mirror of
https://github.com/versity/versitygw.git
synced 2026-08-19 21:56:27 +00:00
Fixes #1327 Fixes #1567 Closes #2264 Wires the S3 gateway up to the standalone IAM service so identity policies, not just bucket policies and ACLs, are enforced on the S3 data plane. The gateway authenticates SigV4 requests by calling new private derive-signing-key and resolve-identity endpoints on the IAM service instead of holding secrets itself, and evaluates identity policy through the same PolicyEvaluator path added to auth.VerifyAccess, combined with the bucket policy using explicit-deny-wins precedence. The private endpoints are served over their own mTLS listener (new iamapi/private package, genmtlscerts.sh to generate test material, and client-cert support in internal/netutil), separate from the public IAM API. As part of this the vendored aws/signer/v4 package is deleted and replaced by a pure-Go SigV4 implementation in internal/sigv4auth, which now reads canonical request data directly off the fiber.Ctx instead of reconstructing an http.Request, and is shared by both the S3 request-signing verification and the new private-endpoint signing. DeleteObjects moves from an all-or-nothing authorization check to true partial success: VerifyObjectsAccess evaluates every object in a batch independently against both the identity policy and any object lock, so a denial or a locked object only removes that key from the batch instead of failing the whole request. It also batches the identity-policy round trip and the bucket-policy fetch once per request rather than once per object, and separates plain deletes from versioned ones since a versioned delete needs s3:DeleteObjectVersion rather than s3:DeleteObject. Object lock handling got a few correctness fixes alongside this: a bypass is now modeled as BypassNone/BypassRequested/BypassOverwrite rather than a single bool, because root's blanket ability to override a GOVERNANCE retention should only apply when the client actually asked to bypass it (DeleteObject/DeleteObjects/PutObjectRetention), not when the gateway is silently replacing a locked object via an overwrite, which needs the permission from everyone including root. Retention changes are now correctly classified as an extension (allowed under plain s3:PutObjectRetention) versus a weakening (date or mode change, which needs the bypass permission), and a COMPLIANCE lock can never be weakened by anyone regardless of permissions, matching AWS. Separately, VerifyObjectCopyAccess had a readonly-mode gap: it returned early for root/admin before ever calling VerifyAccess, so the readonly check inside VerifyAccess never ran for them on CopyObject; access checks are now ordered so the readonly gate always applies before any root/admin bypass, for copy as well as every other write path. Bucket policies also gained Condition block support, via a new shared internal/condition package moved out of the IAM policy package since both bucket and identity policies share the same evaluation semantics. It implements the full AWS operator set — String{Equals,NotEquals,EqualsIgnoreCase,NotEqualsIgnoreCase,Like,NotLike}, Numeric{Equals,NotEquals,LessThan,LessThanEquals,GreaterThan,GreaterThanEquals}, Date{Equals,NotEquals,LessThan,LessThanEquals,GreaterThan,GreaterThanEquals}, Bool, BinaryEquals, Arn{Equals,Like,NotEquals,NotLike}, IpAddress/NotIpAddress, and Null — along with the ForAllValues/ForAnyValue set qualifiers and the IfExists modifier. A new requestConditionContext builds the per-request keys a bucket policy's Condition block can reference — aws:SourceIp, aws:SecureTransport, aws:CurrentTime, aws:EpochTime, aws:UserAgent, aws:Referer, s3:prefix, s3:delimiter, s3:max-keys, s3:x-amz-acl, s3:VersionId — following AWS's own per-action rules for which keys a given S3 operation actually populates. Identity-derived keys such as aws:PrincipalArn and aws:username are deliberately left unwired here, since the gateway has no way to know them; the standalone IAM service fills those in itself when it evaluates an identity policy. Also added new integration test suites for S3-side IAM: s3_iam_access_control.go and s3_iam_session_access_control.go cover identity-policy enforcement and session-credential requests against real S3 operations, alongside expanded OIDC/web-identity coverage and a new runoidctests.sh runner wired into the OIDC GitHub Actions workflow.
