Name:    "GetObjectLegalHold",
-		Service: "s3",
-	}
-	ActionMap[ActionGetObjectLockConfiguration] = Action{
-		Name:    "GetObjectLockConfiguration",
-		Service: "s3",
-	}
-	ActionMap[ActionGetObjectRetention] = Action{
-		Name:    "GetObjectRetention",
-		Service: "s3",
-	}
-	ActionMap[ActionGetObjectTagging] = Action{
-		Name:    "GetObjectTagging",
-		Service: "s3",
-	}
-	ActionMap[ActionHeadBucket] = Action{
-		Name:    "HeadBucket",
-		Service: "s3",
-	}
-	ActionMap[ActionHeadObject] = Action{
-		Name:    "HeadObject",
-		Service: "s3",
-	}
-	ActionMap[ActionListAllMyBuckets] = Action{
-		Name:    "ListAllMyBuckets",
-		Service: "s3",
-	}
-	ActionMap[ActionListMultipartUploads] = Action{
-		Name:    "ListMultipartUploads",
-		Service: "s3",
-	}
-	ActionMap[ActionListObjectVersions] = Action{
-		Name:    "ListObjectVersions",
-		Service: "s3",
-	}
-	ActionMap[ActionListObjects] = Action{
-		Name:    "ListObjects",
-		Service: "s3",
-	}
-	ActionMap[ActionListObjectsV2] = Action{
-		Name:    "ListObjectsV2",
-		Service: "s3",
-	}
-	ActionMap[ActionListParts] = Action{
-		Name:    "ListParts",
-		Service: "s3",
-	}
-	ActionMap[ActionPutBucketAcl] = Action{
-		Name:    "PutBucketAcl",
-		Service: "s3",
-	}
-	ActionMap[ActionPutBucketPolicy] = Action{
-		Name:    "PutBucketPolicy",
-		Service: "s3",
-	}
-	ActionMap[ActionPutBucketTagging] = Action{
-		Name:    "PutBucketTagging",
-		Service: "s3",
-	}
-	ActionMap[ActionPutBucketVersioning] = Action{
-		Name:    "PutBucketVersioning",
-		Service: "s3",
-	}
-	ActionMap[ActionPutObject] = Action{
-		Name:    "PutObject",
-		Service: "s3",
-	}
-	ActionMap[ActionPutObjectAcl] = Action{
-		Name:    "PutObjectAcl",
-		Service: "s3",
-	}
-	ActionMap[ActionPutObjectLegalHold] = Action{
-		Name:    "PutObjectLegalHold",
-		Service: "s3",
-	}
-	ActionMap[ActionPutObjectLockConfiguration] = Action{
-		Name:    "PutObjectLockConfiguration",
-		Service: "s3",
-	}
-	ActionMap[ActionPutObjectRetention] = Action{
-		Name:    "PutObjectRetention",
-		Service: "s3",
-	}
-	ActionMap[ActionPutObjectTagging] = Action{
-		Name:    "PutObjectTagging",
-		Service: "s3",
-	}
-	ActionMap[ActionRestoreObject] = Action{
-		Name:    "RestoreObject",
-		Service: "s3",
-	}
-	ActionMap[ActionSelectObjectContent] = Action{
-		Name:    "SelectObjectContent",
-		Service: "s3",
-	}
-	ActionMap[ActionUploadPart] = Action{
-		Name:    "UploadPart",
-		Service: "s3",
-	}
-	ActionMap[ActionUploadPartCopy] = Action{
-		Name:    "UploadPartCopy",
-		Service: "s3",
-	}
-}

metrics/dogstats.go

@@ -1,65 +0,0 @@
-// Copyright 2024 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package metrics
-
-import (
-	"fmt"
-
-	dogstats "github.com/DataDog/datadog-go/v5/statsd"
-)
-
-// vgwDogStatsd metrics type
-type vgwDogStatsd struct {
-	c *dogstats.Client
-}
-
-var (
-	rateSampleAlways = 1.0
-)
-
-// newDogStatsd takes a server address and returns a statsd merics
-func newDogStatsd(server string, service string) (*vgwDogStatsd, error) {
-	c, err := dogstats.New(server,
-		dogstats.WithMaxMessagesPerPayload(1000),
-		dogstats.WithNamespace("versitygw"),
-		dogstats.WithTags([]string{
-			"service:" + service,
-		}))
-	if err != nil {
-		return nil, err
-	}
-	return &vgwDogStatsd{c: c}, nil
-}
-
-// Close closes statsd connections
-func (s *vgwDogStatsd) Close() {
-	s.c.Close()
-}
-
-func (t Tag) ddString() string {
-	if t.Value == "" {
-		return t.Key
-	}
-	return fmt.Sprintf("%v:%v", t.Key, t.Value)
-}
-
-// Add adds value to key
-func (s *vgwDogStatsd) Add(key string, value int64, tags ...Tag) {
-	stags := make([]string, len(tags))
-	for i, t := range tags {
-		stags[i] = t.ddString()
-	}
-	s.c.Count(key, value, stags, rateSampleAlways)
-}

metrics/metrics.go

@@ -1,225 +0,0 @@
-// Copyright 2024 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package metrics
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"net/http"
-	"os"
-	"strings"
-	"sync"
-
-	"github.com/gofiber/fiber/v2"
-	"github.com/versity/versitygw/s3err"
-)
-
-var (
-	// max size of data items to buffer before dropping
-	// new incoming data items
-	dataItemCount = 100000
-)
-
-// Tag is added metadata for metrics
-type Tag struct {
-	// Key is tag name
-	Key string
-	// Value is tag data
-	Value string
-}
-
-// Manager is a manager of metrics plugins
-type Manager struct {
-	wg  sync.WaitGroup
-	ctx context.Context
-
-	config Config
-
-	publishers  []publisher
-	addDataChan chan datapoint
-}
-
-type Config struct {
-	ServiceName      string
-	StatsdServers    string
-	DogStatsdServers string
-}
-
-// NewManager initializes metrics plugins and returns a new metrics manager
-func NewManager(ctx context.Context, conf Config) (*Manager, error) {
-	if len(conf.StatsdServers) == 0 && len(conf.DogStatsdServers) == 0 {
-		return nil, nil
-	}
-
-	if conf.ServiceName == "" {
-		hostname, err := os.Hostname()
-		if err != nil {
-			return nil, fmt.Errorf("failed to get hostname: %w", err)
-		}
-		conf.ServiceName = hostname
-	}
-
-	addDataChan := make(chan datapoint, dataItemCount)
-
-	mgr := &Manager{
-		addDataChan: addDataChan,
-		ctx:         ctx,
-		config:      conf,
-	}
-
-	// setup statsd endpoints
-	if len(conf.StatsdServers) > 0 {
-		statsdServers := strings.Split(conf.StatsdServers, ",")
-
-		for _, server := range statsdServers {
-			statsd, err := newStatsd(server, conf.ServiceName)
-			if err != nil {
-				return nil, err
-			}
-			mgr.publishers = append(mgr.publishers, statsd)
-		}
-	}
-
-	// setup dogstatsd endpoints
-	if len(conf.DogStatsdServers) > 0 {
-		dogStatsdServers := strings.Split(conf.DogStatsdServers, ",")
-
-		for _, server := range dogStatsdServers {
-			dogStatsd, err := newDogStatsd(server, conf.ServiceName)
-			if err != nil {
-				return nil, err
-			}
-			mgr.publishers = append(mgr.publishers, dogStatsd)
-		}
-	}
-
-	mgr.wg.Add(1)
-	go mgr.addForwarder(addDataChan)
-
-	return mgr, nil
-}
-
-func (m *Manager) Send(ctx *fiber.Ctx, err error, action string, count int64, status int) {
-	// In case of Authentication failures, url parsing ...
-	if action == "" {
-		action = ActionUndetected
-	}
-
-	a := ActionMap[action]
-	reqTags := []Tag{
-		{Key: "method", Value: ctx.Method()},
-		{Key: "api", Value: a.Service},
-		{Key: "action", Value: a.Name},
-	}
-
-	reqStatus := status
-
-	if err != nil {
-		var apierr s3err.APIError
-		if errors.As(err, &apierr) {
-			reqStatus = apierr.HTTPStatusCode
-		} else {
-			reqStatus = http.StatusInternalServerError
-		}
-	}
-	if reqStatus == 0 {
-		reqStatus = http.StatusOK
-	}
-
-	reqTags = append(reqTags, Tag{
-		Key:   "status",
-		Value: fmt.Sprintf("%v", reqStatus),
-	})
-
-	if err != nil {
-		m.increment("failed_count", reqTags...)
-	} else {
-		m.increment("success_count", reqTags...)
-	}
-
-	switch action {
-	case ActionPutObject:
-		m.add("bytes_written", count, reqTags...)
-		m.increment("object_created_count", reqTags...)
-	case ActionCompleteMultipartUpload:
-		m.increment("object_created_count", reqTags...)
-	case ActionUploadPart:
-		m.add("bytes_written", count, reqTags...)
-	case ActionGetObject:
-		m.add("bytes_read", count, reqTags...)
-	case ActionDeleteObject:
-		m.increment("object_removed_count", reqTags...)
-	case ActionDeleteObjects:
-		m.add("object_removed_count", count, reqTags...)
-	}
-}
-
-// increment increments the key by one
-func (m *Manager) increment(key string, tags ...Tag) {
-	m.add(key, 1, tags...)
-}
-
-// add adds value to key
-func (m *Manager) add(key string, value int64, tags ...Tag) {
-	if m.ctx.Err() != nil {
-		return
-	}
-
-	d := datapoint{
-		key:   key,
-		value: value,
-		tags:  tags,
-	}
-
-	select {
-	case m.addDataChan <- d:
-	default:
-		// channel full, drop the updates
-	}
-}
-
-// Close closes metrics channels, waits for data to complete, closes all plugins
-func (m *Manager) Close() {
-	// drain the datapoint channels
-	close(m.addDataChan)
-	m.wg.Wait()
-
-	// close all publishers
-	for _, p := range m.publishers {
-		p.Close()
-	}
-}
-
-// publisher is the interface for interacting with the metrics plugins
-type publisher interface {
-	Add(key string, value int64, tags ...Tag)
-	Close()
-}
-
-func (m *Manager) addForwarder(addChan <-chan datapoint) {
-	for data := range addChan {
-		for _, s := range m.publishers {
-			s.Add(data.key, data.value, data.tags...)
-		}
-	}
-	m.wg.Done()
-}
-
-type datapoint struct {
-	key   string
-	value int64
-	tags  []Tag
-}

metrics/statsd.go

@@ -1,51 +0,0 @@
-// Copyright 2024 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-package metrics
-
-import (
-	"github.com/smira/go-statsd"
-)
-
-// vgwStatsd metrics type
-type vgwStatsd struct {
-	c *statsd.Client
-}
-
-// newStatsd takes a server address and returns a statsd merics
-// Supply service name to be used as a tag to identify the spcific
-// gateway instance, this may typically be the gateway hostname
-func newStatsd(server string, service string) (*vgwStatsd, error) {
-	c := statsd.NewClient(
-		server,
-		statsd.MetricPrefix("versitygw."),
-		statsd.TagStyle(statsd.TagFormatInfluxDB),
-		statsd.DefaultTags(statsd.StringTag("service", service)),
-	)
-	return &vgwStatsd{c: c}, nil
-}
-
-// Close closes statsd connections
-func (s *vgwStatsd) Close() {
-	s.c.Close()
-}
-
-// Add adds value to key
-func (s *vgwStatsd) Add(key string, value int64, tags ...Tag) {
-	stags := make([]statsd.Tag, len(tags))
-	for i, t := range tags {
-		stags[i] = statsd.StringTag(t.Key, t.Value)
-	}
-	s.c.Incr(key, value, stags...)
-}

s3api/admin-server.go

@@ -46,11 +46,12 @@ func NewAdminServer(app *fiber.App, be backend.Backend, root middlewares.RootUse
 
 	// Logging middlewares
 	app.Use(logger.New())
-	app.Use(middlewares.DecodeURL(nil, nil))
+	app.Use(middlewares.DecodeURL(nil))
 
 	// Authentication middlewares
-	app.Use(middlewares.VerifyV4Signature(root, iam, nil, nil, region, false))
+	app.Use(middlewares.VerifyV4Signature(root, iam, nil, region, false))
 	app.Use(middlewares.VerifyMD5Body(nil))
+	app.Use(middlewares.AclParser(be, nil))
 
 	server.router.Init(app, be, iam)
 

s3api/controllers/admin.go

@@ -49,7 +49,7 @@ func (c AdminController) CreateUser(ctx *fiber.Ctx) error {
 
 	err = c.iam.CreateAccount(usr)
 	if err != nil {
-		return fmt.Errorf("failed to create user: %w", err)
+		return fmt.Errorf("failed to create a user: %w", err)
 	}
 
 	return ctx.SendString("The user has been created successfully")

s3api/controllers/backend_moq_test.go

@@ -77,18 +77,9 @@ var _ backend.Backend = &BackendMock{}
 //			GetObjectAclFunc: func(contextMoqParam context.Context, getObjectAclInput *s3.GetObjectAclInput) (*s3.GetObjectAclOutput, error) {
 //				panic("mock out the GetObjectAcl method")
 //			},
-//			GetObjectAttributesFunc: func(contextMoqParam context.Context, getObjectAttributesInput *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error) {
+//			GetObjectAttributesFunc: func(contextMoqParam context.Context, getObjectAttributesInput *s3.GetObjectAttributesInput) (*s3.GetObjectAttributesOutput, error) {
 //				panic("mock out the GetObjectAttributes method")
 //			},
-//			GetObjectLegalHoldFunc: func(contextMoqParam context.Context, bucket string, object string, versionId string) (*bool, error) {
-//				panic("mock out the GetObjectLegalHold method")
-//			},
-//			GetObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
-//				panic("mock out the GetObjectLockConfiguration method")
-//			},
-//			GetObjectRetentionFunc: func(contextMoqParam context.Context, bucket string, object string, versionId string) ([]byte, error) {
-//				panic("mock out the GetObjectRetention method")
-//			},
 //			GetObjectTaggingFunc: func(contextMoqParam context.Context, bucket string, object string) (map[string]string, error) {
 //				panic("mock out the GetObjectTagging method")
 //			},
@@ -137,15 +128,6 @@ var _ backend.Backend = &BackendMock{}
 //			PutObjectAclFunc: func(contextMoqParam context.Context, putObjectAclInput *s3.PutObjectAclInput) error {
 //				panic("mock out the PutObjectAcl method")
 //			},
-//			PutObjectLegalHoldFunc: func(contextMoqParam context.Context, bucket string, object string, versionId string, status bool) error {
-//				panic("mock out the PutObjectLegalHold method")
-//			},
-//			PutObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string, config []byte) error {
-//				panic("mock out the PutObjectLockConfiguration method")
-//			},
-//			PutObjectRetentionFunc: func(contextMoqParam context.Context, bucket string, object string, versionId string, bypass bool, retention []byte) error {
-//				panic("mock out the PutObjectRetention method")
-//			},
 //			PutObjectTaggingFunc: func(contextMoqParam context.Context, bucket string, object string, tags map[string]string) error {
 //				panic("mock out the PutObjectTagging method")
 //			},
@@ -229,16 +211,7 @@ type BackendMock struct {
 	GetObjectAclFunc func(contextMoqParam context.Context, getObjectAclInput *s3.GetObjectAclInput) (*s3.GetObjectAclOutput, error)
 
 	// GetObjectAttributesFunc mocks the GetObjectAttributes method.
-	GetObjectAttributesFunc func(contextMoqParam context.Context, getObjectAttributesInput *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error)
-
-	// GetObjectLegalHoldFunc mocks the GetObjectLegalHold method.
-	GetObjectLegalHoldFunc func(contextMoqParam context.Context, bucket string, object string, versionId string) (*bool, error)
-
-	// GetObjectLockConfigurationFunc mocks the GetObjectLockConfiguration method.
-	GetObjectLockConfigurationFunc func(contextMoqParam context.Context, bucket string) ([]byte, error)
-
-	// GetObjectRetentionFunc mocks the GetObjectRetention method.
-	GetObjectRetentionFunc func(contextMoqParam context.Context, bucket string, object string, versionId string) ([]byte, error)
+	GetObjectAttributesFunc func(contextMoqParam context.Context, getObjectAttributesInput *s3.GetObjectAttributesInput) (*s3.GetObjectAttributesOutput, error)
 
 	// GetObjectTaggingFunc mocks the GetObjectTagging method.
 	GetObjectTaggingFunc func(contextMoqParam context.Context, bucket string, object string) (map[string]string, error)
@@ -288,15 +261,6 @@ type BackendMock struct {
 	// PutObjectAclFunc mocks the PutObjectAcl method.
 	PutObjectAclFunc func(contextMoqParam context.Context, putObjectAclInput *s3.PutObjectAclInput) error
 
