seaweed-vector: work on its defaults, and without identities or credentials (#12323)

* seaweed-vector: default --namespace to the gateway's Lance port

The old default, http://localhost:8888/lance, is a path nothing serves:
the Lance Namespace listens on its own port, 9101 by default on weed s3,
weed server, weed filer and weed mini. With it, the filer answered the
engine's catalog calls with a 500 and every CreateIndex failed with
InternalFailure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

* seaweed-vector: default --listen to a port no SeaweedFS server takes

127.0.0.1:8080 is the volume server's default port, so weed-vector next
to weed server exited with "Address already in use (os error 98)". 8090
is not among the defaults of master, volume, filer, S3 and its Iceberg
and Lance catalogs, IAM, WebDAV, SFTP, the message queue broker and
agent, the admin server or weed mini, nor any of their gRPC ports
(HTTP + 10000).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

* lance: take any key while the S3 server runs without identities

Without identities the S3 port accepts any signature and treats the
caller as the admin. The Lance catalog still checked an x-api-key or
Bearer token against identities that did not exist, so weed-vector
started with --storage-option credentials on such a server got 401 on
every catalog call. The catalog now skips both checks when S3 auth is
off and leaves the caller to the S3 authenticator, which admits it as
the admin, as it already did for a request with no key. With
identities configured nothing changes: an unknown key is still 401.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

* lance: tell clients to skip signing while S3 auth is off

A client with no credentials of its own could not reach a table's data
on a server without identities, though the S3 port takes unsigned
requests there: lance fell back to the AWS default credential chain and
failed with CredentialsNotLoaded. weed-vector without --storage-option
failed every CreateIndex that way. The catalog now adds
aws_skip_signature to the storage options it hands out while S3 auth is
off, and leaves it out once identities exist.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

* seaweed-vector: bind the listener before registering with the master

The engine spawned its master registration and then bound --listen, so
an engine whose port was taken could reach the master before it exited:
on weed server with 18080 taken the master logged "vector node
127.0.0.1:18080 added" and removed it in the same millisecond, and the
gateway noticed it. Bind first, and name the address in the error
instead of "transport error".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

* seaweed-worker: keep an unsigned store off the AWS default chain

A store the catalog says takes unsigned requests needs no credentials,
but lance builds the AWS default credential chain for any store without
them, and the chain probes instance metadata on every dataset open.
With no credentials of its own, weed-vector spent a second on each
query (1030-1066 ms against 32-46 ms with --storage-option ones). The
merge of the operator's fallback and the vended options, which the
engine and the Lance worker each did in their own copy, moves into
table_options, and gives such a store empty credentials.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

* test(s3vectors): serve an index with no identities and no engine credentials

A second cluster runs weed s3 without -config and weed-vector without
--storage-option, with no AWS credentials in either environment: weed s3
would turn them into an admin identity, and the engine would find them.
On master its CreateIndex fails with InternalFailure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011UpvafvK8JpagF94MHWqwK

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

seaweed-vector/crates/server/src/main.rs

@@ -1,6 +1,7 @@
-use anyhow::Result;
+use anyhow::{Context, Result};
 use clap::Parser;
 use tonic::transport::Server;
+use tonic::transport::server::TcpIncoming;
 use weed_lance_worker::catalog::{NamespaceClient, SigningKey};
 use weed_lance_worker::dataset::FallbackOptions;
 use weed_vector_server::pb::vector::vector_service_server::VectorServiceServer;
@@ -10,15 +11,15 @@ use weed_vector_server::service::VectorServer;
 /// The VectorService the S3 gateway fans vector calls out to.
 #[derive(Parser)]
 struct Args {
-    /// Lance Namespace base URL, e.g. http://localhost:8888/lance.
+    /// Lance Namespace base URL: the S3 gateway's Lance port (-s3.port.lance).
     #[arg(
         long,
         env = "WEED_VECTOR_NAMESPACE",
-        default_value = "http://localhost:8888/lance"
+        default_value = "http://localhost:9101"
     )]
     namespace: String,
     /// gRPC listen address.
-    #[arg(long, env = "WEED_VECTOR_LISTEN", default_value = "127.0.0.1:8080")]
+    #[arg(long, env = "WEED_VECTOR_LISTEN", default_value = "127.0.0.1:8090")]
     listen: String,
     /// object_store option fallback for deployments that vend no credentials:
     /// key=value, repeatable.
@@ -104,6 +105,11 @@ fn advertised_addr(listen: &str, masters: &[String]) -> String {
 async fn main() -> Result<()> {
     tracing_subscriber::fmt::init();
     let args = Args::parse_from(normalize_args(std::env::args().collect()));
+    // Bind before registering, so the master never lists an engine that is
+    // about to exit because its port is taken.
+    let incoming = TcpIncoming::bind(args.listen.parse()?)
+        .with_context(|| format!("listen on {}", args.listen))?
+        .with_nodelay(Some(true));
     if let Some(masters) = &args.masters {
         let masters: Vec<String> = masters.split(',').map(|s| s.trim().to_string()).collect();
         for master in &masters {
@@ -132,7 +138,7 @@ async fn main() -> Result<()> {
                 .max_decoding_message_size(1 << 30)
                 .max_encoding_message_size(1 << 30),
         )
-        .serve(args.listen.parse()?)
+        .serve_with_incoming(incoming)
         .await?;
     Ok(())
 }

