gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-27 15:37:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(runtime): remove high-impact unwrap paths (#3755)

Browse Source 
* fix(runtime): remove high-impact unwrap paths

* fix(runtime): propagate managed SSE metadata errors

* fix(runtime): add typed OPA config errors

* fix(runtime): harden config and credential helpers

* fix(runtime): remove SSE hmac unwraps

* fix(runtime): complete SSE helper error propagation

* fix(trusted-proxies): avoid legacy global init panics

* test(credentials): allow deprecated rpc token check

* fix(storage): harden object lock retention parsing

* chore(checks): refresh layer dependency baseline

* chore(checks): refresh layer dependency baseline

* Update layer-dependency-baseline.txt

Signed-off-by: houseme <housemecn@gmail.com>

* test(context): avoid clone on copy boot time

---------

Signed-off-by: houseme <housemecn@gmail.com>
Co-authored-by: Zhengchao An <anzhengchao@gmail.com>
Co-authored-by: heihutu <heihutu@gmail.com>
This commit is contained in:
houseme
2026-06-23 15:12:47 +08:00
committed by GitHub
parent 825c01060c
commit e42c6df0e8
10 changed files with 240 additions and 135 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/policy/src/policy/opa.rs
+57 -18
View File
@@ -36,7 +36,25 @@ pub struct AuthZPlugin {
args: Args,
}
fn check() -> Result<(), String> {
#[derive(Debug, thiserror::Error)]
pub enum OpaConfigError {
#[error("Missing required env var: {0}")]
MissingRequiredEnv(&'static str),
#[error("Invalid env vars: {0:?}")]
InvalidEnvVars(HashMap<String, String>),
#[error("Error getting env var {name}: {source:?}")]
EnvRead {
name: &'static str,
#[source]
source: env::VarError,
},
#[error("OPA returned an error: {0}")]
InvalidStatus(reqwest::StatusCode),
#[error("Error connecting to OPA: {0}")]
Connection(reqwest::Error),
}
fn check() -> Result<(), OpaConfigError> {
let env_list = env::vars();
let mut candidate = HashMap::new();
let prefix = format!("{ENV_PREFIX}{POLICY_PLUGIN_SUB_SYS}").to_uppercase();
@@ -48,17 +66,17 @@ fn check() -> Result<(), String> {
//check required env vars
if candidate.remove(ENV_POLICY_PLUGIN_OPA_URL).is_none() {
return Err(format!("Missing required env var: {ENV_POLICY_PLUGIN_OPA_URL}"));
return Err(OpaConfigError::MissingRequiredEnv(ENV_POLICY_PLUGIN_OPA_URL));
}
// check optional env vars
candidate.remove(ENV_POLICY_PLUGIN_AUTH_TOKEN);
if !candidate.is_empty() {
return Err(format!("Invalid env vars: {candidate:?}"));
return Err(OpaConfigError::InvalidEnvVars(candidate));
}
Ok(())
}
async fn validate(config: &Args) -> Result<(), String> {
async fn validate(config: &Args) -> Result<(), OpaConfigError> {
let client = reqwest::Client::new();
match client.post(&config.url).send().await {
@@ -68,31 +86,34 @@ async fn validate(config: &Args) -> Result<(), String> {
info!("OPA is ready to accept requests.");
}
_ => {
return Err(format!("OPA returned an error: {}", resp.status()));
return Err(OpaConfigError::InvalidStatus(resp.status()));
}
};
}
Err(err) => {
return Err(format!("Error connecting to OPA: {err}"));
return Err(OpaConfigError::Connection(err));
}
};
Ok(())
}
pub async fn lookup_config() -> Result<Args, String> {
pub async fn lookup_config() -> Result<Args, OpaConfigError> {
let args = Args::default();
let get_cfg =
|cfg: &str| -> Result<String, String> { env::var(cfg).map_err(|e| format!("Error getting env var {cfg}: {e:?}")) };
let get_cfg = |cfg: &'static str| -> Result<String, OpaConfigError> {
env::var(cfg).map_err(|source| OpaConfigError::EnvRead { name: cfg, source })
};
let url = get_cfg(ENV_POLICY_PLUGIN_OPA_URL);
if url.is_err() {
info!("OPA is not enabled.");
return Ok(args);
}
let url = match get_cfg(ENV_POLICY_PLUGIN_OPA_URL) {
Ok(url) => url,
Err(_) => {
info!("OPA is not enabled.");
return Ok(args);
}
};
check()?;
let args = Args {
url: url.ok().unwrap(),
url,
auth_token: get_cfg(ENV_POLICY_PLUGIN_AUTH_TOKEN).unwrap_or_default(),
};
validate(&args).await?;
@@ -111,7 +132,10 @@ impl AuthZPlugin {
.http2_keep_alive_interval(Some(Duration::from_secs(30)))
.http2_keep_alive_timeout(Duration::from_secs(15))
.build()
.unwrap();
.unwrap_or_else(|err| {
error!("failed to build OPA HTTP client, falling back to default reqwest client: {err}");
reqwest::Client::new()
});
Self { client, args: config }
}
@@ -235,7 +259,7 @@ mod tests {
temp_env::with_var("RUSTFS_POLICY_PLUGIN_AUTH_TOKEN", Some("test-token"), || {
let result = check();
assert!(result.is_err());
assert!(result.unwrap_err().contains("Missing required env var"));
assert!(matches!(result.unwrap_err(), OpaConfigError::MissingRequiredEnv(_)));
});
});
}
@@ -250,7 +274,7 @@ mod tests {
|| {
let result = check();
assert!(result.is_err());
assert!(result.unwrap_err().contains("Invalid env vars"));
assert!(matches!(result.unwrap_err(), OpaConfigError::InvalidEnvVars(_)));
},
);
}
@@ -270,6 +294,21 @@ mod tests {
});
}
#[test]
fn test_lookup_config_uses_env_url_without_unwrap_path() {
temp_env::with_vars(
[
("RUSTFS_POLICY_PLUGIN_URL", Some("http://localhost:8181")),
("RUSTFS_POLICY_PLUGIN_AUTH_TOKEN", Some("token")),
],
|| {
let rt = tokio::runtime::Runtime::new().unwrap();
let result = rt.block_on(async { lookup_config().await });
assert!(result.is_err(), "lookup should fail validation without panicking when OPA is unreachable");
},
);
}
#[test]
fn test_args_enable() {
// Test Args enable method