gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-16 18:08:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(authz): preserve direct delete usecase callers (#5614)

Browse Source 
* fix(authz): preserve direct delete usecase callers

* test(ilm): provide owner context for forced deletes
This commit is contained in:
cxymds
2026-08-02 17:01:32 +08:00
committed by GitHub
parent 93b38b3fbd
commit 7463655ae1
2 changed files with 34 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rustfs/src/app/object_usecase.rs
+20 -2
View File
@@ -6615,7 +6615,8 @@ impl DefaultObjectUsecase {
));
}
if !recursive_force_delete_is_authorized(&req.headers, req_info_ref(&req)?.is_owner, false) {
let is_owner = req_info_ref(&req).map(|info| info.is_owner).unwrap_or(false);
if !recursive_force_delete_is_authorized(&req.headers, is_owner, false) {
return Err(S3Error::with_message(
S3ErrorCode::AccessDenied,
"Recursive force-delete is restricted to administrative requests",
@@ -7081,7 +7082,7 @@ impl DefaultObjectUsecase {
authorize_request(&mut req, Action::S3Action(S3Action::ReplicateDeleteAction)).await?;
}
let is_owner = req_info_ref(&req)?.is_owner;
let is_owner = req_info_ref(&req).map(|info| info.is_owner).unwrap_or(false);
if !recursive_force_delete_is_authorized(&req.headers, is_owner, replica) {
return Err(S3Error::with_message(
S3ErrorCode::AccessDenied,
@@ -13386,6 +13387,23 @@ mod tests {
let err = usecase.execute_delete_objects(req).await.unwrap_err();
assert_eq!(err.code(), &S3ErrorCode::InternalError);
assert_eq!(err.message(), Some("Not init"));
}
#[tokio::test]
async fn execute_delete_object_allows_non_force_request_without_req_info_until_store_lookup() {
let input = DeleteObjectInput::builder()
.bucket("test-bucket".to_string())
.key("test-key".to_string())
.build()
.unwrap();
let err = DefaultObjectUsecase::without_context()
.execute_delete_object(build_request(input, Method::DELETE))
.await
.expect_err("an uninitialized store should be reported after non-force admission");
assert_eq!(err.code(), &S3ErrorCode::InternalError);
assert_eq!(err.message(), Some("Not init"));
}
#[test]