seaweed-vector/crates/server/src/service.rs

@@ -430,8 +430,7 @@ impl VectorService for VectorServer {
             .describe_table(&table.id)
             .await
             .map_err(internal)?;
-        let mut options = self.fallback.clone();
-        options.extend(description.storage_options.clone());
+        let options = dataset::table_options(&description, &self.fallback);
         let schema = schema_for(dimension, metric, &req.non_filterable_metadata_keys);
         let empty = RecordBatch::new_empty(schema.clone());
         let reader = arrow_array::RecordBatchIterator::new(vec![Ok(empty)].into_iter(), schema);

seaweed-worker/crates/lance/src/dataset.rs

@@ -65,21 +65,38 @@ pub async fn open_with(
     })
 }
 
-/// The namespace vends object_store's own option names, so they pass straight
-/// through. What it vends always wins: the fallback exists because a deployment
-/// without STS vends no credentials at all, and then the worker has no other way
-/// to reach the data.
+/// The object_store options for a table. The namespace vends object_store's own
+/// option names, so they pass straight through. What it vends always wins: the
+/// fallback exists because a deployment without STS vends no credentials at
+/// all, and then the worker has no other way to reach the data.
+pub fn table_options(
+    description: &TableDescription,
+    fallback: &FallbackOptions,
+) -> HashMap<String, String> {
+    let mut options: HashMap<String, String> = fallback.clone();
+    options.extend(description.storage_options.clone());
+    // A store that takes unsigned requests needs no credentials, but without
+    // any lance builds the AWS default chain, and that probes instance
+    // metadata on every open.
+    if options
+        .get("aws_skip_signature")
+        .is_some_and(|v| v == "true")
+    {
+        options.entry("aws_access_key_id".into()).or_default();
+        options.entry("aws_secret_access_key".into()).or_default();
+    }
+    options
+}
+
 async fn open_at(
     description: &TableDescription,
     fallback: &FallbackOptions,
     wrapper: Option<Arc<dyn WrappingObjectStore>>,
 ) -> Result<Dataset> {
-    let mut options: HashMap<String, String> = fallback.clone();
-    options.extend(description.storage_options.clone());
     DatasetBuilder::from_uri(&description.location)
         .with_store_params(ObjectStoreParams {
             storage_options_accessor: Some(Arc::new(StorageOptionsAccessor::with_static_options(
-                options,
+                table_options(description, fallback),
             ))),
             object_store_wrapper: wrapper,
             ..Default::default()
@@ -102,14 +119,12 @@ pub async fn drop(
         Err(err) => return Err(err),
     };
     check_drop_location(id, &description.location)?;
-    let mut options: HashMap<String, String> = fallback.clone();
-    options.extend(description.storage_options.clone());
     let (store, path) = ObjectStore::from_uri_and_params(
         Arc::new(ObjectStoreRegistry::default()),
         &description.location,
         &ObjectStoreParams {
             storage_options_accessor: Some(Arc::new(StorageOptionsAccessor::with_static_options(
-                options,
+                table_options(&description, fallback),
             ))),
             ..Default::default()
         },
@@ -203,12 +218,45 @@ fn schema_json(dataset: &Dataset) -> Option<String> {
 
