mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-11-15 00:09:00 +01:00
Chris LuandClaude Opus 5.5
5150168368
* s3: authorize an empty versionId as the current-object action GET, HEAD and DELETE treat an empty versionId as the current object, but the action resolver keyed on the parameter's presence and authorized it as GetObjectVersion/DeleteObjectVersion, so a Deny on GetObject or DeleteObject did not apply. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3: test an empty versionId against a version-only policy Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3: cover a bare versionId on HEAD Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
431 lines
19 KiB
Go
431 lines
19 KiB
Go
package s3api
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
// TestMapBaseActionToS3Format_ServicePrefixPassthrough verifies that actions
|
|
// with known service prefixes (s3:, iam:, sts:) are returned unchanged.
|
|
func TestMapBaseActionToS3Format_ServicePrefixPassthrough(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
input string
|
|
expect string
|
|
}{
|
|
{"s3 prefix", "s3:GetObject", "s3:GetObject"},
|
|
{"iam prefix", "iam:CreateUser", "iam:CreateUser"},
|
|
{"sts:AssumeRole", "sts:AssumeRole", "sts:AssumeRole"},
|
|
{"sts:GetFederationToken", "sts:GetFederationToken", "sts:GetFederationToken"},
|
|
{"sts:GetCallerIdentity", "sts:GetCallerIdentity", "sts:GetCallerIdentity"},
|
|
{"coarse Read maps to s3:GetObject", "Read", s3_constants.S3_ACTION_GET_OBJECT},
|
|
{"coarse Write maps to s3:PutObject", "Write", s3_constants.S3_ACTION_PUT_OBJECT},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
got := mapBaseActionToS3Format(tt.input)
|
|
if got != tt.expect {
|
|
t.Errorf("mapBaseActionToS3Format(%q) = %q, want %q", tt.input, got, tt.expect)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestResolveS3Action_STSActionsPassthrough verifies that STS actions flow
|
|
// through ResolveS3Action unchanged, both with and without an HTTP request.
|
|
func TestResolveS3Action_STSActionsPassthrough(t *testing.T) {
|
|
stsActions := []string{
|
|
"sts:AssumeRole",
|
|
"sts:GetFederationToken",
|
|
"sts:GetCallerIdentity",
|
|
}
|
|
|
|
for _, action := range stsActions {
|
|
t.Run("nil_request_"+action, func(t *testing.T) {
|
|
got := ResolveS3Action(nil, action, "", "")
|
|
if got != action {
|
|
t.Errorf("ResolveS3Action(nil, %q) = %q, want %q", action, got, action)
|
|
}
|
|
})
|
|
t.Run("with_request_"+action, func(t *testing.T) {
|
|
r, _ := http.NewRequest(http.MethodPost, "http://localhost/", nil)
|
|
got := ResolveS3Action(r, action, "", "")
|
|
if got != action {
|
|
t.Errorf("ResolveS3Action(r, %q) = %q, want %q", action, got, action)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestResolveS3Action_AttributesBeforeVersionId(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
query string
|
|
method string
|
|
baseAction string
|
|
object string
|
|
want string
|
|
}{
|
|
{
|
|
name: "attributes only",
|
|
query: "attributes",
|
|
method: http.MethodGet,
|
|
baseAction: s3_constants.ACTION_READ,
|
|
object: "key",
|
|
want: s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES,
|
|
},
|
|
{
|
|
name: "attributes with versionId",
|
|
query: "attributes&versionId=abc123",
|
|
method: http.MethodGet,
|
|
baseAction: s3_constants.ACTION_READ,
|
|
object: "key",
|
|
want: s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES,
|
|
},
|
|
{
|
|
name: "versionId only GET",
|
|
query: "versionId=abc123",
|
|
method: http.MethodGet,
|
|
baseAction: s3_constants.ACTION_READ,
|
|
object: "key",
|
|
want: s3_constants.S3_ACTION_GET_OBJECT_VERSION,
|
|
},
|
|
{
|
|
name: "versionId only DELETE",
|
|
query: "versionId=abc123",
|
|
method: http.MethodDelete,
|
|
baseAction: s3_constants.ACTION_WRITE,
|
|
object: "key",
|
|
want: s3_constants.S3_ACTION_DELETE_OBJECT_VERSION,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
|
|
got := ResolveS3Action(r, tt.baseAction, "bucket", tt.object)
|
|
if got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// An empty versionId is served as the current object, so it must be
|
|
// authorized as the current-object action.
