seaweedfs/weed/s3api/s3_action_resolver_test.go

package s3api

import (
	"net/http"
	"testing"

	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
)

// TestMapBaseActionToS3Format_ServicePrefixPassthrough verifies that actions
// with known service prefixes (s3:, iam:, sts:) are returned unchanged.
func TestMapBaseActionToS3Format_ServicePrefixPassthrough(t *testing.T) {
	tests := []struct {
		name   string
		input  string
		expect string
	}{
		{"s3 prefix", "s3:GetObject", "s3:GetObject"},
		{"iam prefix", "iam:CreateUser", "iam:CreateUser"},
		{"sts:AssumeRole", "sts:AssumeRole", "sts:AssumeRole"},
		{"sts:GetFederationToken", "sts:GetFederationToken", "sts:GetFederationToken"},
		{"sts:GetCallerIdentity", "sts:GetCallerIdentity", "sts:GetCallerIdentity"},
		{"coarse Read maps to s3:GetObject", "Read", s3_constants.S3_ACTION_GET_OBJECT},
		{"coarse Write maps to s3:PutObject", "Write", s3_constants.S3_ACTION_PUT_OBJECT},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := mapBaseActionToS3Format(tt.input)
			if got != tt.expect {
				t.Errorf("mapBaseActionToS3Format(%q) = %q, want %q", tt.input, got, tt.expect)
			}
		})
	}
}

// TestResolveS3Action_STSActionsPassthrough verifies that STS actions flow
// through ResolveS3Action unchanged, both with and without an HTTP request.
func TestResolveS3Action_STSActionsPassthrough(t *testing.T) {
	stsActions := []string{
		"sts:AssumeRole",
		"sts:GetFederationToken",
		"sts:GetCallerIdentity",
	}

	for _, action := range stsActions {
		t.Run("nil_request_"+action, func(t *testing.T) {
			got := ResolveS3Action(nil, action, "", "")
			if got != action {
				t.Errorf("ResolveS3Action(nil, %q) = %q, want %q", action, got, action)
			}
		})
		t.Run("with_request_"+action, func(t *testing.T) {
			r, _ := http.NewRequest(http.MethodPost, "http://localhost/", nil)
			got := ResolveS3Action(r, action, "", "")
			if got != action {
				t.Errorf("ResolveS3Action(r, %q) = %q, want %q", action, got, action)
			}
		})
	}
}