332 lines
9.9 KiB
Go
332 lines
9.9 KiB
Go
// Code generated by moq; DO NOT EDIT.
|
|
// github.com/matryer/moq
|
|
|
|
package controllers
|
|
|
|
import (
|
|
"github.com/versity/versitygw/auth"
|
|
"sync"
|
|
)
|
|
|
|
// Ensure, that IAMServiceMock does implement auth.IAMService.
|
|
// If this is not the case, regenerate this file with moq.
|
|
var _ auth.IAMService = &IAMServiceMock{}
|
|
|
|
// IAMServiceMock is a mock implementation of auth.IAMService.
|
|
//
|
|
// func TestSomethingThatUsesIAMService(t *testing.T) {
|
|
//
|
|
// // make and configure a mocked auth.IAMService
|
|
// mockedIAMService := &IAMServiceMock{
|
|
// CreateAccountFunc: func(account auth.Account) error {
|
|
// panic("mock out the CreateAccount method")
|
|
// },
|
|
// DeleteUserAccountFunc: func(access string) error {
|
|
// panic("mock out the DeleteUserAccount method")
|
|
// },
|
|
// GetUserAccountFunc: func(access string) (auth.Account, error) {
|
|
// panic("mock out the GetUserAccount method")
|
|
// },
|
|
// ListUserAccountsFunc: func() ([]auth.Account, error) {
|
|
// panic("mock out the ListUserAccounts method")
|
|
// },
|
|
// ResolveAccountsFunc: func(accessKeyIDs []string) ([]string, error) {
|
|
// panic("mock out the ResolveAccounts method")
|
|
// },
|
|
// ShutdownFunc: func() error {
|
|
// panic("mock out the Shutdown method")
|
|
// },
|
|
// UpdateUserAccountFunc: func(access string, props auth.MutableProps) error {
|
|
// panic("mock out the UpdateUserAccount method")
|
|
// },
|
|
// }
|
|
//
|
|
// // use mockedIAMService in code that requires auth.IAMService
|
|
// // and then make assertions.
|
|
//
|
|
// }
|
|
type IAMServiceMock struct {
|
|
// CreateAccountFunc mocks the CreateAccount method.
|
|
CreateAccountFunc func(account auth.Account) error
|
|
|
|
// DeleteUserAccountFunc mocks the DeleteUserAccount method.
|
|
DeleteUserAccountFunc func(access string) error
|
|
|
|
// GetUserAccountFunc mocks the GetUserAccount method.
|
|
GetUserAccountFunc func(access string) (auth.Account, error)
|
|
|
|
// ListUserAccountsFunc mocks the ListUserAccounts method.
|
|
ListUserAccountsFunc func() ([]auth.Account, error)
|
|
|
|
// ResolveAccountsFunc mocks the ResolveAccounts method.
|
|
ResolveAccountsFunc func(accessKeyIDs []string) ([]string, error)
|
|
|
|
// ShutdownFunc mocks the Shutdown method.
|
|
ShutdownFunc func() error
|
|
|
|
// UpdateUserAccountFunc mocks the UpdateUserAccount method.
|
|
UpdateUserAccountFunc func(access string, props auth.MutableProps) error
|
|
|
|
// calls tracks calls to the methods.
|
|
calls struct {
|
|
// CreateAccount holds details about calls to the CreateAccount method.
|
|
CreateAccount []struct {
|
|
// Account is the account argument value.
|
|
Account auth.Account
|
|
}
|
|
// DeleteUserAccount holds details about calls to the DeleteUserAccount method.
|
|
DeleteUserAccount []struct {
|
|
// Access is the access argument value.
|
|
Access string
|
|
}
|
|
// GetUserAccount holds details about calls to the GetUserAccount method.
|
|
GetUserAccount []struct {
|
|
// Access is the access argument value.
|
|
Access string
|
|
}
|
|
// ListUserAccounts holds details about calls to the ListUserAccounts method.
|
|
ListUserAccounts []struct {
|
|
}
|
|
// ResolveAccounts holds details about calls to the ResolveAccounts method.
|
|
ResolveAccounts []struct {
|
|
// AccessKeyIDs is the accessKeyIDs argument value.
|
|
AccessKeyIDs []string
|
|
}
|
|
// Shutdown holds details about calls to the Shutdown method.
|
|
Shutdown []struct {
|
|
}
|
|
// UpdateUserAccount holds details about calls to the UpdateUserAccount method.
|
|
UpdateUserAccount []struct {
|
|
// Access is the access argument value.
|
|
Access string
|
|
// Props is the props argument value.
|
|
Props auth.MutableProps
|
|
}
|
|
}
|
|
lockCreateAccount sync.RWMutex
|
|
lockDeleteUserAccount sync.RWMutex
|
|
lockGetUserAccount sync.RWMutex
|
|
lockListUserAccounts sync.RWMutex
|
|
lockResolveAccounts sync.RWMutex
|
|
lockShutdown sync.RWMutex
|
|
lockUpdateUserAccount sync.RWMutex
|
|
}
|
|
|
|
// CreateAccount calls CreateAccountFunc.
