fix(s3): allow anonymous access when PublicAccessBlock config is miss… (#2039)

Co-authored-by: GatewayJ <8352692332qq.com>
2026-08-08 06:13:14 +00:00 · 2026-03-02 11:37:00 +08:00
parent 273dbc9c38
commit ba32fd9d96
3 changed files with 177 additions and 1 deletions
@@ -473,13 +473,13 @@ pub async fn authorize_request<T>(req: &mut S3Request<T>, action: Action) -> S3R

            if policy_allowed {
                // RestrictPublicBuckets: when true, deny public access even if bucket policy allows it.
-                // Fail closed: if we cannot read the config, do not allow public access.
                match metadata_sys::get_public_access_block_config(bucket_name).await {
                    Ok((config, _)) => {
                        if config.restrict_public_buckets.unwrap_or(false) {
                            return Err(s3_error!(AccessDenied, "Access Denied"));
                        }
                    }
+                    Err(StorageError::ConfigNotFound) => {}
                    Err(_) => {
                        return Err(s3_error!(AccessDenied, "Access Denied"));
                    }