-	// PutObjectLegalHoldFunc mocks the PutObjectLegalHold method.
-	PutObjectLegalHoldFunc func(contextMoqParam context.Context, bucket string, object string, versionId string, status bool) error
-
-	// PutObjectLockConfigurationFunc mocks the PutObjectLockConfiguration method.
-	PutObjectLockConfigurationFunc func(contextMoqParam context.Context, bucket string, config []byte) error
-
-	// PutObjectRetentionFunc mocks the PutObjectRetention method.
-	PutObjectRetentionFunc func(contextMoqParam context.Context, bucket string, object string, versionId string, bypass bool, retention []byte) error
-
 	// PutObjectTaggingFunc mocks the PutObjectTagging method.
 	PutObjectTaggingFunc func(contextMoqParam context.Context, bucket string, object string, tags map[string]string) error
 
@@ -461,35 +425,6 @@ type BackendMock struct {
 			// GetObjectAttributesInput is the getObjectAttributesInput argument value.
 			GetObjectAttributesInput *s3.GetObjectAttributesInput
 		}
-		// GetObjectLegalHold holds details about calls to the GetObjectLegalHold method.
-		GetObjectLegalHold []struct {
-			// ContextMoqParam is the contextMoqParam argument value.
-			ContextMoqParam context.Context
-			// Bucket is the bucket argument value.
-			Bucket string
-			// Object is the object argument value.
-			Object string
-			// VersionId is the versionId argument value.
-			VersionId string
-		}
-		// GetObjectLockConfiguration holds details about calls to the GetObjectLockConfiguration method.
-		GetObjectLockConfiguration []struct {
-			// ContextMoqParam is the contextMoqParam argument value.
-			ContextMoqParam context.Context
-			// Bucket is the bucket argument value.
-			Bucket string
-		}
-		// GetObjectRetention holds details about calls to the GetObjectRetention method.
-		GetObjectRetention []struct {
-			// ContextMoqParam is the contextMoqParam argument value.
-			ContextMoqParam context.Context
-			// Bucket is the bucket argument value.
-			Bucket string
-			// Object is the object argument value.
-			Object string
-			// VersionId is the versionId argument value.
-			VersionId string
-		}
 		// GetObjectTagging holds details about calls to the GetObjectTagging method.
 		GetObjectTagging []struct {
 			// ContextMoqParam is the contextMoqParam argument value.
@@ -610,43 +545,6 @@ type BackendMock struct {
 			// PutObjectAclInput is the putObjectAclInput argument value.
 			PutObjectAclInput *s3.PutObjectAclInput
 		}
-		// PutObjectLegalHold holds details about calls to the PutObjectLegalHold method.
-		PutObjectLegalHold []struct {
-			// ContextMoqParam is the contextMoqParam argument value.
-			ContextMoqParam context.Context
-			// Bucket is the bucket argument value.
-			Bucket string
-			// Object is the object argument value.
-			Object string
-			// VersionId is the versionId argument value.
-			VersionId string
-			// Status is the status argument value.
-			Status bool
-		}
-		// PutObjectLockConfiguration holds details about calls to the PutObjectLockConfiguration method.
-		PutObjectLockConfiguration []struct {
-			// ContextMoqParam is the contextMoqParam argument value.
-			ContextMoqParam context.Context
-			// Bucket is the bucket argument value.
-			Bucket string
-			// Config is the config argument value.
-			Config []byte
-		}
-		// PutObjectRetention holds details about calls to the PutObjectRetention method.
-		PutObjectRetention []struct {
-			// ContextMoqParam is the contextMoqParam argument value.
-			ContextMoqParam context.Context
-			// Bucket is the bucket argument value.
-			Bucket string
-			// Object is the object argument value.
-			Object string
-			// VersionId is the versionId argument value.
-			VersionId string
-			// Bypass is the bypass argument value.
-			Bypass bool
-			// Retention is the retention argument value.
-			Retention []byte
-		}
 		// PutObjectTagging holds details about calls to the PutObjectTagging method.
 		PutObjectTagging []struct {
 			// ContextMoqParam is the contextMoqParam argument value.
@@ -693,54 +591,48 @@ type BackendMock struct {
 			UploadPartCopyInput *s3.UploadPartCopyInput
 		}
 	}
-	lockAbortMultipartUpload       sync.RWMutex
-	lockChangeBucketOwner          sync.RWMutex
-	lockCompleteMultipartUpload    sync.RWMutex
-	lockCopyObject                 sync.RWMutex
-	lockCreateBucket               sync.RWMutex
-	lockCreateMultipartUpload      sync.RWMutex
-	lockDeleteBucket               sync.RWMutex
-	lockDeleteBucketPolicy         sync.RWMutex
-	lockDeleteBucketTagging        sync.RWMutex
-	lockDeleteObject               sync.RWMutex
-	lockDeleteObjectTagging        sync.RWMutex
-	lockDeleteObjects              sync.RWMutex
-	lockGetBucketAcl               sync.RWMutex
-	lockGetBucketPolicy            sync.RWMutex
-	lockGetBucketTagging           sync.RWMutex
-	lockGetBucketVersioning        sync.RWMutex
-	lockGetObject                  sync.RWMutex
-	lockGetObjectAcl               sync.RWMutex
-	lockGetObjectAttributes        sync.RWMutex
-	lockGetObjectLegalHold         sync.RWMutex
-	lockGetObjectLockConfiguration sync.RWMutex
-	lockGetObjectRetention         sync.RWMutex
-	lockGetObjectTagging           sync.RWMutex
-	lockHeadBucket                 sync.RWMutex
-	lockHeadObject                 sync.RWMutex
-	lockListBuckets                sync.RWMutex
-	lockListBucketsAndOwners       sync.RWMutex
-	lockListMultipartUploads       sync.RWMutex
-	lockListObjectVersions         sync.RWMutex
-	lockListObjects                sync.RWMutex
-	lockListObjectsV2              sync.RWMutex
-	lockListParts                  sync.RWMutex
-	lockPutBucketAcl               sync.RWMutex
-	lockPutBucketPolicy            sync.RWMutex
-	lockPutBucketTagging           sync.RWMutex
-	lockPutBucketVersioning        sync.RWMutex
-	lockPutObject                  sync.RWMutex
-	lockPutObjectAcl               sync.RWMutex
-	lockPutObjectLegalHold         sync.RWMutex
-	lockPutObjectLockConfiguration sync.RWMutex
-	lockPutObjectRetention         sync.RWMutex
-	lockPutObjectTagging           sync.RWMutex
-	lockRestoreObject              sync.RWMutex
-	lockSelectObjectContent        sync.RWMutex
-	lockShutdown                   sync.RWMutex
-	lockString                     sync.RWMutex
-	lockUploadPart                 sync.RWMutex
-	lockUploadPartCopy             sync.RWMutex
+	lockAbortMultipartUpload    sync.RWMutex
+	lockChangeBucketOwner       sync.RWMutex
+	lockCompleteMultipartUpload sync.RWMutex
+	lockCopyObject              sync.RWMutex
+	lockCreateBucket            sync.RWMutex
+	lockCreateMultipartUpload   sync.RWMutex
+	lockDeleteBucket            sync.RWMutex
+	lockDeleteBucketPolicy      sync.RWMutex
+	lockDeleteBucketTagging     sync.RWMutex
+	lockDeleteObject            sync.RWMutex
+	lockDeleteObjectTagging     sync.RWMutex
+	lockDeleteObjects           sync.RWMutex
+	lockGetBucketAcl            sync.RWMutex
+	lockGetBucketPolicy         sync.RWMutex
+	lockGetBucketTagging        sync.RWMutex
+	lockGetBucketVersioning     sync.RWMutex
+	lockGetObject               sync.RWMutex
+	lockGetObjectAcl            sync.RWMutex
+	lockGetObjectAttributes     sync.RWMutex
+	lockGetObjectTagging        sync.RWMutex
+	lockHeadBucket              sync.RWMutex
+	lockHeadObject              sync.RWMutex
+	lockListBuckets             sync.RWMutex
+	lockListBucketsAndOwners    sync.RWMutex
+	lockListMultipartUploads    sync.RWMutex
+	lockListObjectVersions      sync.RWMutex
+	lockListObjects             sync.RWMutex
+	lockListObjectsV2           sync.RWMutex
+	lockListParts               sync.RWMutex
+	lockPutBucketAcl            sync.RWMutex
+	lockPutBucketPolicy         sync.RWMutex
+	lockPutBucketTagging        sync.RWMutex
+	lockPutBucketVersioning     sync.RWMutex
+	lockPutObject               sync.RWMutex
+	lockPutObjectAcl            sync.RWMutex
+	lockPutObjectTagging        sync.RWMutex
+	lockRestoreObject           sync.RWMutex
+	lockSelectObjectContent     sync.RWMutex
+	lockShutdown                sync.RWMutex
+	lockString                  sync.RWMutex
+	lockUploadPart              sync.RWMutex
+	lockUploadPartCopy          sync.RWMutex
 }
 
 // AbortMultipartUpload calls AbortMultipartUploadFunc.
@@ -1408,7 +1300,7 @@ func (mock *BackendMock) GetObjectAclCalls() []struct {
 }
 
 // GetObjectAttributes calls GetObjectAttributesFunc.
-func (mock *BackendMock) GetObjectAttributes(contextMoqParam context.Context, getObjectAttributesInput *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error) {
+func (mock *BackendMock) GetObjectAttributes(contextMoqParam context.Context, getObjectAttributesInput *s3.GetObjectAttributesInput) (*s3.GetObjectAttributesOutput, error) {
 	if mock.GetObjectAttributesFunc == nil {
 		panic("BackendMock.GetObjectAttributesFunc: method is nil but Backend.GetObjectAttributes was just called")
 	}
@@ -1443,130 +1335,6 @@ func (mock *BackendMock) GetObjectAttributesCalls() []struct {
 	return calls
 }
 
-// GetObjectLegalHold calls GetObjectLegalHoldFunc.
-func (mock *BackendMock) GetObjectLegalHold(contextMoqParam context.Context, bucket string, object string, versionId string) (*bool, error) {
-	if mock.GetObjectLegalHoldFunc == nil {
-		panic("BackendMock.GetObjectLegalHoldFunc: method is nil but Backend.GetObjectLegalHold was just called")
-	}
-	callInfo := struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-	}{
-		ContextMoqParam: contextMoqParam,
-		Bucket:          bucket,
-		Object:          object,
-		VersionId:       versionId,
-	}
-	mock.lockGetObjectLegalHold.Lock()
-	mock.calls.GetObjectLegalHold = append(mock.calls.GetObjectLegalHold, callInfo)
-	mock.lockGetObjectLegalHold.Unlock()
-	return mock.GetObjectLegalHoldFunc(contextMoqParam, bucket, object, versionId)
-}
-
-// GetObjectLegalHoldCalls gets all the calls that were made to GetObjectLegalHold.
-// Check the length with:
-//
-//	len(mockedBackend.GetObjectLegalHoldCalls())
-func (mock *BackendMock) GetObjectLegalHoldCalls() []struct {
-	ContextMoqParam context.Context
-	Bucket          string
-	Object          string
-	VersionId       string
-} {
-	var calls []struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-	}
-	mock.lockGetObjectLegalHold.RLock()
-	calls = mock.calls.GetObjectLegalHold
-	mock.lockGetObjectLegalHold.RUnlock()
-	return calls
-}
-
-// GetObjectLockConfiguration calls GetObjectLockConfigurationFunc.
-func (mock *BackendMock) GetObjectLockConfiguration(contextMoqParam context.Context, bucket string) ([]byte, error) {
-	if mock.GetObjectLockConfigurationFunc == nil {
-		panic("BackendMock.GetObjectLockConfigurationFunc: method is nil but Backend.GetObjectLockConfiguration was just called")
-	}
-	callInfo := struct {
-		ContextMoqParam context.Context
-		Bucket          string
-	}{
-		ContextMoqParam: contextMoqParam,
-		Bucket:          bucket,
-	}
-	mock.lockGetObjectLockConfiguration.Lock()
-	mock.calls.GetObjectLockConfiguration = append(mock.calls.GetObjectLockConfiguration, callInfo)
-	mock.lockGetObjectLockConfiguration.Unlock()
-	return mock.GetObjectLockConfigurationFunc(contextMoqParam, bucket)
-}
-
-// GetObjectLockConfigurationCalls gets all the calls that were made to GetObjectLockConfiguration.
-// Check the length with:
-//
-//	len(mockedBackend.GetObjectLockConfigurationCalls())
-func (mock *BackendMock) GetObjectLockConfigurationCalls() []struct {
-	ContextMoqParam context.Context
-	Bucket          string
-} {
-	var calls []struct {
-		ContextMoqParam context.Context
-		Bucket          string
-	}
-	mock.lockGetObjectLockConfiguration.RLock()
-	calls = mock.calls.GetObjectLockConfiguration
-	mock.lockGetObjectLockConfiguration.RUnlock()
-	return calls
-}
-
-// GetObjectRetention calls GetObjectRetentionFunc.
-func (mock *BackendMock) GetObjectRetention(contextMoqParam context.Context, bucket string, object string, versionId string) ([]byte, error) {
-	if mock.GetObjectRetentionFunc == nil {
-		panic("BackendMock.GetObjectRetentionFunc: method is nil but Backend.GetObjectRetention was just called")
-	}
-	callInfo := struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-	}{
-		ContextMoqParam: contextMoqParam,
-		Bucket:          bucket,
-		Object:          object,
-		VersionId:       versionId,
-	}
-	mock.lockGetObjectRetention.Lock()
-	mock.calls.GetObjectRetention = append(mock.calls.GetObjectRetention, callInfo)
-	mock.lockGetObjectRetention.Unlock()
-	return mock.GetObjectRetentionFunc(contextMoqParam, bucket, object, versionId)
-}
-
-// GetObjectRetentionCalls gets all the calls that were made to GetObjectRetention.
-// Check the length with:
-//
-//	len(mockedBackend.GetObjectRetentionCalls())
-func (mock *BackendMock) GetObjectRetentionCalls() []struct {
-	ContextMoqParam context.Context
-	Bucket          string
-	Object          string
-	VersionId       string
-} {
-	var calls []struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-	}
-	mock.lockGetObjectRetention.RLock()
-	calls = mock.calls.GetObjectRetention
-	mock.lockGetObjectRetention.RUnlock()
-	return calls
-}
-
 // GetObjectTagging calls GetObjectTaggingFunc.
 func (mock *BackendMock) GetObjectTagging(contextMoqParam context.Context, bucket string, object string) (map[string]string, error) {
 	if mock.GetObjectTaggingFunc == nil {
@@ -2159,146 +1927,6 @@ func (mock *BackendMock) PutObjectAclCalls() []struct {
 	return calls
 }
 
