seaweedfs

Github-Mirror/seaweedfs

0 Fork 0

mirror of https://github.com/seaweedfs/seaweedfs.git synced 2026-10-30 08:50:48 +01:00

Files

T

History

Chris LuandDevin e442eda88e s3: authorize POST policy uploads through the shared object check (#12047 )

* s3: authorize POST policy uploads through the shared object check

doesPolicySignatureMatch gated a verified POST Object signature on the
identity's legacy Write action, which cannot represent attached IAM
policies, STS session policies, or key-scoped grants. Users authorized
only by an attached policy (e.g. s3:PutObject on bucket/*) were denied
with AccessDenied even though the equivalent PUT succeeds.

The handler already runs AuthorizeObjectWrite against the real object
key after the form's x-amz-* fields are promoted to headers, so the
coarse check only shadowed the full evaluation. Signature verification
now just returns the identity; authorization stays in one place.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* test: POST Object authorizes attached-policy identities, still denies others

Cover the signature check and AuthorizeObjectWrite for an identity whose
only write grant comes from an attached IAM policy, plus the deny leg
for an identity whose attached policy omits s3:PutObject.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-10-24 15:09:34 -07:00

cors

fix(s3): set Access-Control-Allow-Credentials on CORS responses (#11886 )

2026-10-21 13:10:49 -07:00

iceberg

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

lance

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

lifecycle_xml

admin: add bucket lifecycle rule editing (#10860 )

2026-08-21 23:42:26 -07:00

policy

…

policy_engine

s3api: support s3:RequestObjectTagKeys in bucket policies (#11993 )

2026-10-24 02:04:39 -07:00

s3_constants

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

s3_objectlock

s3: check Object Lock on directory-marker keys before bucket deletion (#11096 )

2026-09-02 11:35:19 -07:00

s3bucket

s3: reject reserved bucket name "filemeta" (#9760 )

2026-05-31 11:15:05 -07:00

s3err

s3api: skip error response body when http forbids it (#11931 )

2026-10-21 20:43:32 -07:00

s3lifecycle

s3 lifecycle: route version-file writes to current-version expiration (#11956 )

2026-10-23 03:19:41 -07:00

s3tables

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

AmazonS3.xsd

s3: paginate ListBuckets and serve it from a bucket owner index (#10214 )

2026-07-02 21:11:41 -07:00

auth_access_key_attribution_test.go

s3, iceberg: record the access key a request was signed with (#11901 )

2026-10-21 20:33:08 -07:00

auth_access_key_post_policy_test.go

s3, iceberg: record the access key a request was signed with (#11901 )

2026-10-21 20:33:08 -07:00

auth_access_key_shapes_test.go

s3, iceberg: record the access key a request was signed with (#11901 )

2026-10-21 20:33:08 -07:00

auth_account_collapse_test.go

s3tables: tighten legacy OIDC subject re-anchoring (#11808 )

2026-10-18 02:43:03 -07:00

auth_audit_requester_test.go

s3: record requester identity before the authz verdict (#11479 )

2026-09-27 07:03:01 +08:00

auth_config_default_deny_test.go

s3: deny anonymous access when the identity config loads no identities (#10954 )

2026-08-25 15:31:32 -07:00

auth_copy_source_test.go

s3: resolve versionId ACL and attributes requests to the version-scoped actions (#11916 )

2026-10-21 16:50:34 -07:00

auth_credentials_native_floor_test.go

s3: do not promote ?prefix into the object for non-List actions (#11494 )

2026-09-28 07:17:58 +08:00

auth_credentials_policy_document_test.go

s3api: load document-style policies from the advanced IAM config (#10481 )

2026-07-29 10:30:30 -07:00

auth_credentials_policy_document.go

s3api: load document-style policies from the advanced IAM config (#10481 )

2026-07-29 10:30:30 -07:00

auth_credentials_policy_sync_test.go

s3api: load document-style policies from the advanced IAM config (#10481 )

2026-07-29 10:30:30 -07:00

auth_credentials_static_config_test.go

s3api: revoke the identities a config reload no longer declares (#11679 )

2026-10-10 09:34:11 +08:00

auth_credentials_subscribe_test.go

fix(s3api/iam): avoid transient AccessDenied from full reloads on single IAM file changes (#11271 )

2026-09-11 10:42:19 -07:00

auth_credentials_subscribe.go

s3/iam: manage roles through the IAM API, with an opt-in persistent role store (#11522 )

2026-09-30 20:45:47 +08:00

auth_credentials_trust.go

…

auth_credentials_upsert_test.go

s3api: hydrate runtime policies on propagated IAM updates (#11784 )

2026-10-17 15:25:00 -07:00

auth_credentials.go

s3: gate POST Object acl fields behind PutObjectAcl (#11939 )

2026-10-23 17:05:44 -07:00

auth_invalid_bucket_name_test.go

s3: answer InvalidBucketName to a denied request on a malformed bucket name (#11893 )

2026-10-21 14:08:33 -07:00

auth_jwt_streaming_unsigned_test.go

fix(s3): authenticate JWT unsigned-streaming uploads (#9729 )

2026-05-28 18:10:24 -07:00

auth_presigned_semicolon_test.go

s3: accept raw semicolons in query strings (#10305 )

2026-07-10 12:17:35 -07:00

auth_proxy_integration_test.go

s3: verify SigV4 against each plausible reverse-proxy host (#10284 )

2026-07-09 02:34:13 -07:00

auth_prune_bucket_test.go

s3: embedded IAM inline policy honors prefix-scoped resources (#10192 )

2026-07-02 09:14:54 -07:00

auth_security_test.go

s3: do not promote ?prefix into the object for non-List actions (#11494 )

