gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-20 11:32:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(authz): fail closed on policy load errors (#5359)

Browse Source 
* fix(authz): fail closed on policy load errors

* test(authz): cover policy failure precedence

* test: align policy failure expectations

* test: align upload part copy fail-closed expectation
This commit is contained in:
cxymds
2026-07-28 17:04:35 +08:00
committed by GitHub
parent 2216f00cfd
commit 4fb9b0dc7f
5 changed files with 163 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/app/bucket_usecase.rs
+6 -4
View File
@@ -1810,7 +1810,7 @@ impl DefaultBucketUsecase {
client_info,
);
let read_allowed = PolicySys::is_allowed(&BucketPolicyArgs {
let read_allowed = PolicySys::try_is_allowed(&BucketPolicyArgs {
bucket: &bucket,
action: Action::S3Action(S3Action::ListBucketAction),
is_owner: false,
@@ -1819,9 +1819,10 @@ impl DefaultBucketUsecase {
conditions: &conditions,
object: "",
})
.await;
.await
.map_err(ApiError::from)?;
let write_allowed = PolicySys::is_allowed(&BucketPolicyArgs {
let write_allowed = PolicySys::try_is_allowed(&BucketPolicyArgs {
bucket: &bucket,
action: Action::S3Action(S3Action::PutObjectAction),
is_owner: false,
@@ -1830,7 +1831,8 @@ impl DefaultBucketUsecase {
conditions: &conditions,
object: "",
})
.await;
.await
.map_err(ApiError::from)?;
let mut is_public = read_allowed || write_allowed;
let ignore_public_acls = match metadata_sys::get_public_access_block_config(&bucket).await {