lint: clippy rules or_fun_call (#2561)

Co-authored-by: houseme <housemecn@gmail.com>

crates/audit/src/factory.rs

@@ -73,7 +73,9 @@ impl TargetFactory for WebhookTargetFactory {
             enable: true, // If we are here, it's already enabled.
             endpoint: endpoint_url,
             auth_token: config.lookup(WEBHOOK_AUTH_TOKEN).unwrap_or_default(),
-            queue_dir: config.lookup(WEBHOOK_QUEUE_DIR).unwrap_or(AUDIT_DEFAULT_DIR.to_string()),
+            queue_dir: config
+                .lookup(WEBHOOK_QUEUE_DIR)
+                .unwrap_or_else(|| AUDIT_DEFAULT_DIR.to_string()),
             queue_limit: config
                 .lookup(WEBHOOK_QUEUE_LIMIT)
                 .and_then(|v| v.parse::<u64>().ok())
@@ -111,7 +113,9 @@ impl TargetFactory for WebhookTargetFactory {
             ));
         }
 
-        let queue_dir = config.lookup(WEBHOOK_QUEUE_DIR).unwrap_or(AUDIT_DEFAULT_DIR.to_string());
+        let queue_dir = config
+            .lookup(WEBHOOK_QUEUE_DIR)
+            .unwrap_or_else(|| AUDIT_DEFAULT_DIR.to_string());
         if !queue_dir.is_empty() && !std::path::Path::new(&queue_dir).is_absolute() {
             return Err(TargetError::Configuration("Webhook queue directory must be an absolute path".to_string()));
         }
@@ -178,7 +182,7 @@ impl TargetFactory for MQTTTargetFactory {
                 config.lookup(MQTT_TLS_TRUST_LEAF_AS_CA).as_deref(),
                 config.lookup(MQTT_WS_PATH_ALLOWLIST).as_deref(),
             )?,
-            queue_dir: config.lookup(MQTT_QUEUE_DIR).unwrap_or(AUDIT_DEFAULT_DIR.to_string()),
+            queue_dir: config.lookup(MQTT_QUEUE_DIR).unwrap_or_else(|| AUDIT_DEFAULT_DIR.to_string()),
             queue_limit: config
                 .lookup(MQTT_QUEUE_LIMIT)
                 .and_then(|v| v.parse::<u64>().ok())

crates/common/src/data_usage.rs

@@ -51,14 +51,14 @@ impl AllTierStats {
     pub fn add_sizes(&mut self, tiers: HashMap<String, TierStats>) {
         for (tier, st) in tiers {
             self.tiers
-                .insert(tier.clone(), self.tiers.get(&tier).unwrap_or(&TierStats::default()).add(&st));
+                .insert(tier.clone(), self.tiers.get(&tier).copied().unwrap_or_default().add(&st));
         }
     }
 
     pub fn merge(&mut self, other: AllTierStats) {
         for (tier, st) in other.tiers {
             self.tiers
-                .insert(tier.clone(), self.tiers.get(&tier).unwrap_or(&TierStats::default()).add(&st));
+                .insert(tier.clone(), self.tiers.get(&tier).copied().unwrap_or_default().add(&st));
         }
     }
 

crates/credentials/src/credentials.rs

@@ -20,7 +20,7 @@ use std::collections::HashMap;
 use std::env;
 use std::fmt;
 use std::io::Error;
-use std::sync::OnceLock;
+use std::sync::{LazyLock, OnceLock};
 use time::OffsetDateTime;
 