2026-09-28 07:17:58 +08:00

auth_signature_v2_test.go

fix(s3): verify SigV2 using percent-encoded path for Unicode object keys (#10022 )

2026-06-20 08:28:40 -07:00

auth_signature_v2.go

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

auth_signature_v4_sts_test.go

s3: give STS sessions a distinct owner account instead of admin (#9963 )

2026-06-14 13:55:11 -07:00

auth_signature_v4_test.go

s3: keep a signed content-length in the canonical request (#11849 )

2026-10-19 18:32:44 -07:00

auth_signature_v4_unsigned_headers_test.go

s3api: align S3/IAM error responses with AWS (#11632 )

2026-10-07 21:02:38 +08:00

auth_signature_v4.go

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

auth_static_session_token_test.go

s3api: tolerate session tokens on statically configured credentials (#11694 )

2026-10-10 10:11:24 +08:00

auth_sts_identity_test.go

…

auth_sts_session_token_test.go

s3: tighten STS session token handling (#11383 )

2026-09-17 23:50:16 -07:00

auth_sts_v4_test.go

s3: tighten STS session token handling (#11383 )

2026-09-17 23:50:16 -07:00

auto_signature_v4_test.go

s3: verify X-Forwarded-Prefix only from trusted proxies (#11843 )

2026-10-19 15:55:18 -07:00

bucket_metadata_test.go

build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/storage/azblob from 1.8.0 to 1.8.2 (#11740 )

2026-10-15 21:53:16 -07:00

bucket_metadata.go

s3: report the effective ownership when a bucket has none stored (#10591 )

2026-08-05 13:15:28 -07:00

bucket_owner_identity_test.go

s3: honor a bucket owner recorded as an identity (#10567 )

2026-08-04 16:00:04 -07:00

bucket_paths.go

s3tables: accept the external-volume verification object at a table bucket's root (#11900 )

2026-10-21 14:49:36 -07:00

bucket_size_metrics_test.go

s3: take bucket sizes from the master's summary (#10664 )

2026-08-09 00:00:19 -07:00

bucket_size_metrics.go

s3: take bucket sizes from the master's summary (#10664 )

2026-08-09 00:00:19 -07:00

chunked_bug_reproduction_test.go

…

chunked_reader_trailer_split_test.go

s3api: copy the trailer checksum before reading the next trailer line (#11583 )

2026-10-04 01:14:15 +08:00

chunked_reader_v4_bucket_policy_test.go

s3api: do not re-run permission checks in the aws-chunked reader (#11655 )

2026-10-09 10:01:28 +08:00

chunked_reader_v4_test.go

fix: clone protobuf snapshots without copying internal locks (#11968 )

2026-10-22 18:38:33 -07:00

chunked_reader_v4.go

s3: accept signed streaming uploads when IAM is disabled (#11766 )

2026-10-16 21:10:38 -07:00

copy_source_decode_test.go

[s3] validate indirect filer path inputs (#9931 )

2026-06-11 21:56:16 -07:00

crc_combine_test.go

s3api: FULL_OBJECT checksums for CRC multipart uploads (#10236 )

2026-07-05 20:19:20 -07:00

crc_combine.go

s3api: FULL_OBJECT checksums for CRC multipart uploads (#10236 )

2026-07-05 20:19:20 -07:00

credential_iam_errors.go

…

custom_types.go

chore(weed/s3api): prune dead code (#10462 )

2026-07-27 17:48:20 -07:00

filer_multipart_abort_test.go

s3: abort completed multipart uploads metadata-only (#11385 )

2026-09-18 01:01:52 -07:00

filer_multipart_checksum_test.go

s3: return the multipart object checksum in the CompleteMultipartUpload response (#11101 )

2026-09-02 11:57:45 -07:00

filer_multipart_etag_test.go

mount: version open file handles by filer log position (#10403 )

2026-07-23 17:44:02 -07:00

filer_multipart_initiate_acl_test.go

s3: validate multipart initiate ACLs like PUT

2026-10-12 02:41:28 -07:00

filer_multipart_list_encoding_test.go

s3: url-encode ListMultipartUploads results for encoding-type=url (#11998 )

2026-10-23 18:21:26 -07:00

filer_multipart_list_test.go

s3: make ListObjectsV2 continuation tokens round-trip XML-unsafe keys (#11996 )

2026-10-24 07:18:10 -07:00

filer_multipart_sse_s3_test.go

mount: version open file handles by filer log position (#10403 )

2026-07-23 17:44:02 -07:00

filer_multipart.go

s3: make ListObjectsV2 continuation tokens round-trip XML-unsafe keys (#11996 )

2026-10-24 07:18:10 -07:00

filer_util_delete_test.go

s3: replay a delete whose reply the transport dropped (#11022 )

2026-08-28 14:30:21 -07:00

filer_util_list_retry_test.go

Classify a filer error before a user-controlled path is wrapped into it (#11004 )

2026-08-27 22:30:53 -07:00

filer_util_tags.go

…

filer_util.go

s3: bound ListMultipartUploads memory to the page size (#11971 )

2026-10-23 00:46:10 -07:00

iam_batch_delete_test.go

s3: add the RenameObject endpoint (#10659 )

2026-08-08 21:24:30 -07:00

iam_defaults_test.go

s3/iam: manage roles through the IAM API, with an opt-in persistent role store (#11522 )

2026-09-30 20:45:47 +08:00

iam_list_prefix_regression_test.go

s3: keep a listing's start position inside the requested prefix (#11493 )

2026-09-28 06:58:44 +08:00

iam_optional_test.go

fix(s3): keep anonymous access working with EnableIam default (fixes #9557 ) (#9567 )

