gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-27 15:37:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(credentials): derive RPC secret fallback and remove IAM keygen duplication (#3079)

Browse Source 
* refactor(credentials): derive rpc secret and remove iam keygen

* fix(credentials): reject default access key RPC secret

* test(credentials): align RPC fallback and add keygen coverage
This commit is contained in:
houseme
2026-05-25 19:05:58 +08:00
committed by GitHub
parent 5f5b1207e0
commit 3d2449872a
6 changed files with 128 additions and 217 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/iam/src/utils.rs
+1 -180
View File
@@ -13,75 +13,8 @@
// limitations under the License.
use jsonwebtoken::{Algorithm, DecodingKey, EncodingKey, Header};
use rand::{Rng, RngExt};
use serde::{Serialize, de::DeserializeOwned};
use std::collections::HashSet;
use std::io::{Error, Result};
/// Generates a random access key of the specified length.
///
/// # Arguments
///
/// * `length` - The length of the access key to be generated.
///
/// # Returns
///
/// * `Result<String>` - A result containing the generated access key or an error if the length is invalid.
///
/// # Errors
///
/// * Returns an error if the length is less than 3.
///
pub fn gen_access_key(length: usize) -> Result<String> {
const ALPHA_NUMERIC_TABLE: [char; 36] = [
'0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N',
'O', 'P', 'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z',
];
if length < 3 {
return Err(Error::other("access key length is too short"));
}
let mut result = String::with_capacity(length);
let mut rng = rand::rng();
for _ in 0..length {
result.push(ALPHA_NUMERIC_TABLE[rng.random_range(0..ALPHA_NUMERIC_TABLE.len())]);
}
Ok(result)
}
/// Generates a random secret key of the specified length.
///
/// # Arguments
///
/// * `length` - The length of the secret key to be generated.
///
/// # Returns
///
/// * `Result<String>` - A result containing the generated secret key or an error if the length is invalid.
///
/// # Errors
///
/// * Returns an error if the length is less than 8.
///
pub fn gen_secret_key(length: usize) -> Result<String> {
use base64_simd::URL_SAFE_NO_PAD;
if length < 8 {
return Err(Error::other("secret key length is too short"));
}
let mut rng = rand::rng();
let mut key = vec![0u8; URL_SAFE_NO_PAD.estimated_decoded_length(length)];
rng.fill_bytes(&mut key);
let encoded = URL_SAFE_NO_PAD.encode_to_string(&key);
let key_str = encoded.replace("/", "+");
Ok(key_str)
}
pub fn generate_jwt<T: Serialize>(claims: &T, secret: &str) -> std::result::Result<String, jsonwebtoken::errors::Error> {
let header = Header::new(Algorithm::HS512);
@@ -111,99 +44,9 @@ pub fn extract_claims_allow_missing_exp<T: DeserializeOwned + Clone>(
#[cfg(test)]
mod tests {
use super::{extract_claims, gen_access_key, gen_secret_key, generate_jwt};
use super::{extract_claims, generate_jwt};
use serde::{Deserialize, Serialize};
#[test]
fn test_gen_access_key_valid_length() {
// Test valid access key generation
let key = gen_access_key(10).unwrap();
assert_eq!(key.len(), 10);
// Test different lengths
let key_20 = gen_access_key(20).unwrap();
assert_eq!(key_20.len(), 20);
let key_3 = gen_access_key(3).unwrap();
assert_eq!(key_3.len(), 3);
}
#[test]
fn test_gen_access_key_uniqueness() {
// Test that generated keys are unique
let key1 = gen_access_key(16).unwrap();
let key2 = gen_access_key(16).unwrap();
assert_ne!(key1, key2, "Generated access keys should be unique");
}
#[test]
fn test_gen_access_key_character_set() {
// Test that generated keys only contain valid characters
let key = gen_access_key(100).unwrap();
for ch in key.chars() {
assert!(ch.is_ascii_alphanumeric(), "Access key should only contain alphanumeric characters");
assert!(
ch.is_ascii_uppercase() || ch.is_ascii_digit(),
"Access key should only contain uppercase letters and digits"
);
}
}
#[test]
fn test_gen_access_key_invalid_length() {
// Test error cases for invalid lengths
assert!(gen_access_key(0).is_err(), "Should fail for length 0");
assert!(gen_access_key(1).is_err(), "Should fail for length 1");
assert!(gen_access_key(2).is_err(), "Should fail for length 2");
// Verify error message
let error = gen_access_key(2).unwrap_err();
assert_eq!(error.to_string(), "access key length is too short");
}
#[test]
fn test_gen_secret_key_valid_length() {
// Test valid secret key generation
let key = gen_secret_key(10).unwrap();
assert!(!key.is_empty(), "Secret key should not be empty");
let key_20 = gen_secret_key(20).unwrap();
assert!(!key_20.is_empty(), "Secret key should not be empty");
}
#[test]
fn test_gen_secret_key_uniqueness() {
// Test that generated secret keys are unique
let key1 = gen_secret_key(16).unwrap();
let key2 = gen_secret_key(16).unwrap();
assert_ne!(key1, key2, "Generated secret keys should be unique");
}
#[test]
fn test_gen_secret_key_base64_format() {
// Test that secret key is valid base64-like format
let key = gen_secret_key(32).unwrap();
// Should not contain invalid characters for URL-safe base64
for ch in key.chars() {
assert!(
ch.is_ascii_alphanumeric() || ch == '+' || ch == '-' || ch == '_',
"Secret key should be URL-safe base64 compatible"
);
}
}
#[test]
fn test_gen_secret_key_invalid_length() {
// Test error cases for invalid lengths
assert!(gen_secret_key(0).is_err(), "Should fail for length 0");
assert!(gen_secret_key(7).is_err(), "Should fail for length 7");
// Verify error message
let error = gen_secret_key(5).unwrap_err();
assert_eq!(error.to_string(), "secret key length is too short");
}
#[derive(Debug, Serialize, Deserialize, PartialEq, Clone)]
struct Claims {
sub: String,
@@ -370,26 +213,4 @@ mod tests {
assert_eq!(decoded.claims, special_claims);
}
#[test]
fn test_access_key_length_boundaries() {
// Test boundary conditions for access key length
assert!(gen_access_key(3).is_ok(), "Length 3 should be valid (minimum)");
assert!(gen_access_key(1000).is_ok(), "Large length should be valid");
// Test that minimum length is enforced
let min_key = gen_access_key(3).unwrap();
assert_eq!(min_key.len(), 3);
}
#[test]
fn test_secret_key_length_boundaries() {
// Test boundary conditions for secret key length
assert!(gen_secret_key(8).is_ok(), "Length 8 should be valid (minimum)");
assert!(gen_secret_key(1000).is_ok(), "Large length should be valid");
// Test that minimum length is enforced
let result = gen_secret_key(8);
assert!(result.is_ok(), "Minimum valid length should work");
}
}