feat(kms): wire OperationContext into an audit event contract (#5534)

crates/notify/src/rules/mod.rs

@@ -22,6 +22,8 @@ mod pattern_rules_test;
 #[cfg(test)]
 mod pattern_test;
 mod rules_map;
+#[cfg(test)]
+mod rules_map_test;
 mod subscriber_index;
 mod subscriber_snapshot;
 mod target_id_set;

crates/notify/src/rules/rules_map_test.rs

@@ -0,0 +1,104 @@
+// Copyright 2024 RustFS Team
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Regressions for rule matching against the KMS event namespace.
+//!
+//! KMS events (backlog#1583) are appended to `EventName` for the audit sink,
+//! but they must stay invisible to bucket notification rules: a subscriber
+//! asking for `s3:ObjectCreated:*` — or for everything — must never receive
+//! key management activity.
+
+use super::RulesMap;
+use rustfs_s3_types::EventName;
+use rustfs_targets::arn::TargetID;
+
+const KMS_EVENTS: &[EventName] = &[
+    EventName::KmsKeyCreated,
+    EventName::KmsKeyRotated,
+    EventName::KmsKeyEnabled,
+    EventName::KmsKeyDisabled,
+    EventName::KmsKeyDeletionScheduled,
+    EventName::KmsKeyDeletionCancelled,
+    EventName::KmsKeyDeleted,
+    EventName::KmsKeyAccessed,
+];
+
+fn test_target() -> TargetID {
+    TargetID::new("primary".to_string(), "webhook".to_string())
+}
+
+fn rules_for(events: &[EventName]) -> RulesMap {
+    let mut rules = RulesMap::new();
+    rules.add_rule_config(events, String::new(), test_target());
+    rules
+}
+
+#[test]
+fn s3_wildcard_subscriptions_do_not_match_kms_events() {
+    let rules = rules_for(&[
+        EventName::ObjectCreatedAll,
+        EventName::ObjectAccessedAll,
+        EventName::ObjectRemovedAll,
+        EventName::ObjectTaggingAll,
+        EventName::ObjectReplicationAll,
+        EventName::ObjectRestoreAll,
+        EventName::ObjectTransitionAll,
+        EventName::LifecycleExpirationAll,
+        EventName::ObjectScannerAll,
+    ]);
+
+    for event in KMS_EVENTS {
+        assert!(!rules.has_subscriber(event), "{event} must not have an S3 wildcard subscriber");
+        assert!(
+            rules.match_rules(*event, "any/object").is_empty(),
+            "{event} must not match any S3 wildcard rule"
+        );
+    }
+}
+
+#[test]
+fn everything_subscription_does_not_match_kms_events() {
+    let rules = rules_for(&[EventName::Everything]);
+
+    // Sanity: the catch-all really is subscribed to the S3 surface.
+    assert!(rules.has_subscriber(&EventName::ObjectCreatedPut));
+
+    for event in KMS_EVENTS {
+        assert!(!rules.has_subscriber(event), "{event} must stay outside the s3 catch-all");
+        assert!(
+            rules.match_rules(*event, "any/object").is_empty(),
+            "{event} must not match the s3 catch-all rule"
+        );
+    }
+}
+
+#[test]
+fn kms_subscription_does_not_leak_into_s3_matching() {
+    // The inverse direction: even an explicit KMS subscription must not widen
+    // the mask so that S3 events start matching a KMS-only rule.
+    let rules = rules_for(KMS_EVENTS);
+
+    for event in [
+        EventName::ObjectCreatedPut,
+        EventName::ObjectRemovedDelete,
+        EventName::ObjectAccessedGet,
+        EventName::BucketCreated,
+    ] {
+        assert!(!rules.has_subscriber(&event), "{event} must not match a KMS-only rule");
+        assert!(
+            rules.match_rules(event, "any/object").is_empty(),
+            "{event} must not match a KMS-only rule"
+        );
+    }
+}