 #[cfg(test)]
 mod tests {
-    use super::{check_drop_location, table_location};
+    use super::{FallbackOptions, check_drop_location, table_location, table_options};
+    use crate::catalog::TableDescription;
 
     fn id(parts: &[&str]) -> Vec<String> {
         parts.iter().map(|part| part.to_string()).collect()
     }
 
+    fn options(pairs: &[(&str, &str)]) -> FallbackOptions {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.to_string()))
+            .collect()
+    }
+
+    #[test]
+    fn table_options_keep_an_unsigned_store_off_the_aws_default_chain() {
+        let described = |vended: &[(&str, &str)]| TableDescription {
+            location: "s3://bkt/vector/x".into(),
+            storage_options: options(vended),
+            managed_versioning: false,
+        };
+        let unsigned = described(&[("aws_skip_signature", "true")]);
+
+        let got = table_options(&unsigned, &FallbackOptions::new());
+        assert_eq!(got.get("aws_access_key_id").map(String::as_str), Some(""));
+        assert_eq!(
+            got.get("aws_secret_access_key").map(String::as_str),
+            Some("")
+        );
+
+        let fallback = options(&[("aws_access_key_id", "k"), ("aws_secret_access_key", "s")]);
+        let got = table_options(&unsigned, &fallback);
+        assert_eq!(got.get("aws_access_key_id").map(String::as_str), Some("k"));
+
+        let signed = described(&[("aws_endpoint", "http://s3:8333")]);
+        let got = table_options(&signed, &FallbackOptions::new());
+        assert!(!got.contains_key("aws_access_key_id"), "{got:?}");
+    }
+
     #[test]
     fn table_location_matches_the_gateway_layout() {
         assert_eq!(

test/s3vectors/conftest.py

@@ -70,8 +70,18 @@ def stop(process):
 
 @pytest.fixture(scope="module", params=combinations(), ids=lambda p: "-".join(p))
 def cluster(request, tmp_path_factory):
-    volume, mode = request.param
-    directory = tmp_path_factory.mktemp(f"vectors-{volume}-{mode}")
+    yield from run_cluster(request.param, tmp_path_factory, identities=True)
+
+
+@pytest.fixture(scope="module", params=combinations(), ids=lambda p: "-".join(p))
+def open_cluster(request, tmp_path_factory):
+    """A cluster with no S3 identities, and an engine given no credentials."""
+    yield from run_cluster(request.param, tmp_path_factory, identities=False)
+
+
+def run_cluster(param, tmp_path_factory, identities):
+    volume, mode = param
+    directory = tmp_path_factory.mktemp(f"vectors-{volume}-{mode}" + ("" if identities else "-open"))
     print(f"\nVector integration logs: {directory}")
     weed = binary("WEED_BINARY", "weed")
     engine = binary("VECTOR_BINARY", "weed-vector")
@@ -89,10 +99,12 @@ def cluster(request, tmp_path_factory):
         master_addr = f"127.0.0.1:{master}.{master_grpc}"
         filer_addr = f"127.0.0.1:{filer}.{filer_grpc}"
 
-        def start(name, args):
+        def start(name, args, unset=()):
             log = stack.enter_context((directory / f"{name}.log").open("w"))
             env = dict(os.environ, AWS_ACCESS_KEY_ID="test", AWS_SECRET_ACCESS_KEY="test",
                        AWS_DEFAULT_REGION="us-east-1", AWS_EC2_METADATA_DISABLED="true")
+            for key in unset:
+                env.pop(key)
             process = subprocess.Popen(args, cwd=directory, stdout=log, stderr=log, env=env)
             processes[name] = process
             stack.callback(stop, process)
@@ -117,14 +129,20 @@ def cluster(request, tmp_path_factory):
                         f"-defaultStoreDir={directory / 'filer'}"])
         wait_for(lambda: listening(filer_grpc), processes, "filer not ready")
         endpoint = f"http://127.0.0.1:{s3}"
-        start("s3", [weed, "-v=1", "s3", f"-filer={filer_addr}", f"-config={HERE / 's3.json'}",
+        # weed s3 turns AWS_ACCESS_KEY_ID into an admin identity, and the engine
+        # would find it as a credential.
+        if identities:
+            config, unset = [f"-config={HERE / 's3.json'}"], ()
+            credentials = ["--storage-option", "aws_access_key_id=test",
+                           "--storage-option", "aws_secret_access_key=test"]
+        else:
+            config, unset, credentials = [], ("AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"), []
+        start("s3", [weed, "-v=1", "s3", f"-filer={filer_addr}", *config,
                      "-ip=127.0.0.1", "-ip.bind=127.0.0.1", f"-port={s3}",
-                     f"-port.grpc={s3_grpc}", "-port.iceberg=0", f"-port.lance={lance}"])
+                     f"-port.grpc={s3_grpc}", "-port.iceberg=0", f"-port.lance={lance}"], unset)
         wait_for(lambda: http_ready(f"http://127.0.0.1:{lance}/v1/namespace/root/list"), processes, "catalog not ready")
         start("vector", [engine, "--namespace", f"http://127.0.0.1:{lance}",
-                         "--masters", master_addr, "--listen", f"127.0.0.1:{vector}",
-                         "--storage-option", "aws_access_key_id=test",
-                         "--storage-option", "aws_secret_access_key=test"])
+                         "--masters", master_addr, "--listen", f"127.0.0.1:{vector}", *credentials], unset)
         wait_for(lambda: listening(vector), processes, "vector engine not ready")
 