2026-05-19 13:03:30 -07:00

identity_reflection_test.go

…

kms_azure.go

s3api: register the azurekms KMS provider under its build tag (#11691 )

2026-10-10 23:44:09 +08:00

object_lock_utils.go

fix(s3api): clear stale object lock years (#9890 )

2026-06-09 00:48:38 -07:00

README.txt

…

request_body_test.go

s3: drain request body before error response (#11334 )

2026-09-15 13:09:07 -07:00

request_body.go

s3: drain request body before error response (#11334 )

2026-09-15 13:09:07 -07:00

s3_action_resolver_test.go

s3: resolve versionId ACL and attributes requests to the version-scoped actions (#11916 )

2026-10-21 16:50:34 -07:00

s3_action_resolver.go

s3: resolve versionId ACL and attributes requests to the version-scoped actions (#11916 )

2026-10-21 16:50:34 -07:00

s3_bucket_encryption.go

…

s3_content_encoding_test.go

s3api: do not store aws-chunked in an object's Content-Encoding (#11528 )

2026-10-01 01:10:38 +08:00

s3_encodepath_test.go

s3api: optimize encodePath memory allocations (#10252 )

2026-07-07 12:36:47 -07:00

s3_end_to_end_test.go

s3: tighten STS session token handling (#11383 )

2026-09-17 23:50:16 -07:00

s3_error_utils.go

Classify a filer error before a user-controlled path is wrapped into it (#11004 )

2026-08-27 22:30:53 -07:00

s3_existing_object_tag_test.go

s3: resolve versionId ACL and attributes requests to the version-scoped actions (#11916 )

2026-10-21 16:50:34 -07:00

s3_granular_action_security_test.go

…

s3_iam_bearer_trust_policy_test.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774 )

2026-10-16 19:48:32 -07:00

s3_iam_group_role_abac_test.go

s3: tighten STS session token handling (#11383 )

2026-09-17 23:50:16 -07:00

s3_iam_middleware.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774 )

2026-10-16 19:48:32 -07:00

s3_iam_role_selection_test.go

…

s3_jwt_auth_test.go

s3: tighten STS session token handling (#11383 )

2026-09-17 23:50:16 -07:00

s3_list_parts_action_test.go

…

s3_metadata_util.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

s3_sse_c.go

…

s3_sse_ctr_test.go

…

s3_sse_kms_utils.go

…

s3_sse_kms.go

s3api: resolve volume data encryption in CopyObject SSE flows (#11646 ) (#11683 )

2026-10-10 10:59:36 +08:00

s3_sse_metadata.go

…

s3_sse_s3_integration_test.go

…

s3_sse_s3_kek_passphrase_test.go

…

s3_sse_s3_multipart_test.go

…

s3_sse_s3.go

mount: version open file handles by filer log position (#10403 )

2026-07-23 17:44:02 -07:00

s3_sse_test_utils_test.go

…

s3_sse_utils.go

…

s3_token_differentiation_test.go

…

s3_validation_utils_require_test.go

…

s3_validation_utils.go

…

s3api_acl_header_parser_test.go

s3api: persist ACLs on PutObject uploads (#11592 )

2026-10-05 09:13:19 +08:00

s3api_acl_helper.go

s3api: persist ACLs on PutObject uploads (#11592 )

2026-10-05 09:13:19 +08:00

s3api_acp.go

s3: give account-less identities a distinct owner instead of admin (#9962 )

2026-06-14 13:54:49 -07:00

s3api_ambiguous_subresource_test.go

s3: close seaweedfs-quota policy-confusion gap (#11409 )

2026-09-20 23:34:57 -07:00

s3api_auth.go

…

s3api_bucket_config_stubs_test.go

s3: lazy, bounded, entry-free per-bucket caches (#10213 )

2026-07-02 21:11:34 -07:00

s3api_bucket_config_stubs.go

feat(s3): stub bucket configuration list endpoints (#9571 )

2026-05-19 17:34:51 -07:00

s3api_bucket_config_update_test.go

s3: lazy, bounded, entry-free per-bucket caches (#10213 )

2026-07-02 21:11:34 -07:00

s3api_bucket_config.go

s3api: align S3/IAM error responses with AWS (#11632 )

2026-10-07 21:02:38 +08:00

s3api_bucket_cors_handlers.go

…

s3api_bucket_default_encryption_test.go

s3api: apply bucket default encryption when volume data encryption is enabled (#11681 )

2026-10-10 23:41:17 +08:00

s3api_bucket_delete_test.go

s3: count stored versions as bucket contents on delete (#11775 )

2026-10-17 15:25:56 -07:00

s3api_bucket_handlers_list_test.go

s3: list the buckets an attached IAM policy grants (#10458 )

2026-07-27 16:42:01 -07:00

s3api_bucket_handlers_misc_test.go

s3: evaluate bucket policy before ACL public-read for anonymous requests (#11471 )

2026-09-26 17:59:57 +08:00

s3api_bucket_handlers_misc.go

s3api: align S3/IAM error responses with AWS (#11632 )

2026-10-07 21:02:38 +08:00

s3api_bucket_handlers_object_lock_config.go

…

s3api_bucket_handlers.go

s3, s3tables: create buckets and namespaces exclusively (#11872 )

2026-10-20 19:01:08 -07:00

s3api_bucket_lifecycle_config.go

admin: add bucket lifecycle rule editing (#10860 )

2026-08-21 23:42:26 -07:00

s3api_bucket_lifecycle_fastpath_warn_test.go

s3: warn when a lifecycle change leaves fast-path-stamped objects on their old TTL (#11184 )

2026-09-05 12:13:37 -07:00

s3api_bucket_lifecycle_fastpath_warn.go

s3: warn when a lifecycle change leaves fast-path-stamped objects on their old TTL (#11184 )

