niksis02 f567abc91c fix: authorize every key in a DeleteObjects batch after a bucket-policy deny ...

objectsAccessErrors recorded the first resource-policy Deny and returned immediately, leaving every later key in the same action subset with a nil result — which VerifyObjectsAccess caller reads as "authorized" and sends straight to the backend. An explicit bucket-policy Deny therefore let the keys after it skip authorization entirely and be deleted, including keys that same bucket policy explicitly denied.

The loop now continues rather than returning, so every denied key is settled with its own error. The identity-policy round trip the early return was saving is still skipped, but only when the bucket policy denied every key in the batch, since no identity-policy answer could change any result then. Both loops that follow skip keys already holding an error, so a resource-level explicit deny is never overwritten by an identity-policy result nor flattened to the generic AccessDenied message.

2026-09-01 14:40:09 +04:00

..

AbortMultipartUpload.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

Access_Control.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

bench.go

chore: run go modernize tool

2026-03-10 09:47:37 -07:00

CompleteMultipartUpload.go

feat: add optional data-integrity ETag mode for posix/scoutfs

2026-07-31 14:58:21 -07:00

concurrency.go

test: add github actions functional tests for posix sidecar option

2026-04-22 13:23:46 -07:00

CopyObject.go

feat(azure): server-side copy with download+reupload fallback

2026-08-27 16:37:28 -07:00

CreateBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

CreateMultipartUpload.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

data-io.go

chore: add missing copyright headers to files

2024-05-06 16:16:31 -07:00

DeleteBucket.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

DeleteBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

DeleteObject.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

DeleteObjects.go

fix: authorize every key in a DeleteObjects batch after a bucket-policy deny

2026-09-01 14:40:09 +04:00

DeleteObjectTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

general.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

GetBucketAcl.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketCors.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketLocation.go

fix: return null in GetBucketLocation for us-east-1

2026-01-05 16:24:01 +04:00

GetBucketLockConfiguration.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketOwnershipControls.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicy.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketPolicyStatus.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

GetBucketVersioning.go

feat: govern GetBucketVersioning with the regular access checks

2026-08-31 16:47:49 +04:00

GetBucketWebsite.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

GetObject.go

fix: support asterisk read preconditions

2026-06-16 21:36:45 +04:00

GetObjectAttributes.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

GetObjectLegalHold.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

GetObjectRetention.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

GetObjectTagging.go

fix: removes the NoSuchTagSet error in GetObjecTagging

2026-01-02 23:31:35 +04:00

group-tests.go

fix: authorize every key in a DeleteObjects batch after a bucket-policy deny

2026-09-01 14:40:09 +04:00

HeadBucket.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

HeadObject.go

fix: support asterisk read preconditions

2026-06-16 21:36:45 +04:00

iam_access_control.go

feat: add STS web identity federation, IAM policy Condition support, and access control enforcement

2026-08-25 01:06:25 +04:00

iam_add_client_id_to_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_assume_role_with_web_identity_github_oidc.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

iam_assume_role_with_web_identity.go

feat: add STS web identity federation, IAM policy Condition support, and access control enforcement

2026-08-25 01:06:25 +04:00

iam_auth.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam_create_access_key.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_create_oidc_provider.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_create_role.go

feat: add IAM Role CRUD

2026-08-25 01:03:22 +04:00

iam_create_user.go

feat: add IAM Role CRUD

2026-08-25 01:03:22 +04:00

iam_delete_access_key.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_delete_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_delete_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_delete_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_delete_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_delete_user.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_get_access_key_last_used.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_get_caller_identity.go

feat: add STS web identity federation, IAM policy Condition support, and access control enforcement

2026-08-25 01:06:25 +04:00

iam_get_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_get_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_get_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_get_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_get_user.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam_list_access_keys.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_oidc_provider_tags.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_list_oidc_providers.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_list_role_policies.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_role_tags.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_list_roles.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_user_policies.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_user_tags.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_list_users.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_put_role_policy.go

feat: add IAM role inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_put_user_policy.go

feat: add IAM user inline policy CRUD

2026-08-25 01:03:22 +04:00

iam_query_auth.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

iam_remove_client_id_from_oidc_provider.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_tag_oidc_provider.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_tag_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_tag_user.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_untag_oidc_provider.go

feat: add IAM OIDC provider tagging actions

2026-08-28 00:49:21 +04:00

iam_untag_role.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_untag_user.go

feat: add IAM user tagging actions

2026-08-28 00:49:20 +04:00

iam_update_access_key.go

feat: add IAM user access key management

2026-08-25 01:03:22 +04:00

iam_update_assume_role_policy.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

iam_update_oidc_provider_thumbprint.go

feat: add IAM OIDC provider CRUD

2026-08-25 01:03:22 +04:00

iam_update_user.go

feat: add AWS-compatible standalone IAM service

2026-08-25 01:03:12 +04:00

iam.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListBuckets.go

feat: add windows functional test coverage and fix some windows behavior

2026-06-18 11:34:05 -07:00

ListMultipartUploads.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListObjects.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