 /// Global active credentials
@@ -314,6 +314,17 @@ impl fmt::Debug for Credentials {
 }
 
 impl Credentials {
+    /// Returns a reference to this credential's claims, or a shared empty map
+    /// when the credential has no claims attached. Avoids per-call allocation
+    /// at call sites that need an `&HashMap<String, Value>`.
+    pub fn claims_or_empty(&self) -> &HashMap<String, Value> {
+        static EMPTY: LazyLock<HashMap<String, Value>> = LazyLock::new(HashMap::new);
+        match &self.claims {
+            Some(c) => c,
+            None => &EMPTY,
+        }
+    }
+
     pub fn is_expired(&self) -> bool {
         if self.expiration.is_none() {
             return false;

crates/e2e_test/src/kms/test_runner.rs

@@ -450,11 +450,7 @@ impl KMSTestSuite {
         if failed > 0 {
             warn!("❌ Failing tests:");
             for result in results.iter().filter(|r| !r.success) {
-                warn!(
-                    "  - {}: {}",
-                    result.test_name,
-                    result.error_message.as_ref().unwrap_or(&"Unknown error".to_string())
-                );
+                warn!("  - {}: {}", result.test_name, result.error_message.as_deref().unwrap_or("Unknown error"));
             }
         }
     }

crates/e2e_test/src/reliant/conditional_writes.rs

@@ -259,7 +259,7 @@ async fn test_conditional_multi_part_upload() -> Result<(), Box<dyn std::error::
 
     let upload_id = initiate_response
         .upload_id()
-        .ok_or(std::io::Error::other("No upload ID returned"))?;
+        .ok_or_else(|| std::io::Error::other("No upload ID returned"))?;
 
     // Upload parts
     for part_number in 1..=num_parts {
@@ -277,7 +277,7 @@ async fn test_conditional_multi_part_upload() -> Result<(), Box<dyn std::error::
 
         let part_etag = upload_part_response
             .e_tag()
-            .ok_or(std::io::Error::other("Do not have etag"))?
+            .ok_or_else(|| std::io::Error::other("Do not have etag"))?
             .to_string();
 
         let completed_part = CompletedPart::builder().part_number(part_number).e_tag(part_etag).build();

crates/e2e_test/src/reliant/node_interact_test.rs

@@ -154,7 +154,7 @@ async fn walk_dir() -> Result<(), Box<dyn Error>> {
             match response.next().await {
                 Some(Ok(resp)) => {
                     if !resp.success {
-                        println!("{}", resp.error_info.unwrap_or("".to_string()));
+                        println!("{}", resp.error_info.unwrap_or_else(|| "".to_string()));
                     }
                     let entry = serde_json::from_str::<MetaCacheEntry>(&resp.meta_cache_entry)
                         .map_err(|_e| std::io::Error::other(format!("Unexpected response: {response:?}")))

crates/ecstore/src/bucket/bucket_target_sys.rs

@@ -786,7 +786,10 @@ impl BucketTargetSys {
                         && tgt
                             .credentials
                             .as_ref()
-                            .map(|c| c.access_key == target.credentials.as_ref().unwrap_or(&Credentials::default()).access_key)
+                            .map(|c| {
+                                let default_creds = Credentials::default();
+                                c.access_key == target.credentials.as_ref().unwrap_or(&default_creds).access_key
+                            })
                             .unwrap_or(false)
                     {
                         return (tgt.arn.clone(), true);

crates/ecstore/src/bucket/lifecycle/bucket_lifecycle_ops.rs

@@ -1326,18 +1326,18 @@ pub async fn put_restore_opts(
             if !strings_has_prefix_fold(&v.name.clone().unwrap(), "x-amz-meta") {
                 meta.insert(
                     format!("x-amz-meta-{}", v.name.as_ref().unwrap()),
-                    v.value.clone().unwrap_or("".to_string()),
+                    v.value.clone().unwrap_or_else(|| "".to_string()),
                 );
                 continue;
             }
-            meta.insert(v.name.clone().unwrap(), v.value.clone().unwrap_or("".to_string()));
+            meta.insert(v.name.clone().unwrap(), v.value.clone().unwrap_or_else(|| "".to_string()));
         }
         if let Some(output_location) = rreq.output_location.as_ref() {
             if let Some(s3) = &output_location.s3 {
                 if let Some(tags) = &s3.tagging {
                     meta.insert(
                         AMZ_OBJECT_TAGGING.to_string(),
-                        serde_urlencoded::to_string(tags.tag_set.clone()).unwrap_or("".to_string()),
+                        serde_urlencoded::to_string(tags.tag_set.clone()).unwrap_or_else(|_| "".to_string()),
                     );
                 }
             }