|
|
func TestResolveS3Action_EmptyVersionIdIsCurrentObject(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
baseAction string
|
|
query string
|
|
want string
|
|
}{
|
|
{"get empty", http.MethodGet, s3_constants.ACTION_READ, "versionId=", s3_constants.S3_ACTION_GET_OBJECT},
|
|
{"get bare", http.MethodGet, s3_constants.ACTION_READ, "versionId", s3_constants.S3_ACTION_GET_OBJECT},
|
|
{"head empty", http.MethodHead, s3_constants.ACTION_READ, "versionId=", s3_constants.S3_ACTION_GET_OBJECT},
|
|
{"delete empty", http.MethodDelete, s3_constants.ACTION_WRITE, "versionId=", s3_constants.S3_ACTION_DELETE_OBJECT},
|
|
{"delete bare", http.MethodDelete, s3_constants.ACTION_WRITE, "versionId", s3_constants.S3_ACTION_DELETE_OBJECT},
|
|
{"duplicate empty first", http.MethodGet, s3_constants.ACTION_READ, "versionId=&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT},
|
|
{"get null version", http.MethodGet, s3_constants.ACTION_READ, "versionId=null", s3_constants.S3_ACTION_GET_OBJECT_VERSION},
|
|
{"head null version", http.MethodHead, s3_constants.ACTION_READ, "versionId=null", s3_constants.S3_ACTION_GET_OBJECT_VERSION},
|
|
{"delete null version", http.MethodDelete, s3_constants.ACTION_WRITE, "versionId=null", s3_constants.S3_ACTION_DELETE_OBJECT_VERSION},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket/key?"+tt.query, nil)
|
|
if got := ResolveS3Action(r, tt.baseAction, "bucket", "key"); got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestEmptyVersionIdDoesNotBypassCurrentObjectDeny(t *testing.T) {
|
|
iam := &IdentityAccessManagement{isAuthEnabled: true}
|
|
if err := iam.PutPolicy("VersionOnly", `{"Version":"2012-10-17","Statement":[
|
|
{"Effect":"Allow","Action":["s3:GetObjectVersion","s3:DeleteObjectVersion"],"Resource":"arn:aws:s3:::abc/*"},
|
|
{"Effect":"Deny","Action":["s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::abc/*"}]}`); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
identity := &Identity{Name: "versioner", PolicyNames: []string{"VersionOnly"}, Account: &Account{Id: "test-account"}}
|
|
tests := []struct {
|
|
method string
|
|
action Action
|
|
query string
|
|
want s3err.ErrorCode
|
|
}{
|
|
{http.MethodGet, s3_constants.ACTION_READ, "", s3err.ErrAccessDenied},
|
|
{http.MethodGet, s3_constants.ACTION_READ, "?versionId=", s3err.ErrAccessDenied},
|
|
{http.MethodGet, s3_constants.ACTION_READ, "?versionId", s3err.ErrAccessDenied},
|
|
{http.MethodHead, s3_constants.ACTION_READ, "?versionId=", s3err.ErrAccessDenied},
|
|
{http.MethodHead, s3_constants.ACTION_READ, "?versionId", s3err.ErrAccessDenied},
|
|
{http.MethodDelete, s3_constants.ACTION_WRITE, "?versionId=", s3err.ErrAccessDenied},
|
|
{http.MethodDelete, s3_constants.ACTION_WRITE, "?versionId", s3err.ErrAccessDenied},
|
|
{http.MethodGet, s3_constants.ACTION_READ, "?versionId=v1", s3err.ErrNone},
|
|
{http.MethodHead, s3_constants.ACTION_READ, "?versionId=null", s3err.ErrNone},
|
|
{http.MethodDelete, s3_constants.ACTION_WRITE, "?versionId=v1", s3err.ErrNone},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.method+tt.query, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/abc/key"+tt.query, nil)
|
|
if got := iam.VerifyActionPermission(r, identity, tt.action, "abc", "key"); got != tt.want {
|
|
t.Errorf("VerifyActionPermission() = %v, want %v", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// A tagging request carrying versionId targets a specific version and must
|
|
// resolve to the version-tagging action so a grant limited to current-object
|
|
// tagging cannot reach historical versions.
