mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-11-07 20:47:46 +01:00
Chris LuandClaude Opus 5.5
3e64326f2b
* s3: require their own actions to change a bucket's CORS or versioning PUT/DELETE ?cors and PUT ?versioning were authorized as Write, so an identity granted only object writes on a bucket could replace its CORS rules or suspend versioning. They now need PutBucketCors, DeleteBucketCors and PutBucketVersioning (or Admin), and inline policies granting s3:PutBucketCors, s3:DeleteBucketCors or s3:PutBucketVersioning map to those actions instead of Write. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3: test that object Write cannot change bucket CORS or versioning Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * admin: offer the bucket CORS and versioning permissions Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3: test each bucket config action with its own identity Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
39 lines
1.9 KiB
Go
39 lines
1.9 KiB
Go
package s3_constants
|
|
|
|
const (
|
|
ACTION_READ = "Read"
|
|
ACTION_READ_ACP = "ReadAcp"
|
|
ACTION_WRITE = "Write"
|
|
ACTION_WRITE_ACP = "WriteAcp"
|
|
ACTION_ADMIN = "Admin"
|
|
ACTION_TAGGING = "Tagging"
|
|
ACTION_LIST = "List"
|
|
ACTION_DELETE_BUCKET = "DeleteBucket"
|
|
ACTION_BYPASS_GOVERNANCE_RETENTION = "BypassGovernanceRetention"
|
|
ACTION_GET_OBJECT_RETENTION = "GetObjectRetention"
|
|
ACTION_PUT_OBJECT_RETENTION = "PutObjectRetention"
|
|
ACTION_GET_OBJECT_LEGAL_HOLD = "GetObjectLegalHold"
|
|
ACTION_PUT_OBJECT_LEGAL_HOLD = "PutObjectLegalHold"
|
|
ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG = "GetBucketObjectLockConfiguration"
|
|
ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG = "PutBucketObjectLockConfiguration"
|
|
ACTION_PUT_BUCKET_POLICY = "PutBucketPolicy"
|
|
ACTION_DELETE_BUCKET_POLICY = "DeleteBucketPolicy"
|
|
ACTION_PUT_BUCKET_CORS = "PutBucketCors"
|
|
ACTION_DELETE_BUCKET_CORS = "DeleteBucketCors"
|
|
ACTION_PUT_BUCKET_VERSIONING = "PutBucketVersioning"
|
|
ACTION_PUT_BUCKET_QUOTA = "PutBucketQuota"
|
|
ACTION_GET_BUCKET_QUOTA = "GetBucketQuota"
|
|
// Scoped to their single operation: the multipart listing routes are
|
|
// gated on ACTION_READ for compatibility, but a policy granting one of
|
|
// these names must not widen into a general Read grant.
|
|
ACTION_LIST_MULTIPART_UPLOADS = "ListBucketMultipartUploads"
|
|
ACTION_LIST_PARTS = "ListMultipartUploadParts"
|
|
|
|
SeaweedStorageDestinationHeader = "x-seaweedfs-destination"
|
|
MultipartUploadsFolder = ".uploads"
|
|
VersionsFolder = ".versions"
|
|
SystemFolder = ".system"
|
|
FolderMimeType = "httpd/unix-directory"
|
|
DirectoryMimeType = "application/x-directory"
|
|
)
|