crates/ecstore/src/bucket/lifecycle/lifecycle.rs

@@ -636,7 +636,7 @@ impl Lifecycle for BucketLifecycleConfiguration {
                                         storage_class: transitions[0]
                                             .storage_class
                                             .clone()
-                                            .unwrap_or(TransitionStorageClass::from_static(""))
+                                            .unwrap_or_else(|| TransitionStorageClass::from_static(""))
                                             .as_str()
                                             .to_string(),
                                         noncurrent_days: 0,

crates/ecstore/src/disk/local.rs

@@ -1538,7 +1538,7 @@ impl DiskAPI for LocalDisk {
                 volume,
                 path_join_buf(&[
                     path,
-                    &fi.data_dir.map_or("".to_string(), |dir| dir.to_string()),
+                    &fi.data_dir.map_or_else(|| "".to_string(), |dir| dir.to_string()),
                     &format!("part.{}", part.number),
                 ])
                 .as_str(),
@@ -1587,7 +1587,7 @@ impl DiskAPI for LocalDisk {
                 self.get_object_path(
                     bucket,
                     path_join_buf(&[
-                        path.parent().unwrap_or(Path::new("")).to_string_lossy().as_ref(),
+                        path.parent().unwrap_or_else(|| Path::new("")).to_string_lossy().as_ref(),
                         &format!("part.{num}"),
                     ])
                     .as_str(),
@@ -1648,7 +1648,7 @@ impl DiskAPI for LocalDisk {
                 volume,
                 path_join_buf(&[
                     path,
-                    &fi.data_dir.map_or("".to_string(), |dir| dir.to_string()),
+                    &fi.data_dir.map_or_else(|| "".to_string(), |dir| dir.to_string()),
                     &format!("part.{}", part.number),
                 ])
                 .as_str(),
@@ -2497,7 +2497,7 @@ impl DiskAPI for LocalDisk {
                     let part_path = format!("part.{}", part.number);
                     let part_path = path_join_buf(&[
                         path,
-                        fi.data_dir.map_or("".to_string(), |dir| dir.to_string()).as_str(),
+                        fi.data_dir.map_or_else(|| "".to_string(), |dir| dir.to_string()).as_str(),
                         part_path.as_str(),
                     ]);
                     let part_path = self.get_object_path(volume, part_path.as_str())?;
@@ -2514,7 +2514,7 @@ impl DiskAPI for LocalDisk {
             if inline && fi.shard_file_size(fi.parts[0].actual_size) < DEFAULT_INLINE_BLOCK as i64 {
                 let part_path = path_join_buf(&[
                     path,
-                    fi.data_dir.map_or("".to_string(), |dir| dir.to_string()).as_str(),
+                    fi.data_dir.map_or_else(|| "".to_string(), |dir| dir.to_string()).as_str(),
                     format!("part.{}", fi.parts[0].number).as_str(),
                 ]);
                 let part_path = self.get_object_path(volume, part_path.as_str())?;

crates/ecstore/src/endpoints.rs

@@ -554,7 +554,7 @@ impl EndpointServerPools {
 
         for pool in self.0.iter() {
             for ep in pool.endpoints.as_ref() {
-                let n = node_map.entry(ep.host_port()).or_insert(Node {
+                let n = node_map.entry(ep.host_port()).or_insert_with(|| Node {
                     url: ep.url.clone(),
                     pools: vec![],
                     is_local: ep.is_local,

crates/ecstore/src/erasure_coding/encode.rs

@@ -106,7 +106,7 @@ impl<'a> MultiWriter<'a> {
             self.writers.len(),
             self.errs
                 .iter()
-                .map(|e| e.as_ref().map_or("<nil>".to_string(), |e| e.to_string()))
+                .map(|e| e.as_ref().map_or_else(|| "<nil>".to_string(), |e| e.to_string()))
                 .collect::<Vec<_>>()
                 .join(", ")
         )))
@@ -168,7 +168,7 @@ impl<'a> MultiWriter<'a> {
             self.writers.len(),
             self.errs
                 .iter()
-                .map(|e| e.as_ref().map_or("<nil>".to_string(), |e| e.to_string()))
+                .map(|e| e.as_ref().map_or_else(|| "<nil>".to_string(), |e| e.to_string()))
                 .collect::<Vec<_>>()
                 .join(", ")
         )))

