From ad6184b1266ef28c44d8201c25319c5b28cff2b2 Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Wed, 24 Jun 2026 22:49:24 +0800 Subject: [PATCH] refactor: centralize iam runtime source helpers (#3828) --- crates/iam/src/lib.rs | 21 +++++++------- crates/iam/src/root_credentials.rs | 4 +-- crates/iam/src/runtime_sources.rs | 29 +++++++++++++++++++ crates/iam/src/server_config.rs | 4 +-- docs/architecture/migration-progress.md | 16 +++++----- scripts/check_architecture_migration_rules.sh | 19 ++++++++++-- 6 files changed, 68 insertions(+), 25 deletions(-) create mode 100644 crates/iam/src/runtime_sources.rs diff --git a/crates/iam/src/lib.rs b/crates/iam/src/lib.rs index cfa581518..3002c3a59 100644 --- a/crates/iam/src/lib.rs +++ b/crates/iam/src/lib.rs @@ -26,9 +26,7 @@ use rustfs_ecstore::api::error::{ classify_system_path_failure_reason as ecstore_classify_system_path_failure_reason, }; use rustfs_ecstore::api::global::is_first_cluster_node_local as ecstore_is_first_cluster_node_local; -use rustfs_ecstore::api::notification::{ - NotificationPeerErr as EcstoreNotificationPeerErr, get_global_notification_sys as ecstore_get_global_notification_sys, -}; +use rustfs_ecstore::api::notification::NotificationPeerErr as EcstoreNotificationPeerErr; use rustfs_ecstore::api::storage::ECStore as EcstoreStore; use std::sync::{Arc, OnceLock}; use store::object::ObjectStore; @@ -48,6 +46,7 @@ pub mod manager; pub mod oidc; pub mod oidc_state; mod root_credentials; +mod runtime_sources; mod server_config; pub mod store; pub mod sys; @@ -114,7 +113,7 @@ impl From for IamNotificationPeerErr { } pub(crate) async fn notify_iam_delete_policy(policy_name: &str) -> Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys .delete_policy(policy_name) .await @@ -126,7 +125,7 @@ pub(crate) async fn notify_iam_delete_policy(policy_name: &str) -> Vec Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys .load_policy(policy_name) .await @@ -138,7 +137,7 @@ pub(crate) async fn notify_iam_load_policy(policy_name: &str) -> Vec Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys .delete_user(access_key) .await @@ -150,7 +149,7 @@ pub(crate) async fn notify_iam_delete_user(access_key: &str) -> Vec Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys .load_user(access_key, temp) .await @@ -162,7 +161,7 @@ pub(crate) async fn notify_iam_load_user(access_key: &str, temp: bool) -> Vec Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys .load_service_account(access_key) .await @@ -174,7 +173,7 @@ pub(crate) async fn notify_iam_load_service_account(access_key: &str) -> Vec Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys .delete_service_account(access_key) .await @@ -186,7 +185,7 @@ pub(crate) async fn notify_iam_delete_service_account(access_key: &str) -> Vec Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys.load_group(group).await.into_iter().map(Into::into).collect(), None => Vec::new(), } @@ -197,7 +196,7 @@ pub(crate) async fn notify_iam_load_policy_mapping( user_type: u64, is_group: bool, ) -> Vec { - match ecstore_get_global_notification_sys() { + match runtime_sources::notification_sys() { Some(notification_sys) => notification_sys .load_policy_mapping(user_or_group, user_type, is_group) .await diff --git a/crates/iam/src/root_credentials.rs b/crates/iam/src/root_credentials.rs index 26c77f40a..bf375c8a4 100644 --- a/crates/iam/src/root_credentials.rs +++ b/crates/iam/src/root_credentials.rs @@ -12,10 +12,10 @@ // See the License for the specific language governing permissions and // limitations under the License. -use rustfs_credentials::{Credentials, get_global_action_cred}; +use rustfs_credentials::Credentials; pub(crate) fn credentials() -> Option { - get_global_action_cred() + crate::runtime_sources::action_credentials() } pub(crate) fn credentials_or_default() -> Credentials { diff --git a/crates/iam/src/runtime_sources.rs b/crates/iam/src/runtime_sources.rs new file mode 100644 index 000000000..630a79233 --- /dev/null +++ b/crates/iam/src/runtime_sources.rs @@ -0,0 +1,29 @@ +// Copyright 2024 RustFS Team +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +use rustfs_config::server_config::{Config as ServerConfig, get_global_server_config}; +use rustfs_credentials::{Credentials, get_global_action_cred}; +use rustfs_ecstore::api::notification::{NotificationSys, get_global_notification_sys}; + +pub(crate) fn action_credentials() -> Option { + get_global_action_cred() +} + +pub(crate) fn current_server_config() -> Option { + get_global_server_config() +} + +pub(crate) fn notification_sys() -> Option<&'static NotificationSys> { + get_global_notification_sys() +} diff --git a/crates/iam/src/server_config.rs b/crates/iam/src/server_config.rs index 4c4210c5b..e2e535e4e 100644 --- a/crates/iam/src/server_config.rs +++ b/crates/iam/src/server_config.rs @@ -12,8 +12,8 @@ // See the License for the specific language governing permissions and // limitations under the License. -use rustfs_config::server_config::{Config as ServerConfig, get_global_server_config}; +use rustfs_config::server_config::Config as ServerConfig; pub(crate) fn current_server_config() -> Option { - get_global_server_config() + crate::runtime_sources::current_server_config() } diff --git a/docs/architecture/migration-progress.md b/docs/architecture/migration-progress.md index 200b671ff..99916a36b 100644 --- a/docs/architecture/migration-progress.md +++ b/docs/architecture/migration-progress.md @@ -5,9 +5,9 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block ## Current Context - Issue: [`rustfs/backlog#660`](https://github.com/rustfs/backlog/issues/660) -- Branch: `overtrue/arch-scanner-runtime-source-resolvers` -- Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200`. -- Based on: stacked on API-199 PR branch while PR #3826 is pending. +- Branch: `overtrue/arch-iam-runtime-source-helpers` +- Baseline: completed `C-011/C-012/C-013/API-055/API-059/API-079/API-080/API-081/API-082/API-083/API-084/API-085/API-086/API-087/API-088/API-089/API-090/API-091/API-092/API-093/API-094/API-095/API-096/API-097/API-098/API-099/API-100/API-101/API-102/API-103/API-104/API-105/API-106/API-107/API-108/API-109/API-110/API-111/API-112/API-113/API-114/API-115/API-116/API-117/API-118/API-119/API-120/API-121/API-122/API-123/API-124/API-125/API-126/API-127/API-128/API-129/API-130/API-131/API-132/API-133/API-134/API-135/API-136/API-137/API-138/API-139/API-140/API-141/API-142/API-143/API-144/API-145/API-146/API-147/API-148/API-149/API-150/API-151/API-152/API-153/API-154/API-155/API-156/API-157/API-158/API-159/API-160/API-161/API-162/API-163/API-164/API-165/API-166/API-167/API-168/API-169/API-170/API-171/API-172/API-173/API-174/API-175/API-176/API-177/API-178/API-179/API-180/API-181/API-182/API-183/API-184/API-185/API-186/API-187/API-188/API-189/API-190/API-191/API-192/API-193/API-194/API-195/API-196/API-197/API-198/API-199/API-200/API-201`. +- Based