func TestResolveS3Action_AttributesBeforeVersionId(t *testing.T) {
	tests := []struct {
		name       string
		query      string
		method     string
		baseAction string
		object     string
		want       string
	}{
		{
			name:       "attributes only",
			query:      "attributes",
			method:     http.MethodGet,
			baseAction: s3_constants.ACTION_READ,
			object:     "key",
			want:       s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES,
		},
		{
			name:       "attributes with versionId",
			query:      "attributes&versionId=abc123",
			method:     http.MethodGet,
			baseAction: s3_constants.ACTION_READ,
			object:     "key",
			want:       s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES,
		},
		{
			name:       "versionId only GET",
			query:      "versionId=abc123",
			method:     http.MethodGet,
			baseAction: s3_constants.ACTION_READ,
			object:     "key",
			want:       s3_constants.S3_ACTION_GET_OBJECT_VERSION,
		},
		{
			name:       "versionId only DELETE",
			query:      "versionId=abc123",
			method:     http.MethodDelete,
			baseAction: s3_constants.ACTION_WRITE,
			object:     "key",
			want:       s3_constants.S3_ACTION_DELETE_OBJECT_VERSION,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
			got := ResolveS3Action(r, tt.baseAction, "bucket", tt.object)
			if got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// A tagging request carrying versionId targets a specific version and must
// resolve to the version-tagging action so a grant limited to current-object
// tagging cannot reach historical versions.
func TestResolveS3Action_VersionTagging(t *testing.T) {
	tests := []struct {
		name   string
		method string
		object string
		query  string
		want   string
	}{
		{"get current tags", http.MethodGet, "key", "tagging", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
		{"put current tags", http.MethodPut, "key", "tagging", s3_constants.S3_ACTION_PUT_OBJECT_TAGGING},
		{"delete current tags", http.MethodDelete, "key", "tagging", s3_constants.S3_ACTION_DELETE_OBJECT_TAGGING},
		{"get version tags", http.MethodGet, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING},
		{"put version tags", http.MethodPut, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_PUT_OBJECT_VERSION_TAGGING},
		{"delete version tags", http.MethodDelete, "key", "tagging&versionId=v1", s3_constants.S3_ACTION_DELETE_OBJECT_VERSION_TAGGING},
		{"empty versionId stays current", http.MethodGet, "key", "tagging&versionId=", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
		{"bucket tagging ignores versionId", http.MethodGet, "", "tagging&versionId=v1", s3_constants.S3_ACTION_GET_BUCKET_TAGGING},
		{"non-empty tagging is still tagging", http.MethodGet, "key", "tagging=x&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_TAGGING},
		{"non-empty tagging plain", http.MethodGet, "key", "tagging=x", s3_constants.S3_ACTION_GET_OBJECT_TAGGING},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
			if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// An ACL request carrying versionId targets a specific version and must
// resolve to the version ACL action so a grant limited to the current-object
// action cannot reach historical versions.
func TestResolveS3Action_VersionAcl(t *testing.T) {
	tests := []struct {
		name   string
		method string
		object string
		query  string
		want   string
	}{
		{"get current acl", http.MethodGet, "key", "acl", s3_constants.S3_ACTION_GET_OBJECT_ACL},
		{"put current acl", http.MethodPut, "key", "acl", s3_constants.S3_ACTION_PUT_OBJECT_ACL},
		{"get version acl", http.MethodGet, "key", "acl&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_ACL},
		{"head acl resolves as head object", http.MethodHead, "key", "acl", s3_constants.S3_ACTION_GET_OBJECT},
