mirror of
https://github.com/versity/versitygw.git
synced 2026-10-22 14:22:40 +00:00
niksis02
c99f9ba757
Fixes #2445 The S3 auth middlewares (header, presigned and POST) return 403 `InvalidAccessKeyId` only when the IAM lookup returns exactly `auth.ErrNoSuchUser`, since they compare with `==`. Three IAM backends returned a different error for an unknown access key, and the client received that error unchanged. The root-only `IAMServiceSingle` returned the admin API's `ErrAdminUserNotFound`, so clients got 404 `XAdminUserNotFound`, which tools such as pgBackRest and rclone read as missing data rather than bad credentials. It now returns `ErrNoSuchUser`. The `ErrAdminUserNotFound` check in `resolveAccountsByLookup` is removed because no backend returns that error anymore. In the Vault backend, `KvV2Read` of a missing key fails with a 404, which was passed through and rendered as 500 `InternalError`. The same error broke the admin `create-bucket`, `change-bucket-owner` and `update-user` commands for unknown users, which returned 500 instead of `XAdminUserNotFound`. `GetUserAccount` now maps a 404 to `ErrNoSuchUser` on both the initial read and the retry after re-authentication, the same way `ListUserAccounts` already handles 404. FreeIPA reports a missing object as `NotFound` (code `4001`), both from `user_show` for an unknown user and from `vault_retrieve_internal` for a user who has no S3 vault. Both cases rendered as 500. `rpcInternal` now returns `errRpcNotFound`, which wraps `errRpc`, for code `4001`, and `GetUserAccount` maps it to `ErrNoSuchUser` in both places. A user without the vault has no S3 secret, so it is treated as a nonexistent account, and the PKCS#1 v1.5 to OAEP retry is skipped in that case.