-// PutObjectLegalHold calls PutObjectLegalHoldFunc.
-func (mock *BackendMock) PutObjectLegalHold(contextMoqParam context.Context, bucket string, object string, versionId string, status bool) error {
-	if mock.PutObjectLegalHoldFunc == nil {
-		panic("BackendMock.PutObjectLegalHoldFunc: method is nil but Backend.PutObjectLegalHold was just called")
-	}
-	callInfo := struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-		Status          bool
-	}{
-		ContextMoqParam: contextMoqParam,
-		Bucket:          bucket,
-		Object:          object,
-		VersionId:       versionId,
-		Status:          status,
-	}
-	mock.lockPutObjectLegalHold.Lock()
-	mock.calls.PutObjectLegalHold = append(mock.calls.PutObjectLegalHold, callInfo)
-	mock.lockPutObjectLegalHold.Unlock()
-	return mock.PutObjectLegalHoldFunc(contextMoqParam, bucket, object, versionId, status)
-}
-
-// PutObjectLegalHoldCalls gets all the calls that were made to PutObjectLegalHold.
-// Check the length with:
-//
-//	len(mockedBackend.PutObjectLegalHoldCalls())
-func (mock *BackendMock) PutObjectLegalHoldCalls() []struct {
-	ContextMoqParam context.Context
-	Bucket          string
-	Object          string
-	VersionId       string
-	Status          bool
-} {
-	var calls []struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-		Status          bool
-	}
-	mock.lockPutObjectLegalHold.RLock()
-	calls = mock.calls.PutObjectLegalHold
-	mock.lockPutObjectLegalHold.RUnlock()
-	return calls
-}
-
-// PutObjectLockConfiguration calls PutObjectLockConfigurationFunc.
-func (mock *BackendMock) PutObjectLockConfiguration(contextMoqParam context.Context, bucket string, config []byte) error {
-	if mock.PutObjectLockConfigurationFunc == nil {
-		panic("BackendMock.PutObjectLockConfigurationFunc: method is nil but Backend.PutObjectLockConfiguration was just called")
-	}
-	callInfo := struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Config          []byte
-	}{
-		ContextMoqParam: contextMoqParam,
-		Bucket:          bucket,
-		Config:          config,
-	}
-	mock.lockPutObjectLockConfiguration.Lock()
-	mock.calls.PutObjectLockConfiguration = append(mock.calls.PutObjectLockConfiguration, callInfo)
-	mock.lockPutObjectLockConfiguration.Unlock()
-	return mock.PutObjectLockConfigurationFunc(contextMoqParam, bucket, config)
-}
-
-// PutObjectLockConfigurationCalls gets all the calls that were made to PutObjectLockConfiguration.
-// Check the length with:
-//
-//	len(mockedBackend.PutObjectLockConfigurationCalls())
-func (mock *BackendMock) PutObjectLockConfigurationCalls() []struct {
-	ContextMoqParam context.Context
-	Bucket          string
-	Config          []byte
-} {
-	var calls []struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Config          []byte
-	}
-	mock.lockPutObjectLockConfiguration.RLock()
-	calls = mock.calls.PutObjectLockConfiguration
-	mock.lockPutObjectLockConfiguration.RUnlock()
-	return calls
-}
-
-// PutObjectRetention calls PutObjectRetentionFunc.
-func (mock *BackendMock) PutObjectRetention(contextMoqParam context.Context, bucket string, object string, versionId string, bypass bool, retention []byte) error {
-	if mock.PutObjectRetentionFunc == nil {
-		panic("BackendMock.PutObjectRetentionFunc: method is nil but Backend.PutObjectRetention was just called")
-	}
-	callInfo := struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-		Bypass          bool
-		Retention       []byte
-	}{
-		ContextMoqParam: contextMoqParam,
-		Bucket:          bucket,
-		Object:          object,
-		VersionId:       versionId,
-		Bypass:          bypass,
-		Retention:       retention,
-	}
-	mock.lockPutObjectRetention.Lock()
-	mock.calls.PutObjectRetention = append(mock.calls.PutObjectRetention, callInfo)
-	mock.lockPutObjectRetention.Unlock()
-	return mock.PutObjectRetentionFunc(contextMoqParam, bucket, object, versionId, bypass, retention)
-}
-
-// PutObjectRetentionCalls gets all the calls that were made to PutObjectRetention.
-// Check the length with:
-//
-//	len(mockedBackend.PutObjectRetentionCalls())
-func (mock *BackendMock) PutObjectRetentionCalls() []struct {
-	ContextMoqParam context.Context
-	Bucket          string
-	Object          string
-	VersionId       string
-	Bypass          bool
-	Retention       []byte
-} {
-	var calls []struct {
-		ContextMoqParam context.Context
-		Bucket          string
-		Object          string
-		VersionId       string
-		Bypass          bool
-		Retention       []byte
-	}
-	mock.lockPutObjectRetention.RLock()
-	calls = mock.calls.PutObjectRetention
-	mock.lockPutObjectRetention.RUnlock()
-	return calls
-}
-
 // PutObjectTagging calls PutObjectTaggingFunc.
 func (mock *BackendMock) PutObjectTagging(contextMoqParam context.Context, bucket string, object string, tags map[string]string) error {
 	if mock.PutObjectTaggingFunc == nil {

s3api/controllers/base_test.go

@@ -77,7 +77,7 @@ func TestNew(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := New(tt.args.be, tt.args.iam, nil, nil, nil, false, false)
+			got := New(tt.args.be, tt.args.iam, nil, nil, false)
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("New() = %v, want %v", got, tt.want)
 			}
@@ -188,8 +188,8 @@ func TestS3ApiController_GetActions(t *testing.T) {
 			GetObjectAclFunc: func(context.Context, *s3.GetObjectAclInput) (*s3.GetObjectAclOutput, error) {
 				return &s3.GetObjectAclOutput{}, nil
 			},
-			GetObjectAttributesFunc: func(context.Context, *s3.GetObjectAttributesInput) (s3response.GetObjectAttributesResult, error) {
-				return s3response.GetObjectAttributesResult{}, nil
+			GetObjectAttributesFunc: func(context.Context, *s3.GetObjectAttributesInput) (*s3.GetObjectAttributesOutput, error) {
+				return &s3.GetObjectAttributesOutput{}, nil
 			},
 			GetObjectFunc: func(context.Context, *s3.GetObjectInput, io.Writer) (*s3.GetObjectOutput, error) {
 				return &s3.GetObjectOutput{
@@ -205,19 +205,6 @@ func TestS3ApiController_GetActions(t *testing.T) {
 			GetObjectTaggingFunc: func(_ context.Context, bucket, object string) (map[string]string, error) {
 				return map[string]string{"hello": "world"}, nil
 			},
-			GetObjectRetentionFunc: func(contextMoqParam context.Context, bucket, object, versionId string) ([]byte, error) {
-				result, err := json.Marshal(types.ObjectLockRetention{
-					Mode: types.ObjectLockRetentionModeCompliance,
-				})
-				if err != nil {
-					return nil, err
-				}
-				return result, nil
-			},
-			GetObjectLegalHoldFunc: func(contextMoqParam context.Context, bucket, object, versionId string) (*bool, error) {
-				result := true
-				return &result, nil
-			},
 		},
 	}
 	app.Use(func(ctx *fiber.Ctx) error {
@@ -249,24 +236,6 @@ func TestS3ApiController_GetActions(t *testing.T) {
 			wantErr:    false,
 			statusCode: 200,
 		},
-		{
-			name: "Get-actions-get-object-retention-success",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodGet, "/my-bucket/my-obj?retention", nil),
-			},
-			wantErr:    false,
-			statusCode: 200,
-		},
-		{
-			name: "Get-actions-get-object-legal-hold-success",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodGet, "/my-bucket/my-obj?legal-hold", nil),
-			},
-			wantErr:    false,
-			statusCode: 200,
-		},
 		{
 			name: "Get-actions-invalid-max-parts-string",
 			app:  app,
@@ -360,11 +329,6 @@ func TestS3ApiController_ListActions(t *testing.T) {
 		req *http.Request
 	}
 
-	objectLockResult, err := json.Marshal(auth.BucketLockConfig{})
-	if err != nil {
-		t.Errorf("failed to parse object lock result %v", err)
-	}
-
 	app := fiber.New()
 	s3ApiController := S3ApiController{
 		be: &BackendMock{
@@ -392,9 +356,6 @@ func TestS3ApiController_ListActions(t *testing.T) {
 			GetBucketPolicyFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
 				return []byte{}, nil
 			},
-			GetObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
-				return objectLockResult, nil
-			},
 		},
 	}
 
@@ -408,7 +369,7 @@ func TestS3ApiController_ListActions(t *testing.T) {
 
 	app.Get("/:bucket", s3ApiController.ListActions)
 
-	// Error case
+	//Error case
 	s3ApiControllerError := S3ApiController{
 		be: &BackendMock{
 			GetBucketAclFunc: func(context.Context, *s3.GetBucketAclInput) ([]byte, error) {
@@ -457,15 +418,6 @@ func TestS3ApiController_ListActions(t *testing.T) {
 			wantErr:    false,
 			statusCode: 200,
 		},
-		{
-			name: "Get-object-lock-configuration-success",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodGet, "/my-bucket?object-lock", nil),
-			},
-			wantErr:    false,
-			statusCode: 200,
-		},
 		{
 			name: "Get-bucket-acl-success",
 			app:  app,
@@ -593,6 +545,14 @@ func TestS3ApiController_PutBucketActions(t *testing.T) {
 	</AccessControlPolicy>
 	`
 
+	succBody := `
+	<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
+		<Owner>
+			<ID>valid access</ID>
+		</Owner>
+	</AccessControlPolicy>
+	`
+
 	tagBody := `
 	<Tagging xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
 		<TagSet>
@@ -624,18 +584,6 @@ func TestS3ApiController_PutBucketActions(t *testing.T) {
 	}
 	`
 
-	objectLockBody := `
-	<ObjectLockConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-		<ObjectLockEnabled>Enabled</ObjectLockEnabled>
-		<Rule>
-			<DefaultRetention>
-				<Mode>GOVERNANCE</Mode>
-				<Years>2</Years>
-			</DefaultRetention>
-		</Rule>
-	</ObjectLockConfiguration>
-	`
-
 	s3ApiController := S3ApiController{
 		be: &BackendMock{
 			GetBucketAclFunc: func(context.Context, *s3.GetBucketAclInput) ([]byte, error) {
@@ -656,9 +604,6 @@ func TestS3ApiController_PutBucketActions(t *testing.T) {
 			PutBucketPolicyFunc: func(contextMoqParam context.Context, bucket string, policy []byte) error {
 				return nil
 			},
-			PutObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string, config []byte) error {
-				return nil
-			},
 		},
 	}
 	// Mock ctx.Locals
@@ -682,9 +627,10 @@ func TestS3ApiController_PutBucketActions(t *testing.T) {
 
 	// PutBucketAcl incorrect bucket owner case
 	incorrectBucketOwner := httptest.NewRequest(http.MethodPut, "/my-bucket?acl", strings.NewReader(invOwnerBody))
+	incorrectBucketOwner.Header.Set("X-Amz-Acl", "private")
 
 	// PutBucketAcl acl success
-	aclSuccReq := httptest.NewRequest(http.MethodPut, "/my-bucket?acl", nil)
+	aclSuccReq := httptest.NewRequest(http.MethodPut, "/my-bucket?acl", strings.NewReader(succBody))
 	aclSuccReq.Header.Set("X-Amz-Acl", "private")
 
 	// Invalid acl body case
@@ -716,24 +662,6 @@ func TestS3ApiController_PutBucketActions(t *testing.T) {
 			wantErr:    false,
 			statusCode: 200,
 		},
-		{
-			name: "Put-object-lock-configuration-invalid-body",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodPut, "/my-bucket?object-lock", nil),
-			},
-			wantErr:    false,
-			statusCode: 400,
-		},
-		{
-			name: "Put-object-lock-configuration-success",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodPut, "/my-bucket?object-lock", strings.NewReader(objectLockBody)),
-			},
-			wantErr:    false,
-			statusCode: 200,
-		},
 		{
 			name: "Put-bucket-versioning-invalid-body",
 			app:  app,
@@ -878,19 +806,6 @@ func TestS3ApiController_PutActions(t *testing.T) {
 	</Tagging>
 	`
 
-	retentionBody := `
-	<Retention xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-		<Mode>GOVERNANCE</Mode>
-		<RetainUntilDate>2025-01-01T00:00:00Z</RetainUntilDate>
-	</Retention>
-	`
-
-	legalHoldBody := `
-	<LegalHold xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
-		<Status>ON</Status>
-	</LegalHold>
-	`
-
 	app := fiber.New()
 	s3ApiController := S3ApiController{
 		be: &BackendMock{
@@ -917,15 +832,6 @@ func TestS3ApiController_PutActions(t *testing.T) {
 			UploadPartCopyFunc: func(context.Context, *s3.UploadPartCopyInput) (s3response.CopyObjectResult, error) {
 				return s3response.CopyObjectResult{}, nil
 			},
-			PutObjectLegalHoldFunc: func(contextMoqParam context.Context, bucket, object, versionId string, status bool) error {
-				return nil
-			},
-			PutObjectRetentionFunc: func(contextMoqParam context.Context, bucket, object, versionId string, bypass bool, retention []byte) error {
-				return nil
-			},
-			GetObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
-				return nil, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)
-			},
 		},
 	}
 	app.Use(func(ctx *fiber.Ctx) error {
@@ -1004,42 +910,6 @@ func TestS3ApiController_PutActions(t *testing.T) {
 			wantErr:    false,
 			statusCode: 200,
 		},
-		{
-			name: "put-object-retention-invalid-request",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodPut, "/my-bucket/my-key?retention", nil),
-			},
-			wantErr:    false,
-			statusCode: 400,
-		},
-		{
-			name: "put-object-retention-success",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodPut, "/my-bucket/my-key?retention", strings.NewReader(retentionBody)),
-			},
-			wantErr:    false,
-			statusCode: 200,
-		},
-		{
-			name: "put-legal-hold-invalid-request",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodPut, "/my-bucket/my-key?legal-hold", nil),
-			},
-			wantErr:    false,
-			statusCode: 400,
-		},
-		{
-			name: "put-legal-hold-success",
-			app:  app,
-			args: args{
-				req: httptest.NewRequest(http.MethodPut, "/my-bucket/my-key?legal-hold", strings.NewReader(legalHoldBody)),
-			},
-			wantErr:    false,
-			statusCode: 200,
-		},
 		{
 			name: "Put-object-acl-invalid-acl",
 			app:  app,
@@ -1226,9 +1096,6 @@ func TestS3ApiController_DeleteObjects(t *testing.T) {
 			DeleteObjectsFunc: func(context.Context, *s3.DeleteObjectsInput) (s3response.DeleteResult, error) {
 				return s3response.DeleteResult{}, nil
 			},
-			GetObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
-				return nil, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)
-			},
 		},
 	}
 
@@ -1306,9 +1173,6 @@ func TestS3ApiController_DeleteActions(t *testing.T) {
 			DeleteObjectTaggingFunc: func(_ context.Context, bucket, object string) error {
 				return nil
 			},
-			GetObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
-				return nil, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)
-			},
 		},
 	}
 
@@ -1331,9 +1195,6 @@ func TestS3ApiController_DeleteActions(t *testing.T) {
 		DeleteObjectFunc: func(context.Context, *s3.DeleteObjectInput) error {
 			return s3err.GetAPIError(7)
 		},
-		GetObjectLockConfigurationFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {
-			return nil, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)
-		},
 	}}
 
 	appErr.Use(func(ctx *fiber.Ctx) error {
@@ -1424,7 +1285,6 @@ func TestS3ApiController_HeadBucket(t *testing.T) {
 		ctx.Locals("isRoot", true)
 		ctx.Locals("isDebug", false)
 		ctx.Locals("parsedAcl", auth.ACL{})
-		ctx.Locals("region", "us-east-1")
 		return ctx.Next()
 	})
 
@@ -1448,7 +1308,6 @@ func TestS3ApiController_HeadBucket(t *testing.T) {
 		ctx.Locals("isRoot", true)
 		ctx.Locals("isDebug", false)
 		ctx.Locals("parsedAcl", auth.ACL{})
-		ctx.Locals("region", "us-east-1")
 		return ctx.Next()
 	})
 

s3api/middlewares/acl-parser.go

@@ -24,7 +24,6 @@ import (
 	"github.com/versity/versitygw/auth"
 	"github.com/versity/versitygw/backend"
 	"github.com/versity/versitygw/s3api/controllers"
-	"github.com/versity/versitygw/s3err"
 	"github.com/versity/versitygw/s3log"
 )
 
@@ -32,7 +31,7 @@ var (
 	singlePath = regexp.MustCompile(`^/[^/]+/?$`)
 )
 
-func AclParser(be backend.Backend, logger s3log.AuditLogger, readonly bool) fiber.Handler {
+func AclParser(be backend.Backend, logger s3log.AuditLogger) fiber.Handler {
 	return func(ctx *fiber.Ctx) error {
 		isRoot, acct := ctx.Locals("isRoot").(bool), ctx.Locals("account").(auth.Account)
 		path := ctx.Path()
@@ -49,18 +48,10 @@ func AclParser(be backend.Backend, logger s3log.AuditLogger, readonly bool) fibe
 			!ctx.Request().URI().QueryArgs().Has("acl") &&
 			!ctx.Request().URI().QueryArgs().Has("tagging") &&
 			!ctx.Request().URI().QueryArgs().Has("versioning") &&
-			!ctx.Request().URI().QueryArgs().Has("policy") &&
-			!ctx.Request().URI().QueryArgs().Has("object-lock") {
+			!ctx.Request().URI().QueryArgs().Has("policy") {
 			if err := auth.MayCreateBucket(acct, isRoot); err != nil {
 				return controllers.SendXMLResponse(ctx, nil, err, &controllers.MetaOpts{Logger: logger, Action: "CreateBucket"})
 			}
-			if readonly {
-				return controllers.SendXMLResponse(ctx, nil, s3err.GetAPIError(s3err.ErrAccessDenied),
-					&controllers.MetaOpts{
-						Logger: logger,
-						Action: "CreateBucket",
-					})
-			}
 			return ctx.Next()
 		}
 		data, err := be.GetBucketAcl(ctx.Context(), &s3.GetBucketAclInput{Bucket: &bucket})

s3api/middlewares/authentication.go

@@ -25,7 +25,6 @@ import (
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/versity/versitygw/auth"
-	"github.com/versity/versitygw/metrics"
 	"github.com/versity/versitygw/s3api/controllers"
 	"github.com/versity/versitygw/s3api/utils"
 	"github.com/versity/versitygw/s3err"
@@ -41,7 +40,7 @@ type RootUserConfig struct {
 	Secret string
 }
 
