From d5433ae745bbd199bc7a73f39b979e884fe3ca95 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Wed, 28 Oct 2026 01:47:12 -0700 Subject: [PATCH] vector: cover the identity object in s3vectors auth (#12162) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vector: cover the identity object in the s3vectors auth context The auth middleware must carry the resolved identity object — only the name survives otherwise and authorization loses actions, account, and claims. --- weed/s3api/s3vectors/auth_test.go | 37 +++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 weed/s3api/s3vectors/auth_test.go diff --git a/weed/s3api/s3vectors/auth_test.go b/weed/s3api/s3vectors/auth_test.go new file mode 100644 index 0000000000..43c5d8e26b --- /dev/null +++ b/weed/s3api/s3vectors/auth_test.go @@ -0,0 +1,37 @@ +package s3vectors + +import ( + "net/http" + "net/http/httptest" + "testing" + + "github.com/seaweedfs/seaweedfs/weed/s3api" + "github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants" + "github.com/seaweedfs/seaweedfs/weed/s3api/s3err" +) + +type fakeAuthenticator struct { + identity *s3api.Identity +} + +func (f *fakeAuthenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) { + return f.identity.Name, f.identity, s3err.ErrNone +} + +func (f *fakeAuthenticator) DefaultAllow() bool { return true } + +// The authenticated identity object must ride the request context — only the +// name survives otherwise, and downstream authorization loses actions, +// account, and claims. +func TestAuthKeepsIdentityObject(t *testing.T) { + want := &s3api.Identity{Name: "alice", Actions: []s3api.Action{"Admin"}} + s := &Server{authenticator: &fakeAuthenticator{identity: want}} + var got interface{} + h := s.Auth(func(w http.ResponseWriter, r *http.Request) { + got = s3_constants.GetIdentityFromContext(r) + }) + h(httptest.NewRecorder(), httptest.NewRequest(http.MethodPost, "/", nil)) + if got != interface{}(want) { + t.Fatalf("identity object missing from context: %v", got) + } +}