crates/ecstore/src/set_disk.rs

@@ -2973,7 +2973,7 @@ impl MultipartOperations for SetDisks {
 
         let (shuffle_disks, mut parts_metadatas) = Self::shuffle_disks_and_parts_metadata(&disks, &parts_metadata, &fi);
 
-        let mod_time = opts.mod_time.unwrap_or(OffsetDateTime::now_utc());
+        let mod_time = opts.mod_time.unwrap_or_else(OffsetDateTime::now_utc);
 
         for f in parts_metadatas.iter_mut() {
             f.metadata = user_defined.clone();
@@ -3989,7 +3989,7 @@ async fn get_disks_info(disks: &[Option<DiskStore>], eps: &[Endpoint]) -> Vec<ru
                     healing: res.healing,
                     scanning: res.scanning,
 
-                    uuid: res.id.map_or("".to_string(), |id| id.to_string()),
+                    uuid: res.id.map_or_else(|| "".to_string(), |id| id.to_string()),
                     major: res.major as u32,
                     minor: res.minor as u32,
                     model: None,

crates/ecstore/src/set_disk/metadata.rs

@@ -38,14 +38,17 @@ impl SetDisks {
         let upload_uuid = base64_simd::URL_SAFE_NO_PAD
             .decode_to_vec(upload_id.as_bytes())
             .and_then(|v| {
-                String::from_utf8(v).map_or(Ok(upload_id.to_owned()), |v| {
-                    let parts: Vec<_> = v.splitn(2, '.').collect();
-                    if parts.len() == 2 {
-                        Ok(parts[1].to_string())
-                    } else {
-                        Ok(upload_id.to_string())
-                    }
-                })
+                String::from_utf8(v).map_or_else(
+                    |_| Ok(upload_id.to_owned()),
+                    |v| {
+                        let parts: Vec<_> = v.splitn(2, '.').collect();
+                        if parts.len() == 2 {
+                            Ok(parts[1].to_string())
+                        } else {
+                            Ok(upload_id.to_string())
+                        }
+                    },
+                )
             })
             .unwrap_or_default();
 

crates/ecstore/tests/legacy_bitrot_read_test.rs

@@ -40,7 +40,7 @@ fn workspace_root() -> PathBuf {
     PathBuf::from(&manifest)
         .ancestors()
         .nth(2)
-        .unwrap_or(std::path::Path::new("."))
+        .unwrap_or_else(|| std::path::Path::new("."))
         .to_path_buf()
 }
 

crates/filemeta/src/fileinfo.rs

@@ -429,7 +429,7 @@ impl FileInfo {
         if self.deleted {
             return "delete-marker".to_string();
         }
-        self.data_dir.map_or("".to_string(), |dir| dir.to_string())
+        self.data_dir.map_or_else(|| "".to_string(), |dir| dir.to_string())
     }
 
     /// Read quorum returns expected read quorum for this FileInfo

crates/filemeta/src/filemeta/version.rs

@@ -517,16 +517,20 @@ impl FileMetaVersion {
                     }
                 }
             }
-            VersionType::Object => self
-                .object
-                .as_ref()
-                .unwrap_or(&MetaObject::default())
-                .into_fileinfo(volume, path, all_parts),
-            VersionType::Delete => self
-                .delete_marker
-                .as_ref()
-                .unwrap_or(&MetaDeleteMarker::default())
-                .into_fileinfo(volume, path, all_parts),
+            VersionType::Object => {
+                let default_object = MetaObject::default();
+                self.object
+                    .as_ref()
+                    .unwrap_or(&default_object)
+                    .into_fileinfo(volume, path, all_parts)
+            }
+            VersionType::Delete => {
+                let default_marker = MetaDeleteMarker::default();
+                self.delete_marker
+                    .as_ref()
+                    .unwrap_or(&default_marker)
+                    .into_fileinfo(volume, path, all_parts)
+            }
         };
         fi.uses_legacy_checksum = self.uses_legacy_checksum;
         fi

