feat: admin permission check (#1783)

Signed-off-by: GatewayJ <835269233@qq.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: houseme <housemecn@gmail.com>

rustfs/src/admin/auth.rs

@@ -52,15 +52,14 @@ pub async fn validate_admin_request(
         remote_addr,
     };
 
-    for action in actions {
-        match check_admin_request_auth(iam_store.clone(), &ctx, action, "", "").await {
-            Ok(_) => return Ok(()),
-            Err(_) => {
-                continue;
-            }
+    for action in &actions {
+        if check_admin_request_auth(iam_store.clone(), &ctx, *action, "", "")
+            .await
+            .is_ok()
+        {
+            return Ok(());
         }
     }
-
     Err(s3_error!(AccessDenied, "Access Denied"))
 }
 
@@ -113,14 +112,13 @@ pub async fn validate_admin_request_with_bucket(
         remote_addr,
     };
 
-    for action in actions {
-        match check_admin_request_auth(iam_store.clone(), &ctx, action, bucket, "").await {
-            Ok(_) => return Ok(()),
-            Err(_) => {
-                continue;
-            }
+    for action in &actions {
+        if check_admin_request_auth(iam_store.clone(), &ctx, *action, bucket, "")
+            .await
+            .is_ok()
+        {
+            return Ok(());
         }
     }
-
     Err(s3_error!(AccessDenied, "Access Denied"))
 }

rustfs/src/admin/handlers/policies.rs

@@ -196,9 +196,8 @@ impl Operation for AddCannedPolicy {
         })?;
 
         if policy.version.is_empty() {
-            return Err(s3_error!(InvalidRequest, "policy version is empty"));
+            return Err(s3_error!(InvalidArgument, "policy version is empty"));
         }
-
         let Ok(iam_store) = rustfs_iam::get() else { return Err(s3_error!(InternalError, "iam not init")) };
 
         iam_store.set_policy(&query.name, policy).await.map_err(|e| {