From ea8dbf49a2dd82b5904dbde5d4b8b111d0c922da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=94=90=E5=B0=8F=E9=B8=AD?= <tangtang1251@qq.com>
Date: Thu, 6 Aug 2026 03:22:28 +0800
Subject: [PATCH] fix(auth): route ListBuckets denial through ApiError to hold
 s3s ratchet (#5755)

fix(auth): route ListBuckets auth denial through ApiError to keep s3s ratchet at baseline

PR #5726 added one s3_error! call in authorize_request while PR #5739 froze
the s3_error! line baseline at 1686 counted before that merge, so a clean
main-derived branch fails the s3s footprint ratchet with +1.

Replace the new macro call with ApiError::access_denied().into(), a small
constructor on the gateway-side error abstraction (rustfs/backlog#1677 F1,
rustfs/backlog#1733) instead of raising the baseline. The converted S3Error
carries the identical AccessDenied code and "Access Denied" message, and the
filtered ListBuckets fallback matches on the code only.
---
 rustfs/src/error.rs          | 10 ++++++++++
 rustfs/src/storage/access.rs |  2 +-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/rustfs/src/error.rs b/rustfs/src/error.rs
index e5a243630..e7826bbac 100644
--- a/rustfs/src/error.rs
+++ b/rustfs/src/error.rs
@@ -33,6 +33,16 @@ impl std::fmt::Display for ApiError {
 impl std::error::Error for ApiError {}
 
 impl ApiError {
+    /// Access-denied error with the exact message emitted by the authorization
+    /// paths in `storage::access`; callers there match on the code only.
+    pub fn access_denied() -> Self {
+        ApiError {
+            code: S3ErrorCode::AccessDenied,
+            message: "Access Denied".to_string(),
+            source: None,
+        }
+    }
+
     pub fn other<E>(error: E) -> Self
     where
         E: std::fmt::Display + Into<Box<dyn std::error::Error + Send + Sync>>,
diff --git a/rustfs/src/storage/access.rs b/rustfs/src/storage/access.rs
index 4b4674869..b86c208e2 100644
--- a/rustfs/src/storage/access.rs
+++ b/rustfs/src/storage/access.rs
@@ -859,7 +859,7 @@ pub async fn authorize_request<T>(req: &mut S3Request<T>, action: Action) -> S3R
         }
 
         if action == Action::S3Action(S3Action::ListAllMyBucketsAction) {
-            return Err(s3_error!(AccessDenied, "Access Denied"));
+            return Err(ApiError::access_denied().into());
         }
 
         let policy_allowed_fallback = PolicySys::try_is_allowed(&BucketPolicyArgs {