crates/iam/src/manager.rs

@@ -429,7 +429,7 @@ where
                 p.update(policy.clone());
                 p
             })
-            .unwrap_or(PolicyDoc::new(policy));
+            .unwrap_or_else(|| PolicyDoc::new(policy));
 
         self.api.save_policy_doc(name, policy_doc.clone()).await?;
 
@@ -797,7 +797,7 @@ where
                         Cache::add_or_update(&self.cache.groups, name, p, OffsetDateTime::now_utc());
                     }
 
-                    m.get(name).cloned().ok_or(Error::NoSuchGroup(name.to_string()))?
+                    m.get(name).cloned().ok_or_else(|| Error::NoSuchGroup(name.to_string()))?
                 }
             };
 
@@ -1452,7 +1452,7 @@ where
             .load()
             .get(name)
             .cloned()
-            .ok_or(Error::NoSuchGroup(name.to_string()))?;
+            .ok_or_else(|| Error::NoSuchGroup(name.to_string()))?;
 
         let mapped_policy = if let Some(policy) = self.cache.group_policies.load().get(name).cloned() {
             Some(policy)
@@ -1511,7 +1511,7 @@ where
             .load()
             .get(name)
             .cloned()
-            .ok_or(Error::NoSuchGroup(name.to_string()))?;
+            .ok_or_else(|| Error::NoSuchGroup(name.to_string()))?;
 
         let s: HashSet<&String> = HashSet::from_iter(gi.members.iter());
         let d: HashSet<&String> = HashSet::from_iter(members.iter());
@@ -1556,14 +1556,14 @@ where
             // Reload from backend so we see latest members (e.g. after user was deleted elsewhere)
             let mut m = HashMap::new();
             self.api.load_group(group, &mut m).await?;
-            m.get(group).cloned().ok_or(Error::NoSuchGroup(group.to_string()))?
+            m.get(group).cloned().ok_or_else(|| Error::NoSuchGroup(group.to_string()))?
         } else {
             self.cache
                 .groups
                 .load()
                 .get(group)
                 .cloned()
-                .ok_or(Error::NoSuchGroup(group.to_string()))?
+                .ok_or_else(|| Error::NoSuchGroup(group.to_string()))?
         };
 
         if members.is_empty() && !gi.members.is_empty() {

crates/keystone/src/client.rs

@@ -240,7 +240,7 @@ impl KeystoneClient {
         let _body: serde_json::Value = response.json().await.map_err(|e| KeystoneError::ParseError(e.to_string()))?;
 
         // Parse access key to extract user_id and project_id
-        let (user_id, project_id) = EC2Credential::parse_access_key(access_key).unwrap_or((access_key.to_string(), None));
+        let (user_id, project_id) = EC2Credential::parse_access_key(access_key).unwrap_or_else(|| (access_key.to_string(), None));
 
         Ok(EC2Credential {
             access: access_key.to_string(),

crates/madmin/src/metrics.rs

@@ -351,7 +351,7 @@ impl RPCMetrics {
                         s_by_de
                             .entry(key.to_string())
                             .and_modify(|v| v.merge(value))
-                            .or_insert(value.clone());
+                            .or_insert_with(|| value.clone());
                     }
                 }
                 None => self.by_destination = Some(by_destination.clone()),
@@ -365,7 +365,7 @@ impl RPCMetrics {
                         s_by_caller
                             .entry(key.to_string())
                             .and_modify(|v| v.merge(value))
-                            .or_insert(value.clone());
+                            .or_insert_with(|| value.clone());
                     }
                 }
                 None => self.by_caller = Some(by_caller.clone()),