2026-09-05 12:13:37 -07:00

s3api_bucket_lifecycle_response_test.go

s3: lazy, bounded, entry-free per-bucket caches (#10213 )

2026-07-02 21:11:34 -07:00

s3api_bucket_metadata_test.go

…

s3api_bucket_owner_index_test.go

s3: paginate ListBuckets and serve it from a bucket owner index (#10214 )

2026-07-02 21:11:41 -07:00

s3api_bucket_owner_index.go

weed filer.remote.sync: ignore .system directory under buckets (#11966 ) (#11969 )

2026-10-22 18:40:30 -07:00

s3api_bucket_policy_arn_test.go

…

s3api_bucket_policy_authz_test.go

s3: require a bucket-policy action to write a bucket policy (#10444 )

2026-07-26 00:52:22 -07:00

s3api_bucket_policy_engine.go

s3api: persist ACLs on PutObject uploads (#11592 )

2026-10-05 09:13:19 +08:00

s3api_bucket_policy_handlers.go

Fixes from the review of the admin bucket policy UI (#10907 )

2026-08-24 00:52:01 -07:00

s3api_bucket_policy_identity_deny_test.go

s3: evaluate tag conditions on copy-source and tagging subresources (#11771 )

2026-10-16 19:50:36 -07:00

s3api_bucket_policy_mirror_test.go

Fixes from the review of the admin bucket policy UI (#10907 )

2026-08-24 00:52:01 -07:00

s3api_bucket_quota_handlers_test.go

feat(s3api): add bucket quota S3 extension via ?seaweedfs-quota (#11279 )

2026-09-11 22:17:30 -07:00

s3api_bucket_quota_handlers.go

s3: drain request body before error response (#11334 )

2026-09-15 13:09:07 -07:00

s3api_bucket_subresource_routing_test.go

s3: allow-unordered is a listing parameter, not an unimplemented subresource (#10846 )

2026-08-19 20:09:23 -07:00

s3api_bucket_tagging_handlers_test.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

s3api_bucket_tagging_handlers.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

s3api_chunk_manifest_test.go

filer: pack SSE chunks into manifests (#11175 )

2026-09-05 10:16:17 -07:00

s3api_chunk_manifest.go

filer: guard FoundationDB 100KB value limit and pack earlier (#11161 )

2026-09-04 23:12:27 -07:00

s3api_circuit_breaker_test.go

s3api: add optional request interceptor to circuit breaker (#9994 )

2026-06-16 16:29:30 -07:00

s3api_circuit_breaker.go

s3api: add optional request interceptor to circuit breaker (#9994 )

2026-06-16 16:29:30 -07:00

s3api_copy_size_calculation.go

…

s3api_copy_source_classify_test.go

s3: return NoSuchKey/NoSuchBucket for a missing CopyObject source (#10332 )

2026-07-14 11:53:53 -07:00

s3api_copy_validation_test.go

s3api: reject SSE headers PutObject cannot honor, as CopyObject does (#11642 )

2026-10-09 12:43:04 +08:00

s3api_copy_validation.go

s3api: reject SSE headers PutObject cannot honor, as CopyObject does (#11642 )

2026-10-09 12:43:04 +08:00

s3api_directory_marker.go

s3: replay a delete whose reply the transport dropped (#11022 )

2026-08-28 14:30:21 -07:00

s3api_domain_test.go

…

s3api_embedded_iam_authz_test.go

iam: optionally require an iam: grant for self-service access-key actions (#11937 )

2026-10-21 20:06:30 -07:00

s3api_embedded_iam_oidc.go

s3/iam: persist IAM-managed OIDC providers in the filer, and trust them after a restart (#11510 )

2026-09-29 11:51:39 +08:00

s3api_embedded_iam_role.go

s3/iam: manage roles through the IAM API, with an opt-in persistent role store (#11522 )

2026-09-30 20:45:47 +08:00

s3api_embedded_iam_targeted_test.go

iam: targeted writes for single-user IAM actions (#11877 )

2026-10-20 17:41:37 -07:00

s3api_embedded_iam_test.go

iam: GetUserPolicy returns NoSuchEntity for a policy name the user does not have (#11944 )

2026-10-23 17:08:49 -07:00

s3api_embedded_iam_user_tags_test.go

s3api: align S3/IAM error responses with AWS (#11632 )

2026-10-07 21:02:38 +08:00

s3api_embedded_iam.go

iam: GetUserPolicy returns NoSuchEntity for a policy name the user does not have (#11944 )

2026-10-23 17:08:49 -07:00

s3api_encrypted_volume_copy_test.go

s3api: resolve volume data encryption in CopyObject SSE flows (#11646 ) (#11683 )

2026-10-10 10:59:36 +08:00

s3api_governance_permissions_test.go

s3: enforce dedicated Object Lock actions (#11362 )

2026-09-16 20:34:06 -07:00

s3api_handlers_failover_test.go

master, filer, s3api: bound the collection deletes that strand a caller (#11026 )

2026-08-28 16:32:30 -07:00

s3api_handlers.go

s3api: make ambiguous routed-PUT recovery atomic and stop transaction replay (#11787 )

2026-10-17 21:36:39 -07:00

s3api_head_bucket_test.go

test: fix HEAD bucket assertions and FUSE failover startup timing (#11967 )

2026-10-22 14:34:52 -07:00

s3api_iam_oidc_test.go

s3api: align S3/IAM error responses with AWS (#11632 )

2026-10-07 21:02:38 +08:00

s3api_iam_role_test.go

s3/iam: manage roles through the IAM API, with an opt-in persistent role store (#11522 )