		{"head version acl resolves as head version", http.MethodHead, "key", "acl&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION},
		{"put version acl", http.MethodPut, "key", "acl&versionId=v1", s3_constants.S3_ACTION_PUT_OBJECT_VERSION_ACL},
		{"empty versionId stays current", http.MethodGet, "key", "acl&versionId=", s3_constants.S3_ACTION_GET_OBJECT_ACL},
		{"bucket acl ignores versionId", http.MethodGet, "", "acl&versionId=v1", s3_constants.S3_ACTION_GET_BUCKET_ACL},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
			if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// An attributes request carrying versionId targets a specific version and
// must resolve to the version attributes action.
func TestResolveS3Action_VersionAttributes(t *testing.T) {
	tests := []struct {
		name   string
		method string
		object string
		query  string
		want   string
	}{
		{"get current attributes", http.MethodGet, "key", "attributes", s3_constants.S3_ACTION_GET_OBJECT_ATTRIBUTES},
		{"get version attributes", http.MethodGet, "key", "attributes&versionId=v1", s3_constants.S3_ACTION_GET_OBJECT_VERSION_ATTRIBUTES},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
			if got := ResolveS3Action(r, s3_constants.ACTION_READ, "bucket", tt.object); got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// Bucket subresources registered with ACTION_ADMIN must resolve to their own
// S3 actions so a policy granting one of them does not need s3:*, and so no
// broader grant sweeps them in.
func TestResolveS3Action_AdminBucketSubresources(t *testing.T) {
	tests := []struct {
		name   string
		method string
		query  string
		want   string
	}{
		{"get encryption", http.MethodGet, "encryption", s3_constants.S3_ACTION_GET_BUCKET_ENCRYPTION},
		{"put encryption", http.MethodPut, "encryption", s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION},
		{"delete encryption", http.MethodDelete, "encryption", s3_constants.S3_ACTION_PUT_BUCKET_ENCRYPTION},
		{"get requestPayment", http.MethodGet, "requestPayment", s3_constants.S3_ACTION_GET_BUCKET_REQUEST_PAYMENT},
		{"put requestPayment", http.MethodPut, "requestPayment", s3_constants.S3_ACTION_PUT_BUCKET_REQUEST_PAYMENT},
		{"get publicAccessBlock", http.MethodGet, "publicAccessBlock", s3_constants.S3_ACTION_GET_BUCKET_PUBLIC_ACCESS_BLOCK},
		{"put publicAccessBlock", http.MethodPut, "publicAccessBlock", s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK},
		{"delete publicAccessBlock", http.MethodDelete, "publicAccessBlock", s3_constants.S3_ACTION_PUT_BUCKET_PUBLIC_ACCESS_BLOCK},
		{"get ownershipControls", http.MethodGet, "ownershipControls", s3_constants.S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS},
		{"put ownershipControls", http.MethodPut, "ownershipControls", s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS},
		{"delete ownershipControls", http.MethodDelete, "ownershipControls", s3_constants.S3_ACTION_PUT_BUCKET_OWNERSHIP_CONTROLS},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, "http://localhost/bucket?"+tt.query, nil)
			got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "bucket", "")
			if got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// CreateBucket is a plain bucket-level PUT registered with ACTION_ADMIN. It
// must resolve to s3:CreateBucket so an attached policy granting that action
// can authorize it without granting s3:*.
func TestResolveS3Action_CreateBucket(t *testing.T) {
	r, _ := http.NewRequest(http.MethodPut, "http://localhost/new-bucket", nil)
	if got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "new-bucket", ""); got != s3_constants.S3_ACTION_CREATE_BUCKET {
		t.Errorf("ResolveS3Action() = %q, want %q", got, s3_constants.S3_ACTION_CREATE_BUCKET)
	}
}