-func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.AuditLogger, mm *metrics.Manager, region string, debug bool) fiber.Handler {
+func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.AuditLogger, region string, debug bool) fiber.Handler {
 	acct := accounts{root: root, iam: iam}
 
 	return func(ctx *fiber.Ctx) error {
@@ -55,16 +54,16 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.Au
 		ctx.Locals("startTime", time.Now())
 		authorization := ctx.Get("Authorization")
 		if authorization == "" {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrAuthHeaderEmpty), logger, mm)
+			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrAuthHeaderEmpty), logger)
 		}
 
 		authData, err := utils.ParseAuthorization(authorization)
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 
 		if authData.Algorithm != "AWS4-HMAC-SHA256" {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrSignatureVersionNotSupported), logger, mm)
+			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrSignatureVersionNotSupported), logger)
 		}
 
 		if authData.Region != region {
@@ -72,40 +71,40 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.Au
 				Code:           "SignatureDoesNotMatch",
 				Description:    fmt.Sprintf("Credential should be scoped to a valid Region, not %v", authData.Region),
 				HTTPStatusCode: http.StatusForbidden,
-			}, logger, mm)
+			}, logger)
 		}
 
 		ctx.Locals("isRoot", authData.Access == root.Access)
 
 		account, err := acct.getAccount(authData.Access)
 		if err == auth.ErrNoSuchUser {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidAccessKeyID), logger, mm)
+			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidAccessKeyID), logger)
 		}
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 		ctx.Locals("account", account)
 
 		// Check X-Amz-Date header
 		date := ctx.Get("X-Amz-Date")
 		if date == "" {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrMissingDateHeader), logger, mm)
+			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrMissingDateHeader), logger)
 		}
 
 		// Parse the date and check the date validity
 		tdate, err := time.Parse(iso8601Format, date)
 		if err != nil {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrMalformedDate), logger, mm)
+			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrMalformedDate), logger)
 		}
 
 		if date[:8] != authData.Date {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrSignatureDateDoesNotMatch), logger, mm)
+			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrSignatureDateDoesNotMatch), logger)
 		}
 
 		// Validate the dates difference
 		err = utils.ValidateDate(tdate)
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 
 		if utils.IsBigDataAction(ctx) {
@@ -126,7 +125,7 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.Au
 
 			// Compare the calculated hash with the hash provided
 			if hashPayload != hexPayload {
-				return sendResponse(ctx, s3err.GetAPIError(s3err.ErrContentSHA256Mismatch), logger, mm)
+				return sendResponse(ctx, s3err.GetAPIError(s3err.ErrContentSHA256Mismatch), logger)
 			}
 		}
 
@@ -135,13 +134,13 @@ func VerifyV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.Au
 		if contentLengthStr != "" {
 			contentLength, err = strconv.ParseInt(contentLengthStr, 10, 64)
 			if err != nil {
-				return sendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidRequest), logger, mm)
+				return sendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidRequest), logger)
 			}
 		}
 
 		err = utils.CheckValidSignature(ctx, authData, account.Secret, hashPayload, tdate, contentLength, debug)
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 
 		return ctx.Next()
@@ -165,6 +164,6 @@ func (a accounts) getAccount(access string) (auth.Account, error) {
 	return a.iam.GetUserAccount(access)
 }
 
-func sendResponse(ctx *fiber.Ctx, err error, logger s3log.AuditLogger, mm *metrics.Manager) error {
-	return controllers.SendResponse(ctx, err, &controllers.MetaOpts{Logger: logger, MetricsMng: mm})
+func sendResponse(ctx *fiber.Ctx, err error, logger s3log.AuditLogger) error {
+	return controllers.SendResponse(ctx, err, &controllers.MetaOpts{Logger: logger})
 }

s3api/middlewares/chunk.go

@@ -20,14 +20,13 @@ import (
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/versity/versitygw/auth"
-	"github.com/versity/versitygw/metrics"
 	"github.com/versity/versitygw/s3api/utils"
 	"github.com/versity/versitygw/s3log"
 )
 
 // ProcessChunkedBody initializes the chunked upload stream if the
 // request appears to be a chunked upload
-func ProcessChunkedBody(root RootUserConfig, iam auth.IAMService, logger s3log.AuditLogger, mm *metrics.Manager, region string) fiber.Handler {
+func ProcessChunkedBody(root RootUserConfig, iam auth.IAMService, logger s3log.AuditLogger, region string) fiber.Handler {
 	return func(ctx *fiber.Ctx) error {
 		decodedLength := ctx.Get("X-Amz-Decoded-Content-Length")
 		if decodedLength == "" {
@@ -37,7 +36,7 @@ func ProcessChunkedBody(root RootUserConfig, iam auth.IAMService, logger s3log.A
 
 		authData, err := utils.ParseAuthorization(ctx.Get("Authorization"))
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 
 		acct := ctx.Locals("account").(auth.Account)
@@ -52,7 +51,7 @@ func ProcessChunkedBody(root RootUserConfig, iam auth.IAMService, logger s3log.A
 				return cr
 			})
 			if err != nil {
-				return sendResponse(ctx, err, logger, mm)
+				return sendResponse(ctx, err, logger)
 			}
 			return ctx.Next()
 		}

s3api/middlewares/presign-auth.go

@@ -20,13 +20,12 @@ import (
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/versity/versitygw/auth"
-	"github.com/versity/versitygw/metrics"
 	"github.com/versity/versitygw/s3api/utils"
 	"github.com/versity/versitygw/s3err"
 	"github.com/versity/versitygw/s3log"
 )
 
-func VerifyPresignedV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.AuditLogger, mm *metrics.Manager, region string, debug bool) fiber.Handler {
+func VerifyPresignedV4Signature(root RootUserConfig, iam auth.IAMService, logger s3log.AuditLogger, region string, debug bool) fiber.Handler {
 	acct := accounts{root: root, iam: iam}
 
 	return func(ctx *fiber.Ctx) error {
@@ -39,16 +38,16 @@ func VerifyPresignedV4Signature(root RootUserConfig, iam auth.IAMService, logger
 
 		authData, err := utils.ParsePresignedURIParts(ctx)
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 
 		ctx.Locals("isRoot", authData.Access == root.Access)
 		account, err := acct.getAccount(authData.Access)
 		if err == auth.ErrNoSuchUser {
-			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidAccessKeyID), logger, mm)
+			return sendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidAccessKeyID), logger)
 		}
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 		ctx.Locals("account", account)
 
@@ -62,7 +61,7 @@ func VerifyPresignedV4Signature(root RootUserConfig, iam auth.IAMService, logger
 
 		err = utils.CheckPresignedSignature(ctx, authData, account.Secret, debug)
 		if err != nil {
-			return sendResponse(ctx, err, logger, mm)
+			return sendResponse(ctx, err, logger)
 		}
 
 		return ctx.Next()

s3api/middlewares/url-decoder.go

@@ -18,18 +18,17 @@ import (
 	"net/url"
 
 	"github.com/gofiber/fiber/v2"
-	"github.com/versity/versitygw/metrics"
 	"github.com/versity/versitygw/s3api/controllers"
 	"github.com/versity/versitygw/s3err"
 	"github.com/versity/versitygw/s3log"
 )
 
-func DecodeURL(logger s3log.AuditLogger, mm *metrics.Manager) fiber.Handler {
+func DecodeURL(logger s3log.AuditLogger) fiber.Handler {
 	return func(ctx *fiber.Ctx) error {
 		reqURL := ctx.Request().URI().String()
 		decoded, err := url.Parse(reqURL)
 		if err != nil {
-			return controllers.SendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidURI), &controllers.MetaOpts{Logger: logger, MetricsMng: mm})
+			return controllers.SendResponse(ctx, s3err.GetAPIError(s3err.ErrInvalidURI), &controllers.MetaOpts{Logger: logger})
 		}
 		ctx.Path(decoded.Path)
 		return ctx.Next()

s3api/router.go

@@ -18,7 +18,6 @@ import (
 	"github.com/gofiber/fiber/v2"
 	"github.com/versity/versitygw/auth"
 	"github.com/versity/versitygw/backend"
-	"github.com/versity/versitygw/metrics"
 	"github.com/versity/versitygw/s3api/controllers"
 	"github.com/versity/versitygw/s3event"
 	"github.com/versity/versitygw/s3log"
@@ -28,8 +27,8 @@ type S3ApiRouter struct {
 	WithAdmSrv bool
 }
 
-func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMService, logger s3log.AuditLogger, evs s3event.S3EventSender, mm *metrics.Manager, debug bool, readonly bool) {
-	s3ApiController := controllers.New(be, iam, logger, evs, mm, debug, readonly)
+func (sa *S3ApiRouter) Init(app *fiber.App, be backend.Backend, iam auth.IAMService, logger s3log.AuditLogger, evs s3event.S3EventSender, debug bool) {
+	s3ApiController := controllers.New(be, iam, logger, evs, debug)
 
 	if sa.WithAdmSrv {
 		adminController := controllers.NewAdminController(iam, be)

s3api/router_test.go

@@ -45,7 +45,7 @@ func TestS3ApiRouter_Init(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			tt.sa.Init(tt.args.app, tt.args.be, tt.args.iam, nil, nil, nil, false, false)
+			tt.sa.Init(tt.args.app, tt.args.be, tt.args.iam, nil, nil, false)
 		})
 	}
 }

s3api/server.go

@@ -22,35 +22,23 @@ import (
 	"github.com/gofiber/fiber/v2/middleware/logger"
 	"github.com/versity/versitygw/auth"
 	"github.com/versity/versitygw/backend"
-	"github.com/versity/versitygw/metrics"
 	"github.com/versity/versitygw/s3api/middlewares"
 	"github.com/versity/versitygw/s3event"
 	"github.com/versity/versitygw/s3log"
 )
 
 type S3ApiServer struct {
-	app      *fiber.App
-	backend  backend.Backend
-	router   *S3ApiRouter
-	port     string
-	cert     *tls.Certificate
-	quiet    bool
-	debug    bool
-	readonly bool
-	health   string
+	app     *fiber.App
+	backend backend.Backend
+	router  *S3ApiRouter
+	port    string
+	cert    *tls.Certificate
+	quiet   bool
+	debug   bool
+	health  string
 }
 
-func New(
-	app *fiber.App,
-	be backend.Backend,
-	root middlewares.RootUserConfig,
-	port, region string,
-	iam auth.IAMService,
-	l s3log.AuditLogger,
-	evs s3event.S3EventSender,
-	mm *metrics.Manager,
-	opts ...Option,
-) (*S3ApiServer, error) {
+func New(app *fiber.App, be backend.Backend, root middlewares.RootUserConfig, port, region string, iam auth.IAMService, l s3log.AuditLogger, evs s3event.S3EventSender, opts ...Option) (*S3ApiServer, error) {
 	server := &S3ApiServer{
 		app:     app,
 		backend: be,
@@ -72,17 +60,17 @@ func New(
 			return ctx.SendStatus(http.StatusOK)
 		})
 	}
-	app.Use(middlewares.DecodeURL(l, mm))
+	app.Use(middlewares.DecodeURL(l))
 	app.Use(middlewares.RequestLogger(server.debug))
 
 	// Authentication middlewares
-	app.Use(middlewares.VerifyPresignedV4Signature(root, iam, l, mm, region, server.debug))
-	app.Use(middlewares.VerifyV4Signature(root, iam, l, mm, region, server.debug))
-	app.Use(middlewares.ProcessChunkedBody(root, iam, l, mm, region))
+	app.Use(middlewares.VerifyPresignedV4Signature(root, iam, l, region, server.debug))
+	app.Use(middlewares.VerifyV4Signature(root, iam, l, region, server.debug))
+	app.Use(middlewares.ProcessChunkedBody(root, iam, l, region))
 	app.Use(middlewares.VerifyMD5Body(l))
-	app.Use(middlewares.AclParser(be, l, server.readonly))
+	app.Use(middlewares.AclParser(be, l))
 
-	server.router.Init(app, be, iam, l, evs, mm, server.debug, server.readonly)
+	server.router.Init(app, be, iam, l, evs, server.debug)
 
 	return server, nil
 }
@@ -115,10 +103,6 @@ func WithHealth(health string) Option {
 	return func(s *S3ApiServer) { s.health = health }
 }
 
-func WithReadOnly() Option {
-	return func(s *S3ApiServer) { s.readonly = true }
-}
-
 func (sa *S3ApiServer) Serve() (err error) {
 	if sa.cert != nil {
 		return sa.app.ListenTLSWithCertificate(sa.port, *sa.cert)

s3api/server_test.go

@@ -64,7 +64,7 @@ func TestNew(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			gotS3ApiServer, err := New(tt.args.app, tt.args.be, tt.args.root,
-				tt.args.port, "us-east-1", &auth.IAMServiceInternal{}, nil, nil, nil)
+				tt.args.port, "us-east-1", &auth.IAMServiceInternal{}, nil, nil)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr)
 				return

s3api/utils/auth_test.go

@@ -1,17 +1,3 @@
-// Copyright 2023 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
 package utils
 
 import (

s3api/utils/chunk-reader.go

@@ -23,7 +23,6 @@ import (
 	"fmt"
 	"hash"
 	"io"
-	"math"
 	"strconv"
 	"time"
 
@@ -193,15 +192,12 @@ func (cr *ChunkReader) parseAndRemoveChunkInfo(p []byte) (int, error) {
 		cr.chunkDataLeft = 0
 		cr.chunkHash.Write(p[:chunkSize])
 		n, err := cr.parseAndRemoveChunkInfo(p[chunkSize:n])
-		if (chunkSize + int64(n)) > math.MaxInt {
-			return 0, s3err.GetAPIError(s3err.ErrSignatureDoesNotMatch)
-		}
 		return n + int(chunkSize), err
+	} else {
+		cr.chunkDataLeft = chunkSize - int64(n)
+		cr.chunkHash.Write(p[:n])
 	}
 
-	cr.chunkDataLeft = chunkSize - int64(n)
-	cr.chunkHash.Write(p[:n])
-
 	return n, nil
 }
 
@@ -235,7 +231,6 @@ const (
 // error if any. See the AWS documentation for the chunk header format. The
 // header[0] byte is expected to be the first byte of the chunk size here.
 func (cr *ChunkReader) parseChunkHeaderBytes(header []byte) (int64, string, int, error) {
-	stashLen := len(cr.stash)
 	if cr.stash != nil {
 		tmp := make([]byte, maxHeaderSize)
 		copy(tmp, cr.stash)
@@ -270,5 +265,5 @@ func (cr *ChunkReader) parseChunkHeaderBytes(header []byte) (int64, string, int,
 	signature := string(header[sigIndex:(sigIndex + sigEndIndex)])
 	dataStartOffset := sigIndex + sigEndIndex + len(chunkHdrDelim)
 
-	return chunkSize, signature, dataStartOffset - stashLen, nil
+	return chunkSize, signature, dataStartOffset, nil
 }

s3api/utils/utils.go

@@ -26,12 +26,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/aws/smithy-go/encoding/httpbinding"
 	"github.com/gofiber/fiber/v2"
 	"github.com/valyala/fasthttp"
 	"github.com/versity/versitygw/s3err"
-	"github.com/versity/versitygw/s3response"
 )
 
 var (
@@ -224,105 +222,25 @@ func IsBigDataAction(ctx *fiber.Ctx) bool {
 	return false
 }
 
-// expiration time window
-// https://docs.aws.amazon.com/AmazonS3/latest/userguide/RESTAuthentication.html#RESTAuthenticationTimeStamp
-const timeExpirationSec = 15 * 60
-
 func ValidateDate(date time.Time) error {
 	now := time.Now().UTC()
 	diff := date.Unix() - now.Unix()
 