on: latest main after PR #3827. - PR type for this branch: `consumer-migration` - Runtime behavior changes: none. - Rust code changes: route replication pool, outbound TLS generation, runtime @@ -39,7 +39,8 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block runtime-source helpers, scanner lifecycle/tier runtime source reads, and the stale RustFS tier-config and expiry-state test compat shims, plus scanner runtime config, erasure-mode, lifecycle queue, and tier runtime source helper - names, + names, plus IAM root-credential, server-config, and notification runtime + source helpers, through AppContext-first or owner-crate resolver boundaries. - CI/script changes: lock completed owner and test/fuzz boundaries against bare/glob imports, scattered raw ECStore facade subpaths, and startup @@ -47,9 +48,10 @@ Status values: `[ ]` not started, `[~]` in progress, `[x]` complete, `[!]` block regressions, plus external runtime, test, fuzz, and storage-owner module ECStore compatibility bypasses, plus runtime crate, owner crate, test/fuzz, and storage owner thin bridge regressions, plus app context and notify - event-bridge thin module regressions; accept the reviewed AppContext resolver - reverse dependencies in the layer baseline. -- Docs changes: record the API-136 through API-200 owner facade and lifecycle + event-bridge thin module regressions, plus IAM runtime-source bypasses; + accept the reviewed AppContext resolver reverse dependencies in the layer + baseline. +- Docs changes: record the API-136 through API-201 owner facade and lifecycle runtime-source cleanup. ## Phase 0 Tasks diff --git a/scripts/check_architecture_migration_rules.sh b/scripts/check_architecture_migration_rules.sh index c54e857ad..694eb639f 100755 --- a/scripts/check_architecture_migration_rules.sh +++ b/scripts/check_architecture_migration_rules.sh @@ -151,6 +151,7 @@ ECSTORE_COMPAT_PASSTHROUGH_EXPECTED_FILE="${TMP_DIR}/ecstore_compat_passthrough_ ECSTORE_COMPAT_PASSTHROUGH_ACTUAL_FILE="${TMP_DIR}/ecstore_compat_passthrough_actual.txt" ECSTORE_COMPAT_PASSTHROUGH_DIFF_FILE="${TMP_DIR}/ecstore_compat_passthrough_diff.txt" RUSTFS_WORKLOAD_DIRECT_FOREGROUND_MAPPING_HITS_FILE="${TMP_DIR}/rustfs_workload_direct_foreground_mapping_hits.txt" +IAM_RUNTIME_SOURCE_BYPASS_HITS_FILE="${TMP_DIR}/iam_runtime_source_bypass_hits.txt" awk ' /^## PR Types$/ { @@ -737,7 +738,7 @@ fi --glob '!**/ecstore_test_compat/**' \ --glob '!**/ecstore_fuzz_compat.rs' \ --glob '!target/**' \ - | rg -v '^(rustfs/src/(admin/mod|app/mod|storage/mod)\.rs|crates/e2e_test/src/(replication_extension_test|reliant/(grpc_lock_client|node_interact_test))\.rs|crates/heal/src/heal/mod\.rs|crates/heal/tests/(endpoint_index_test|heal_bug_fixes_test|heal_integration_test)\.rs|crates/iam/src/lib\.rs|crates/notify/src/lib\.rs|crates/obs/src/metrics/mod\.rs|crates/protocols/src/swift/mod\.rs|crates/s3select-api/src/lib\.rs|crates/scanner/src/lib\.rs|crates/scanner/tests/lifecycle_integration_test\.rs|fuzz/fuzz_targets/(bucket_validation|path_containment)\.rs):' || true + | rg -v '^(rustfs/src/(admin/mod|app/mod|storage/mod)\.rs|crates/e2e_test/src/(replication_extension_test|reliant/(grpc_lock_client|node_interact_test))\.rs|crates/heal/src/heal/mod\.rs|crates/heal/tests/(endpoint_index_test|heal_bug_fixes_test|heal_integration_test)\.rs|crates/iam/src/(lib|runtime_sources)\.rs|crates/notify/src/lib\.rs|crates/obs/src/metrics/mod\.rs|crates/protocols/src/swift/mod\.rs|crates/s3select-api/src/lib\.rs|crates/scanner/src/lib\.rs|crates/scanner/tests/lifecycle_integration_test\.rs|fuzz/fuzz_targets/(bucket_validation|path_containment)\.rs):' || true ) | cat >"$DIRECT_ECSTORE_IMPORT_HITS_FILE" @@ -1086,7 +1087,7 @@ fi --glob '!