mirror of
https://github.com/versity/versitygw.git
synced 2026-08-17 12:46:23 +00:00
niksis02
4756b4d236
Implements the `AssumeRoleWithWebIdentity` and `GetCallerIdentity` STS actions, letting callers exchange an external OIDC token for temporary credentials scoped to an IAM role. Token handling covers JWT claim parsing, issuer/audience resolution (including `azp` override semantics), JWKS fetching and caching with `singleflight`-deduplicated refresh, and rate-limited forced refresh on unrecognized `kid` values. OIDC provider thumbprint fetching now performs a real TLS handshake verified against the system trust store and the provider hostname (previously `InsecureSkipVerify`), since the observed certificate is persisted as a long-lived trust anchor rather than used once and discarded; all discovery-document and JWKS fetches go through an SSRF-safe HTTP client with bounded redirects and response size.
Adds policy `Condition` block evaluation, supporting `String`, `Numeric`, `Date`, `Bool`, `BinaryEquals`, and `IpAddress` operators along with their `IfExists`/`Not` variants and `ForAllValues`/`ForAnyValues` set qualifiers, plus policy variable substitution (e.g. `${aws:username}`) in supported operators. Adds identity-based inline policy evaluation and a new IAM authorization middleware that authorizes each request against action, resource, and condition context together, applying the session-policy-intersects-role-policy semantics for assumed-role sessions.
Adds a new debug logger `--log-level` flag (`silent`/`debug`/`unsafe`), along with a tree-based XML masker that redacts secrets and tokens at the property level in logged request/response bodies instead of skipping the whole body. The old `--debug/VGW_DEBUG` flag is kept as a deprecated alias for `--log-level=debug`, printing a console warning that points users at `--log-level` for finer-grained control.
Fixes a Vault storage bug where CAS (check-and-set) writes always read the current document version as 0 because `kvVersion` asserted metadata as `float64` while the Vault client actually returns `json.Number`, causing every write past the first to be rejected as a concurrent modification. Also adds a constant-time `SecureCompare` for signature/token comparisons in sigv4 auth.
Adds an integration test suite (`iam_access_control.go`) covering IAM access control across user, role, and session identities.
93 lines
4.0 KiB
AMPL
93 lines
4.0 KiB
AMPL
module github.com/versity/versitygw
|
|
|
|
go 1.25.0
|
|
|
|
toolchain go1.26.5
|
|
|
|
require (
|
|
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
|
|
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.0
|
|
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0
|
|
github.com/DataDog/datadog-go/v5 v5.9.0
|
|
github.com/aws/aws-sdk-go-v2 v1.43.4
|
|
github.com/aws/aws-sdk-go-v2/config v1.32.35
|
|
github.com/aws/aws-sdk-go-v2/credentials v1.19.34
|
|
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.3.11
|
|
github.com/aws/aws-sdk-go-v2/service/iam v1.54.5
|
|
github.com/aws/aws-sdk-go-v2/service/s3 v1.107.0
|
|
github.com/aws/aws-sdk-go-v2/service/sts v1.45.4
|
|
github.com/aws/smithy-go v1.27.7
|
|
github.com/cespare/xxhash/v2 v2.3.0
|
|
github.com/davecgh/go-spew v1.1.1
|
|
github.com/go-ldap/ldap/v3 v3.4.14
|
|
github.com/gofiber/fiber/v3 v3.4.0
|
|
github.com/golang-jwt/jwt/v5 v5.3.1
|
|
github.com/google/go-cmp v0.7.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/hashicorp/vault-client-go v0.4.3
|
|
github.com/minio/crc64nvme v1.1.1
|
|
github.com/nats-io/nats.go v1.52.0
|
|
github.com/oklog/ulid/v2 v2.1.2
|
|
github.com/pkg/xattr v0.4.12
|
|
github.com/rabbitmq/amqp091-go v1.13.0
|
|
github.com/segmentio/kafka-go v0.4.51
|
|
github.com/smira/go-statsd v1.3.4
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/urfave/cli/v2 v2.27.7
|
|
github.com/valyala/fasthttp v1.73.0
|
|
github.com/versity/scoutfs-go v0.0.0-20260414000839-70f8b6bdfa96
|
|
github.com/zeebo/xxh3 v1.1.0
|
|
golang.org/x/sync v0.22.0
|
|
golang.org/x/sys v0.47.0
|
|
gopkg.in/yaml.v3 v3.0.1
|
|
)
|
|
|
|
require (
|
|
github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
|
|
github.com/Azure/go-ntlmssp v0.1.1 // indirect
|
|
github.com/AzureAD/microsoft-authentication-library-for-go v1.8.0 // indirect
|
|
github.com/Microsoft/go-winio v0.6.2 // indirect
|
|
github.com/andybalholm/brotli v1.2.2 // indirect
|
|
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 // indirect
|
|
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 // indirect
|
|
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 // indirect
|
|
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
|
|
github.com/go-asn1-ber/asn1-ber v1.5.8 // indirect
|
|
github.com/gofiber/schema v1.8.3 // indirect
|
|
github.com/gofiber/utils/v2 v2.4.1 // indirect
|
|
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
|
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
|
|
github.com/klauspost/compress v1.19.2 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.4.0 // indirect
|
|
github.com/kylelemons/godebug v1.1.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.15 // indirect
|
|
github.com/mattn/go-isatty v0.0.24 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/nats-io/nkeys v0.4.16 // indirect
|
|
github.com/nats-io/nuid v1.0.1 // indirect
|
|
github.com/philhofer/fwd v1.2.0 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.28 // indirect
|
|
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/russross/blackfriday/v2 v2.1.0 // indirect
|
|
github.com/ryanuber/go-glob v1.0.0 // indirect
|
|
github.com/tinylib/msgp v1.6.4 // indirect
|
|
github.com/valyala/bytebufferpool v1.0.0 // indirect
|
|
github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
|
|
golang.org/x/crypto v0.54.0 // indirect
|
|
golang.org/x/net v0.57.0 // indirect
|
|
golang.org/x/text v0.40.0 // indirect
|
|
golang.org/x/time v0.15.0 // indirect
|
|
)
|