refactor(time): migrate audit and notify timestamps to jiff (#5707)

* refactor(time): migrate audit and notify timestamps to jiff Co-Authored-By: heihutu <heihutu@gmail.com> * test(ecstore): initialize heal walk decode error Co-Authored-By: heihutu <heihutu@gmail.com> * refactor(targets): parse MySQL event time with jiff Preserve MySQL DATETIME(6) wall-time formatting for RFC3339 eventTime values while removing the direct chrono dependency from rustfs-targets. Co-Authored-By: heihutu <heihutu@gmail.com> * chore(deps): prune unused workspace dependencies Apply cargo shear --fix to remove unused path-clean and s3select-api tempfile entries after the scoped jiff migration. Co-Authored-By: heihutu <heihutu@gmail.com> * test(ecstore): remove duplicate heal walk decode error init Remove the duplicate decode_error field from the heal walk test collector initializer so lib-test clippy compiles on CI. Co-Authored-By: heihutu <heihutu@gmail.com> * refactor(policy): emit OPA timestamps with jiff Co-Authored-By: heihutu <heihutu@gmail.com> --------- Co-authored-by: heihutu <heihutu@gmail.com>
2026-08-13 00:26:53 +00:00 · 2026-08-04 23:20:44 +08:00
parent b14805af47
commit 510b0350d6
16 changed files with 206 additions and 55 deletions
@@ -274,7 +274,9 @@ impl AuthZPlugin {
                    "context": {
                        "conditions": args.conditions,
                        "deny_only": args.deny_only,
-                        "timestamp": chrono::Utc::now().to_rfc3339()
+                        "timestamp": jiff::Timestamp::now()
+                            .display_with_offset(jiff::tz::Offset::UTC)
+                            .to_string()
                    }
            }
        })
@@ -439,6 +441,43 @@ mod tests {
        }
    }

+    #[test]
+    fn test_build_opa_input_timestamp_serializes_as_rfc3339_utc() {
+        let plugin = AuthZPlugin::new(Args {
+            url: "http://127.0.0.1:8181/v1/data/rustfs/authz/allow".to_string(),
+            auth_token: String::new(),
+        });
+        let groups = Some(vec!["developers".to_string()]);
+        let conditions = HashMap::new();
+        let claims = HashMap::new();
+        let args = PArgs {
+            account: "account",
+            groups: &groups,
+            action: crate::policy::action::Action::None,
+            bucket: "bucket",
+            conditions: &conditions,
+            is_owner: false,
+            object: "object",
+            claims: &claims,
+            deny_only: false,
+        };
+
+        let payload = plugin.build_opa_input(&args);
+        let timestamp = payload
+            .pointer("/input/context/timestamp")
+            .and_then(|value| value.as_str())
+            .expect("OPA input should include a timestamp string");
+
+        timestamp
+            .parse::<jiff::Timestamp>()
+            .expect("OPA timestamp should remain RFC3339-compatible");
+        assert!(timestamp.contains('T'), "OPA timestamp should use RFC3339 date-time form: {timestamp}");
+        assert!(
+            timestamp.ends_with("+00:00"),
+            "OPA timestamp should preserve chrono::DateTime::to_rfc3339 UTC offset form: {timestamp}"
+        );
+    }
+
    #[test]
    fn test_opa_connection_error_removes_sensitive_endpoint() {
        let listener = TcpListener::bind("127.0.0.1:0").expect("bind local test listener");