mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-11-04 11:07:35 +01:00
Chris LuandClaude Opus 5.5
b0c6297041
* s3api: store and serve a bucket's PublicAccessBlock configuration PutPublicAccessBlock, GetPublicAccessBlock and DeletePublicAccessBlock answered NotImplemented. Store the configuration in the bucket entry's extended attributes next to the ownership controls, carry it in the cached BucketConfig, and answer Get on an unset bucket with NoSuchPublicAccessBlockConfiguration like S3 does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3api: refuse public ACLs when a bucket blocks them With BlockPublicAcls set, a PutObject, CopyObject, CreateMultipartUpload, POST Object, PutObjectAcl or PutBucketAcl whose canned ACL or grants name the AllUsers or AuthenticatedUsers group is refused with AccessDenied. Private and account grants keep working, so clients that send x-amz-acl: private on every upload are unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3api: ignore public ACL grants for anonymous reads under IgnorePublicAcls A bucket with IgnorePublicAcls no longer lets an AllUsers grant on the bucket or on an object answer an anonymous read or listing. Bucket policies and identity permissions are unaffected. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3api: reject PublicAccessBlock bodies with unknown elements A misspelled element such as BlockPublicAcl was ignored, so the request succeeded and stored the flag as false. Answer MalformedXML instead, and store the configuration without the request's namespace. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3api: fail closed when a bucket's public access block cannot be read A stored PublicAccessBlock that does not parse now blocks and ignores public ACLs instead of acting as if none were set. PutBucketAcl and POST Object return the bucket lookup error rather than skipping the BlockPublicAcls check when the bucket config cannot be loaded. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3api: test BlockPublicAcls on copy, multipart initiate and a PUT-then-GET Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * s3api: keep stored public access block bytes on unrelated bucket updates An unreadable stored configuration was replaced with the in-memory all-true fallback whenever another bucket setting was updated, losing the original value. Write the key only when the update changes the public access block. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
3.8 KiB
Go
86 lines
3.8 KiB
Go
package s3_constants
|
|
|
|
const (
|
|
ExtAmzPrefix = "Seaweed-X-Amz-"
|
|
ExtAmzOwnerKey = "Seaweed-X-Amz-Owner"
|
|
ExtAmzAclKey = "Seaweed-X-Amz-Acl"
|
|
ExtOwnershipKey = "Seaweed-X-Amz-Ownership"
|
|
ExtPublicAccessBlockKey = "Seaweed-X-Amz-Public-Access-Block"
|
|
ExtVersioningKey = "Seaweed-X-Amz-Versioning"
|
|
ExtVersionIdKey = "Seaweed-X-Amz-Version-Id"
|
|
ExtDeleteMarkerKey = "Seaweed-X-Amz-Delete-Marker"
|
|
ExtIsLatestKey = "Seaweed-X-Amz-Is-Latest"
|
|
ExtETagKey = "Seaweed-X-Amz-ETag"
|
|
ExtLatestVersionIdKey = "Seaweed-X-Amz-Latest-Version-Id"
|
|
ExtLatestVersionFileNameKey = "Seaweed-X-Amz-Latest-Version-File-Name"
|
|
ExtAllowEmptyFolders = "Seaweed-X-Amz-Allow-Empty-Folders"
|
|
// Cached list metadata in .versions directory for single-scan efficiency
|
|
ExtLatestVersionSizeKey = "Seaweed-X-Amz-Latest-Version-Size"
|
|
ExtLatestVersionETagKey = "Seaweed-X-Amz-Latest-Version-ETag"
|
|
ExtLatestVersionMtimeKey = "Seaweed-X-Amz-Latest-Version-Mtime"
|
|
ExtLatestVersionOwnerKey = "Seaweed-X-Amz-Latest-Version-Owner"
|
|
ExtLatestVersionIsDeleteMarker = "Seaweed-X-Amz-Latest-Version-Is-Delete-Marker"
|
|
ExtLatestVersionStorageClassKey = "Seaweed-X-Amz-Latest-Version-Storage-Class"
|
|
ExtMultipartObjectKey = "key"
|
|
// Wall-clock nanoseconds (int64 as decimal string) captured at the
|
|
// moment a versioned entry was demoted from current to noncurrent
|
|
// by a later PUT or delete marker. Read by the s3 lifecycle engine
|
|
// to compute NoncurrentDays due time; zero/missing falls back to
|
|
// the entry's own mtime so legacy data still expires.
|
|
ExtNoncurrentSinceNsKey = "Seaweed-X-Amz-Noncurrent-Since-Ns"
|
|
|
|
// Set on a .versions directory when a suspended-versioning write made the
|
|
// base-path null object the current version; cleared whenever a version in
|
|
// the directory becomes current. Unlike an absent latest pointer, which a
|
|
// replica may simply not have received yet, this is an explicit signal.
|
|
ExtNullVersionIsLatestKey = "Seaweed-X-Amz-Null-Version-Is-Latest"
|
|
|
|
// Per-bucket opt-in for the PutObject lifecycle TTL fast path ("true"
|
|
// to enable). When on, an Expiration.Days rule is stamped as a volume
|
|
// TTL at write time instead of being expired by the worker. Off by
|
|
// default: a baked-in TTL can't honor a later policy change (rule
|
|
// removed or lengthened) the way worker-driven expiration does.
|
|
ExtLifecycleTtlFastPathKey = "Seaweed-X-Amz-Lifecycle-Ttl-Fast-Path"
|
|
|
|
// S3 checksum storage keys (use x-seaweedfs- prefix to avoid leaking in generic header loop)
|
|
ExtChecksumAlgorithm = "x-seaweedfs-checksum-algorithm"
|
|
ExtChecksumValue = "x-seaweedfs-checksum-value"
|
|
ExtChecksumType = "x-seaweedfs-checksum-type"
|
|
|
|
// Bucket Policy
|
|
ExtBucketPolicyKey = "Seaweed-X-Amz-Bucket-Policy"
|
|
|
|
// Every attribute the s3tables catalog stores on a table bucket, namespace,
|
|
// table or view directory entry starts with this.
|
|
ExtS3TablesPrefix = "s3tables."
|
|
|
|
// Object Retention and Legal Hold
|
|
ExtObjectLockModeKey = "Seaweed-X-Amz-Object-Lock-Mode"
|
|
ExtRetentionUntilDateKey = "Seaweed-X-Amz-Retention-Until-Date"
|
|
ExtLegalHoldKey = "Seaweed-X-Amz-Legal-Hold"
|
|
ExtObjectLockEnabledKey = "Seaweed-X-Amz-Object-Lock-Enabled"
|
|
|
|
// Object Lock Bucket Configuration (individual components, not XML)
|
|
ExtObjectLockDefaultModeKey = "Lock-Default-Mode"
|
|
ExtObjectLockDefaultDaysKey = "Lock-Default-Days"
|
|
ExtObjectLockDefaultYearsKey = "Lock-Default-Years"
|
|
)
|
|
|
|
// Object Lock and Retention Constants
|
|
const (
|
|
// Retention modes
|
|
RetentionModeGovernance = "GOVERNANCE"
|
|
RetentionModeCompliance = "COMPLIANCE"
|
|
|
|
// Legal hold status
|
|
LegalHoldOn = "ON"
|
|
LegalHoldOff = "OFF"
|
|
|
|
// Object lock enabled status
|
|
ObjectLockEnabled = "Enabled"
|
|
|
|
// Bucket versioning status
|
|
VersioningEnabled = "Enabled"
|
|
VersioningSuspended = "Suspended"
|
|
)
|