crates/notify/src/factory.rs

@@ -73,7 +73,9 @@ impl TargetFactory for WebhookTargetFactory {
             enable: true, // If we are here, it's already enabled.
             endpoint: endpoint_url,
             auth_token: config.lookup(WEBHOOK_AUTH_TOKEN).unwrap_or_default(),
-            queue_dir: config.lookup(WEBHOOK_QUEUE_DIR).unwrap_or(EVENT_DEFAULT_DIR.to_string()),
+            queue_dir: config
+                .lookup(WEBHOOK_QUEUE_DIR)
+                .unwrap_or_else(|| EVENT_DEFAULT_DIR.to_string()),
             queue_limit: config
                 .lookup(WEBHOOK_QUEUE_LIMIT)
                 .and_then(|v| v.parse::<u64>().ok())
@@ -111,7 +113,9 @@ impl TargetFactory for WebhookTargetFactory {
             ));
         }
 
-        let queue_dir = config.lookup(WEBHOOK_QUEUE_DIR).unwrap_or(EVENT_DEFAULT_DIR.to_string());
+        let queue_dir = config
+            .lookup(WEBHOOK_QUEUE_DIR)
+            .unwrap_or_else(|| EVENT_DEFAULT_DIR.to_string());
         if !queue_dir.is_empty() && !std::path::Path::new(&queue_dir).is_absolute() {
             return Err(TargetError::Configuration("Webhook queue directory must be an absolute path".to_string()));
         }
@@ -178,7 +182,7 @@ impl TargetFactory for MQTTTargetFactory {
                 config.lookup(MQTT_TLS_TRUST_LEAF_AS_CA).as_deref(),
                 config.lookup(MQTT_WS_PATH_ALLOWLIST).as_deref(),
             )?,
-            queue_dir: config.lookup(MQTT_QUEUE_DIR).unwrap_or(EVENT_DEFAULT_DIR.to_string()),
+            queue_dir: config.lookup(MQTT_QUEUE_DIR).unwrap_or_else(|| EVENT_DEFAULT_DIR.to_string()),
             queue_limit: config
                 .lookup(MQTT_QUEUE_LIMIT)
                 .and_then(|v| v.parse::<u64>().ok())

crates/obs/examples/test_dial9_s3.rs

@@ -21,7 +21,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     println!("  is_enabled(): {}", is_enabled());
     println!(
         "  RUSTFS_RUNTIME_DIAL9_ENABLED: {}",
-        std::env::var("RUSTFS_RUNTIME_DIAL9_ENABLED").unwrap_or("not set".to_string())
+        std::env::var("RUSTFS_RUNTIME_DIAL9_ENABLED").unwrap_or_else(|_| "not set".to_string())
     );
     println!();
 

crates/obs/examples/test_dial9_simple.rs

@@ -10,7 +10,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     println!("Test 1: Check dial9 state");
     println!(
         "  RUSTFS_RUNTIME_DIAL9_ENABLED: {}",
-        std::env::var("RUSTFS_RUNTIME_DIAL9_ENABLED").unwrap_or("not set".to_string())
+        std::env::var("RUSTFS_RUNTIME_DIAL9_ENABLED").unwrap_or_else(|_| "not set".to_string())
     );
     println!("  is_enabled(): {}", is_enabled());
     println!("  ✓ Dial9 state check complete");

crates/s3select-query/src/metadata/mod.rs

@@ -88,7 +88,7 @@ impl ContextProvider for MetadataProvider {
         self.func_manager
             .udf(name)
             .ok()
-            .or(self.session.inner().scalar_functions().get(name).cloned())
+            .or_else(|| self.session.inner().scalar_functions().get(name).cloned())
     }
 
     fn get_aggregate_meta(&self, name: &str) -> Option<Arc<AggregateUDF>> {

crates/scanner/src/data_usage_define.rs

@@ -96,14 +96,14 @@ impl AllTierStats {
     pub fn add_sizes(&mut self, tiers: HashMap<String, TierStats>) {
         for (tier, st) in tiers {
             self.tiers
-                .insert(tier.clone(), self.tiers.get(&tier).unwrap_or(&TierStats::default()).add(&st));
+                .insert(tier.clone(), self.tiers.get(&tier).copied().unwrap_or_default().add(&st));
         }
     }
 
     pub fn merge(&mut self, other: AllTierStats) {
         for (tier, st) in other.tiers {
             self.tiers
-                .insert(tier.clone(), self.tiers.get(&tier).unwrap_or(&TierStats::default()).add(&st));
+                .insert(tier.clone(), self.tiers.get(&tier).copied().unwrap_or_default().add(&st));
         }
     }
 
