mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-20 13:30:46 +02:00
Chris Lu
f9dfc0ea37
- OIDC discovery via .well-known/openid-configuration; falls back to /.well-known/jwks.json when discovery is absent. Reject discovery docs whose issuer claim does not match the configured issuer to defend against issuer-substitution. - ComputeParentUser derives a stable per-identity hash from (sub, iss). Surface as aws:userid in the request context and as a parent_user claim in the session JWT so per-user state survives token rotation. - Per-role MaxSessionDuration (3600..43200) clamps requested DurationSeconds before the STS service applies its own caps. - Tighten RoleSessionName to the AWS contract: 2..64 chars from [\w+=,.@-]. - Populate PackedPolicySize in AssumeRole / AssumeRoleWithWebIdentity / AssumeRoleWithLDAPIdentity responses as a percentage of the 2048-byte inline session policy budget.
35 lines
877 B
Go
35 lines
877 B
Go
package s3api
|
|
|
|
import "testing"
|
|
|
|
func TestComputePackedPolicySize(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
policyLen int
|
|
empty bool
|
|
want int64
|
|
}{
|
|
{"empty -> nil", 0, true, 0},
|
|
{"tiny policy -> 0%", 10, false, 0},
|
|
{"half budget -> 50%", sessionPolicyBudgetBytes / 2, false, 50},
|
|
{"full budget -> 100%", sessionPolicyBudgetBytes, false, 100},
|
|
{"oversized -> capped at 100", sessionPolicyBudgetBytes * 3, false, 100},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
policy := repeat('a', tc.policyLen)
|
|
got := computePackedPolicySize(policy)
|
|
switch {
|
|
case tc.empty:
|
|
if got != nil {
|
|
t.Fatalf("expected nil for empty input, got %d", *got)
|
|
}
|
|
case got == nil:
|
|
t.Fatalf("expected non-nil result, got nil")
|
|
case *got != tc.want:
|
|
t.Fatalf("got=%d want=%d", *got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|