|
|
func TestResolveS3Action_VersionTagging(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
object string
|
|
query string
|
|
want string
|
|
}{
|
|
{"get current tags", http.MethodGet, "key", "tagging", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
|
|
{"put current tags", http.MethodPut, "key", "tagging", s3_constants.S3_ACTION_PUT_OBJECT_TAGGING},
|
|
{"delete current tags", http.MethodDelete, "key", "tagging", s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING},
|
|
{"get version tags", http.MethodGet, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING},
|
|
{"put version tags", http.MethodPut, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_PUT_OBJECT_VERSION_TAGGING},
|
|
{"delete version tags", http.MethodDelete, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_DELETE_OBJECT_VERSION_TAGGING},
|
|
{"empty versionId stays current", http.MethodGet, "key", "tagging&versionId=", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
|
|
{"bucket tagging ignores versionId", http.MethodGet, "", "tagging&versionId=v1", s3_constants.S3_ACTION_GET_BUCKET_TAGGING},
|
|
{"non-empty tagging is still tagging", http.MethodGet, "key", "tagging=x&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING},
|
|
{"non-empty tagging plain", http.MethodGet, "key", "tagging=x", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
|
|
if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// An ACL request carrying versionId targets a specific version and must
|
|
// resolve to the version ACL action so a grant limited to the current-object
|
|
// action cannot reach historical versions.
|
|
func TestResolveS3Action_VersionAcl(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
object string
|
|
query string
|
|
want string
|
|
}{
|
|
{"get current acl", http.MethodGet, "key", "acl", s3_constants.S3_ACTION_GET_OBJECT_ACL},
|
|
{"put current acl", http.MethodPut, "key", "acl", s3_constants.S3_ACTION_PUT_OBJECT_ACL},
|
|
{"get version acl", http.MethodGet, "key", "acl&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_ACL},
|
|
{"head acl resolves as head object", http.MethodHead, "key", "acl", s3_constants.S3_ACTION_GET_OBJECT},
|
|
{"head version acl resolves as head version", http.MethodHead, "key", "acl&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION},
|
|
{"put version acl", http.MethodPut, "key", "acl&versionId=v1", s3_constants.S3_ACTION_PUT_OBJECT_VERSION_ACL},
|
|
{"empty versionId stays current", http.MethodGet, "key", "acl&versionId=", s3_constants.S3_ACTION_GET_OBJECT_ACL},
|
|
{"bucket acl ignores versionId", http.MethodGet, "", "acl&versionId=v1", s3_constants.S3_ACTION_GET_BUCKET_ACL},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
|
|
if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// An attributes request carrying versionId targets a specific version and
|
|
// must resolve to the version attributes action.
|
|
func TestResolveS3Action_VersionAttributes(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
object string
|
|
query string
|
|
want string
|
|
}{
|
|
{"get current attributes", http.MethodGet, "key", "attributes", s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES},
|
|
{"get version attributes", http.MethodGet, "key", "attributes&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
|
|
if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// Bucket subresources registered with ACTION_ADMIN must resolve to their own
|
|
// S3 actions so a policy granting one of them does not need s3:*, and so no
|
|
// broader grant sweeps them in.
