* shell: accept ReadAcp and WriteAcp in per-bucket and service account actions
s3.bucket.access, s3.anonymous.set and s3.serviceaccount.create rejected
ReadAcp and WriteAcp, so the ACL actions the S3 gateway enforces could not
be granted through them. Share one canonical action table across the
three commands and list the ACL actions in their help.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: list ReadAcp and WriteAcp in s3.configure and s3.circuitBreaker help
The -actions usage of both commands stopped at Admin, so the ACL actions
the gateway enforces could only be found in the source. s3.circuitBreaker
now prints the actions it actually accepts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: offer ReadAcp and WriteAcp in the object store user permissions
The create and edit user forms only offered Read, Write, List, Tagging and
Admin among the bucket permissions, so an identity could not be given the
ACL actions from the UI even though uploads with x-amz-acl need WriteAcp.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* s3api: log the WriteAcp denial of an upload that sets an ACL
An upload or copy that carries x-amz-acl or an x-amz-grant-* header also
needs WriteAcp. When that check denies, the client only sees a bare
AccessDenied and nothing reached the log at the default verbosity, so
the header was never suspected. Log the identity and the missing action.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* s3api: quote the key in the ACL upload denial log
An object key can carry a decoded newline, which let a caller add forged
lines to the default log. Quote the bucket and key, and word the message
so it also fits a policy deny, not only a missing grant.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: say ACL uploads need both Write and WriteAcp
The s3.configure example granted WriteAcp alone, which still fails the
upload's Write check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: parse S3 action lists with one shared helper
s3.bucket.access, s3.anonymous.set and s3.serviceaccount.create each had
their own validation loop, so a test of the table did not cover the
parsing the commands run. They now call canonicalActionList, which skips
empty entries and repeats. s3.anonymous.set validates before contacting
IAM, and s3.bucket.access still rejects a list with no actions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: keep bucket-scoped actions the user form cannot show
When a user has both global and bucket-scoped actions, the edit form
shows only the global ones, and saving replaced the identity's actions
with what the form rebuilt, deleting the scoped grants. Carry those
actions through the save.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: list hidden bucket grants in the user edit form
Restoring the bucket-scoped grants the form cannot show kept them active
even when an admin narrowed the user's permissions, with no way to see
or drop them. Show them as checked boxes under Other Bucket Permissions;
unchecking one removes it on save.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: reject an s3.anonymous.set -access list with no actions
A blank list such as ",," parsed to nothing and cleared the bucket's
anonymous grants. Use "none" for that, as s3.bucket.access does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* s3api: skip the ACL upload denial log for anonymous requests
Anonymous uploads with ACL headers can be sent by anyone, so logging
each denial at the default level lets unauthenticated clients flood the
log. Keep the line for named identities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: count kept bucket grants when checking an edited user for permissions
The empty check ran before the checked Other Bucket Permissions were
merged, so a user left with only those grants could not be saved.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: list bucket grants of Admin users in the user edit form
parseBucketPermissions returned before reading scoped actions when the
user had Admin, so removing Admin and saving dropped grants such as
WriteAcp:bucket.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: keep unpaired bucket grants as separate checkboxes in the user edit form
The form saves every selected permission on every selected bucket, so
grants such as ReadAcp:a with WriteAcp:b came back as all four pairs.
Show the grants through the picker only when they cover that full
product; otherwise list each grant on its own. Opening the form also
resets the bucket scope left over from the previous user.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: keep grants the edit pickers have no option for
A permission x bucket product was shown through the pickers even when a
bucket was not in the bucket list (deleted, prefix or wildcard grants)
or a permission had no picker option (DeleteBucket, PutBucketQuota).
Saving then dropped those grants. Such grants now go to the checkbox
list, global ones included, and are submitted unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: name the s3.bucket.access anonymous example by what it grants
Read,Write,List leaves out ReadAcp and WriteAcp, so it is not full
access.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: keep unlisted global grants of Admin users in the user edit form
parseBucketPermissions returned for Admin before splitting global grants
into picker options and the rest, and only raw option values were
re-selected. Saving an Admin user dropped s3tables:* and grants with no
picker option such as DeleteBucket. Admin users now use the same split.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* admin: keep the /* suffix of bucket grants in the user edit form
parseBucketPermissions dropped a trailing /* before matching bucket
options, so saving rewrote ReadAcp:bucket/* as ReadAcp:bucket. The bare
form also matches bucket-level requests such as GET ?acl, so the save
widened the grant. A /* bucket is not a picker option, so the grant now
stays in the checkbox list as written.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* shell: test that s3.bucket.access saves ReadAcp and WriteAcp grants
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* feat(s3/lifecycle): filer-backed cursor Persister
FilerPersister persists per-shard cursor maps as JSON to
/etc/s3/lifecycle/cursors/shard-NN.json via filer.SaveInsideFiler.
One file per shard keeps Save atomic — the filer writes the entry
in a single mutation, so a crash mid-write doesn't leak partial
state. Pipeline.Run loads on start; the periodic checkpoint and
graceful-shutdown save go through this implementation.
A small FilerStore interface wraps the SeaweedFilerClient surface
the persister needs, so tests inject an in-memory fake instead of
mocking the full gRPC client.
* refactor(s3/lifecycle): drop BlockerStore — durable cursor IS the block
A frozen cursor doesn't advance, so the durable cursor (FilerPersister)
encodes the blocked state on its own. On worker restart the reader
re-encounters the poison event at MinTsNs, the dispatcher walks the
same retry budget to BLOCKED, and the cursor freezes at the same
EventTs. Other in-flight events between freeze tsNs and prior cursor
positions self-resolve via NOOP_RESOLVED (STALE_IDENTITY) since the
underlying objects were already deleted on the prior pass.
Removed:
- BlockerStore interface + InMemoryBlockerStore + BlockerRecord
- Dispatcher.Blockers + Dispatcher.ReplayBlockers
- the BlockerStore.Put call in handleBlocked
- Pipeline.Blockers field + the ReplayBlockers call on startup
Added a TestDispatchRestartReFreezesNaturally that pins the
self-recovery property: a fresh Dispatcher with a fresh Cursor, fed
the same poison event, reaches the same frozen state at the same
EventTs without any durable blocker store.
Operator visibility: a cursor whose MinTsNs hasn't advanced is the
signal — surfaced via the durable cursor file.
* refactor(filer): SaveInsideFiler accepts ctx
ReadInsideFiler already takes ctx; SaveInsideFiler used context.Background()
internally and silently dropped the caller's ctx. Symmetric API now;
cancellation/deadlines propagate through LookupEntry / CreateEntry /
UpdateEntry. Mechanical update of all callers — most pass
context.Background() since the existing call sites have no ctx in scope.
* fix(s3/lifecycle): deterministic order in cursor save
Iterating Go maps yields random order, so json.Encode produced a different
byte sequence on each save even when the state hadn't changed. Sort
entries by (Bucket, ActionKind, RuleHash) before encoding so the on-disk
file diffs cleanly. New test pins byte-identical output across two saves
of the same map.
* fix(s3/lifecycle): log reason when freezing cursor in handleBlocked
handleBlocked dropped the reason via _ = reason with a comment claiming
the caller logged it; none of the three callers do. A frozen cursor is
the only surface where the operator finds out something stuck, so the
reason has to land somewhere. glog.Warningf with shard, key, eventTs,
and the original reason — same shape the rest of the package uses.