|
|
func (mock *IAMServiceMock) CreateAccount(account auth.Account) error {
|
|
if mock.CreateAccountFunc == nil {
|
|
panic("IAMServiceMock.CreateAccountFunc: method is nil but IAMService.CreateAccount was just called")
|
|
}
|
|
callInfo := struct {
|
|
Account auth.Account
|
|
}{
|
|
Account: account,
|
|
}
|
|
mock.lockCreateAccount.Lock()
|
|
mock.calls.CreateAccount = append(mock.calls.CreateAccount, callInfo)
|
|
mock.lockCreateAccount.Unlock()
|
|
return mock.CreateAccountFunc(account)
|
|
}
|
|
|
|
// CreateAccountCalls gets all the calls that were made to CreateAccount.
|
|
// Check the length with:
|
|
//
|
|
// len(mockedIAMService.CreateAccountCalls())
|
|
func (mock *IAMServiceMock) CreateAccountCalls() []struct {
|
|
Account auth.Account
|
|
} {
|
|
var calls []struct {
|
|
Account auth.Account
|
|
}
|
|
mock.lockCreateAccount.RLock()
|
|
calls = mock.calls.CreateAccount
|
|
mock.lockCreateAccount.RUnlock()
|
|
return calls
|
|
}
|
|
|
|
// DeleteUserAccount calls DeleteUserAccountFunc.
|
|
func (mock *IAMServiceMock) DeleteUserAccount(access string) error {
|
|
if mock.DeleteUserAccountFunc == nil {
|
|
panic("IAMServiceMock.DeleteUserAccountFunc: method is nil but IAMService.DeleteUserAccount was just called")
|
|
}
|
|
callInfo := struct {
|
|
Access string
|
|
}{
|
|
Access: access,
|
|
}
|
|
mock.lockDeleteUserAccount.Lock()
|
|
mock.calls.DeleteUserAccount = append(mock.calls.DeleteUserAccount, callInfo)
|
|
mock.lockDeleteUserAccount.Unlock()
|
|
return mock.DeleteUserAccountFunc(access)
|
|
}
|
|
|
|
// DeleteUserAccountCalls gets all the calls that were made to DeleteUserAccount.
|
|
// Check the length with:
|
|
//
|
|
// len(mockedIAMService.DeleteUserAccountCalls())
|
|
func (mock *IAMServiceMock) DeleteUserAccountCalls() []struct {
|
|
Access string
|
|
} {
|
|
var calls []struct {
|
|
Access string
|
|
}
|
|
mock.lockDeleteUserAccount.RLock()
|
|
calls = mock.calls.DeleteUserAccount
|
|
mock.lockDeleteUserAccount.RUnlock()
|
|
return calls
|
|
}
|
|
|
|
// GetUserAccount calls GetUserAccountFunc.
|
|
func (mock *IAMServiceMock) GetUserAccount(access string) (auth.Account, error) {
|
|
if mock.GetUserAccountFunc == nil {
|
|
panic("IAMServiceMock.GetUserAccountFunc: method is nil but IAMService.GetUserAccount was just called")
|
|
}
|
|
callInfo := struct {
|
|
Access string
|
|
}{
|
|
Access: access,
|
|
}
|
|
mock.lockGetUserAccount.Lock()
|
|
mock.calls.GetUserAccount = append(mock.calls.GetUserAccount, callInfo)
|
|
mock.lockGetUserAccount.Unlock()
|
|
return mock.GetUserAccountFunc(access)
|
|
}
|
|
|
|
// GetUserAccountCalls gets all the calls that were made to GetUserAccount.
|
|
// Check the length with:
|
|
//
|
|
// len(mockedIAMService.GetUserAccountCalls())
|
|
func (mock *IAMServiceMock) GetUserAccountCalls() []struct {
|
|
Access string
|
|
} {
|
|
var calls []struct {
|
|
Access string
|
|
}
|
|
mock.lockGetUserAccount.RLock()
|
|
calls = mock.calls.GetUserAccount
|
|
mock.lockGetUserAccount.RUnlock()
|
|
return calls
|
|
}
|
|
|
|
// ListUserAccounts calls ListUserAccountsFunc.
|
|
func (mock *IAMServiceMock) ListUserAccounts() ([]auth.Account, error) {
|
|
if mock.ListUserAccountsFunc == nil {
|
|
panic("IAMServiceMock.ListUserAccountsFunc: method is nil but IAMService.ListUserAccounts was just called")
|
|
}
|
|
callInfo := struct {
|
|
}{}
|
|
mock.lockListUserAccounts.Lock()
|
|
mock.calls.ListUserAccounts = append(mock.calls.ListUserAccounts, callInfo)
|
|
mock.lockListUserAccounts.Unlock()
|
|
return mock.ListUserAccountsFunc()
|
|
}
|
|
|
|
// ListUserAccountsCalls gets all the calls that were made to ListUserAccounts.