2026-09-30 20:45:47 +08:00

s3api_iceberg_credentials_test.go

s3, iceberg: record the access key a request was signed with (#11901 )

2026-10-21 20:33:08 -07:00

s3api_iceberg_credentials.go

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

s3api_iceberg_session_name_test.go

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

s3api_iceberg_vended_session_test.go

s3: end a catalog-vended session with the access key it was vended for (#11945 )

2026-10-23 03:58:06 -07:00

s3api_implicit_directory_test.go

…

s3api_inline_policy_condition_test.go

fix(s3api): evaluate aws:SourceIp from the direct TCP peer, not forwarded headers (#11231 )

2026-09-08 15:09:31 -07:00

s3api_internal_lifecycle_test.go

s3: restrict admin gRPC to local callers when no signing key (#11530 )

2026-10-01 23:12:23 +08:00

s3api_internal_lifecycle.go

s3: abort completed multipart uploads metadata-only (#11385 )

2026-09-18 01:01:52 -07:00

s3api_list_normalization_test.go

…

s3api_list_parts_no_such_upload_test.go

s3api: exclude marker part in listObjectParts pagination (#11463 )

2026-09-26 11:58:23 +08:00

s3api_local_read_fallback_test.go

S3: commit GET status only after the first read succeeds (#10930 )

2026-08-24 16:14:52 -07:00

s3api_multipart_path_validation_test.go

[s3] validate indirect filer path inputs (#9931 )

2026-06-11 21:56:16 -07:00

s3api_multipart_ssekms_test.go

…

s3api_multipart_upload_entry_test.go

s3: an abort answered mid-part no longer leaves the upload completable (#11025 )

2026-08-28 16:12:09 -07:00

s3api_nextmarker_test.go

…

s3api_object_acl_permissions_test.go

s3api: fix PutObjectAcl permission scoping and owner grants (#11587 )

2026-10-04 19:41:10 +08:00

s3api_object_ambiguous_route_test.go

s3api: make ambiguous routed-PUT recovery atomic and stop transaction replay (#11787 )

2026-10-17 21:36:39 -07:00

s3api_object_anonymous_cache_test.go

s3: keep '\' a literal object-key character behind -s3.allowBackslashInKey (#11911 )

2026-10-21 20:02:04 -07:00

s3api_object_anonymous_read_test.go

s3: answer InvalidBucketName to a denied request on a malformed bucket name (#11893 )

2026-10-21 14:08:33 -07:00

s3api_object_anonymous_read.go

s3: keep '\' a literal object-key character behind -s3.allowBackslashInKey (#11911 )

2026-10-21 20:02:04 -07:00

s3api_object_handlers_acl_test.go

Fix object tagging writing back to the wrong object for nested keys (#10338 )

2026-07-15 02:31:51 -07:00

s3api_object_handlers_acl.go

s3: resolve versionId ACL and attributes requests to the version-scoped actions (#11916 )

2026-10-21 16:50:34 -07:00

s3api_object_handlers_attributes_test.go

s3api: report the stored checksum in GetObjectAttributes (#11529 )

2026-10-01 01:11:19 +08:00

s3api_object_handlers_attributes.go

s3: resolve versionId ACL and attributes requests to the version-scoped actions (#11916 )

2026-10-21 16:50:34 -07:00

s3api_object_handlers_conditional_read_test.go

s3api: ignore response header overrides on anonymous requests

2026-10-12 02:49:55 -07:00

s3api_object_handlers_conditional_write_test.go

s3: answer a conditional write on a missing object with 404, not 412 (#11882 )

2026-10-20 23:43:30 -07:00

s3api_object_handlers_copy_acl_test.go

fix(s3): initialize destination ACLs for CopyObject (#11599 )

2026-10-05 18:22:16 +08:00

s3api_object_handlers_copy_alloc_test.go

fix(s3api): cap copy-chunk receive buffer to avoid append-grow blowup (#9420 )

2026-05-10 12:08:06 -07:00

s3api_object_handlers_copy_bench_test.go

s3: report the copied bytes' MD5 in UploadPartCopy ETags (#11884 )

2026-10-21 13:46:11 -07:00

s3api_object_handlers_copy_checksum_test.go

S3: quote ETag in CopyObject and UploadPartCopy XML responses (#11624 )

2026-10-06 18:05:15 +08:00

s3api_object_handlers_copy_chunk_upload_test.go

fix: cap pool retention so chunk-copy buffers don't hoard memory (#9422 )

2026-05-10 13:34:25 -07:00

s3api_object_handlers_copy_collection_test.go

s3: place multipart part chunks by the destination object's storage rule (#10845 )

2026-08-19 20:07:57 -07:00

s3api_object_handlers_copy_default_encryption_test.go

s3api: resolve volume data encryption in CopyObject SSE flows (#11646 ) (#11683 )

2026-10-10 10:59:36 +08:00

s3api_object_handlers_copy_etag_test.go

s3api: cover the inline-content UploadPartCopy route at handler level (#11914 )

2026-10-21 14:15:04 -07:00

s3api_object_handlers_copy_mime_test.go

fix(s3api): preserve requested AES256 copy encryption (#10049 )

2026-06-22 22:19:24 -07:00

s3api_object_handlers_copy_part_sse.go

s3: report the copied bytes' MD5 in UploadPartCopy ETags (#11884 )

2026-10-21 13:46:11 -07:00

s3api_object_handlers_copy_self_reuse_test.go

s3: give a versioned metadata-only copy its own chunks (#10594 )

2026-08-05 20:29:28 -07:00

s3api_object_handlers_copy_storage_class_test.go

s3: accept a self-copy that changes the storage class (#12031 )