**/ecstore_compat.rs' \ --glob '!**/ecstore_test_compat.rs' \ --glob '!**/ecstore_test_compat/**' | - rg -v '^(fuzz/fuzz_targets/bucket_validation\.rs|fuzz/fuzz_targets/path_containment\.rs|crates/e2e_test/src/reliant/grpc_lock_client\.rs|crates/e2e_test/src/reliant/node_interact_test\.rs|crates/e2e_test/src/replication_extension_test\.rs|crates/heal/src/heal/mod\.rs|crates/heal/tests/endpoint_index_test\.rs|crates/heal/tests/heal_bug_fixes_test\.rs|crates/heal/tests/heal_integration_test\.rs|crates/iam/src/lib\.rs|crates/notify/src/lib\.rs|crates/obs/src/metrics/mod\.rs|crates/protocols/src/swift/mod\.rs|crates/s3select-api/src/lib\.rs|crates/scanner/src/lib\.rs|crates/scanner/tests/lifecycle_integration_test\.rs|rustfs/src/admin/mod\.rs|rustfs/src/app/mod\.rs|rustfs/src/storage/mod\.rs):' || true + rg -v '^(fuzz/fuzz_targets/bucket_validation\.rs|fuzz/fuzz_targets/path_containment\.rs|crates/e2e_test/src/reliant/grpc_lock_client\.rs|crates/e2e_test/src/reliant/node_interact_test\.rs|crates/e2e_test/src/replication_extension_test\.rs|crates/heal/src/heal/mod\.rs|crates/heal/tests/endpoint_index_test\.rs|crates/heal/tests/heal_bug_fixes_test\.rs|crates/heal/tests/heal_integration_test\.rs|crates/iam/src/(lib|runtime_sources)\.rs|crates/notify/src/lib\.rs|crates/obs/src/metrics/mod\.rs|crates/protocols/src/swift/mod\.rs|crates/s3select-api/src/lib\.rs|crates/scanner/src/lib\.rs|crates/scanner/tests/lifecycle_integration_test\.rs|rustfs/src/admin/mod\.rs|rustfs/src/app/mod\.rs|rustfs/src/storage/mod\.rs):' || true ) >"$ALL_ECSTORE_API_RAW_SUBPATH_HITS_FILE" if [[ -s "$ALL_ECSTORE_API_RAW_SUBPATH_HITS_FILE" ]]; then @@ -1286,13 +1287,25 @@ fi crates/scanner/src \ --glob '*.rs' \ --glob '!**/ecstore_compat.rs' | - rg -v '^(crates/heal/src/heal/mod.rs|crates/iam/src/lib.rs|crates/notify/src/lib.rs|crates/obs/src/metrics/mod.rs|crates/protocols/src/swift/mod.rs|crates/s3select-api/src/lib.rs|crates/scanner/src/lib.rs):' || true + rg -v '^(crates/heal/src/heal/mod.rs|crates/iam/src/(lib|runtime_sources).rs|crates/notify/src/lib.rs|crates/obs/src/metrics/mod.rs|crates/protocols/src/swift/mod.rs|crates/s3select-api/src/lib.rs|crates/scanner/src/lib.rs):' || true ) >"$EXTERNAL_RUNTIME_ECSTORE_COMPAT_BYPASS_HITS_FILE" if [[ -s "$EXTERNAL_RUNTIME_ECSTORE_COMPAT_BYPASS_HITS_FILE" ]]; then report_failure "external runtime crates must source ECStore API symbols through their owner root or ecstore_compat boundary: $(paste -sd '; ' "$EXTERNAL_RUNTIME_ECSTORE_COMPAT_BYPASS_HITS_FILE")" fi +( + cd "$ROOT_DIR" + rg -n --with-filename 'get_global_(?:action_cred|server_config|notification_sys)' \ + crates/iam/src \ + --glob '*.rs' | + rg -v '^crates/iam/src/runtime_sources\.rs:' || true +) >"$IAM_RUNTIME_SOURCE_BYPASS_HITS_FILE" + +if [[ -s "$IAM_RUNTIME_SOURCE_BYPASS_HITS_FILE" ]]; then + report_failure "IAM runtime-source globals must stay behind crates/iam/src/runtime_sources.rs: $(paste -sd '; ' "$IAM_RUNTIME_SOURCE_BYPASS_HITS_FILE")" +fi + ( cd "$ROOT_DIR" rg -n --with-filename 'rustfs_ecstore::api::' \