|
|
func TestResolveS3Action_AdminBucketSubresources(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
query string
|
|
want string
|
|
}{
|
|
{"get encryption", http.MethodGet, "encryption", s3_constants.S3_ACTION_GET_BUCKET_ENCRYPTION},
|
|
{"put encryption", http.MethodPut, "encryption", s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION},
|
|
{"delete encryption", http.MethodDelete, "encryption", s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION},
|
|
{"get requestPayment", http.MethodGet, "requestPayment", s3_constants.S3_ACTION_GET_BUCKET_REQUEST_PAYMENT},
|
|
{"put requestPayment", http.MethodPut, "requestPayment", s3_constants.S3_ACTION_PUT_BUCKET_REQUEST_PAYMENT},
|
|
{"get publicAccessBlock", http.MethodGet, "publicAccessBlock", s3_constants.S3_ACTION_GET_BUCKET_PUBLIC_ACCESS_BLOCK},
|
|
{"put publicAccessBlock", http.MethodPut, "publicAccessBlock", s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK},
|
|
{"delete publicAccessBlock", http.MethodDelete, "publicAccessBlock", s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK},
|
|
{"get ownershipControls", http.MethodGet, "ownershipControls", s3_constants.S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS},
|
|
{"put ownershipControls", http.MethodPut, "ownershipControls", s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS},
|
|
{"delete ownershipControls", http.MethodDelete, "ownershipControls", s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket?"+tt.query, nil)
|
|
got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "bucket", "")
|
|
if got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// CreateBucket is a plain bucket-level PUT registered with ACTION_ADMIN. It
|
|
// must resolve to s3:CreateBucket so an attached policy granting that action
|
|
// can authorize it without granting s3:*.
|
|
func TestResolveS3Action_CreateBucket(t *testing.T) {
|
|
r, _ := http.NewRequest(http.MethodPut, "http://localhost/new-bucket", nil)
|
|
if got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "new-bucket", ""); got != s3_constants.S3_ACTION_CREATE_BUCKET {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, s3_constants.S3_ACTION_CREATE_BUCKET)
|
|
}
|
|
}
|
|
|
|
// list-type selects ListObjectsV2, which the router registers ahead of the
|
|
// bucket subresource routes. The resolver must align with routing and resolve
|
|
// it to s3:ListBucket even when an operation subresource like ownershipControls
|
|
// is also present, so authorization checks the listing action the handler runs.
|
|
func TestResolveS3Action_ListType(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
query string
|
|
want string
|
|
}{
|
|
{"list-type alone", "list-type=2", s3_constants.S3_ACTION_LIST_BUCKET},
|
|
{"list-type with listing params", "list-type=2&prefix=a&continuation-token=x", s3_constants.S3_ACTION_LIST_BUCKET},
|
|
{"list-type with ownershipControls", "list-type=2&ownershipControls=", s3_constants.S3_ACTION_LIST_BUCKET},
|
|
// The router only selects ListObjectsV2 for list-type=2; another value
|
|
// falls through to the subresource route, so ownershipControls wins.
|
|
{"list-type=1 with ownershipControls", "list-type=1&ownershipControls=", s3_constants.S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(http.MethodGet, "http://localhost/bucket?"+tt.query, nil)
|
|
if got := ResolveS3Action(r, s3_constants.ACTION_LIST, "bucket", ""); got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// The seaweedfs-quota routes are registered last among the bucket subresource
|
|
// routes, so the resolver must resolve it last as well: a request combining it
|
|
// with another selector is served by that selector's handler, and authorization
|
|
// must name the same operation.