-	// Checks the dates difference to be within allotted window
-	if diff > timeExpirationSec || diff < -timeExpirationSec {
-		return s3err.GetAPIError(s3err.ErrRequestTimeTooSkewed)
+	// Checks the dates difference to be less than a minute
+	if diff > 60 {
+		return s3err.APIError{
+			Code:           "SignatureDoesNotMatch",
+			Description:    fmt.Sprintf("Signature not yet current: %s is still later than %s", date.Format(iso8601Format), now.Format(iso8601Format)),
+			HTTPStatusCode: http.StatusForbidden,
+		}
+	}
+	if diff < -60 {
+		return s3err.APIError{
+			Code:           "SignatureDoesNotMatch",
+			Description:    fmt.Sprintf("Signature expired: %s is now earlier than %s", date.Format(iso8601Format), now.Format(iso8601Format)),
+			HTTPStatusCode: http.StatusForbidden,
+		}
 	}
 
 	return nil
 }
-
-func ParseDeleteObjects(objs []types.ObjectIdentifier) (result []string) {
-	for _, obj := range objs {
-		result = append(result, *obj.Key)
-	}
-
-	return
-}
-
-func FilterObjectAttributes(attrs map[types.ObjectAttributes]struct{}, output s3response.GetObjectAttributesResult) s3response.GetObjectAttributesResult {
-	if _, ok := attrs[types.ObjectAttributesEtag]; !ok {
-		output.ETag = nil
-	}
-	if _, ok := attrs[types.ObjectAttributesObjectParts]; !ok {
-		output.ObjectParts = nil
-	}
-	if _, ok := attrs[types.ObjectAttributesObjectSize]; !ok {
-		output.ObjectSize = nil
-	}
-	if _, ok := attrs[types.ObjectAttributesStorageClass]; !ok {
-		output.StorageClass = nil
-	}
-
-	return output
-}
-
-func ParseObjectAttributes(ctx *fiber.Ctx) map[types.ObjectAttributes]struct{} {
-	attrs := map[types.ObjectAttributes]struct{}{}
-	ctx.Request().Header.VisitAll(func(key, value []byte) {
-		if string(key) == "X-Amz-Object-Attributes" {
-			oattrs := strings.Split(string(value), ",")
-			for _, a := range oattrs {
-				attrs[types.ObjectAttributes(a)] = struct{}{}
-			}
-		}
-	})
-
-	return attrs
-}
-
-type objLockCfg struct {
-	RetainUntilDate time.Time
-	ObjectLockMode  types.ObjectLockMode
-	LegalHoldStatus types.ObjectLockLegalHoldStatus
-}
-
-func ParsObjectLockHdrs(ctx *fiber.Ctx) (*objLockCfg, error) {
-	legalHoldHdr := ctx.Get("X-Amz-Object-Lock-Legal-Hold")
-	objLockModeHdr := ctx.Get("X-Amz-Object-Lock-Mode")
-	objLockDate := ctx.Get("X-Amz-Object-Lock-Retain-Until-Date")
-
-	if (objLockDate != "" && objLockModeHdr == "") || (objLockDate == "" && objLockModeHdr != "") {
-		return nil, s3err.GetAPIError(s3err.ErrObjectLockInvalidHeaders)
-	}
-
-	var retainUntilDate time.Time
-	if objLockDate != "" {
-		rDate, err := time.Parse(time.RFC3339, objLockDate)
-		if err != nil {
-			return nil, s3err.GetAPIError(s3err.ErrInvalidRequest)
-		}
-		if rDate.Before(time.Now()) {
-			return nil, s3err.GetAPIError(s3err.ErrPastObjectLockRetainDate)
-		}
-		retainUntilDate = rDate
-	}
-
-	objLockMode := types.ObjectLockMode(objLockModeHdr)
-
-	if objLockMode != "" &&
-		objLockMode != types.ObjectLockModeCompliance &&
-		objLockMode != types.ObjectLockModeGovernance {
-		return nil, s3err.GetAPIError(s3err.ErrInvalidRequest)
-	}
-
-	legalHold := types.ObjectLockLegalHoldStatus(legalHoldHdr)
-
-	if legalHold != "" && legalHold != types.ObjectLockLegalHoldStatusOff && legalHold != types.ObjectLockLegalHoldStatusOn {
-		return nil, s3err.GetAPIError(s3err.ErrInvalidRequest)
-	}
-
-	return &objLockCfg{
-		RetainUntilDate: retainUntilDate,
-		ObjectLockMode:  objLockMode,
-		LegalHoldStatus: legalHold,
-	}, nil
-}

s3api/utils/utils_test.go

@@ -1,17 +1,3 @@
-// Copyright 2023 Versity Software
-// This file is licensed under the Apache License, Version 2.0
-// (the "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
 package utils
 
 import (
@@ -20,10 +6,8 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/aws/aws-sdk-go-v2/service/s3/types"
 	"github.com/gofiber/fiber/v2"
 	"github.com/valyala/fasthttp"
-	"github.com/versity/versitygw/s3response"
 )
 
 func TestCreateHttpRequestFromCtx(t *testing.T) {
@@ -280,58 +264,3 @@ func TestParseUint(t *testing.T) {
 		})
 	}
 }
-
-func TestFilterObjectAttributes(t *testing.T) {
-	type args struct {
-		attrs  map[types.ObjectAttributes]struct{}
-		output s3response.GetObjectAttributesResult
-	}
-	etag, objSize := "etag", int64(3222)
-	tests := []struct {
-		name string
-		args args
-		want s3response.GetObjectAttributesResult
-	}{
-		{
-			name: "keep only ETag",
-			args: args{
-				attrs: map[types.ObjectAttributes]struct{}{
-					types.ObjectAttributesEtag: {},
-				},
-				output: s3response.GetObjectAttributesResult{
-					ObjectSize: &objSize,
-					ETag:       &etag,
-				},
-			},
-			want: s3response.GetObjectAttributesResult{ETag: &etag},
-		},
-		{
-			name: "keep multiple props",
-			args: args{
-				attrs: map[types.ObjectAttributes]struct{}{
-					types.ObjectAttributesEtag:         {},
-					types.ObjectAttributesObjectSize:   {},
-					types.ObjectAttributesStorageClass: {},
-				},
-				output: s3response.GetObjectAttributesResult{
-					ObjectSize:  &objSize,
-					ETag:        &etag,
-					ObjectParts: &s3response.ObjectParts{},
-					VersionId:   &etag,
-				},
-			},
-			want: s3response.GetObjectAttributesResult{
-				ETag:       &etag,
-				ObjectSize: &objSize,
-				VersionId:  &etag,
-			},
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := FilterObjectAttributes(tt.args.attrs, tt.args.output); !reflect.DeepEqual(got, tt.want) {
-				t.Errorf("FilterObjectAttributes() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}

s3err/s3err.go

@@ -69,7 +69,6 @@ const (
 	ErrInvalidMaxParts
 	ErrInvalidPartNumberMarker
 	ErrInvalidPart
-	ErrInvalidPartNumber
 	ErrInternalError
 	ErrInvalidCopyDest
 	ErrInvalidCopySource
@@ -112,17 +111,6 @@ const (
 	ErrInvalidObjectState
 	ErrInvalidRange
 	ErrInvalidURI
-	ErrObjectLockConfigurationNotFound
-	ErrNoSuchObjectLockConfiguration
-	ErrInvalidBucketObjectLockConfiguration
-	ErrObjectLockConfigurationNotAllowed
-	ErrObjectLocked
-	ErrPastObjectLockRetainDate
-	ErrObjectLockInvalidRetentionPeriod
-	ErrNoSuchBucketPolicy
-	ErrBucketTaggingNotFound
-	ErrObjectLockInvalidHeaders
-	ErrRequestTimeTooSkewed
 
 	// Non-AWS errors
 	ErrExistingObjectIsDirectory
@@ -212,11 +200,6 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "One or more of the specified parts could not be found.  The part may not have been uploaded, or the specified entity tag may not match the part's entity tag.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
-	ErrInvalidPartNumber: {
-		Code:           "InvalidArgument",
-		Description:    "Part number must be an integer between 1 and 10000, inclusive",
-		HTTPStatusCode: http.StatusBadRequest,
-	},
 	ErrInvalidCopyDest: {
 		Code:           "InvalidRequest",
 		Description:    "This copy request is illegal because it is trying to copy an object to itself without changing the object's metadata, storage class, website redirect location or encryption attributes.",
@@ -417,63 +400,6 @@ var errorCodeResponse = map[ErrorCode]APIError{
 		Description:    "The specified URI couldn't be parsed.",
 		HTTPStatusCode: http.StatusBadRequest,
 	},
-	ErrObjectLockConfigurationNotFound: {
-		Code:           "ObjectLockConfigurationNotFoundError",
-		Description:    "Object Lock configuration does not exist for this bucket",
-		HTTPStatusCode: http.StatusNotFound,
-	},
-	ErrNoSuchObjectLockConfiguration: {
-		Code:           "NoSuchObjectLockConfiguration",
-		Description:    "The specified object does not have an ObjectLock configuration",
-		HTTPStatusCode: http.StatusBadRequest,
-	},
-	ErrInvalidBucketObjectLockConfiguration: {
-		Code:           "InvalidRequest",
-		Description:    "Bucket is missing ObjectLockConfiguration",
-		HTTPStatusCode: http.StatusBadRequest,
-	},
-	ErrObjectLockConfigurationNotAllowed: {
-		Code:           "InvalidBucketState",
-		Description:    "Object Lock configuration cannot be enabled on existing buckets",
-		HTTPStatusCode: http.StatusConflict,
-	},
-	ErrObjectLocked: {
-		Code:           "InvalidRequest",
-		Description:    "Object is WORM protected and cannot be overwritten",
-		HTTPStatusCode: http.StatusBadRequest,
-	},
-	ErrPastObjectLockRetainDate: {
-		Code:           "InvalidRequest",
-		Description:    "the retain until date must be in the future",
-		HTTPStatusCode: http.StatusBadRequest,
-	},
-	ErrObjectLockInvalidRetentionPeriod: {
-		Code:           "InvalidRetentionPeriod",
-		Description:    "the retention days/years must be positive integer",
-		HTTPStatusCode: http.StatusBadRequest,
-	},
-	ErrNoSuchBucketPolicy: {
-		Code:           "NoSuchBucketPolicy",
-		Description:    "The bucket policy does not exist",
-		HTTPStatusCode: http.StatusNotFound,
-	},
-	ErrBucketTaggingNotFound: {
-		Code:           "NoSuchTagSet",
-		Description:    "The TagSet does not exist",
-		HTTPStatusCode: http.StatusNotFound,
-	},
-	ErrObjectLockInvalidHeaders: {
-		Code:           "InvalidRequest",
-		Description:    "x-amz-object-lock-retain-until-date and x-amz-object-lock-mode must both be supplied",
-		HTTPStatusCode: http.StatusBadRequest,
-	},
-	ErrRequestTimeTooSkewed: {
-		Code:           "RequestTimeTooSkewed",
-		Description:    "The difference between the request time and the server's time is too large.",
-		HTTPStatusCode: http.StatusForbidden,
-	},
-
-	// non aws errors
 	ErrExistingObjectIsDirectory: {
 		Code:           "ExistingObjectIsDirectory",
 		Description:    "Existing Object is a directory.",

s3event/event.go

@@ -37,11 +37,11 @@ type EventMeta struct {
 	VersionId   *string
 }
 
-type EventSchema struct {
-	Records []EventRecord
+type EventFields struct {
+	Records []EventSchema
 }
 
-type EventRecord struct {
+type EventSchema struct {
 	EventVersion      string                `json:"eventVersion"`
 	EventSource       string                `json:"eventSource"`
 	AwsRegion         string                `json:"awsRegion"`
@@ -117,7 +117,7 @@ type EventConfig struct {
 }
 
 func InitEventSender(cfg *EventConfig) (S3EventSender, error) {
-	filter, err := parseEventFiltersFile(cfg.FilterConfigFilePath)
+	filter, err := parseEventFilters(cfg.FilterConfigFilePath)
 	if err != nil {
 		return nil, fmt.Errorf("parse event filter config file %w", err)
 	}
@@ -139,54 +139,54 @@ func InitEventSender(cfg *EventConfig) (S3EventSender, error) {
 	return evSender, err
 }
 
-func createEventSchema(ctx *fiber.Ctx, meta EventMeta, configId ConfigurationId) EventSchema {
+func createEventSchema(ctx *fiber.Ctx, meta EventMeta, configId ConfigurationId) ([]byte, error) {
 	path := strings.Split(ctx.Path(), "/")
 	bucket, object := path[1], strings.Join(path[2:], "/")
 	acc := ctx.Locals("account").(auth.Account)
 
-	return EventSchema{
-		Records: []EventRecord{
-			{
-				EventVersion: "2.2",
-				EventSource:  "aws:s3",
-				AwsRegion:    ctx.Locals("region").(string),
-				EventTime:    time.Now().Format(time.RFC3339),
-				EventName:    meta.EventName,
-				UserIdentity: EventUserIdentity{
-					PrincipalId: acc.Access,
-				},
-				RequestParameters: EventRequestParams{
-					SourceIPAddress: ctx.IP(),
-				},
-				ResponseElements: EventResponseElements{
-					RequestId: ctx.Get("X-Amz-Request-Id"),
-					HostId:    ctx.Get("X-Amz-Id-2"),
-				},
-				S3: EventS3Data{
-					S3SchemaVersion: "1.0",
-					ConfigurationId: configId,
-					Bucket: EventS3BucketData{
-						Name: bucket,
-						OwnerIdentity: EventUserIdentity{
-							PrincipalId: meta.BucketOwner,
-						},
-						Arn: fmt.Sprintf("arn:aws:s3:::%v", strings.Join(path, "/")),
-					},
-					Object: EventObjectData{
-						Key:       object,
-						Size:      meta.ObjectSize,
-						ETag:      meta.ObjectETag,
-						VersionId: meta.VersionId,
-						Sequencer: genSequencer(),
+	event := []EventSchema{
+		{
+			EventVersion: "2.2",
+			EventSource:  "aws:s3",
+			AwsRegion:    ctx.Locals("region").(string),
+			EventTime:    time.Now().Format(time.RFC3339),
+			EventName:    meta.EventName,
+			UserIdentity: EventUserIdentity{
+				PrincipalId: acc.Access,
+			},
+			RequestParameters: EventRequestParams{
+				SourceIPAddress: ctx.IP(),
+			},
+			ResponseElements: EventResponseElements{
+				RequestId: ctx.Get("X-Amz-Request-Id"),
+				HostId:    ctx.Get("X-Amz-Id-2"),
+			},
+			S3: EventS3Data{
+				S3SchemaVersion: "1.0",
+				ConfigurationId: configId,
+				Bucket: EventS3BucketData{
+					Name: bucket,
+					OwnerIdentity: EventUserIdentity{
+						PrincipalId: meta.BucketOwner,
 					},
+					Arn: fmt.Sprintf("arn:aws:s3:::%v", strings.Join(path, "/")),
 				},
-				GlacierEventData: EventGlacierData{
-					// Not supported
-					RestoreEventData: EventRestoreData{},
+				Object: EventObjectData{
+					Key:       object,
+					Size:      meta.ObjectSize,
+					ETag:      meta.ObjectETag,
+					VersionId: meta.VersionId,
+					Sequencer: genSequencer(),
 				},
 			},
+			GlacierEventData: EventGlacierData{
+				// Not supported
+				RestoreEventData: EventRestoreData{},
+			},
 		},
 	}
+
+	return json.Marshal(event)
 }
 
 func generateTestEvent() ([]byte, error) {

s3event/filter.go

@@ -17,7 +17,6 @@ package s3event
 import (
 	"encoding/json"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -26,21 +25,19 @@ import (
 type EventType string
 
 const (
-	EventObjectCreated              EventType = "s3:ObjectCreated:*" // ObjectCreated
-	EventObjectCreatedPut           EventType = "s3:ObjectCreated:Put"
-	EventObjectCreatedPost          EventType = "s3:ObjectCreated:Post"
-	EventObjectCreatedCopy          EventType = "s3:ObjectCreated:Copy"
-	EventCompleteMultipartUpload    EventType = "s3:ObjectCreated:CompleteMultipartUpload"
-	EventObjectRemoved              EventType = "s3:ObjectRemoved:*"
-	EventObjectRemovedDelete        EventType = "s3:ObjectRemoved:Delete"
-	EventObjectRemovedDeleteObjects EventType = "s3:ObjectRemoved:DeleteObjects" // non AWS custom type for DeleteObjects
-	EventObjectTagging              EventType = "s3:ObjectTagging:*"             // ObjectTagging
-	EventObjectTaggingPut           EventType = "s3:ObjectTagging:Put"
-	EventObjectTaggingDelete        EventType = "s3:ObjectTagging:Delete"
-	EventObjectAclPut               EventType = "s3:ObjectAcl:Put"
-	EventObjectRestore              EventType = "s3:ObjectRestore:*" // ObjectRestore
-	EventObjectRestorePost          EventType = "s3:ObjectRestore:Post"
-	EventObjectRestoreCompleted     EventType = "s3:ObjectRestore:Completed"
+	EventObjectCreated           EventType = "s3:ObjectCreated:*" // ObjectCreated
+	EventObjectCreatedPut        EventType = "s3:ObjectCreated:Put"
+	EventObjectCreatedPost       EventType = "s3:ObjectCreated:Post"
+	EventObjectCreatedCopy       EventType = "s3:ObjectCreated:Copy"
+	EventCompleteMultipartUpload EventType = "s3:ObjectCreated:CompleteMultipartUpload"
+	EventObjectDeleted           EventType = "s3:ObjectRemoved:Delete" // ObjectRemoved
+	EventObjectTagging           EventType = "s3:ObjectTagging:*"      // ObjectTagging
+	EventObjectTaggingPut        EventType = "s3:ObjectTagging:Put"
+	EventObjectTaggingDelete     EventType = "s3:ObjectTagging:Delete"
+	EventObjectAclPut            EventType = "s3:ObjectAcl:Put"
+	EventObjectRestore           EventType = "s3:ObjectRestore:*" // ObjectRestore
+	EventObjectRestorePost       EventType = "s3:ObjectRestore:Post"
+	EventObjectRestoreCompleted  EventType = "s3:ObjectRestore:Completed"
 	// EventObjectRestorePost       EventType = "s3:ObjectRestore:Post"
 	// EventObjectRestoreDelete     EventType = "s3:ObjectRestore:Delete"
 )
@@ -51,26 +48,24 @@ func (event EventType) IsValid() bool {
 }
 
