mirror of
https://github.com/versity/versitygw.git
synced 2026-08-17 20:56:21 +00:00
niksis02
4756b4d236
Implements the `AssumeRoleWithWebIdentity` and `GetCallerIdentity` STS actions, letting callers exchange an external OIDC token for temporary credentials scoped to an IAM role. Token handling covers JWT claim parsing, issuer/audience resolution (including `azp` override semantics), JWKS fetching and caching with `singleflight`-deduplicated refresh, and rate-limited forced refresh on unrecognized `kid` values. OIDC provider thumbprint fetching now performs a real TLS handshake verified against the system trust store and the provider hostname (previously `InsecureSkipVerify`), since the observed certificate is persisted as a long-lived trust anchor rather than used once and discarded; all discovery-document and JWKS fetches go through an SSRF-safe HTTP client with bounded redirects and response size.
Adds policy `Condition` block evaluation, supporting `String`, `Numeric`, `Date`, `Bool`, `BinaryEquals`, and `IpAddress` operators along with their `IfExists`/`Not` variants and `ForAllValues`/`ForAnyValues` set qualifiers, plus policy variable substitution (e.g. `${aws:username}`) in supported operators. Adds identity-based inline policy evaluation and a new IAM authorization middleware that authorizes each request against action, resource, and condition context together, applying the session-policy-intersects-role-policy semantics for assumed-role sessions.
Adds a new debug logger `--log-level` flag (`silent`/`debug`/`unsafe`), along with a tree-based XML masker that redacts secrets and tokens at the property level in logged request/response bodies instead of skipping the whole body. The old `--debug/VGW_DEBUG` flag is kept as a deprecated alias for `--log-level=debug`, printing a console warning that points users at `--log-level` for finer-grained control.
Fixes a Vault storage bug where CAS (check-and-set) writes always read the current document version as 0 because `kvVersion` asserted metadata as `float64` while the Vault client actually returns `json.Number`, causing every write past the first to be rejected as a concurrent modification. Also adds a constant-time `SecureCompare` for signature/token comparisons in sigv4 auth.
Adds an integration test suite (`iam_access_control.go`) covering IAM access control across user, role, and session identities.
98 lines
2.6 KiB
Go
98 lines
2.6 KiB
Go
// Copyright 2026 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package debuglogger
|
|
|
|
import "testing"
|
|
|
|
func TestParseLevel(t *testing.T) {
|
|
tests := []struct {
|
|
in string
|
|
want Level
|
|
wantErr bool
|
|
}{
|
|
{"silent", LevelSilent, false},
|
|
{"", LevelSilent, false},
|
|
{"SILENT", LevelSilent, false},
|
|
{"debug", LevelDebug, false},
|
|
{" Debug ", LevelDebug, false},
|
|
{"unsafe", LevelUnsafe, false},
|
|
{"UNSAFE", LevelUnsafe, false},
|
|
{"verbose", LevelSilent, true},
|
|
{"true", LevelSilent, true},
|
|
}
|
|
for _, tt := range tests {
|
|
got, err := ParseLevel(tt.in)
|
|
if (err != nil) != tt.wantErr {
|
|
t.Errorf("ParseLevel(%q) error = %v, wantErr %v", tt.in, err, tt.wantErr)
|
|
continue
|
|
}
|
|
if err == nil && got != tt.want {
|
|
t.Errorf("ParseLevel(%q) = %v, want %v", tt.in, got, tt.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestLevelGatesDebugAndUnsafe(t *testing.T) {
|
|
defer SetLevel(LevelSilent)
|
|
|
|
SetLevel(LevelSilent)
|
|
if IsDebugEnabled() {
|
|
t.Error("IsDebugEnabled() at LevelSilent = true, want false")
|
|
}
|
|
if IsUnsafeEnabled() {
|
|
t.Error("IsUnsafeEnabled() at LevelSilent = true, want false")
|
|
}
|
|
|
|
SetLevel(LevelDebug)
|
|
if !IsDebugEnabled() {
|
|
t.Error("IsDebugEnabled() at LevelDebug = false, want true")
|
|
}
|
|
if IsUnsafeEnabled() {
|
|
t.Error("IsUnsafeEnabled() at LevelDebug = true, want false")
|
|
}
|
|
|
|
SetLevel(LevelUnsafe)
|
|
if !IsDebugEnabled() {
|
|
t.Error("IsDebugEnabled() at LevelUnsafe = false, want true")
|
|
}
|
|
if !IsUnsafeEnabled() {
|
|
t.Error("IsUnsafeEnabled() at LevelUnsafe = false, want true")
|
|
}
|
|
}
|
|
|
|
func TestIsIAMDebugEnabledRequiresBothLevelAndIAMFlag(t *testing.T) {
|
|
defer func() {
|
|
SetLevel(LevelSilent)
|
|
debugIAMEnabled.Store(false)
|
|
}()
|
|
|
|
SetLevel(LevelSilent)
|
|
debugIAMEnabled.Store(true)
|
|
if IsIAMDebugEnabled() {
|
|
t.Error("IsIAMDebugEnabled() with iam-debug set but level silent = true, want false")
|
|
}
|
|
|
|
SetLevel(LevelDebug)
|
|
debugIAMEnabled.Store(false)
|
|
if IsIAMDebugEnabled() {
|
|
t.Error("IsIAMDebugEnabled() with level debug but iam-debug unset = true, want false")
|
|
}
|
|
|
|
debugIAMEnabled.Store(true)
|
|
if !IsIAMDebugEnabled() {
|
|
t.Error("IsIAMDebugEnabled() with level debug and iam-debug set = false, want true")
|
|
}
|
|
}
|