mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-10-25 22:40:44 +01:00
Chris Lu
8d2b417c69
* s3tables: share the UpdateTable authorization gate Extract the validation, load, and permission check from handleUpdateTable into authorizeUpdateTable so the table an update was authorized against is the same snapshot the mutation writes to. Manager gains AuthorizeUpdateTable, mirroring AuthorizeCreateTable, so callers can ask the question without updating anything. * s3tables: share the UpdateView authorization gate Extract the lookup, policy load, and permission check from handleUpdateView into authorizeUpdateView, mirroring authorizeUpdateTable, and expose it as Manager.AuthorizeUpdateView for callers that need the answer without the update. * s3api: scope vended table credentials to read-only on request VendTableCredentials takes a readOnly flag and tablePrefixSessionPolicy emits only s3:GetObject for the table prefix when it is set, keeping the conditioned ListBucket and unconditioned GetBucketLocation statements that reads still need. * iceberg: vend read-only credentials when the caller may not write LoadTable and friends vend storage credentials only for the authority the caller holds: the vend now checks UpdateTable/UpdateView permission and a caller that may only read the catalog entry gets a read-only session. Paths that just passed a write gate (stage-create, view commit) keep the full session. * lance: vend read-only credentials when the caller may not write storage_options vends the same read-only session as the Iceberg catalog when the caller lacks UpdateTable on the table. * lance: keep write credentials for callers authorized to declare A Lance commit is a direct S3 write that never revisits the catalog, so a caller that just passed CreateTable still gets a writable session; the UpdateTable gate applies to describe, the read path. * iceberg, lance: log a failed write check instead of only reading it as denied
80 lines
3.1 KiB
Go
80 lines
3.1 KiB
Go
package iceberg
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3tables"
|
|
)
|
|
|
|
func TestWantsVendedCredentials(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
values []string
|
|
want bool
|
|
}{
|
|
{name: "no header", want: false},
|
|
{name: "vended credentials", values: []string{"vended-credentials"}, want: true},
|
|
{name: "mechanism list", values: []string{"remote-signing,vended-credentials"}, want: true},
|
|
{name: "spaced and mixed case", values: []string{"Remote-Signing, Vended-Credentials"}, want: true},
|
|
{name: "repeated header", values: []string{"remote-signing", "vended-credentials"}, want: true},
|
|
{name: "remote signing only", values: []string{"remote-signing"}, want: false},
|
|
}
|
|
for _, tc := range tests {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
r := httptest.NewRequest(http.MethodGet, "/v1/namespaces/ns/tables/t", nil)
|
|
for _, v := range tc.values {
|
|
r.Header.Add(accessDelegationHeader, v)
|
|
}
|
|
if got := wantsVendedCredentials(r); got != tc.want {
|
|
t.Fatalf("wantsVendedCredentials(%v) = %v, want %v", tc.values, got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// A client that asked for vended credentials replaces its own storage
|
|
// credentials with whatever the catalog returns. With no vending configured
|
|
// there are none, so an endpoint by itself would leave the client signing
|
|
// nothing and every data file read and write would come back 403.
|
|
func TestBuildFileIOConfigWithholdsEndpointFromCredentialVendingClients(t *testing.T) {
|
|
s := &Server{s3Endpoint: "http://seaweed.example:8333"}
|
|
|
|
r := httptest.NewRequest(http.MethodGet, "/v1/namespaces/ns/tables/t", nil)
|
|
r.Header.Set(accessDelegationHeader, "vended-credentials")
|
|
if got, _ := s.buildFileIOConfig(r, "s3://warehouse/ns/t", nil); len(got) != 0 {
|
|
t.Fatalf("buildFileIOConfig() = %v, want empty for a vended-credentials request", got)
|
|
}
|
|
|
|
plain := httptest.NewRequest(http.MethodGet, "/v1/namespaces/ns/tables/t", nil)
|
|
if got, _ := s.buildFileIOConfig(plain, "s3://warehouse/ns/t", nil); got["s3.endpoint"] != s.s3Endpoint {
|
|
t.Fatalf("s3.endpoint = %q, want %q", got["s3.endpoint"], s.s3Endpoint)
|
|
}
|
|
}
|
|
|
|
// The body of a load response depends on the delegation header, so a cache in
|
|
// front of the catalog must not key on the URL alone.
|
|
func TestWriteLoadResultVariesOnTheDelegationHeader(t *testing.T) {
|
|
rec := httptest.NewRecorder()
|
|
writeLoadResult(rec, http.StatusOK, LoadTableResult{})
|
|
if got := rec.Header().Get("Vary"); got != accessDelegationHeader {
|
|
t.Fatalf("Vary = %q, want %q", got, accessDelegationHeader)
|
|
}
|
|
}
|
|
|
|
func TestLoadTableResultOmitsConfigForCredentialVendingClients(t *testing.T) {
|
|
s := &Server{s3Endpoint: "http://seaweed.example:8333"}
|
|
r := httptest.NewRequest(http.MethodGet, "/v1/namespaces/ns/tables/t", nil)
|
|
r.Header.Set(accessDelegationHeader, "vended-credentials")
|
|
|
|
getResp := s3tables.GetTableResponse{MetadataLocation: "s3://bkt/ns/t/metadata/v1.metadata.json"}
|
|
result, err := s.buildLoadTableResult(r, getResp, "bkt", []string{"ns"}, "t")
|
|
if err != nil {
|
|
t.Fatalf("buildLoadTableResult() error = %v", err)
|
|
}
|
|
if len(result.Config) != 0 {
|
|
t.Fatalf("LoadTableResult.Config = %v, want empty", result.Config)
|
|
}
|
|
}
|