         wait_for(

test/s3vectors/s3vectors_test.py

@@ -5,6 +5,7 @@ import time
 import uuid
 
 import boto3
+from botocore.config import Config
 from botocore.exceptions import ClientError
 import pytest
 
@@ -415,3 +416,17 @@ def test_query_without_writer(vectors, index, cluster):
                 raise
             time.sleep(0.2)
     assert [v["key"] for v in result["vectors"]] == ["survivor"]
+
+
+def test_engine_without_credentials(open_cluster):
+    """With no S3 identities, an engine given no credentials still serves an index."""
+    client = boto3.client("s3vectors", endpoint_url=open_cluster["endpoint"], aws_access_key_id="any",
+                          aws_secret_access_key="any", region_name="us-east-1",
+                          config=Config(connect_timeout=3, read_timeout=20, retries={"max_attempts": 0}))
+    index = {"vectorBucketName": BUCKET, "indexName": INDEX}
+    client.create_vector_bucket(vectorBucketName=BUCKET)
+    client.create_index(**index, dataType="float32", dimension=2, distanceMetric="cosine")
+    client.put_vectors(**index, vectors=[{"key": "a", "data": {"float32": [1, 0]}},
+                                         {"key": "b", "data": {"float32": [0, 1]}}])
+    hits = client.query_vectors(**index, queryVector={"float32": [1, 0]}, topK=1)["vectors"]
+    assert [h["key"] for h in hits] == ["a"]

weed/s3api/lance/handlers_oauth_test.go

@@ -49,8 +49,9 @@ func newTestServerWithOAuth() *Server {
 }
 
 type mockS3Authenticator struct {
-	called  bool
-	errCode s3err.ErrorCode
+	called       bool
+	errCode      s3err.ErrorCode
+	authDisabled bool
 }
 
 func (m *mockS3Authenticator) AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode) {
@@ -63,6 +64,8 @@ func (m *mockS3Authenticator) AuthenticateRequest(r *http.Request) (string, inte
 
 func (m *mockS3Authenticator) DefaultAllow() bool { return false }
 
+func (m *mockS3Authenticator) AuthEnabled() bool { return !m.authDisabled }
+
 func mintTestToken(t *testing.T, accessKey, secret string, issuedAt, expiresAt time.Time) string {
 	t.Helper()
 	key := deriveSigningKey(accessKey, secret)
@@ -316,6 +319,32 @@ func TestAuthApiKeyInvalid(t *testing.T) {
 	}
 }
 