 var supportedEventFilters = map[EventType]struct{}{
-	EventObjectCreated:              {},
-	EventObjectCreatedPut:           {},
-	EventObjectCreatedPost:          {},
-	EventObjectCreatedCopy:          {},
-	EventCompleteMultipartUpload:    {},
-	EventObjectRemoved:              {},
-	EventObjectRemovedDelete:        {},
-	EventObjectRemovedDeleteObjects: {},
-	EventObjectTagging:              {},
-	EventObjectTaggingPut:           {},
-	EventObjectTaggingDelete:        {},
-	EventObjectAclPut:               {},
-	EventObjectRestore:              {},
-	EventObjectRestorePost:          {},
-	EventObjectRestoreCompleted:     {},
+	EventObjectCreated:           {},
+	EventObjectCreatedPut:        {},
+	EventObjectCreatedPost:       {},
+	EventObjectCreatedCopy:       {},
+	EventCompleteMultipartUpload: {},
+	EventObjectDeleted:           {},
+	EventObjectTagging:           {},
+	EventObjectTaggingPut:        {},
+	EventObjectTaggingDelete:     {},
+	EventObjectAclPut:            {},
+	EventObjectRestore:           {},
+	EventObjectRestorePost:       {},
+	EventObjectRestoreCompleted:  {},
 }
 
 type EventFilter map[EventType]bool
 
-func parseEventFiltersFile(path string) (EventFilter, error) {
+func parseEventFilters(path string) (EventFilter, error) {
 	// if no filter config file path is specified return nil map
 	if path == "" {
 		return nil, nil
@@ -88,12 +83,8 @@ func parseEventFiltersFile(path string) (EventFilter, error) {
 	}
 	defer file.Close()
 
-	return parseEventFilters(file)
-}
-
-func parseEventFilters(r io.Reader) (EventFilter, error) {
 	var filter EventFilter
-	if err := json.NewDecoder(r).Decode(&filter); err != nil {
+	if err := json.NewDecoder(file).Decode(&filter); err != nil {
 		return nil, err
 	}
 
@@ -121,7 +112,7 @@ func (ef EventFilter) Filter(event EventType) bool {
 	}
 
 	// check wildcard match
-	wildCardEv := EventType(string(event[:strings.LastIndex(string(event), ":")+1]) + "*")
+	wildCardEv := EventType(string(event[strings.LastIndex(string(event), ":")+1]) + "*")
 	wildcard, found := ef[wildCardEv]
 	if found {
 		return wildcard

s3event/filter_test.go

@@ -1,52 +0,0 @@
-package s3event
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestFilterWildcardCreated(t *testing.T) {
-	filterString := `{"s3:ObjectCreated:*": true}`
-	strReader := strings.NewReader(filterString)
-
-	ef, err := parseEventFilters(strReader)
-	if err != nil {
-		t.Fatalf("failed to parse event filter: %v", err)
-	}
-
-	created := []string{
-		"s3:ObjectCreated:Put",
-		"s3:ObjectCreated:Post",
-		"s3:ObjectCreated:Copy",
-		"s3:ObjectCreated:CompleteMultipartUpload",
-	}
-
-	for _, event := range created {
-		allowed := ef.Filter(EventType(event))
-		if !allowed {
-			t.Errorf("expected event to be allowed: %s", event)
-		}
-	}
-}
-
-func TestFilterWildcardRemoved(t *testing.T) {
-	filterString := `{"s3:ObjectRemoved:*": true}`
-	strReader := strings.NewReader(filterString)
-
-	ef, err := parseEventFilters(strReader)
-	if err != nil {
-		t.Fatalf("failed to parse event filter: %v", err)
-	}
-
-	removed := []string{
-		"s3:ObjectRemoved:Delete",
-		"s3:ObjectRemoved:DeleteObjects",
-	}
-
-	for _, event := range removed {
-		allowed := ef.Filter(EventType(event))
-		if !allowed {
-			t.Errorf("expected event to be allowed: %s", event)
-		}
-	}
-}

s3event/kafka.go

@@ -16,8 +16,6 @@ package s3event
 
 import (
 	"context"
-	"encoding/json"
-	"encoding/xml"
 	"fmt"
 	"os"
 	"sync"
@@ -25,7 +23,6 @@ import (
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/segmentio/kafka-go"
-	"github.com/versity/versitygw/s3response"
 )
 
 var sequencer = 0
@@ -81,29 +78,12 @@ func (ks *Kafka) SendEvent(ctx *fiber.Ctx, meta EventMeta) {
 		return
 	}
 
-	if meta.EventName == EventObjectRemovedDeleteObjects {
-		var dObj s3response.DeleteObjects
-
-		if err := xml.Unmarshal(ctx.Body(), &dObj); err != nil {
-			fmt.Fprintf(os.Stderr, "failed to parse delete objects input payload: %v\n", err.Error())
-			return
-		}
-
-		// Events aren't send in correct order
-		for _, obj := range dObj.Objects {
-			key := *obj.Key
-			schema := createEventSchema(ctx, meta, ConfigurationIdWebhook)
-			schema.Records[0].S3.Object.Key = key
-			schema.Records[0].S3.Object.VersionId = obj.VersionId
-
-			go ks.send(schema)
-		}
-
+	schema, err := createEventSchema(ctx, meta, ConfigurationIdKafka)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to create kafka event: %v\n", err.Error())
 		return
 	}
 
-	schema := createEventSchema(ctx, meta, ConfigurationIdWebhook)
-
 	go ks.send(schema)
 }
 
@@ -111,20 +91,14 @@ func (ks *Kafka) Close() error {
 	return ks.writer.Close()
 }
 
-func (ks *Kafka) send(event EventSchema) {
-	eventBytes, err := json.Marshal(event)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "failed to parse event data: %v\n", err.Error())
-		return
-	}
-
+func (ks *Kafka) send(event []byte) {
 	message := kafka.Message{
 		Key:   []byte(ks.key),
-		Value: eventBytes,
+		Value: event,
 	}
 
 	ctx := context.Background()
-	err = ks.writer.WriteMessages(ctx, message)
+	err := ks.writer.WriteMessages(ctx, message)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "failed to send kafka event: %v\n", err.Error())
 	}

s3event/nats.go

@@ -15,15 +15,12 @@
 package s3event
 
 import (
-	"encoding/json"
-	"encoding/xml"
 	"fmt"
 	"os"
 	"sync"
 
 	"github.com/gofiber/fiber/v2"
 	"github.com/nats-io/nats.go"
-	"github.com/versity/versitygw/s3response"
 )
 
 type NatsEventSender struct {
@@ -68,29 +65,12 @@ func (ns *NatsEventSender) SendEvent(ctx *fiber.Ctx, meta EventMeta) {
 		return
 	}
 
-	if meta.EventName == EventObjectRemovedDeleteObjects {
-		var dObj s3response.DeleteObjects
-
-		if err := xml.Unmarshal(ctx.Body(), &dObj); err != nil {
-			fmt.Fprintf(os.Stderr, "failed to parse delete objects input payload: %v\n", err.Error())
-			return
-		}
-
-		// Events aren't send in correct order
-		for _, obj := range dObj.Objects {
-			key := *obj.Key
-			schema := createEventSchema(ctx, meta, ConfigurationIdWebhook)
-			schema.Records[0].S3.Object.Key = key
-			schema.Records[0].S3.Object.VersionId = obj.VersionId
-
-			go ns.send(schema)
-		}
-
+	schema, err := createEventSchema(ctx, meta, ConfigurationIdNats)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to create nats event: %v\n", err.Error())
 		return
 	}
 
-	schema := createEventSchema(ctx, meta, ConfigurationIdWebhook)
-
 	go ns.send(schema)
 }
 
@@ -99,13 +79,8 @@ func (ns *NatsEventSender) Close() error {
 	return nil
 }
 
-func (ns *NatsEventSender) send(event EventSchema) {
-	eventBytes, err := json.Marshal(event)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "failed to parse event data: %v\n", err.Error())
-		return
-	}
-	err = ns.client.Publish(ns.topic, eventBytes)
+func (ns *NatsEventSender) send(event []byte) {
+	err := ns.client.Publish(ns.topic, event)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "failed to send nats event: %v\n", err.Error())
 	}

s3event/webhook.go

@@ -16,8 +16,6 @@ package s3event
 
 import (
 	"bytes"
-	"encoding/json"
-	"encoding/xml"
 	"fmt"
 	"net"
 	"net/http"
@@ -26,7 +24,6 @@ import (
 	"time"
 
 	"github.com/gofiber/fiber/v2"
-	"github.com/versity/versitygw/s3response"
 )
 
 type Webhook struct {
@@ -80,29 +77,12 @@ func (w *Webhook) SendEvent(ctx *fiber.Ctx, meta EventMeta) {
 		return
 	}
 
-	if meta.EventName == EventObjectRemovedDeleteObjects {
-		var dObj s3response.DeleteObjects
-
-		if err := xml.Unmarshal(ctx.Body(), &dObj); err != nil {
-			fmt.Fprintf(os.Stderr, "failed to parse delete objects input payload: %v\n", err.Error())
-			return
-		}
-
-		// Events aren't send in correct order
-		for _, obj := range dObj.Objects {
-			key := *obj.Key
-			schema := createEventSchema(ctx, meta, ConfigurationIdWebhook)
-			schema.Records[0].S3.Object.Key = key
-			schema.Records[0].S3.Object.VersionId = obj.VersionId
-
-			go w.send(schema)
-		}
-
+	schema, err := createEventSchema(ctx, meta, ConfigurationIdWebhook)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to create webhook event: %v\n", err.Error())
 		return
 	}
 
-	schema := createEventSchema(ctx, meta, ConfigurationIdWebhook)
-
 	go w.send(schema)
 }
 
@@ -110,14 +90,8 @@ func (w *Webhook) Close() error {
 	return nil
 }
 
-func (w *Webhook) send(event EventSchema) {
-	eventBytes, err := json.Marshal(event)
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "failed to parse event data: %v\n", err.Error())
-		return
-	}
-
-	req, err := http.NewRequest(http.MethodPost, w.url, bytes.NewReader(eventBytes))
+func (w *Webhook) send(event []byte) {
+	req, err := http.NewRequest(http.MethodPost, w.url, bytes.NewReader(event))
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "failed to create webhook event request: %v\n", err.Error())
 		return

s3response/s3response.go

@@ -52,23 +52,6 @@ type ListPartsResult struct {
 	Parts []Part `xml:"Part"`
 }
 
-type GetObjectAttributesResult struct {
-	ETag         *string
-	LastModified *time.Time
-	ObjectSize   *int64
-	StorageClass *types.StorageClass
-	VersionId    *string
-	ObjectParts  *ObjectParts
-}
-
-type ObjectParts struct {
-	PartNumberMarker     int
-	NextPartNumberMarker int
-	MaxParts             int
-	IsTruncated          bool
-	Parts                []types.ObjectPart `xml:"Part"`
-}
-
 // ListMultipartUploadsResponse - s3 api list multipart uploads response.
 type ListMultipartUploadsResult struct {
 	XMLName xml.Name `xml:"http://s3.amazonaws.com/doc/2006-03-01/ ListMultipartUploadsResult" json:"-"`

tests/.env.default

@@ -6,12 +6,11 @@ BACKEND=posix
 LOCAL_FOLDER=/tmp/gw
 BUCKET_ONE_NAME=versity-gwtest-bucket-one
 BUCKET_TWO_NAME=versity-gwtest-bucket-two
-RECREATE_BUCKETS=true
+#RECREATE_BUCKETS=true
 CERT=$PWD/cert.pem
 KEY=$PWD/versitygw.pem
 S3CMD_CONFIG=./tests/s3cfg.local.default
 SECRETS_FILE=./tests/.secrets
 MC_ALIAS=versity
 LOG_LEVEL=2
-GOCOVERDIR=$PWD/cover
-USERS_FOLDER=$PWD/iam
+GOCOVERDIR=$PWD/cover

tests/.env.s3.default

@@ -0,0 +1,14 @@
+AWS_PROFILE=versity_s3
+AWS_ENDPOINT_URL=https://127.0.0.1:7070
+VERSITY_EXE=./versitygw
+RUN_VERSITYGW=true
+BACKEND=s3
+LOCAL_FOLDER=/tmp/gw
+BUCKET_ONE_NAME=versity-gwtest-bucket-one
+BUCKET_TWO_NAME=versity-gwtest-bucket-two
+#RECREATE_BUCKETS=true
+CERT=$PWD/cert.pem
+KEY=$PWD/versitygw.pem
+S3CMD_CONFIG=./tests/s3cfg.local.default
+SECRETS_FILE=./tests/.secrets.s3
+MC_ALIAS=versity_s3

tests/README.md

@@ -36,38 +36,12 @@ Instructions are mostly the same; however, testing with the S3 backend requires
 
 To set up the latter:
 1. Create a new AWS profile with ID and key values set to dummy 20-char allcaps and 40-char alphabetical values respectively.
-2. In the `.secrets` file being used, create the fields `AWS_ACCESS_KEY_ID_TWO` and `AWS_SECRET_ACCESS_KEY_TWO`.  Set these values to the actual AWS ID and key.  
-3. Set the values for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` the same dummy values set in the AWS profile, and set `AWS_PROFILE` to the profile you just created.
-4. Create a new AWS profile with these dummy values.  In the `.env` file being used, set the `AWS_PROFILE` parameter to the name of this new profile, and the ID and key fields to the dummy values.  
-5. Set `BACKEND` to `s3`.  Also, change the `MC_ALIAS` value if testing **mc** in this configuration.
-
-### Direct Mode
-
-To communicate directly with s3, in order to compare the gateway results to direct results:
-1.  Create an AWS profile with the direct connection info.  Set `AWS_PROFILE` to this.
-2.  Set `RUN_VERSITYGW` to false.
-3.  Set `AWS_ENDPOINT_URL` to the typical endpoint location (usually `https://s3.amazonaws.com`).
-4.  If testing **s3cmd**, create a new `s3cfg.local` file with `host_base` and `host_bucket` set to `s3.amazonaws.com`.
-5.  If testing **mc**, change the `MC_ALIAS` value to a new value such as `versity-direct`.
+1. In the `.secrets` file being used, create the fields `AWS_ACCESS_KEY_ID_TWO` and `AWS_SECRET_ACCESS_KEY_TWO`.  Set these values to the actual AWS ID and key.  
+2. Set the values for `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` the same dummy values set in the AWS profile, and set `AWS_PROFILE` to the profile you just created.
+3. Create a new AWS profile with these dummy values.  In the `.env` file being used, set the `AWS_PROFILE` parameter to the name of this new profile, and the ID and key fields to the dummy values.  
+4. Set `BACKEND` to `s3`.  Also, change the `MC_ALIAS` value if testing **mc** in this configuration.
 