2026-10-24 07:06:20 -07:00

s3api_object_handlers_copy_stream.go

s3: report the copied bytes' MD5 in UploadPartCopy ETags (#11884 )

2026-10-21 13:46:11 -07:00

s3api_object_handlers_copy_unified.go

s3api: resolve volume data encryption in CopyObject SSE flows (#11646 ) (#11683 )

2026-10-10 10:59:36 +08:00

s3api_object_handlers_copy.go

s3: accept a self-copy that changes the storage class (#12031 )

2026-10-24 07:06:20 -07:00

s3api_object_handlers_delete_test.go

s3: replay a delete whose reply the transport dropped (#11022 )

2026-08-28 14:30:21 -07:00

s3api_object_handlers_delete.go

s3: keep '\' a literal object-key character behind -s3.allowBackslashInKey (#11911 )

2026-10-21 20:02:04 -07:00

s3api_object_handlers_dir_test.go

s3api: reject SSE headers PutObject cannot honor, as CopyObject does (#11642 )

2026-10-09 12:43:04 +08:00

s3api_object_handlers_extract_test.go

s3: extract zip members on PutObject (#11786 )

2026-10-16 21:07:05 -07:00

s3api_object_handlers_extract.go

s3: extract zip members on PutObject (#11786 )

2026-10-16 21:07:05 -07:00

s3api_object_handlers_legal_hold.go

s3api: evaluate object-tag policy conditions on delete, ACL and lock operations (#11807 )

2026-10-17 22:30:32 -07:00

s3api_object_handlers_list_deleted_prefix_test.go

s3: give each prefix its own hidden-prefix probe budget (#11626 )

2026-10-07 20:53:39 +08:00

s3api_object_handlers_list_directory_marker_test.go

s3: list the size of a directory marker that has a body (#11830 )

2026-10-19 04:35:23 -07:00

s3api_object_handlers_list_directory_test.go

s3: no empty-directory marker in a "<dir>/" self-prefix listing (#11906 )

2026-10-21 14:03:02 -07:00

s3api_object_handlers_list_marker_before_prefix_test.go

s3: keep a listing's start position inside the requested prefix (#11493 )

2026-09-28 06:58:44 +08:00

s3api_object_handlers_list_regression_test.go

s3: fix prefix filtering and delimiter pagination (#11962 )

2026-10-22 09:31:20 -07:00

s3api_object_handlers_list_test.go

s3: list keys in byte order around directory markers (#11832 )

2026-10-20 05:36:22 -07:00

s3api_object_handlers_list_token_test.go

s3: make ListObjectsV2 continuation tokens round-trip XML-unsafe keys (#11996 )

2026-10-24 07:18:10 -07:00

s3api_object_handlers_list_versioned_test.go

s3api: validate ListObjectVersions max-keys and honor max-keys=0 (#11703 )

2026-10-10 22:36:43 +08:00

s3api_object_handlers_list.go

s3: make ListObjectsV2 continuation tokens round-trip XML-unsafe keys (#11996 )

2026-10-24 07:18:10 -07:00

s3api_object_handlers_multipart.go

s3: make ListObjectsV2 continuation tokens round-trip XML-unsafe keys (#11996 )

2026-10-24 07:18:10 -07:00

s3api_object_handlers_postpolicy_authz_test.go

s3: authorize POST policy uploads through the shared object check (#12047 )

2026-10-24 15:09:34 -07:00

s3api_object_handlers_postpolicy_test.go

s3: lazy, bounded, entry-free per-bucket caches (#10213 )

2026-07-02 21:11:34 -07:00

s3api_object_handlers_postpolicy.go

s3: authorize POST policy uploads through the shared object check (#12047 )

2026-10-24 15:09:34 -07:00

s3api_object_handlers_put_ambiguous_test.go

s3api: recheck suspended-version condition under the lock when the filer ignores condition_alt_key (#11806 )

2026-10-18 02:23:00 -07:00

s3api_object_handlers_put_checksum_test.go

…

s3api_object_handlers_put_chunksize_test.go

s3: chunk uploads at the filer's maxMB (#10439 )

2026-07-25 11:30:02 -07:00

s3api_object_handlers_put_error_test.go

s3: return 403, not 500, when an over-quota bucket refuses a write (#11552 )

2026-10-01 22:21:03 +08:00

s3api_object_handlers_put.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

s3api_object_handlers_readonly_test.go

s3: report the copied bytes' MD5 in UploadPartCopy ETags (#11884 )

2026-10-21 13:46:11 -07:00

s3api_object_handlers_rename_test.go

s3: make RenameObject idempotent for a retried request (#11178 )

2026-09-05 11:48:42 -07:00

s3api_object_handlers_rename.go

s3: evaluate tag conditions on copy-source and tagging subresources (#11771 )

2026-10-16 19:50:36 -07:00

s3api_object_handlers_retention.go

s3api: evaluate object-tag policy conditions on delete, ACL and lock operations (#11807 )

2026-10-17 22:30:32 -07:00

s3api_object_handlers_tagging_test.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

s3api_object_handlers_tagging.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

s3api_object_handlers.go

volume: report the needle read error with a failed read (#11934 )

2026-10-21 20:24:48 -07:00

s3api_object_lifecycle_ttl_test.go

s3: lazy, bounded, entry-free per-bucket caches (#10213 )

2026-07-02 21:11:34 -07:00

s3api_object_lifecycle_ttl.go

feat(s3api): apply lifecycle TTL at write time (#9377 )

2026-05-08 21:35:27 -07:00

s3api_object_lock_actions_authz_test.go

s3: mask anonymous misses behind AccessDenied unless the bucket is listable (#11857 )

2026-10-20 12:52:58 -07:00

s3api_object_lock_authz_test.go

s3: separate Object Lock configuration permission (#11361 )