+// Without identities the S3 port takes any signature, so the catalog takes any
+// key or token and leaves the caller to the S3 authenticator.
+func TestAuthTakesAnyKeyWhenS3AuthIsOff(t *testing.T) {
+	s := newTestServerWithOAuth()
+	s.authenticator = &mockS3Authenticator{authDisabled: true}
+
+	for header, value := range map[string]string{
+		"x-api-key":     "unknown:key",
+		"Authorization": "Bearer not-a-token",
+	} {
+		var gotIdentity string
+		handler := s.Auth(func(w http.ResponseWriter, r *http.Request) {
+			gotIdentity = s3_constants.GetIdentityNameFromContext(r)
+			w.WriteHeader(http.StatusOK)
+		})
+		req := httptest.NewRequest(http.MethodGet, "/v1/namespace/$/list", nil)
+		req.Header.Set(header, value)
+		rec := httptest.NewRecorder()
+		handler(rec, req)
+
+		if rec.Code != http.StatusOK || gotIdentity != "s3user" {
+			t.Fatalf("%s: status = %d, identity = %q, want 200 as s3user", header, rec.Code, gotIdentity)
+		}
+	}
+}
+
 func TestAuthNoBearerStillUsesS3Authenticator(t *testing.T) {
 	s := newTestServerWithOAuth()
 	auth := &mockS3Authenticator{errCode: s3err.ErrNone}

weed/s3api/lance/handlers_test.go

@@ -24,6 +24,14 @@ func (openAuthenticator) AuthenticateRequest(*http.Request) (string, interface{}
 
 func (openAuthenticator) DefaultAllow() bool { return true }
 
+func (openAuthenticator) AuthEnabled() bool { return false }
+
+// signedAuthenticator admits the same caller on a gateway that checks
+// credentials.
+type signedAuthenticator struct{ openAuthenticator }
+
+func (signedAuthenticator) AuthEnabled() bool { return true }
+
 type testHarness struct {
 	router *mux.Router
 	filer  *s3tablestest.MemFiler
@@ -134,6 +142,28 @@ func decode[T any](t *testing.T, recorder *httptest.ResponseRecorder) T {
 	return out
 }
 
+// While the S3 port takes unsigned requests the catalog says so, and a client
+// with no credentials of its own still reaches the data. Once auth is on it
+// has to sign again.
+func TestStorageOptionsSkipSignatureOnlyWhileS3AuthIsOff(t *testing.T) {
+	h := newTestHarness(t)
+	h.createBucket(t, "open", s3tables.FormatLance)
+	h.mustDo(t, http.MethodPost, "/v1/namespace/open$ns/create", `{}`, http.StatusOK)
+
+	declared := decode[DeclareTableResponse](t,
+		h.mustDo(t, http.MethodPost, "/v1/table/open$ns$t/declare", `{}`, http.StatusOK))
+	if declared.StorageOptions["aws_skip_signature"] != "true" {
+		t.Fatalf("auth off: storage options = %v, want aws_skip_signature", declared.StorageOptions)
+	}
+
+	h.server.authenticator = signedAuthenticator{}
+	described := decode[DescribeTableResponse](t,
+		h.mustDo(t, http.MethodPost, "/v1/table/open$ns$t/describe", `{}`, http.StatusOK))
+	if _, ok := described.StorageOptions["aws_skip_signature"]; ok {
+		t.Fatalf("auth on: storage options = %v, want no aws_skip_signature", described.StorageOptions)
+	}
+}
+
 // The lifecycle a Lance client drives: create the namespace, declare the table
 // before any data exists, resolve it to a location, then deregister and bring it
 // back by registering the same location.
@@ -429,6 +459,8 @@ func (createOnlyAuthenticator) AuthenticateRequest(*http.Request) (string, inter
 
 func (createOnlyAuthenticator) DefaultAllow() bool { return false }
 
+func (createOnlyAuthenticator) AuthEnabled() bool { return true }
+
 // The right to create a name is the write evidence for a table the declare
 // creates, but not for one it only finds.
 func TestDeclareVendsWriteOnlyForATableItCreates(t *testing.T) {

weed/s3api/lance/server.go

@@ -25,6 +25,8 @@ type FilerClient interface {
 type S3Authenticator interface {
 	AuthenticateRequest(r *http.Request) (string, interface{}, s3err.ErrorCode)
 	DefaultAllow() bool
+	// AuthEnabled reports whether the S3 server checks credentials at all.
+	AuthEnabled() bool
 }
 
 // CredentialValidator validates S3 access key / secret key pairs
@@ -177,6 +179,13 @@ func loggingMiddleware(next http.Handler) http.Handler {
 	})
 }
 