 ## Instructions - Running With Docker
 
-1.  Create a `.secrets` file in the `tests` folder, and add the `AWS_PROFILE`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and the `AWS_PROFILE` fields, as well as the additional s3 fields explained in the **S3 Backend** section above if running with the s3 backend.
-2.  Build and run the `Dockerfile_test_bats` file.  Change the `SECRETS_FILE` and `CONFIG_FILE` parameters to point to your secrets and config file, respectively.  Example:  `docker build -t <tag> -f Dockerfile_test_bats --build-arg="SECRETS_FILE=<file>" --build-arg="CONFIG_FILE=<file>" .`.
-
-## Instructions - Running with docker-compose
-
-A file named `docker-compose-bats.yml` is provided in the root folder.  Four configurations are provided:
-* insecure (without certificates), with creation/removal of buckets
-* secure, posix backend, with static buckets
-* secure, posix backend, with creation/removal of buckets
-* secure, s3 backend, with creation/removal of buckets
-* direct mode
-
-To use each of these, creating a separate `.env` file for each is suggested.  How to do so is explained below.
-
-To run in insecure mode, comment out the `CERT` and `KEY` parameters in the `.env` file, and change the prefix for the `AWS_ENDPOINT_URL` parameter to `http://`.  Also, set `S3CMD_CONFIG` to point to a copy of the default s3cmd config file that has `use_https` set to false.  Finally, change `MC_ALIAS` to something new to avoid overwriting the secure `MC_ALIAS` values.
-
-To use static buckets set the `RECREATE_BUCKETS` value to `false`.
-
-For the s3 backend, see the **S3 Backend** instructions above.
+1.  Create a `.secrets` file in the `tests` folder, and add the `AWS_PROFILE`, `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and the `AWS_PROFILE` fields.
+2.  Build and run the `Dockerfile_test_bats` file.  Change the `SECRETS_FILE` and `CONFIG_FILE` parameters to point to an S3-backend-friendly config.  Example:  `docker build -t <tag> -f Dockerfile_test_bats --build-arg="SECRETS_FILE=<file>" --build-arg="CONFIG_FILE=<file>" .`.

tests/commands/abort_multipart_upload.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-abort_multipart_upload() {
-  if [ $# -ne 3 ]; then
-    echo "command to run abort requires bucket, key, upload ID"
-    return 1
-  fi
-
-  error=$(aws --no-verify-ssl s3api abort-multipart-upload --bucket "$1" --key "$2" --upload-id "$3") || local aborted=$?
-  if [[ $aborted -ne 0 ]]; then
-    echo "Error aborting upload: $error"
-    return 1
-  fi
-  return 0
-}

tests/commands/complete_multipart_upload.sh

@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-complete_multipart_upload() {
-  if [[ $# -ne 4 ]]; then
-    log 2 "'complete multipart upload' command requires bucket, key, upload ID, parts list"
-    return 1
-  fi
-  log 5 "complete multipart upload id: $3, parts: $4"
-  error=$(aws --no-verify-ssl s3api complete-multipart-upload --bucket "$1" --key "$2" --upload-id "$3" --multipart-upload '{"Parts": '"$4"'}' 2>&1) || local completed=$?
-  if [[ $completed -ne 0 ]]; then
-    log 2 "error completing multipart upload: $error"
-    return 1
-  fi
-  log 5 "complete multipart upload error: $error"
-  return 0
-}

tests/commands/copy_object.sh

@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-
-copy_object() {
-  if [ $# -ne 4 ]; then
-    echo "copy object command requires command type, source, bucket, key"
-    return 1
-  fi
-  local exit_code=0
-  local error
-  if [[ $1 == 's3' ]]; then
-    error=$(aws --no-verify-ssl s3 cp "$2" s3://"$3/$4" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    error=$(aws --no-verify-ssl s3api copy-object --copy-source "$2" --bucket "$3" --key "$4" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate cp "s3://$2" s3://"$3/$4" 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    error=$(mc --insecure cp "$MC_ALIAS/$2" "$MC_ALIAS/$3/$4" 2>&1) || exit_code=$?
-  else
-    echo "'copy-object' not implemented for '$1'"
-    return 1
-  fi
-  log 5 "copy object exit code: $exit_code"
-  if [ $exit_code -ne 0 ]; then
-    echo "error copying object to bucket: $error"
-    return 1
-  fi
-  return 0
-}
-
-copy_object_empty() {
-  error=$(aws --no-verify-ssl s3api copy-object 2>&1) || local result=$?
-  if [[ $result -eq 0 ]]; then
-    log 2 "copy object with empty parameters returned no error"
-    return 1
-  fi
-  if [[ $error != *"the following arguments are required: --bucket, --copy-source, --key" ]]; then
-    log 2 "copy object with no params returned mismatching error: $error"
-    return 1
-  fi
-  return 0
-}

tests/commands/create_bucket.sh

@@ -1,46 +0,0 @@
-#!/usr/bin/env bash
-
-# create an AWS bucket
-# param:  bucket name
-# return 0 for success, 1 for failure
-create_bucket() {
-  if [ $# -ne 2 ]; then
-    echo "create bucket missing command type, bucket name"
-    return 1
-  fi
-
-  local exit_code=0
-  local error
-  if [[ $1 == 's3' ]]; then
-    error=$(aws --no-verify-ssl s3 mb s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "aws" ]] || [[ $1 == 's3api' ]]; then
-    error=$(aws --no-verify-ssl s3api create-bucket --bucket "$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "s3cmd" ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate mb s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "mc" ]]; then
-    error=$(mc --insecure mb "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
-  else
-    echo "invalid command type $1"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    echo "error creating bucket: $error"
-    return 1
-  fi
-  return 0
-}
-
-create_bucket_object_lock_enabled() {
-  if [ $# -ne 1 ]; then
-    log 2 "create bucket missing bucket name"
-    return 1
-  fi
-
-  local exit_code=0
-  error=$(aws --no-verify-ssl s3api create-bucket --bucket "$1" 2>&1 --object-lock-enabled-for-bucket) || local exit_code=$?
-  if [ $exit_code -ne 0 ]; then
-    log 2 "error creating bucket: $error"
-    return 1
-  fi
-  return 0
-}

tests/commands/create_multipart_upload.sh

@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-
-# initialize a multipart upload
-# params:  bucket, key
-# return 0 for success, 1 for failure
-create_multipart_upload() {
-  if [ $# -ne 2 ]; then
-    log 2 "create multipart upload function must have bucket, key"
-    return 1
-  fi
-
-  local multipart_data
-  multipart_data=$(aws --no-verify-ssl s3api create-multipart-upload --bucket "$1" --key "$2") || local created=$?
-  if [[ $created -ne 0 ]]; then
-    log 2 "Error creating multipart upload: $upload_id"
-    return 1
-  fi
-
-  upload_id=$(echo "$multipart_data" | jq '.UploadId')
-  upload_id="${upload_id//\"/}"
-  export upload_id
-}
-
-create_multipart_upload_params() {
-  if [ $# -ne 8 ]; then
-    log 2 "create multipart upload function with params must have bucket, key, content type, metadata, object lock legal hold status, " \
-      "object lock mode, object lock retain until date, and tagging"
-    return 1
-  fi
-  local multipart_data
-  multipart_data=$(aws --no-verify-ssl s3api create-multipart-upload \
-    --bucket "$1" \
-    --key "$2" \
-    --content-type "$3" \
-    --metadata "$4" \
-    --object-lock-legal-hold-status "$5" \
-    --object-lock-mode "$6" \
-    --object-lock-retain-until-date "$7" \
-    --tagging "$8" 2>&1) || local create_result=$?
-  if [[ $create_result -ne 0 ]]; then
-    log 2 "error creating multipart upload with params: $multipart_data"
-    return 1
-  fi
-  export multipart_data
-  upload_id=$(echo "$multipart_data" | grep -v "InsecureRequestWarning" | jq '.UploadId')
-  upload_id="${upload_id//\"/}"
-  export upload_id
-  return 0
-}
-
-create_multipart_upload_custom() {
-  if [ $# -lt 2 ]; then
-    log 2 "create multipart upload custom function must have at least bucket and key"
-    return 1
-  fi
-  local multipart_data
-  log 5 "additional create multipart params"
-  for i in "$@"; do
-    log 5 $i
-  done
-  log 5 "${*:3}"
-  log 5 "aws --no-verify-ssl s3api create-multipart-upload --bucket $1 --key $2 ${*:3}"
-  multipart_data=$(aws --no-verify-ssl s3api create-multipart-upload --bucket "$1" --key "$2" 2>&1) || local result=$?
-  if [[ $result -ne 0 ]]; then
-    log 2 "error creating custom multipart data command: $multipart_data"
-    return 1
-  fi
-  export multipart_data
-  log 5 "multipart data: $multipart_data"
-  upload_id=$(echo "$multipart_data" | grep -v "InsecureRequestWarning" | jq '.UploadId')
-  upload_id="${upload_id//\"/}"
-  log 5 "upload id: $upload_id"
-  export upload_id
-  return 0
-}

tests/commands/delete_bucket.sh

@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-
-# delete an AWS bucket
-# param:  bucket name
-# return 0 for success, 1 for failure
-delete_bucket() {
-  if [ $# -ne 2 ]; then
-    log 2 "delete bucket missing command type, bucket name"
-    return 1
-  fi
-
-  local exit_code=0
-  local error
-  if [[ $1 == 's3' ]]; then
-    error=$(aws --no-verify-ssl s3 rb s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == 'aws' ]] || [[ $1 == 's3api' ]]; then
-    error=$(aws --no-verify-ssl s3api delete-bucket --bucket "$2" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate rb s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    error=$(mc --insecure rb "$MC_ALIAS/$2" 2>&1) || exit_code=$?
-  else
-    log 2 "Invalid command type $1"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    if [[ "$error" == *"The specified bucket does not exist"* ]]; then
-      return 0
-    else
-      log 2 "error deleting bucket: $error"
-      return 1
-    fi
-  fi
-  return 0
-}

tests/commands/delete_bucket_policy.sh

@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-
-delete_bucket_policy() {
-  if [[ $# -ne 2 ]]; then
-    log 2 "delete bucket policy command requires command type, bucket"
-    return 1
-  fi
-  if [[ $1 == 'aws' ]]; then
-    error=$(aws --no-verify-ssl s3api delete-bucket-policy --bucket "$2") || delete_result=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate delpolicy "s3://$2") || delete_result=$?
-  elif [[ $1 == 'mc' ]]; then
-    error=$(mc --insecure anonymous set none "$MC_ALIAS/$2") || delete_result=$?
-  else
-    log 2 "command 'get bucket policy' not implemented for '$1'"
-    return 1
-  fi
-  if [[ $delete_result -ne 0 ]]; then
-    log 2 "error deleting bucket policy: $error"
-    return 1
-  fi
-  return 0
-}

tests/commands/delete_object.sh

@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-
-delete_object() {
-  if [ $# -ne 3 ]; then
-    log 2 "delete object command requires command type, bucket, key"
-    return 1
-  fi
-  local exit_code=0
-  local error
-  if [[ $1 == 's3' ]]; then
-    error=$(aws --no-verify-ssl s3 rm "s3://$2/$3" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    error=$(aws --no-verify-ssl s3api delete-object --bucket "$2" --key "$3" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate rm "s3://$2/$3" 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    error=$(mc --insecure rm "$MC_ALIAS/$2/$3" 2>&1) || exit_code=$?
-  else
-    log 2 "invalid command type $1"
-    return 1
-  fi
-  log 5 "delete object exit code: $exit_code"
-  if [ $exit_code -ne 0 ]; then
-    log 2 "error deleting object: $error"
-    return 1
-  fi
-  return 0
-}
-
-delete_object_with_user() {
-  if [ $# -ne 5 ]; then
-    log 2 "delete object with user command requires command type, bucket, key, access ID, secret key"
-    return 1
-  fi
-  local exit_code=0
-  if [[ $1 == 's3' ]]; then
-    error=$(AWS_ACCESS_KEY_ID="$4" AWS_SECRET_ACCESS_KEY="$5" aws --no-verify-ssl s3 rm "s3://$2/$3" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    error=$(AWS_ACCESS_KEY_ID="$4" AWS_SECRET_ACCESS_KEY="$5" aws --no-verify-ssl s3api delete-object --bucket "$2" --key "$3" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate rm --access_key="$4" --secret_key="$5" "s3://$2/$3" 2>&1) || exit_code=$?
-  else
-    log 2 "command 'delete object with user' not implemented for '$1'"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    log 2 "error deleting object: $error"
-    export error
-    return 1
-  fi
-  return 0
-}

tests/commands/delete_object_tagging.sh

@@ -1,21 +0,0 @@
-#!/usr/bin/env bash
-
-delete_object_tagging() {
-  if [[ $# -ne 3 ]]; then
-    echo "delete object tagging command missing command type, bucket, key"
-    return 1
-  fi
-  if [[ $1 == 'aws' ]]; then
-    error=$(aws --no-verify-ssl s3api delete-object-tagging --bucket "$2" --key "$3" 2>&1) || delete_result=$?
-  elif [[ $1 == 'mc' ]]; then
-    error=$(mc --insecure tag remove "$MC_ALIAS/$2/$3") || delete_result=$?
-  else
-    echo "delete-object-tagging command not implemented for '$1'"
-    return 1
-  fi
-  if [[ $delete_result -ne 0 ]]; then
-    echo "error deleting object tagging: $error"
-    return 1
-  fi
-  return 0
-}

tests/commands/get_bucket_acl.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-get_bucket_acl() {
-  if [ $# -ne 2 ]; then
-    log 2 "bucket ACL command missing command type, bucket name"
-    return 1
-  fi
-  local exit_code=0
-  if [[ $1 == 'aws' ]] || [[ $1 == 's3api' ]]; then
-    acl=$(aws --no-verify-ssl s3api get-bucket-acl --bucket "$2" 2>&1) || exit_code="$?"
-  elif [[ $1 == 's3cmd' ]]; then
-    acl=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate info "s3://$2" 2>&1) || exit_code="$?"
-  else
-    log 2 "command 'get bucket acl' not implemented for $1"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    log 2 "Error getting bucket ACLs: $acl"
-    return 1
-  fi
-  export acl
-}

tests/commands/get_bucket_location.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-
-get_bucket_location() {
-  if [[ $# -ne 2 ]]; then
-    echo "get bucket location command requires command type, bucket name"
-    return 1
-  fi
-  if [[ $1 == 'aws' ]]; then
-    get_bucket_location_aws "$2" || get_result=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    get_bucket_location_s3cmd "$2" || get_result=$?
-  elif [[ $1 == 'mc' ]]; then
-    get_bucket_location_mc "$2" || get_result=$?
-  else
-    echo "command type '$1' not implemented for get_bucket_location"
-    return 1
-  fi
-  if [[ $get_result -ne 0 ]]; then
-    return 1
-  fi
-  location=$(echo "$location_json" | jq -r '.LocationConstraint')
-  export location
-}
-
-get_bucket_location_aws() {
-  if [[ $# -ne 1 ]]; then
-    echo "get bucket location (aws) requires bucket name"
-    return 1
-  fi
-  location_json=$(aws --no-verify-ssl s3api get-bucket-location --bucket "$1") || location_result=$?
-  if [[ $location_result -ne 0 ]]; then
-    echo "error getting bucket location: $location"
-    return 1
-  fi
-  bucket_location=$(echo "$location_json" | jq -r '.LocationConstraint')
-  export bucket_location
-  return 0
-}
-
-get_bucket_location_s3cmd() {
-  if [[ $# -ne 1 ]]; then
-    echo "get bucket location (s3cmd) requires bucket name"
-    return 1
-  fi
-  info=$(s3cmd --no-check-certificate info "s3://$1") || results=$?
-  if [[ $results -ne 0 ]]; then
-    echo "error getting s3cmd info: $info"
-    return 1
-  fi
-  bucket_location=$(echo "$info" | grep -o 'Location:.*' | awk '{print $2}')
-  export bucket_location
-  return 0
-}
-
-get_bucket_location_mc() {
-  if [[ $# -ne 1 ]]; then
-    echo "get bucket location (mc) requires bucket name"
-    return 1
-  fi
-  info=$(mc --insecure stat "$MC_ALIAS/$1") || results=$?
-  if [[ $results -ne 0 ]]; then
-    echo "error getting s3cmd info: $info"
-    return 1
-  fi
-  bucket_location=$(echo "$info" | grep -o 'Location:.*' | awk '{print $2}')
-  export bucket_location
-  return 0
-}