2026-09-16 15:27:09 -07:00

s3api_object_lock_fix_test.go

s3: apply destination retention on copies instead of inheriting it (#11773 )

2026-10-16 19:52:10 -07:00

s3api_object_lock_headers_test.go

s3: require dedicated object-lock permissions for x-amz-object-lock-* headers (#11492 )

2026-09-27 20:17:12 +08:00

s3api_object_ownership_test.go

s3: lazy, bounded, entry-free per-bucket caches (#10213 )

2026-07-02 21:11:34 -07:00

s3api_object_part_number_test.go

s3: HeadObject with partNumber returns the part's size and 206 (#11166 )

2026-09-04 23:10:41 -07:00

s3api_object_range_test.go

s3: apply Range to HeadObject (#11856 )

2026-10-21 13:37:00 -07:00

s3api_object_retention_test.go

s3api: write the null version's object-lock metadata to the plain entry (#12033 )

2026-10-24 06:57:02 -07:00

s3api_object_retention.go

s3api: write the null version's object-lock metadata to the plain entry (#12033 )

2026-10-24 06:57:02 -07:00

s3api_object_routed_read_test.go

s3: route object reads to the key's owner filer (#9806 )

2026-06-03 00:12:28 -07:00

s3api_object_routed_read.go

s3api: make ambiguous routed-PUT recovery atomic and stop transaction replay (#11787 )

2026-10-17 21:36:39 -07:00

s3api_object_routed_write_test.go

s3api: make ambiguous routed-PUT recovery atomic and stop transaction replay (#11787 )

2026-10-17 21:36:39 -07:00

s3api_object_routed_write.go

s3api: make ambiguous routed-PUT recovery atomic and stop transaction replay (#11787 )

2026-10-17 21:36:39 -07:00

s3api_object_upload_acl_test.go

fix(s3): initialize destination ACLs for CopyObject (#11599 )

2026-10-05 18:22:16 +08:00

s3api_object_upload_acl.go

fix(s3): initialize destination ACLs for CopyObject (#11599 )

2026-10-05 18:22:16 +08:00

s3api_object_versioned_finalize.go

s3: fix PutObject If-Match under suspended versioning (#11780 )

2026-10-16 19:44:26 -07:00

s3api_object_versioning_heal_test.go

fix(s3): make self-heal pointer persist CAS-bound against concurrent writers (#11627 )

2026-10-07 20:04:09 +08:00

s3api_object_versioning_list_prefix_test.go

s3api: push the listing prefix down to the filer in ListObjectVersions (#11070 )

2026-09-01 10:37:52 -07:00

s3api_object_versioning_lookup_retry_test.go

s3api: stop retrying a definitive NotFound in getLatestObjectVersion (#11067 )

2026-09-01 10:11:09 -07:00

s3api_object_versioning_pagination_test.go

S3: fix ListObjectVersions losing keys across page boundaries (#11598 )

2026-10-05 11:58:04 +08:00

s3api_object_versioning_self_heal_test.go

fix(s3): recover versioned reads when the .versions latest pointer is absent (#9782 )

2026-06-01 20:01:30 -07:00

s3api_object_versioning.go

s3: make ListObjectsV2 continuation tokens round-trip XML-unsafe keys (#11996 )

2026-10-24 07:18:10 -07:00

s3api_part_boundary_test.go

S3: fold large chunk lists into manifest chunks on the direct write path (#10383 )

2026-07-21 00:08:05 -07:00

s3api_path_validation_test.go

[s3] validate indirect filer path inputs (#9931 )

2026-06-11 21:56:16 -07:00

s3api_path_validation.go

s3: close seaweedfs-quota policy-confusion gap (#11409 )

2026-09-20 23:34:57 -07:00

s3api_put_handlers.go

s3api: reject SSE headers PutObject cannot honor, as CopyObject does (#11642 )

2026-10-09 12:43:04 +08:00

s3api_put_object_helper_test.go

s3: accept signed streaming uploads when IAM is disabled (#11766 )

2026-10-16 21:10:38 -07:00

s3api_put_object_helper.go

s3: accept signed streaming uploads when IAM is disabled (#11766 )

2026-10-16 21:10:38 -07:00

s3api_remote_storage_test.go

fix: return NoSuchKey and drop stale entries when a remote-mounted object is gone from the remote (#11680 )

2026-10-10 11:00:04 +08:00

s3api_remote_versioned_path_test.go

s3: validate the version-id header used as a filer path segment (#11097 )

2026-09-02 11:36:58 -07:00

s3api_server_advertise_test.go

s3: register the advertised ip with the master (#10482 )

2026-07-29 10:30:46 -07:00

s3api_server_grpc_test.go

s3: restrict admin gRPC to local callers when no signing key (#11530 )

2026-10-01 23:12:23 +08:00

s3api_server_grpc.go

security: share the admin gRPC peer authentication check

2026-10-12 02:55:50 -07:00

s3api_server_routing_test.go

s3: evaluate bucket CORS for path-style OPTIONS on the bucket root (#12028 )

2026-10-24 06:58:59 -07:00

s3api_server.go

s3: evaluate bucket CORS for path-style OPTIONS on the bucket root (#12028 )

2026-10-24 06:58:59 -07:00

s3api_sosapi.go

master: let VolumeList ask for the volumes it wants (#10674 )

2026-08-09 21:59:42 -07:00

s3api_sse_decrypt_test.go

…

s3api_sse_s3_upload_test.go

…

s3api_sse_stream_status_test.go

S3: commit SSE GET status only after the first read succeeds (#10935 )

