s3: allow bucket ownership controls when auth is off (#12121)

checkAccessByOwnership compared the caller's account with the bucket
owner even with no identities configured, so Get/Put/Delete
BucketOwnershipControls answered AccessDenied to every request. With
auth off there is no owner to compare against, as the other auth-off
checks already assume.

weed/s3api/auth_account_collapse_test.go

@@ -68,6 +68,21 @@ func TestCheckAccessByOwnershipDeniesNonOwner(t *testing.T) {
 	assert.Equal(t, s3err.ErrNone, s3a.checkAccessByOwnership(owner, "b"), "the actual owner is still allowed")
 }
 
+// With auth off nobody has an account id, so the owner check must not deny:
+// GetBucketOwnershipControls and friends answered AccessDenied to every caller.
+func TestCheckAccessByOwnershipAllowsWhenAuthDisabled(t *testing.T) {
+	adminOwner := AccountAdmin.Id
+	s3a := &S3ApiServer{
+		bucketRegistry: NewBucketRegistry(nil),
+		iam:            &IdentityAccessManagement{},
+	}
+	require.False(t, s3a.iam.isEnabled())
+	s3a.bucketRegistry.setMetadataCache(&BucketMetaData{Name: "b", Owner: &s3.Owner{ID: &adminOwner}})
+
+	req := httptest.NewRequest(http.MethodGet, "/b?ownershipControls=", nil)
+	assert.Equal(t, s3err.ErrNone, s3a.checkAccessByOwnership(req, "b"))
+}
+
 // An account-less identity's synthesized account must be registered in the
 // account lookup so its id resolves to a display name. Otherwise ACL grantee
 // validation and owner display report the id as "not exists" — the regression

weed/s3api/s3api_acp.go

@@ -21,6 +21,10 @@ func (s3a *S3ApiServer) checkAccessByOwnership(r *http.Request, bucket string) s
 	if errCode != s3err.ErrNone {
 		return errCode
 	}
+	// Without auth there is no owner to compare against.
+	if s3a.iam != nil && !s3a.iam.isEnabled() {
+		return s3err.ErrNone
+	}
 	// Admin by capability, not account id: account-less identities share the "admin" id.
 	if s3a.isUserAdmin(r) {
 		return s3err.ErrNone