diff --git a/rustfs/src/admin/handlers/ilm_transition.rs b/rustfs/src/admin/handlers/ilm_transition.rs index d490914cf..de5c28693 100644 --- a/rustfs/src/admin/handlers/ilm_transition.rs +++ b/rustfs/src/admin/handlers/ilm_transition.rs @@ -483,7 +483,7 @@ async fn authorize_transition_admin_request(req: &S3Request, action: Admin async fn authorize_recovery_admin_request(req: &S3Request, action: AdminAction) -> S3Result { if req.credentials.is_none() { - return Err(s3_error!(InvalidRequest, "authentication required")); + return Err(admin_s3_error(AdminS3ErrorCode::InvalidRequest, "authentication required")); } let credentials = authorize_admin_request(req, vec![Action::AdminAction(action)]).await?; Ok(recovery_actor_sha256(&credentials)) @@ -2481,6 +2481,19 @@ mod tests { assert_eq!(err.message(), Some("authentication required")); } + #[tokio::test] + async fn recovery_admin_gate_keeps_its_missing_credentials_response() { + let err = authorize_recovery_admin_request( + &manual_transition_job_request(Method::GET, "/rustfs/admin/v3/ilm/recovery/controls/control-123"), + AdminAction::ListTierAction, + ) + .await + .expect_err("a recovery admin request without credentials must fail"); + + assert_eq!(err.code(), &S3ErrorCode::InvalidRequest); + assert_eq!(err.message(), Some("authentication required")); + } + #[test] fn transition_admin_gate_routes_through_the_shared_gate() { let production = include_str!("ilm_transition.rs")