From 7ab1abee808afb0024f379c2167f2634be4b70dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=94=90=E5=B0=8F=E9=B8=AD?= Date: Fri, 10 Jul 2026 02:09:42 +0800 Subject: [PATCH] fix(admin): allow site replication peer edits (#4623) * fix(site-replication): align IAM and bucket metadata replication * fix(admin): allow site replication peer edits --- rustfs/src/admin/handlers/site_replication.rs | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/rustfs/src/admin/handlers/site_replication.rs b/rustfs/src/admin/handlers/site_replication.rs index 0dc9f07d2..ce05978ac 100644 --- a/rustfs/src/admin/handlers/site_replication.rs +++ b/rustfs/src/admin/handlers/site_replication.rs @@ -5392,7 +5392,7 @@ pub struct SRPeerEditHandler {} #[async_trait::async_trait] impl Operation for SRPeerEditHandler { async fn call(&self, req: S3Request, _params: Params<'_, '_>) -> S3Result> { - validate_site_replication_admin_request(&req, AdminAction::SiteReplicationAddAction).await?; + validate_site_replication_admin_request(&req, AdminAction::SiteReplicationOperationAction).await?; let ilm_expiry_override = sr_edit_ilm_expiry_override(&req.uri); let _state_guard = SITE_REPLICATION_STATE_LOCK.lock().await; let state = load_site_replication_state().await?; @@ -5829,6 +5829,27 @@ mod tests { assert!(!policy.is_allowed(&put_policy_args).await); } + #[test] + fn test_sr_peer_edit_handler_uses_site_replication_operation_action() { + let src = include_str!("site_replication.rs"); + let handler_block = src + .split("impl Operation for SRPeerEditHandler") + .nth(1) + .and_then(|rest| rest.split("pub struct SRPeerRemoveHandler").next()) + .expect("SRPeerEditHandler block should exist"); + + assert!( + handler_block + .contains("validate_site_replication_admin_request(&req, AdminAction::SiteReplicationOperationAction).await?;"), + "SRPeerEditHandler should authorize internal peer edits with SiteReplicationOperationAction" + ); + assert!( + !handler_block + .contains("validate_site_replication_admin_request(&req, AdminAction::SiteReplicationAddAction).await?;"), + "SRPeerEditHandler must not require SiteReplicationAddAction for internal peer edits" + ); + } + #[test] fn test_bucket_versioning_xml_enables_versioning() { let data = bucket_versioning_xml().expect("versioning XML should serialize");