feat(admin): implement handler for delete group (#1901)

Signed-off-by: Niraj Yadav <niryadav@redhat.com> Signed-off-by: heihutu <30542132+heihutu@users.noreply.github.com> Co-authored-by: heihutu <30542132+heihutu@users.noreply.github.com> Co-authored-by: yxrxy <yxrxytrigger@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Co-authored-by: 安正超 <anzhengchao@gmail.com>
2026-08-08 22:33:22 +00:00 · 2026-02-24 10:30:46 +05:30
parent f9da807bdf
commit 8f00d1fbb0
4 changed files with 170 additions and 0 deletions
@@ -51,6 +51,12 @@ pub fn register_group_management_route(r: &mut S3Router<AdminOperation>) -> std:
        AdminOperation(&GetGroup {}),
    )?;

+    r.insert(
+        Method::DELETE,
+        format!("{}{}", ADMIN_PREFIX, "/v3/group/{group}").as_str(),
+        AdminOperation(&DeleteGroup {}),
+    )?;
+
    r.insert(
        Method::PUT,
        format!("{}{}", ADMIN_PREFIX, "/v3/set-group-status").as_str(),
@@ -159,6 +165,89 @@ impl Operation for GetGroup {
    }
 }

+/// Deletes an empty user group.
+///
+/// # Arguments
+/// * `group` - The name of the group to delete
+///
+/// # Returns
+/// - `200 OK` - Group deleted successfully
+/// - `400 Bad Request` - Group name missing or invalid
+/// - `401 Unauthorized` - Insufficient permissions
+/// - `404 Not Found` - Group does not exist
+/// - `409 Conflict` - Group contains members and cannot be deleted
+/// - `500 Internal Server Error` - Server-side error
+///
+/// # Example
+/// ```
+/// DELETE /rustfs/admin/v3/group/developers
+/// ```
+pub struct DeleteGroup {}
+#[async_trait::async_trait]
+impl Operation for DeleteGroup {
+    async fn call(&self, req: S3Request<Body>, params: Params<'_, '_>) -> S3Result<S3Response<(StatusCode, Body)>> {
+        warn!("handle DeleteGroup");
+
+        let Some(input_cred) = req.credentials else {
+            return Err(s3_error!(InvalidRequest, "get cred failed"));
+        };
+
+        let (cred, owner) =
+            check_key_valid(get_session_token(&req.uri, &req.headers).unwrap_or_default(), &input_cred.access_key).await?;
+
+        validate_admin_request(
+            &req.headers,
+            &cred,
+            owner,
+            false,
+            vec![Action::AdminAction(AdminAction::RemoveUserFromGroupAdminAction)],
+            req.extensions.get::<Option<RemoteAddr>>().and_then(|opt| opt.map(|a| a.0)),
+        )
+        .await?;
+
+        let group = params
+            .get("group")
+            .ok_or_else(|| s3_error!(InvalidArgument, "missing group name in request"))?
+            .trim();
+
+        // Validate the group name format
+        if group.is_empty() || group.len() > 256 {
+            return Err(s3_error!(InvalidArgument, "invalid group name"));
+        }
+
+        // Sanity check the group name
+        if group.contains(['/', '\\', '\0']) {
+            return Err(s3_error!(InvalidArgument, "group name contains invalid characters"));
+        }
+
+        let Ok(iam_store) = rustfs_iam::get() else { return Err(s3_error!(InternalError, "iam not init")) };
+
+        iam_store.remove_users_from_group(group, vec![]).await.map_err(|e| {
+            warn!("delete group failed, e: {:?}", e);
+            match e {
+                rustfs_iam::error::Error::GroupNotEmpty => {
+                    s3_error!(InvalidRequest, "group is not empty")
+                }
+                rustfs_iam::error::Error::InvalidArgument => {
+                    s3_error!(InvalidArgument, "{e}")
+                }
+                _ => {
+                    if is_err_no_such_group(&e) {
+                        s3_error!(NoSuchKey, "group '{group}' does not exist")
+                    } else {
+                        s3_error!(InternalError, "{e}")
+                    }
+                }
+            }
+        })?;
+
+        let mut header = HeaderMap::new();
+        header.insert(CONTENT_TYPE, "application/json".parse().unwrap());
+        header.insert(CONTENT_LENGTH, "0".parse().unwrap());
+        Ok(S3Response::with_headers((StatusCode::OK, Body::empty()), header))
+    }
+}
+
 pub struct SetGroupStatus {}
 #[async_trait::async_trait]
 impl Operation for SetGroupStatus {
@@ -64,6 +64,7 @@ fn test_register_routes_cover_representative_admin_paths() {
    assert_route(&router, Method::PUT, &admin_path("/v3/add-user"));
    assert_route(&router, Method::PUT, &admin_path("/v3/set-user-status"));
    assert_route(&router, Method::GET, &admin_path("/v3/groups"));
+    assert_route(&router, Method::DELETE, &admin_path("/v3/group/test-group"));
    assert_route(&router, Method::PUT, &admin_path("/v3/update-group-members"));
    assert_route(&router, Method::PUT, &admin_path("/v3/add-service-accounts"));
    assert_route(&router, Method::GET, &admin_path("/v3/export-iam"));