// list-type selects ListObjectsV2, which the router registers ahead of the
// bucket subresource routes. The resolver must align with routing and resolve
// it to s3:ListBucket even when an operation subresource like ownershipControls
// is also present, so authorization checks the listing action the handler runs.
func TestResolveS3Action_ListType(t *testing.T) {
	tests := []struct {
		name  string
		query string
		want  string
	}{
		{"list-type alone", "list-type=2", s3_constants.S3_ACTION_LIST_BUCKET},
		{"list-type with listing params", "list-type=2&prefix=a&continuation-token=x", s3_constants.S3_ACTION_LIST_BUCKET},
		{"list-type with ownershipControls", "list-type=2&ownershipControls=", s3_constants.S3_ACTION_LIST_BUCKET},
		// The router only selects ListObjectsV2 for list-type=2; another value
		// falls through to the subresource route, so ownershipControls wins.
		{"list-type=1 with ownershipControls", "list-type=1&ownershipControls=", s3_constants.S3_ACTION_GET_BUCKET_OWNERSHIP_CONTROLS},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(http.MethodGet, "http://localhost/bucket?"+tt.query, nil)
			if got := ResolveS3Action(r, s3_constants.ACTION_LIST, "bucket", ""); got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// The seaweedfs-quota routes are registered last among the bucket subresource
// routes, so the resolver must resolve it last as well: a request combining it
// with another selector is served by that selector's handler, and authorization
// must name the same operation.
func TestResolveS3Action_Quota(t *testing.T) {
	tests := []struct {
		name   string
		method string
		query  string
		want   string
	}{
		{"quota get", http.MethodGet, "seaweedfs-quota", s3_constants.S3_ACTION_GET_BUCKET_QUOTA},
		{"quota put", http.MethodPut, "seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_QUOTA},
		{"policy wins over quota", http.MethodPut, "policy&seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_POLICY},
		{"quota after policy wins too", http.MethodPut, "seaweedfs-quota&policy", s3_constants.S3_ACTION_PUT_BUCKET_POLICY},
		{"tagging wins over quota", http.MethodPut, "tagging&seaweedfs-quota", s3_constants.S3_ACTION_PUT_BUCKET_TAGGING},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, "http://localhost/bucket?"+tt.query, nil)
			if got := ResolveS3Action(r, s3_constants.ACTION_ADMIN, "bucket", ""); got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// Dedicated object-lock actions already name the operation being authorized;
// competing query parameters must not re-map them. Notably the synthetic
// DELETE ?versionId request behind the governance-bypass check must stay
// s3:BypassGovernanceRetention rather than resolving to s3:DeleteObjectVersion.
func TestResolveS3ActionDedicatedObjectLockActions(t *testing.T) {
	tests := []struct {
		name       string
		method     string
		object     string
		query      string
		baseAction string
		want       string
	}{
		{"bypass on versioned delete shape", http.MethodDelete, "key", "versionId=abc123",
			s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, s3_constants.S3_ACTION_BYPASS_GOVERNANCE},
		{"bypass on batch delete shape", http.MethodPost, "", "delete",
			s3_constants.ACTION_BYPASS_GOVERNANCE_RETENTION, s3_constants.S3_ACTION_BYPASS_GOVERNANCE},
		{"get retention with versionId", http.MethodGet, "key", "retention&versionId=abc123",
			s3_constants.ACTION_GET_OBJECT_RETENTION, s3_constants.S3_ACTION_GET_OBJECT_RETENTION},
		{"put retention with versionId", http.MethodPut, "key", "retention&versionId=abc123",
			s3_constants.ACTION_PUT_OBJECT_RETENTION, s3_constants.S3_ACTION_PUT_OBJECT_RETENTION},
		{"get legal hold with versionId", http.MethodGet, "key", "legal-hold&versionId=abc123",
			s3_constants.ACTION_GET_OBJECT_LEGAL_HOLD, s3_constants.S3_ACTION_GET_OBJECT_LEGAL_HOLD},
		{"put legal hold with versionId", http.MethodPut, "key", "legal-hold&versionId=abc123",
			s3_constants.ACTION_PUT_OBJECT_LEGAL_HOLD, s3_constants.S3_ACTION_PUT_OBJECT_LEGAL_HOLD},
		{"get object-lock config", http.MethodGet, "", "object-lock&versioning",
			s3_constants.ACTION_GET_BUCKET_OBJECT_LOCK_CONFIG, s3_constants.S3_ACTION_GET_BUCKET_OBJECT_LOCK},
		{"put object-lock config", http.MethodPut, "", "object-lock",
			s3_constants.ACTION_PUT_BUCKET_OBJECT_LOCK_CONFIG, s3_constants.S3_ACTION_PUT_BUCKET_OBJECT_LOCK},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, "http://localhost/bucket/"+tt.object+"?"+tt.query, nil)
			if got := ResolveS3Action(r, tt.baseAction, "bucket", tt.object); got != tt.want {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.want)
			}
		})
	}
}

// A base action naming another service carries no S3 request shape, so a query
// parameter on the request must not redirect it to an S3 action.
func TestResolveS3ActionKeepsNonS3Service(t *testing.T) {
	tests := []struct {
		name       string
		method     string
		url        string
		baseAction string
	}{
		{"iam action with batch delete query", http.MethodPost, "http://localhost/?delete", "iam:CreateUser"},
		{"iam action with acl query", http.MethodPut, "http://localhost/?acl", "iam:AttachUserPolicy"},
		{"iam action with tagging query", http.MethodGet, "http://localhost/?tagging", "iam:ListUsers"},
		{"sts action with batch delete query", http.MethodPost, "http://localhost/?delete", "sts:AssumeRole"},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			r, _ := http.NewRequest(tt.method, tt.url, nil)
			if got := ResolveS3Action(r, tt.baseAction, "", ""); got != tt.baseAction {
				t.Errorf("ResolveS3Action() = %q, want %q", got, tt.baseAction)
			}
		})
	}
}