|
|
func TestResolveS3Action_Quota(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
query string
|
|
want string
|
|
}{
|
|
{"quota get", http.MethodGet, "seaweedfs-quota", s3_constants.S3_ACTION_GET_BUCKET_QUOTA},
|
|
{"quota put", http.MethodPut, "seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_QUOTA},
|
|
{"policy wins over quota", http.MethodPut, "policy&seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_POLICY},
|
|
{"quota after policy wins too", http.MethodPut, "seaweedfs-quota&policy", s3_constants.S3_ACTION_PUT_BUCKET_POLICY},
|
|
{"tagging wins over quota", http.MethodPut, "tagging&seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_TAGGING},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket?"+tt.query, nil)
|
|
if got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "bucket", ""); got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// Dedicated object-lock actions already name the operation being authorized;
|
|
// competing query parameters must not re-map them. Notably the synthetic
|
|
// DELETE ?versionId request behind the governance-bypass check must stay
|
|
// s3:BypassGovernanceRetention rather than resolving to s3:DeleteObjectVersion.
|
|
func TestResolveS3ActionDedicatedObjectLockActions(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
object string
|
|
query string
|
|
baseAction string
|
|
want string
|
|
}{
|
|
{"bypass on versioned delete shape", http.MethodDelete, "key", "versionId=abc123",
|
|
s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, s3_constants.S3_ACTION_BYPASS_GOVERNANCE},
|
|
{"bypass on batch delete shape", http.MethodPost, "", "delete",
|
|
s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, s3_constants.S3_ACTION_BYPASS_GOVERNANCE},
|
|
{"get retention with versionId", http.MethodGet, "key", "retention&versionId=abc123",
|
|
s3_constants.ACTION_GET_OBJECT_RETENTION, s3_constants.S3_ACTION_GET_OBJECT_RETENTION},
|
|
{"put retention with versionId", http.MethodPut, "key", "retention&versionId=abc123",
|
|
s3_constants.ACTION_PUT_OBJECT_RETENTION, s3_constants.S3_ACTION_PUT_OBJECT_RETENTION},
|
|
{"get legal hold with versionId", http.MethodGet, "key", "legal-hold&versionId=abc123",
|
|
s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD, s3_constants.S3_ACTION_GET_OBJECT_LEGAL_HOLD},
|
|
{"put legal hold with versionId", http.MethodPut, "key", "legal-hold&versionId=abc123",
|
|
s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD, s3_constants.S3_ACTION_PUT_OBJECT_LEGAL_HOLD},
|
|
{"get object-lock config", http.MethodGet, "", "object-lock&versioning",
|
|
s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG, s3_constants.S3_ACTION_GET_BUCKET_OBJECT_LOCK},
|
|
{"put object-lock config", http.MethodPut, "", "object-lock",
|
|
s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG, s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
|
|
if got := ResolveS3Action(r, tt.baseAction, "bucket", tt.object); got != tt.want {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// A base action naming another service carries no S3 request shape, so a query
|
|
// parameter on the request must not redirect it to an S3 action.
|
|
func TestResolveS3ActionKeepsNonS3Service(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
method string
|
|
url string
|
|
baseAction string
|
|
}{
|
|
{"iam action with batch delete query", http.MethodPost, "http://localhost/?delete", "iam:CreateUser"},
|
|
{"iam action with acl query", http.MethodPut, "http://localhost/?acl", "iam:AttachUserPolicy"},
|
|
{"iam action with tagging query", http.MethodGet, "http://localhost/?tagging", "iam:ListUsers"},
|
|
{"sts action with batch delete query", http.MethodPost, "http://localhost/?delete", "sts:AssumeRole"},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r, _ := http.NewRequest(tt.method, tt.url, nil)
|
|
if got := ResolveS3Action(r, tt.baseAction, "", ""); got != tt.baseAction {
|
|
t.Errorf("ResolveS3Action() = %q, want %q", got, tt.baseAction)
|
|
}
|
|
})
|
|
}
|
|
}
|