fix: restore default CORS fallback and STS object ACL ownership (#2053)

Co-authored-by: houseme <housemecn@gmail.com>

crates/obs/src/telemetry/filter.rs

@@ -22,10 +22,11 @@ use tracing_subscriber::EnvFilter;
 
 /// Build an `EnvFilter` from the given log level string.
 ///
-/// If the `RUST_LOG` environment variable is set, it takes precedence over the
-/// provided `logger_level`. For non-verbose levels (`info`, `warn`, `error`),
-/// noisy internal crates (`hyper`, `tonic`, `h2`, `reqwest`, `tower`) are
-/// automatically silenced to reduce log noise.
+/// If `default_level` is provided, it is used directly. Otherwise, the
+/// `RUST_LOG` environment variable takes precedence over `logger_level`.
+/// For non-verbose levels (`info`, `warn`, `error`), noisy internal crates
+/// (`hyper`, `tonic`, `h2`, `reqwest`, `tower`) are automatically silenced
+/// based on the effective log configuration.
 ///
 /// # Arguments
 /// * `logger_level` - The desired log level string (e.g., `"info"`, `"debug"`).
@@ -35,13 +36,48 @@ use tracing_subscriber::EnvFilter;
 ///
 /// # Returns
 /// A configured `EnvFilter` ready to be attached to a `tracing_subscriber` registry.
+fn is_verbose_level(level: &str) -> bool {
+    matches!(level.to_ascii_lowercase().as_str(), "trace" | "debug")
+}
+
+fn rust_log_requests_verbose(rust_log: &str) -> bool {
+    rust_log.split(',').any(|directive| {
+        let directive = directive.trim();
+        if directive.is_empty() {
+            return false;
+        }
+
+        let level = directive.rsplit('=').next().unwrap_or("").trim();
+        is_verbose_level(level)
+    })
+}
+
+fn should_suppress_noisy_crates(logger_level: &str, default_level: Option<&str>, rust_log: Option<&str>) -> bool {
+    if let Some(level) = default_level {
+        return !is_verbose_level(level);
+    }
+
+    if let Some(rust_log) = rust_log {
+        return !rust_log_requests_verbose(rust_log);
+    }
+
+    !is_verbose_level(logger_level)
+}
+
 pub(super) fn build_env_filter(logger_level: &str, default_level: Option<&str>) -> EnvFilter {
     let level = default_level.unwrap_or(logger_level);
-    let mut filter = EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(level));
+    let rust_log = if default_level.is_none() {
+        std::env::var("RUST_LOG").ok()
+    } else {
+        None
+    };
+    let mut filter = default_level
+        .map(EnvFilter::new)
+        .unwrap_or_else(|| EnvFilter::try_from_default_env().unwrap_or_else(|_| EnvFilter::new(level)));
 
     // Suppress chatty infrastructure crates unless the operator explicitly
     // requests trace/debug output.
-    if !matches!(logger_level, "trace" | "debug") {
+    if should_suppress_noisy_crates(logger_level, default_level, rust_log.as_deref()) {
         let directives: SmallVec<[&str; 5]> = smallvec::smallvec!["hyper", "tonic", "h2", "reqwest", "tower"];
         for directive in directives {
             filter = filter.add_directive(format!("{directive}=off").parse().unwrap());
@@ -70,7 +106,7 @@ mod tests {
     #[test]
     fn test_build_env_filter_suppresses_noisy_crates() {
         // For info level, hyper/tonic/etc. should be suppressed with OFF.
-        let filter = build_env_filter("info", None);
+        let filter = build_env_filter("debug", Some("info"));
         let dbg = format!("{filter:?}");
         // The Debug output uses `LevelFilter::OFF` for suppressed crates.
         assert!(
@@ -82,7 +118,7 @@ mod tests {
     #[test]
     fn test_build_env_filter_debug_no_suppression() {
         // For debug level, our code does NOT inject any OFF directives.
-        let filter = build_env_filter("debug", None);
+        let filter = build_env_filter("info", Some("debug"));
         let dbg = format!("{filter:?}");
         // Verify the filter builds without panicking and contains the debug level.
         assert!(!dbg.is_empty());
@@ -91,4 +127,11 @@ mod tests {
             "Expected 'LevelFilter::DEBUG' in filter debug output: {dbg}"
         );
     }
+
+    #[test]
+    fn test_should_suppress_noisy_crates_respects_rust_log_debug() {
+        assert!(!should_suppress_noisy_crates("info", None, Some("debug")));
+        assert!(!should_suppress_noisy_crates("info", None, Some("s3=info,hyper=debug")));
+        assert!(should_suppress_noisy_crates("info", None, Some("info")));
+    }
 }