mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-11-09 21:38:19 +01:00
Chris Lu
84cd3c621b
* s3vectors: attribute request and traffic metrics to authorized buckets * s3vectors: emit resource and identity audit events * s3vectors: apply existing S3 request limits and preserve JSON errors * s3vectors: select limit resources by the dispatched operation * s3vectors: count decoded chunked request bodies against byte limits
51 lines
1.9 KiB
Go
51 lines
1.9 KiB
Go
package s3vectors
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
)
|
|
|
|
func TestVectorAuditRecordsIdentityResourceAndErrors(t *testing.T) {
|
|
for _, status := range []int{http.StatusOK, http.StatusForbidden, http.StatusServiceUnavailable} {
|
|
t.Run(http.StatusText(status), func(t *testing.T) {
|
|
r := s3err.EnsureAuditTracking(httptest.NewRequest(http.MethodPost, "/QueryVectors", strings.NewReader(`{}`)))
|
|
r = s3_constants.EnsureIdentityHolder(r)
|
|
s := &Server{}
|
|
var got *s3err.AccessLog
|
|
s.instrument(func(w http.ResponseWriter, request *http.Request) {
|
|
request = request.WithContext(s3_constants.SetIdentityNameInContext(request.Context(), "alice"))
|
|
setRequestTarget(request, "embeddings", "documents")
|
|
w.WriteHeader(status)
|
|
if status >= http.StatusBadRequest {
|
|
_, _ = w.Write([]byte(`{"code":"AccessDenied","message":"no secret data"}`))
|
|
}
|
|
info := request.Context().Value(requestInfoKey{}).(*requestInfo)
|
|
got = accessLog(request, status, "s3vectors.QueryVectors", info)
|
|
})(httptest.NewRecorder(), r)
|
|
if !s3err.AuditAlreadyLogged(r) {
|
|
t.Fatal("vector response did not emit an audit event")
|
|
}
|
|
if got.Requester != "alice" || got.Bucket != "embeddings" || got.Key != "documents" || got.Operation != "s3vectors.QueryVectors" || got.HTTPStatus != status {
|
|
t.Fatalf("audit event: %+v", got)
|
|
}
|
|
if status >= http.StatusBadRequest && got.ErrorCode != "AccessDenied" {
|
|
t.Fatalf("error code = %q", got.ErrorCode)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestVectorBucketAuditHasNoObjectKey(t *testing.T) {
|
|
r := httptest.NewRequest(http.MethodPost, "/CreateVectorBucket", nil).WithContext(context.Background())
|
|
log := accessLog(r, http.StatusOK, "s3vectors.CreateVectorBucket", &requestInfo{bucket: "embeddings"})
|
|
if log.Bucket != "embeddings" || log.Key != "" {
|
|
t.Fatalf("bucket audit: %+v", log)
|
|
}
|
|
}
|