From 5c14e566bc657981c3ac635ee99d88e25598fe75 Mon Sep 17 00:00:00 2001
From: Jay Hemnani <193022578+jayhemnani9910@users.noreply.github.com>
Date: Tue, 27 Oct 2026 13:06:53 +0530
Subject: [PATCH] s3: allow bucket ownership controls when auth is off (#12121)

checkAccessByOwnership compared the caller's account with the bucket
owner even with no identities configured, so Get/Put/Delete
BucketOwnershipControls answered AccessDenied to every request. With
auth off there is no owner to compare against, as the other auth-off
checks already assume.
---
 weed/s3api/auth_account_collapse_test.go | 15 +++++++++++++++
 weed/s3api/s3api_acp.go                  |  4 ++++
 2 files changed, 19 insertions(+)

diff --git a/weed/s3api/auth_account_collapse_test.go b/weed/s3api/auth_account_collapse_test.go
index b2b741a7c2..a48f78f072 100644
--- a/weed/s3api/auth_account_collapse_test.go
+++ b/weed/s3api/auth_account_collapse_test.go
@@ -68,6 +68,21 @@ func TestCheckAccessByOwnershipDeniesNonOwner(t *testing.T) {
 	assert.Equal(t, s3err.ErrNone, s3a.checkAccessByOwnership(owner, "b"), "the actual owner is still allowed")
 }
 
+// With auth off nobody has an account id, so the owner check must not deny:
+// GetBucketOwnershipControls and friends answered AccessDenied to every caller.
+func TestCheckAccessByOwnershipAllowsWhenAuthDisabled(t *testing.T) {
+	adminOwner := AccountAdmin.Id
+	s3a := &S3ApiServer{
+		bucketRegistry: NewBucketRegistry(nil),
+		iam:            &IdentityAccessManagement{},
+	}
+	require.False(t, s3a.iam.isEnabled())
+	s3a.bucketRegistry.setMetadataCache(&BucketMetaData{Name: "b", Owner: &s3.Owner{ID: &adminOwner}})
+
+	req := httptest.NewRequest(http.MethodGet, "/b?ownershipControls=", nil)
+	assert.Equal(t, s3err.ErrNone, s3a.checkAccessByOwnership(req, "b"))
+}
+
 // An account-less identity's synthesized account must be registered in the
 // account lookup so its id resolves to a display name. Otherwise ACL grantee
 // validation and owner display report the id as "not exists" — the regression
diff --git a/weed/s3api/s3api_acp.go b/weed/s3api/s3api_acp.go
index 44a5f77452..bd72ed420b 100644
--- a/weed/s3api/s3api_acp.go
+++ b/weed/s3api/s3api_acp.go
@@ -21,6 +21,10 @@ func (s3a *S3ApiServer) checkAccessByOwnership(r *http.Request, bucket string) s
 	if errCode != s3err.ErrNone {
 		return errCode
 	}
+	// Without auth there is no owner to compare against.
+	if s3a.iam != nil && !s3a.iam.isEnabled() {
+		return s3err.ErrNone
+	}
 	// Admin by capability, not account id: account-less identities share the "admin" id.
 	if s3a.isUserAdmin(r) {
 		return s3err.ErrNone