|
|
// Check the length with:
|
|
//
|
|
// len(mockedIAMService.ListUserAccountsCalls())
|
|
func (mock *IAMServiceMock) ListUserAccountsCalls() []struct {
|
|
} {
|
|
var calls []struct {
|
|
}
|
|
mock.lockListUserAccounts.RLock()
|
|
calls = mock.calls.ListUserAccounts
|
|
mock.lockListUserAccounts.RUnlock()
|
|
return calls
|
|
}
|
|
|
|
// ResolveAccounts calls ResolveAccountsFunc.
|
|
func (mock *IAMServiceMock) ResolveAccounts(accessKeyIDs []string) ([]string, error) {
|
|
if mock.ResolveAccountsFunc == nil {
|
|
panic("IAMServiceMock.ResolveAccountsFunc: method is nil but IAMService.ResolveAccounts was just called")
|
|
}
|
|
callInfo := struct {
|
|
AccessKeyIDs []string
|
|
}{
|
|
AccessKeyIDs: accessKeyIDs,
|
|
}
|
|
mock.lockResolveAccounts.Lock()
|
|
mock.calls.ResolveAccounts = append(mock.calls.ResolveAccounts, callInfo)
|
|
mock.lockResolveAccounts.Unlock()
|
|
return mock.ResolveAccountsFunc(accessKeyIDs)
|
|
}
|
|
|
|
// ResolveAccountsCalls gets all the calls that were made to ResolveAccounts.
|
|
// Check the length with:
|
|
//
|
|
// len(mockedIAMService.ResolveAccountsCalls())
|
|
func (mock *IAMServiceMock) ResolveAccountsCalls() []struct {
|
|
AccessKeyIDs []string
|
|
} {
|
|
var calls []struct {
|
|
AccessKeyIDs []string
|
|
}
|
|
mock.lockResolveAccounts.RLock()
|
|
calls = mock.calls.ResolveAccounts
|
|
mock.lockResolveAccounts.RUnlock()
|
|
return calls
|
|
}
|
|
|
|
// Shutdown calls ShutdownFunc.
|
|
func (mock *IAMServiceMock) Shutdown() error {
|
|
if mock.ShutdownFunc == nil {
|
|
panic("IAMServiceMock.ShutdownFunc: method is nil but IAMService.Shutdown was just called")
|
|
}
|
|
callInfo := struct {
|
|
}{}
|
|
mock.lockShutdown.Lock()
|
|
mock.calls.Shutdown = append(mock.calls.Shutdown, callInfo)
|
|
mock.lockShutdown.Unlock()
|
|
return mock.ShutdownFunc()
|
|
}
|
|
|
|
// ShutdownCalls gets all the calls that were made to Shutdown.
|
|
// Check the length with:
|
|
//
|
|
// len(mockedIAMService.ShutdownCalls())
|
|
func (mock *IAMServiceMock) ShutdownCalls() []struct {
|
|
} {
|
|
var calls []struct {
|
|
}
|
|
mock.lockShutdown.RLock()
|
|
calls = mock.calls.Shutdown
|
|
mock.lockShutdown.RUnlock()
|
|
return calls
|
|
}
|
|
|
|
// UpdateUserAccount calls UpdateUserAccountFunc.
|
|
func (mock *IAMServiceMock) UpdateUserAccount(access string, props auth.MutableProps) error {
|
|
if mock.UpdateUserAccountFunc == nil {
|
|
panic("IAMServiceMock.UpdateUserAccountFunc: method is nil but IAMService.UpdateUserAccount was just called")
|
|
}
|
|
callInfo := struct {
|
|
Access string
|
|
Props auth.MutableProps
|
|
}{
|
|
Access: access,
|
|
Props: props,
|
|
}
|
|
mock.lockUpdateUserAccount.Lock()
|
|
mock.calls.UpdateUserAccount = append(mock.calls.UpdateUserAccount, callInfo)
|
|
mock.lockUpdateUserAccount.Unlock()
|
|
return mock.UpdateUserAccountFunc(access, props)
|
|
}
|
|
|
|
// UpdateUserAccountCalls gets all the calls that were made to UpdateUserAccount.
|
|
// Check the length with:
|
|
//
|
|
// len(mockedIAMService.UpdateUserAccountCalls())
|
|
func (mock *IAMServiceMock) UpdateUserAccountCalls() []struct {
|
|
Access string
|
|
Props auth.MutableProps
|
|
} {
|
|
var calls []struct {
|
|
Access string
|
|
Props auth.MutableProps
|
|
}
|
|
mock.lockUpdateUserAccount.RLock()
|
|
calls = mock.calls.UpdateUserAccount
|
|
mock.lockUpdateUserAccount.RUnlock()
|
|
return calls
|
|
}
|