mirror of
https://github.com/versity/versitygw.git
synced 2026-09-23 08:24:17 +00:00
Jihyeon Gim
39aae5435c
Review of the operational publication found four gaps where the records disagreed with the S3 surface or were missing entirely. Authorization-failure records lost the requester because the pre-session publisher did not carry the authenticated account; the account now flows into the record, so the audit trail names who was denied. Signature failures and malformed PREPARE headers ended the request before any publication point. The auth adapter now publishes authentication failures through the route handler, and header validation failures publish with whatever object identity the headers still carried, matching the S3 surface where every denied request still logs. RC requests carried no region: the custom routes run before the middleware that stores the region local, so event records lacked awsRegion and audit host headers read s3..amazonaws.com. The auth adapter sets the region for every verified RC request. Operational records reported generic 500 statuses for protocol errors that the wire answers with a specific status (a resource limit rejection logged 500 while the client saw 429). Status mapping now reuses the route error mapping, so the recorded status always equals the wire status.