+// authEnabled is false when the S3 server has no identities and takes any
+// signature. The catalog then takes any key too, and leaves the caller to the
+// S3 authenticator.
+func (s *Server) authEnabled() bool {
+	return s.authenticator == nil || s.authenticator.AuthEnabled()
+}
+
 // Auth authenticates the caller and puts the identity in the request context.
 // Lance clients authenticate the catalog with a Bearer token or an x-api-key
 // header; the S3 authenticator stays for callers that can SigV4-sign.
@@ -190,7 +199,7 @@ func (s *Server) Auth(handler http.HandlerFunc) http.HandlerFunc {
 		// authenticator would parse the header as SigV4 and fail with a
 		// different error that clients cannot act on.
 		// The auth scheme is case-insensitive (RFC 7235).
-		if strings.HasPrefix(strings.ToLower(r.Header.Get("Authorization")), "bearer ") {
+		if s.authEnabled() && strings.HasPrefix(strings.ToLower(r.Header.Get("Authorization")), "bearer ") {
 			if identityName, identity, accessKey, secretKey, ok := s.authenticateBearerKey(r); ok {
 				ctx := r.Context()
 				ctx = s3_constants.SetIdentityNameInContext(ctx, identityName)
@@ -208,7 +217,7 @@ func (s *Server) Auth(handler http.HandlerFunc) http.HandlerFunc {
 			return
 		}
 
-		if apiKey := r.Header.Get("x-api-key"); apiKey != "" {
+		if apiKey := r.Header.Get("x-api-key"); apiKey != "" && s.authEnabled() {
 			if identityName, identity, ok := s.authenticateApiKey(apiKey); ok {
 				accessKey, secretKey, _ := strings.Cut(apiKey, ":")
 				ctx := r.Context()

weed/s3api/lance/storage.go

@@ -149,6 +149,11 @@ func (s *Server) storageOptions(r *http.Request, bucket, location string, vend b
 	if s.s3Region != "" {
 		options["aws_region"] = s.s3Region
 	}
+	if !s.authEnabled() {
+		// The S3 port takes unsigned requests, and a client with no
+		// credentials of its own would otherwise fail looking for some.
+		options["aws_skip_signature"] = "true"
+	}
 
 	if !vend || s.credentialVendor == nil {
 		return options, nil

weed/s3api/s3api_server.go

@@ -1509,6 +1509,12 @@ func (s3a *S3ApiServer) FilerSigningKey() security.SigningKey {
 	return s3a.filerGuard.SigningKey()
 }
 
+// AuthEnabled reports whether requests must carry valid credentials. With no
+// identities configured, every request is allowed as the admin.
+func (s3a *S3ApiServer) AuthEnabled() bool {
+	return s3a.iam == nil || s3a.iam.isEnabled()
+}
+
 // DefaultAllow returns whether access is allowed by default when no policy is found
 func (s3a *S3ApiServer) DefaultAllow() bool {
 	if s3a.iam == nil || s3a.iam.iamIntegration == nil {

weed/s3api/s3api_tables_auth_test.go

@@ -159,6 +159,34 @@ func TestLanceAuthRejectsFailedSignature(t *testing.T) {
 	assert.NotEqual(t, http.StatusOK, rr.Code)
 }
 
+// The Lance catalog takes any x-api-key while the S3 port runs without
+// identities, as the admin, and refuses an unknown key once auth is on.
+func TestLanceAuthTakesAnyKeyOnlyWhileS3AuthIsOff(t *testing.T) {
+	s3a := &S3ApiServer{iam: &IdentityAccessManagement{}}
+	server := lance.NewServer(nil, s3a)
+	server.SetCredentialValidator(s3a)
+
+	call := func() (int, string) {
+		req := httptest.NewRequest(http.MethodGet, "/v1/namespace/list", nil)
+		req.Header.Set("x-api-key", "unknown:key")
+		identity := ""
+		rr := httptest.NewRecorder()
+		server.Auth(func(w http.ResponseWriter, r *http.Request) {
+			identity = s3_constants.GetIdentityNameFromContext(r)
+			w.WriteHeader(http.StatusOK)
+		})(rr, req)
+		return rr.Code, identity
+	}
+
+	code, identity := call()
+	assert.Equal(t, http.StatusOK, code)
+	assert.Equal(t, s3_constants.AccountAdminId, identity)
+
+	s3a.iam.isAuthEnabled = true
+	code, _ = call()
+	assert.Equal(t, http.StatusUnauthorized, code)
+}
+
 func TestAuthSignatureOnlyScrubsAccountHeader(t *testing.T) {
 	s3a := setupDefaultAllowAuthServer(t)