2026-08-24 18:36:46 -07:00

s3api_status_handlers.go

…

s3api_stream_error_test.go

…

s3api_sts_assume_role_admin_scope_test.go

s3: keep an admin's role session scoped to the role (#10520 )

2026-07-31 19:50:59 -07:00

s3api_sts_assume_role_arn_shape_test.go

s3api: load document-style policies from the advanced IAM config (#10481 )

2026-07-29 10:30:30 -07:00

s3api_sts_assume_role_authz_test.go

sts: enforce session-policy explicit deny during role chaining (#10103 )

2026-06-24 21:38:21 -07:00

s3api_sts_assume_role_dispatch_test.go

fix(iam): four phase-3 follow-ups (provider scoping, public path wrapper, static mirror, claim-mode RoleArn) (#9333 )

2026-05-05 19:14:44 -07:00

s3api_sts_assume_role_empty_arn_test.go

fix(iam): four phase-3 follow-ups (provider scoping, public path wrapper, static mirror, claim-mode RoleArn) (#9333 )

2026-05-05 19:14:44 -07:00

s3api_sts_assume_role_test.go

s3/iam: manage roles through the IAM API, with an opt-in persistent role store (#11522 )

2026-09-30 20:45:47 +08:00

s3api_sts_audit_routing_test.go

s3: cover three untested STS paths (#10521 )

2026-07-31 23:56:04 -07:00

s3api_sts_duration_test.go

fix(s3api/sts): respect MaxSessionLength config in DurationSeconds validation (#11267 )

2026-09-10 23:03:32 -07:00

s3api_sts_get_caller_identity_handler_test.go

s3: cover three untested STS paths (#10521 )

2026-07-31 23:56:04 -07:00

s3api_sts_get_caller_identity_test.go

…

s3api_sts_get_federation_token_test.go

s3api: tolerate session tokens on statically configured credentials (#11694 )

2026-10-10 10:11:24 +08:00

s3api_sts_web_identity_http_test.go

iam/oidc: reject reused jti claims with a bounded replay cache (#11936 )

2026-10-23 00:46:14 -07:00

s3api_sts.go

s3api: tolerate session tokens on statically configured credentials (#11694 )

2026-10-10 10:11:24 +08:00

s3api_subresource_ambiguity_test.go

s3: reject requests carrying more than one routed subresource (#11942 )

2026-10-21 22:45:53 -07:00

s3api_subresource_ambiguity.go

s3: reject requests carrying more than one routed subresource (#11942 )

2026-10-21 22:45:53 -07:00

s3api_tables_auth_test.go

s3api: unify auth error handling across s3tables, iceberg and lance (#11381 )

2026-09-18 01:01:04 -07:00

s3api_tables_maintenance_rest_test.go

s3tables: add the maintenance configuration APIs (#10773 )

2026-08-16 10:36:59 -07:00

s3api_tables_rest_validation_test.go

s3tables: allow hyphens in namespace and table names (#10093 )

2026-06-24 16:24:45 -07:00

s3api_tables_routing_test.go

fix(s3): stop S3 Tables routes from swallowing buckets named "buckets" or "get-table" (#9566 )

2026-05-19 14:24:25 -07:00

s3api_tables.go

s3tables: tighten legacy OIDC subject re-anchoring (#11808 )

2026-10-18 02:43:03 -07:00

s3api_test.go

…

s3api_version_id_test.go

[s3] validate indirect filer path inputs (#9931 )

2026-06-11 21:56:16 -07:00

s3api_version_id.go

[s3] validate indirect filer path inputs (#9931 )

2026-06-11 21:56:16 -07:00

s3api_versioning_heal_log_test.go

feat(s3/versioning): grep-able heal logs + scan-anomaly diagnostics + audit cmd (#9468 )

2026-05-13 10:48:58 -07:00

s3api_versioning_reconciler_test.go

s3: share one retry allowance across a batch delete (#11001 )

2026-08-27 22:28:25 -07:00

s3api_versioning_reconciler.go

feat(s3/versioning): grep-able heal logs + scan-anomaly diagnostics + audit cmd (#9468 )

2026-05-13 10:48:58 -07:00

s3api_xml_timestamp_test.go

s3api: always write XML timestamps with three fractional digits (#11520 )

2026-09-30 16:22:31 +08:00

s3api_xsd_generated_helper.go

…

s3api_xsd_generated.go

s3api: always write XML timestamps with three fractional digits (#11520 )

2026-09-30 16:22:31 +08:00

sses3_multipart_repro_test.go

mount: version open file handles by filer log position (#10403 )

2026-07-23 17:44:02 -07:00

stats_test.go

fix(s3/audit): emit audit log for successful GET/HEAD (#9467 )

2026-05-13 09:24:59 -07:00

stats.go

s3: log each request at -v=2 (#10931 )

2026-08-24 18:39:30 -07:00

sts_packed_policy_test.go

…

sts_params_test.go

…

sts_session_name_test.go

…

table_bucket_verify_object_test.go

s3tables: accept the external-volume verification object at a table bucket's root (#11900 )

2026-10-21 14:49:36 -07:00

tags_test.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

tags.go

s3: allow up to 50 tags in a bucket tag set (#12030 )

2026-10-24 07:04:01 -07:00

README.txt

see https://blog.aqwari.net/xml-schema-go/

1. go get aqwari.net/xml/cmd/xsdgen
2. Add EncodingType element for ListBucketResult in AmazonS3.xsd
3. xsdgen -o s3api_xsd_generated.go -pkg s3api AmazonS3.xsd
4. Remove empty Grantee struct in s3api_xsd_generated.go
5. Remove xmlns: sed s'/http:\/\/s3.amazonaws.com\/doc\/2006-03-01\/\ //' s3api_xsd_generated.go