@@ -251,7 +251,7 @@ impl SizeSummary {
             return;
         }
 
-        let mut tier = oi.storage_class.clone().unwrap_or(storageclass::STANDARD.to_string());
+        let mut tier = oi.storage_class.clone().unwrap_or_else(|| storageclass::STANDARD.to_string());
         if oi.transitioned_object.status == TRANSITION_COMPLETE {
             tier = oi.transitioned_object.tier.clone();
         }

crates/scanner/src/scanner_io.rs

@@ -599,7 +599,7 @@ impl ScannerIODisk for Disk {
 
         let (lifecycle_config, _) = get_lifecycle_config(&cache.info.name)
             .await
-            .unwrap_or((BucketLifecycleConfiguration::default(), OffsetDateTime::now_utc()));
+            .unwrap_or_else(|_| (BucketLifecycleConfiguration::default(), OffsetDateTime::now_utc()));
 
         if lifecycle_config.has_active_rules("") {
             cache.info.lifecycle = Some(Arc::new(lifecycle_config));

crates/trusted-proxies/src/proxy/chain.rs

@@ -140,7 +140,7 @@ impl ProxyChainAnalyzer {
             return (client_ip, chain.to_vec(), chain.len());
         }
 
-        let client_ip = chain.first().copied().unwrap_or(IpAddr::from([0, 0, 0, 0]));
+        let client_ip = chain.first().copied().unwrap_or_else(|| IpAddr::from([0, 0, 0, 0]));
         (client_ip, Vec::new(), 0)
     }
 
@@ -156,7 +156,7 @@ impl ProxyChainAnalyzer {
             }
         }
 
-        let client_ip = chain.first().copied().unwrap_or(IpAddr::from([0, 0, 0, 0]));
+        let client_ip = chain.first().copied().unwrap_or_else(|| IpAddr::from([0, 0, 0, 0]));
         Ok((client_ip, chain.to_vec(), chain.len()))
     }
 

rustfs/src/admin/auth.rs

@@ -20,7 +20,6 @@ use rustfs_iam::store::object::ObjectStore;
 use rustfs_iam::sys::IamSys;
 use rustfs_policy::policy::{Args, action::Action};
 use s3s::{S3Result, s3_error};
-use std::collections::HashMap;
 use std::sync::Arc;
 use tracing::debug;
 
@@ -79,7 +78,7 @@ async fn check_admin_request_auth(
             action,
             conditions: &conditions,
             is_owner: ctx.is_owner,
-            claims: ctx.cred.claims.as_ref().unwrap_or(&HashMap::new()),
+            claims: ctx.cred.claims_or_empty(),
             deny_only: ctx.deny_only,
             bucket,
             object,

rustfs/src/admin/console.rs

@@ -419,7 +419,7 @@ fn get_console_config_from_env() -> (bool, u32, u64, String) {
     let cors_allowed_origins = std::env::var(rustfs_config::ENV_CONSOLE_CORS_ALLOWED_ORIGINS)
         .unwrap_or_else(|_| rustfs_config::DEFAULT_CONSOLE_CORS_ALLOWED_ORIGINS.to_string())
         .parse::<String>()
-        .unwrap_or(rustfs_config::DEFAULT_CONSOLE_CORS_ALLOWED_ORIGINS.to_string());
+        .unwrap_or_else(|_| rustfs_config::DEFAULT_CONSOLE_CORS_ALLOWED_ORIGINS.to_string());
 