ListObjectsV2.go

feat(azure): carry Azure blob marker in continuation token for pagination

2026-08-27 16:40:43 -07:00

ListObjectVersions.go

fix: omit null version id for suspended buckets

2026-07-14 19:21:20 -07:00

ListParts.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

no_acl.go

feat: revert ignore object ACL behavior

2026-03-02 19:30:57 +04:00

NotImplemented_actions.go

Add website integration tests and remove NotImplemented stubs

2026-06-10 12:41:51 +04:00

OPTIONS.go

feat: add option for default global cors allow origin headers

2026-01-08 16:23:23 -08:00

output.go

feat: add live GitHub OIDC end-to-end test for AssumeRoleWithWebIdentity

2026-08-25 01:07:33 +04:00

posix.go

fix: retry link on ENOENT caused by racing DeleteObject

2026-04-02 08:14:44 -07:00

PostObject.go

fix: add integeration tests

2026-08-29 12:06:50 +05:00

presigned_urls.go

feat: version the private IAM protocol between gateway and standalone service

2026-08-25 01:41:12 +04:00

public_bucket.go

fix: honor explicit public bucket policy deny

2026-05-22 00:01:24 +04:00

PutBucketAcl.go

fix: adds validation for bucket canned ACL

2025-11-03 22:59:06 +04:00

PutBucketCors.go

fix: fixes PutBucketCors CORSRules validation

2026-02-24 16:59:38 +04:00

PutBucketOwnershipControls.go

fix: fix empty ownership control rules panic

2026-05-23 04:18:06 +04:00

PutBucketPolicy.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

PutBucketTagging.go

feat: global error refactoring

2026-05-21 23:49:34 +04:00

PutBucketVersioning.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

PutBucketWebsite.go

feat: support x-amz-website-redirect-location

2026-06-10 12:41:55 +04:00

PutObject.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

PutObjectLegalHold.go

fix: fixes missing bucket object lock config error

2026-01-14 13:41:50 +04:00

PutObjectLockConfiguration.go

fix: validate object lock default retention upper limits

2026-06-16 22:48:51 +04:00

PutObjectRetention.go

feat: add IAM role tagging actions

2026-08-28 00:49:20 +04:00

PutObjectTagging.go

feat: refactoring of the integration tests

2025-10-31 20:53:55 +04:00

s3_iam_access_control.go

fix: authorize every key in a DeleteObjects batch after a bucket-policy deny

2026-09-01 14:40:09 +04:00

s3_iam_session_access_control.go

feat: version the private IAM protocol between gateway and standalone service

2026-08-25 01:41:12 +04:00

s3_iam_utils.go

fix: authorize every key in a DeleteObjects batch after a bucket-policy deny

2026-09-01 14:40:09 +04:00

s3conf.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00

server.go

feat: migrate Fiber to v3.3.0

2026-06-15 14:48:31 +04:00

signed_streaming_payload_trailer.go

feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums

2026-05-04 08:50:39 -07:00

signed_streaming_payload.go

feat: adds integration tests for STREAMING-AWS4-HMAC-SHA256-PAYLOAD-TRAILER requests

2025-12-26 21:16:01 +04:00

sigv4_auth.go

fix: reject empty Content-MD5 on PUT operations

2026-06-15 18:53:42 +04:00

unsigned_streaming_payload_trailer.go

feat: support sha512, md5, xxhash3, xxhash64, xxhash128 data integrity checksums

2026-05-04 08:50:39 -07:00

UploadPart.go

feat: add optional data-integrity ETag mode for posix/scoutfs

2026-07-31 14:58:21 -07:00

UploadPartCopy.go

feat: add optional data-integrity ETag mode for posix/scoutfs

2026-07-31 14:58:21 -07:00

utils.go

fix: authorize every key in a DeleteObjects batch after a bucket-policy deny

2026-09-01 14:40:09 +04:00

versioning.go

Merge pull request #2293 from lhjnano/fix/getbucketversioning-empty-config

2026-08-26 21:22:24 -07:00

WebsiteHosting.go

Bugfix: url-encoded chars on the website listener

2026-08-19 13:54:34 +02:00

WORM_protection.go

feat: integrate standalone IAM service with S3 gateway for identity-based policy enforcement

2026-08-25 01:07:36 +04:00