tests/commands/get_bucket_policy.sh

@@ -1,97 +0,0 @@
-#!/usr/bin/env bash
-
-get_bucket_policy() {
-  if [[ $# -ne 2 ]]; then
-    echo "get bucket policy command requires command type, bucket"
-    return 1
-  fi
-  local get_bucket_policy_result=0
-  if [[ $1 == 'aws' ]]; then
-    get_bucket_policy_aws "$2" || get_bucket_policy_result=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    get_bucket_policy_s3cmd "$2" || get_bucket_policy_result=$?
-  elif [[ $1 == 'mc' ]]; then
-    get_bucket_policy_mc "$2" || get_bucket_policy_result=$?
-  else
-    echo "command 'get bucket policy' not implemented for '$1'"
-    return 1
-  fi
-  if [[ $get_bucket_policy_result -ne 0 ]]; then
-    echo "error getting policy: $bucket_policy"
-    return 1
-  fi
-  export bucket_policy
-  return 0
-}
-
-get_bucket_policy_aws() {
-  if [[ $# -ne 1 ]]; then
-    echo "aws 'get bucket policy' command requires bucket"
-    return 1
-  fi
-  policy_json=$(aws --no-verify-ssl s3api get-bucket-policy --bucket "$1" 2>&1) || get_result=$?
-  if [[ $policy_json == *"InsecureRequestWarning"* ]]; then
-    policy_json=$(awk 'NR>2' <<< "$policy_json")
-  fi
-  if [[ $get_result -ne 0 ]]; then
-    if [[ "$policy_json" == *"(NoSuchBucketPolicy)"* ]]; then
-      bucket_policy=
-    else
-      echo "error getting policy: $policy_json"
-      return 1
-    fi
-  else
-    bucket_policy=$(echo "{$policy_json}" | jq -r '.Policy')
-  fi
-  export bucket_policy
-  return 0
-}
-
-get_bucket_policy_s3cmd() {
-  if [[ $# -ne 1 ]]; then
-    echo "s3cmd 'get bucket policy' command requires bucket"
-    return 1
-  fi
-
-  info=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate info "s3://$1") || get_result=$?
-  if [[ $get_result -ne 0 ]]; then
-    echo "error getting bucket policy: $info"
-    return 1
-  fi
-
-  bucket_policy=""
-  policy_brackets=false
-  while IFS= read -r line; do
-    if [[ $policy_brackets == false ]]; then
-      policy_line=$(echo "$line" | grep 'Policy: ')
-      if [[ $policy_line != "" ]]; then
-        if [[ $policy_line != *'{' ]]; then
-          break
-        fi
-        policy_brackets=true
-        bucket_policy+="{"
-      fi
-    else
-      bucket_policy+=$line
-      if [[ $line == "" ]]; then
-        break
-      fi
-    fi
-  done <<< "$info"
-  export bucket_policy
-  return 0
-}
-
-get_bucket_policy_mc() {
-  if [[ $# -ne 1 ]]; then
-    echo "aws 'get bucket policy' command requires bucket"
-    return 1
-  fi
-  bucket_policy=$(mc --insecure anonymous get-json "$MC_ALIAS/$1") || get_result=$?
-  if [[ $get_result -ne 0 ]]; then
-    echo "error getting policy: $bucket_policy"
-    return 1
-  fi
-  export bucket_policy
-  return 0
-}

tests/commands/get_bucket_tagging.sh

@@ -1,31 +0,0 @@
-#!/usr/bin/env bash
-
-# get bucket tags
-# params:  bucket
-# export 'tags' on success, return 1 for error
-get_bucket_tagging() {
-  if [ $# -ne 2 ]; then
-    echo "get bucket tag command missing command type, bucket name"
-    return 1
-  fi
-  local result
-  if [[ $1 == 'aws' ]]; then
-    tags=$(aws --no-verify-ssl s3api get-bucket-tagging --bucket "$2" 2>&1) || result=$?
-  elif [[ $1 == 'mc' ]]; then
-    tags=$(mc --insecure tag list "$MC_ALIAS"/"$2" 2>&1) || result=$?
-  else
-    echo "invalid command type $1"
-    return 1
-  fi
-  log 5 "Tags: $tags"
-  tags=$(echo "$tags" | grep -v "InsecureRequestWarning")
-  if [[ $result -ne 0 ]]; then
-    if [[ $tags =~ "No tags found" ]] || [[ $tags =~ "The TagSet does not exist" ]]; then
-      export tags=
-      return 0
-    fi
-    echo "error getting bucket tags: $tags"
-    return 1
-  fi
-  export tags
-}

tests/commands/get_bucket_versioning.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-get_bucket_versioning() {
-  if [[ $# -ne 2 ]]; then
-    log 2 "put bucket versioning command requires command type, bucket name"
-    return 1
-  fi
-  local get_result=0
-  if [[ $1 == 's3api' ]]; then
-    error=$(aws --no-verify-ssl s3api get-bucket-versioning --bucket "$2" 2>&1) || get_result=$?
-  fi
-  if [[ $get_result -ne 0 ]]; then
-    log 2 "error getting bucket versioning: $error"
-    return 1
-  fi
-  return 0
-}

tests/commands/get_object.sh

@@ -1,41 +0,0 @@
-#!/usr/bin/env bash
-
-get_object() {
-  if [ $# -ne 4 ]; then
-    log 2 "get object command requires command type, bucket, key, destination"
-    return 1
-  fi
-  local exit_code=0
-  local error
-  if [[ $1 == 's3' ]]; then
-    error=$(aws --no-verify-ssl s3 mv "s3://$2/$3" "$4" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    error=$(aws --no-verify-ssl s3api get-object --bucket "$2" --key "$3" "$4" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate get "s3://$2/$3" "$4" 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    error=$(mc --insecure get "$MC_ALIAS/$2/$3" "$4" 2>&1) || exit_code=$?
-  else
-    log 2 "'get object' command not implemented for '$1'"
-    return 1
-  fi
-  log 5 "get object exit code: $exit_code"
-  if [ $exit_code -ne 0 ]; then
-    log 2 "error getting object: $error"
-    return 1
-  fi
-  return 0
-}
-
-get_object_with_range() {
-  if [[ $# -ne 4 ]]; then
-    log 2 "'get object with range' requires bucket, key, range, outfile"
-    return 1
-  fi
-  error=$(aws --no-verify-ssl s3api get-object --bucket "$1" --key "$2" --range "$3" "$4" 2>&1) || local exit_code=$?
-  if [[ $exit_code -ne 0 ]]; then
-    log 2 "error getting object with range: $error"
-    return 1
-  fi
-  return 0
-}

tests/commands/get_object_attributes.sh

@@ -1,17 +0,0 @@
-#!/usr/bin/env bash
-
-get_object_attributes() {
-  if [[ $# -ne 2 ]]; then
-    log 2 "'get object attributes' command requires bucket, key"
-    return 1
-  fi
-  attributes=$(aws --no-verify-ssl s3api get-object-attributes --bucket "$1" --key "$2" --object-attributes "ObjectSize" 2>&1) || local get_result=$?
-  if [[ $get_result -ne 0 ]]; then
-    log 2 "error getting object attributes: $attributes"
-    return 1
-  fi
-  attributes=$(echo "$attributes" | grep -v "InsecureRequestWarning")
-  log 5 "$attributes"
-  export attributes
-  return 0
-}

tests/commands/get_object_legal_hold.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-get_object_legal_hold() {
-  if [[ $# -ne 2 ]]; then
-    log 2 "'get object legal hold' command requires bucket, key"
-    return 1
-  fi
-  legal_hold=$(aws --no-verify-ssl s3api get-object-legal-hold --bucket "$1" --key "$2" 2>&1) || local get_result=$?
-  if [[ $get_result -ne 0 ]]; then
-    log 2 "error getting object legal hold: $legal_hold"
-    return 1
-  fi
-  export legal_hold
-  return 0
-}

tests/commands/get_object_lock_configuration.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-get_object_lock_configuration() {
-  if [[ $# -ne 1 ]]; then
-    log 2 "'get object lock configuration' command missing bucket name"
-    return 1
-  fi
-  lock_config=$(aws --no-verify-ssl s3api get-object-lock-configuration --bucket "$1") || local get_result=$?
-  if [[ $get_result -ne 0 ]]; then
-    log 2 "error obtaining lock config: $lock_config"
-    return 1
-  fi
-  export lock_config
-  return 0
-}

tests/commands/get_object_retention.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-get_object_retention() {
-  if [[ $# -ne 2 ]]; then
-    log 2 "'get object retention' command requires bucket, key"
-    return 1
-  fi
-  retention=$(aws --no-verify-ssl s3api get-object-retention --bucket "$1" --key "$2" 2>&1) || local get_result=$?
-  if [[ $get_result -ne 0 ]]; then
-    log 2 "error getting object retention: $retention"
-    return 1
-  fi
-  export retention
-  return 0
-}

tests/commands/get_object_tagging.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-
-get_object_tagging() {
-  if [ $# -ne 3 ]; then
-    log 2 "get object tag command missing command type, bucket, and/or key"
-    return 1
-  fi
-  local result
-  if [[ $1 == 'aws' ]]; then
-    tags=$(aws --no-verify-ssl s3api get-object-tagging --bucket "$2" --key "$3" 2>&1) || result=$?
-  elif [[ $1 == 'mc' ]]; then
-    tags=$(mc --insecure tag list "$MC_ALIAS"/"$2"/"$3" 2>&1) || result=$?
-  else
-    log 2 "invalid command type $1"
-    return 1
-  fi
-  if [[ $result -ne 0 ]]; then
-    if [[ "$tags" == *"NoSuchTagSet"* ]] || [[ "$tags" == *"No tags found"* ]]; then
-      tags=
-    else
-      log 2 "error getting object tags: $tags"
-      return 1
-    fi
-  else
-    log 5 "$tags"
-    tags=$(echo "$tags" | grep -v "InsecureRequestWarning")
-  fi
-  export tags
-}

tests/commands/head_bucket.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-head_bucket() {
-  if [ $# -ne 2 ]; then
-    echo "head bucket command missing command type, bucket name"
-    return 1
-  fi
-  local exit_code=0
-  if [[ $1 == "aws" ]] || [[ $1 == 's3api' ]] || [[ $1 == 's3' ]]; then
-    bucket_info=$(aws --no-verify-ssl s3api head-bucket --bucket "$2" 2>&1) || exit_code=$?
-  elif [[ $1 == "s3cmd" ]]; then
-    bucket_info=$(s3cmd --no-check-certificate info "s3://$2" 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    bucket_info=$(mc --insecure stat "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
-  else
-    echo "invalid command type $1"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    echo "error getting bucket info: $bucket_info"
-    return 1
-  fi
-  export bucket_info
-  return 0
-}

tests/commands/head_object.sh

@@ -1,30 +0,0 @@
-#!/usr/bin/env bash
-
-head_object() {
-  if [ $# -ne 3 ]; then
-    log 2 "head-object missing command, bucket name, object name"
-    return 2
-  fi
-  local exit_code=0
-  if [[ $1 == 'aws' ]] || [[ $1 == 's3api' ]] || [[ $1 == 's3' ]]; then
-    metadata=$(aws --no-verify-ssl s3api head-object --bucket "$2" --key "$3" 2>&1) || exit_code="$?"
-  elif [[ $1 == 's3cmd' ]]; then
-    metadata=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate info s3://"$2/$3" 2>&1) || exit_code="$?"
-  elif [[ $1 == 'mc' ]]; then
-    metadata=$(mc --insecure stat "$MC_ALIAS/$2/$3" 2>&1) || exit_code=$?
-  else
-    log 2 "invalid command type $1"
-    return 2
-  fi
-  if [ $exit_code -ne 0 ]; then
-    if [[ "$metadata" == *"404"* ]] || [[ "$metadata" == *"does not exist"* ]]; then
-      log 5 "file doesn't exist ($metadata)"
-      return 1
-    else
-      log 2 "error checking if object exists: $metadata"
-      return 2
-    fi
-  fi
-  export metadata
-  return 0
-}

tests/commands/list_buckets.sh

@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-
-list_buckets() {
-  if [ $# -ne 1 ]; then
-    echo "list buckets command missing command type"
-    return 1
-  fi
-
-  local exit_code=0
-  local error
-  if [[ $1 == 's3' ]]; then
-    buckets=$(aws --no-verify-ssl s3 ls 2>&1 s3://) || exit_code=$?
-  elif [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    list_buckets_s3api || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    buckets=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate ls s3:// 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    buckets=$(mc --insecure ls "$MC_ALIAS" 2>&1) || exit_code=$?
-  else
-    echo "list buckets command not implemented for '$1'"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    echo "error listing buckets: $buckets"
-    return 1
-  fi
-
-  if [[ $1 == 's3api' ]] || [[ $1 == 'aws' ]]; then
-    return 0
-  fi
-
-  bucket_array=()
-  while IFS= read -r line; do
-    bucket_name=$(echo "$line" | awk '{print $NF}')
-    bucket_array+=("${bucket_name%/}")
-  done <<< "$buckets"
-  export bucket_array
-  return 0
-}
-
-list_buckets_s3api() {
-  output=$(aws --no-verify-ssl s3api list-buckets 2>&1) || exit_code=$?
-  if [[ $exit_code -ne 0 ]]; then
-    echo "error listing buckets: $output"
-    return 1
-  fi
-
-  modified_output=""
-  while IFS= read -r line; do
-    if [[ $line != *InsecureRequestWarning* ]]; then
-      modified_output+="$line"
-    fi
-  done <<< "$output"
-
-  bucket_array=()
-  names=$(jq -r '.Buckets[].Name' <<<"$modified_output")
-  IFS=$'\n' read -rd '' -a bucket_array <<<"$names"
-
-  export bucket_array
-  return 0
-}

tests/commands/list_object_versions.sh

@@ -1,15 +0,0 @@
-#!/usr/bin/env bash
-
-list_object_versions() {
-  if [[ $# -ne 1 ]]; then
-    log 2 "'list object versions' command requires bucket name"
-    return 1
-  fi
-  versions=$(aws --no-verify-ssl s3api list-object-versions --bucket "$1") || local list_result=$?
-  if [[ $list_result -ne 0 ]]; then
-    log 2 "error listing object versions: $versions"
-    return 1
-  fi
-  export versions
-  return 0
-}

tests/commands/list_objects.sh

@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-
-list_objects() {
-  if [ $# -ne 2 ]; then
-    echo "list objects command requires command type, and bucket or folder"
-    return 1
-  fi
-  local exit_code=0
-  local output
-  if [[ $1 == "aws" ]] || [[ $1 == 's3' ]]; then
-    output=$(aws --no-verify-ssl s3 ls s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == 's3api' ]]; then
-    list_objects_s3api "$2" || exit_code=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    output=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate ls s3://"$2" 2>&1) || exit_code=$?
-  elif [[ $1 == 'mc' ]]; then
-    output=$(mc --insecure ls "$MC_ALIAS"/"$2" 2>&1) || exit_code=$?
-  else
-    echo "invalid command type $1"
-    return 1
-  fi
-  if [ $exit_code -ne 0 ]; then
-    echo "error listing objects: $output"
-    return 1
-  fi
-
-  if [[ $1 == 's3api' ]]; then
-    return 0
-  fi
-
-  object_array=()
-  while IFS= read -r line; do
-    if [[ $line != *InsecureRequestWarning* ]]; then
-      object_name=$(echo "$line" | awk '{print $NF}')
-      object_array+=("$object_name")
-    fi
-  done <<< "$output"
-
-  export object_array
-}
-
-list_objects_s3api() {
-  if [[ $# -ne 1 ]]; then
-    echo "list objects s3api command requires bucket name"
-    return 1
-  fi
-  output=$(aws --no-verify-ssl s3api list-objects --bucket "$1" 2>&1) || local exit_code=$?
-  if [[ $exit_code -ne 0 ]]; then
-    echo "error listing objects: $output"
-    return 1
-  fi
-
-  modified_output=""
-  while IFS= read -r line; do
-    if [[ $line != *InsecureRequestWarning* ]]; then
-      modified_output+="$line"
-    fi
-  done <<< "$output"
-
-  object_array=()
-  log 5 "modified output: $modified_output"
-  if echo "$modified_output" | jq -e 'has("Contents")'; then
-    contents=$(echo "$modified_output" | jq -r '.Contents[]')
-    log 5 "contents: $contents"
-    keys=$(echo "$contents" | jq -r '.Key')
-    IFS=$'\n' read -rd '' -a object_array <<<"$keys"
-  fi
-
-  export object_array
-}

tests/commands/put_bucket_acl.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-
-put_bucket_acl() {
-  if [[ $# -ne 3 ]]; then
-    log 2 "put bucket acl command requires command type, bucket name, acls"
-    return 1
-  fi
-  local error=""
-  local put_result=0
-  if [[ $1 == 's3api' ]]; then
-    log 5 "bucket name: $2, acls: $3"
-    error=$(aws --no-verify-ssl s3api put-bucket-acl --bucket "$2" --access-control-policy "file://$3" 2>&1) || put_result=$?
-  elif [[ $1 == 's3cmd' ]]; then
-    error=$(s3cmd "${S3CMD_OPTS[@]}" --no-check-certificate setacl "s3://$2" --acl-grant=read:ABCDEFG 2>&1) || put_result=$?
-  else
-    log 2 "put_bucket_acl not implemented for '$1'"
-    return 1
-  fi
-  if [[ $put_result -ne 0 ]]; then
-    log 2 "error putting bucket acl: $error"
-    return 1
-  fi
-  return 0
-}