     (rate_limit_enable, rate_limit_rpm, auth_timeout, cors_allowed_origins)
 }

rustfs/src/admin/handlers/quota.rs

@@ -103,7 +103,7 @@ fn parse_set_bucket_quota_request(body: &[u8]) -> Result<SetBucketQuotaRequest,
         quota: request
             .size
             .filter(|quota| *quota > 0)
-            .or(request.quota.filter(|quota| *quota > 0)),
+            .or_else(|| request.quota.filter(|quota| *quota > 0)),
         quota_type: request.quota_type.unwrap_or_else(default_quota_type),
     })
 }

rustfs/src/admin/handlers/service_account.rs

@@ -250,7 +250,7 @@ impl Operation for AddServiceAccount {
                 ),
                 is_owner: owner,
                 object: "",
-                claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                claims: cred.claims_or_empty(),
                 deny_only: false, // Always require explicit Allow permission
             })
             .await
@@ -546,7 +546,7 @@ impl Operation for UpdateServiceAccount {
                 ),
                 is_owner: owner,
                 object: "",
-                claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                claims: cred.claims_or_empty(),
                 deny_only: false,
             })
             .await
@@ -662,7 +662,7 @@ impl Operation for InfoServiceAccount {
                 ),
                 is_owner: owner,
                 object: "",
-                claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                claims: cred.claims_or_empty(),
                 deny_only: false,
             })
             .await
@@ -729,7 +729,7 @@ impl Operation for TemporaryAccountInfo {
                 ),
                 is_owner: owner,
                 object: "",
-                claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                claims: cred.claims_or_empty(),
                 deny_only: false,
             })
             .await
@@ -803,7 +803,7 @@ impl Operation for InfoAccessKey {
                 ),
                 is_owner: owner,
                 object: "",
-                claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                claims: cred.claims_or_empty(),
                 deny_only: false,
             })
             .await
@@ -940,7 +940,7 @@ impl Operation for ListServiceAccount {
                     ),
                     is_owner: owner,
                     object: "",
-                    claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                    claims: cred.claims_or_empty(),
                     deny_only: false,
                 })
                 .await
@@ -1076,7 +1076,7 @@ impl Operation for ListAccessKeysBulk {
                     ),
                     is_owner: owner,
                     object: "",
-                    claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                    claims: cred.claims_or_empty(),
                     deny_only: false,
                 })
                 .await
@@ -1099,7 +1099,7 @@ impl Operation for ListAccessKeysBulk {
                 ),
                 is_owner: owner,
                 object: "",
-                claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                claims: cred.claims_or_empty(),
                 deny_only: self_only,
             })
             .await
@@ -1268,7 +1268,7 @@ impl Operation for DeleteServiceAccount {
                 ),
                 is_owner: owner,
                 object: "",
-                claims: cred.claims.as_ref().unwrap_or(&HashMap::new()),
+                claims: cred.claims_or_empty(),
                 deny_only: false,
             })
             .await

rustfs/src/admin/handlers/sts.rs

@@ -245,7 +245,7 @@ async fn handle_assume_role(
             expiration: Timestamp::from(
                 new_cred
                     .expiration
-                    .unwrap_or(OffsetDateTime::now_utc().saturating_add(Duration::seconds(3600))),
+                    .unwrap_or_else(|| OffsetDateTime::now_utc().saturating_add(Duration::seconds(3600))),
             ),
             secret_access_key: new_cred.secret_key,
             session_token: new_cred.session_token,
@@ -326,7 +326,7 @@ async fn handle_assume_role_with_web_identity(body: AssumeRoleRequest) -> S3Resu
     // Build XML response (AssumeRoleWithWebIdentityResponse)
     let expiration = new_cred
         .expiration
-        .unwrap_or(OffsetDateTime::now_utc().saturating_add(Duration::seconds(3600)));
+        .unwrap_or_else(|| OffsetDateTime::now_utc().saturating_add(Duration::seconds(3600)));
     let exp_str = expiration
         .format(&time::format_description::well_known::Rfc3339)
         .unwrap_or_default();