gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-06 05:17:42 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,943 Commits 31 Branches 119 Tags
953a080b373bc14c48b4eb3061095105c193779a
Commit Graph

42 Commits

Author SHA1 Message Date
Zhengchao An 70a2441407 refactor: route notify dispatch through app context (#3789) 
* refactor: route notify dispatch through app context

* refactor: route admin IAM globals through app context (#3791)

* refactor: centralize IAM root credential access (#3792)
 2026-06-23 20:05:28 +08:00
Zhengchao An d3796d6c10 refactor: remove external owner compat bridges (#3741) 2026-06-22 18:28:35 +08:00
安正超 cca9e83a8b refactor: use relative standalone compat consumers (#3734) 2026-06-22 15:07:58 +08:00
houseme cc6909b08b fix(iam): verify sts temp-user persistence (#3722) 2026-06-22 13:54:57 +08:00
安正超 b14e49e84e refactor: narrow IAM and Swift compatibility surfaces (#3587) 
* refactor: narrow IAM and Swift compatibility surfaces

* refactor: narrow heal and scanner compatibility surfaces (#3588)

* refactor: narrow RustFS runtime compatibility surfaces (#3591)
 2026-06-19 03:06:57 +08:00
安正超 c098184c49 refactor: clean runtime and test storage boundaries (#3573) 
* refactor: clean runtime observability select boundaries

* refactor: clean test harness fuzz storage boundaries
 2026-06-18 18:09:25 +08:00
cxymds d094d91925 fix(site-replication): harden service account sync (#3500) 2026-06-16 21:20:13 +08:00
Alexander Kharkevich 528c3278b7 fix(iam): allow colons and dots in STS claim policy names (#3164) 
`is_safe_claim_policy_name` rejected any character other than
`[a-zA-Z0-9_-]`, silently dropping policy names containing colons.
This breaks Kubernetes workload identity where `claim_name=sub`
resolves to `system:serviceaccount:<namespace>:<sa-name>` — a valid
policy name that can be created via the admin API but is then
unreachable during STS session authorization.

Add `:` and `.` to the allowed character set. These characters are:
- Used in K8s service account `sub` claims (colons)
- Used in Java/DNS-style group names from OIDC providers (dots)
- Already accepted by the `add-canned-policy` admin API endpoint

Require at least one alphanumeric character to prevent meaningless
names (`.`, `..`, `-`, `_`, `:`, etc.) from resolving.

Still rejected: `/`, `\`, whitespace, `$`, `;`, `{`, `}` and other
chars that could enable path traversal or injection.

Signed-off-by: Alexander Kharkevich <alex@mara.com>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
Co-authored-by: loverustfs <hello@rustfs.com>
Co-authored-by: GatewayJ <835269233@qq.com>
 2026-06-04 03:39:50 +00:00
GatewayJ c257043b63 fix(iam): serialize IAM cache writes (#3105) 
* fix(iam): serialize IAM cache writes

* fix(iam): timestamp rebuilt group memberships

* fix(iam): publish cache updates atomically

* fix(iam): reuse policy cache snapshots

* fix(iam): commit missing user notification cache updates atomically

* fix(iam): remove unused cache membership rebuild wrapper

---------

Co-authored-by: 季宏伟 <jihongwei@jihongweis-MacBook-Pro.local>
Co-authored-by: houseme <housemecn@gmail.com>
 2026-05-29 08:02:42 +00:00
安正超 8a501846f4 test(iam): cover mixed STS claim policy names (#2932) 2026-05-12 10:39:53 +00:00
GatewayJ b2ba2e5bb3 iam: handle sts claim policy names (#2902) 
Co-authored-by: cxymds <Cxymds@qq.com>
 2026-05-12 07:10:42 +00:00
Henry Guo 03045ff2e6 fix(iam): keep error state on initial load failure (#2846) 
Signed-off-by: houseme <housemecn@gmail.com>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: loverustfs <hello@rustfs.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
 2026-05-08 08:26:01 +00:00
weisd a995ec0315 fix(iam): preserve portable IAM storage and derived auth (#2713) 2026-04-28 05:57:10 +00:00
GatewayJ cfbd094bc4 fix(iam): propagate cache miss load failures (#2692) 
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: loverustfs <hello@rustfs.com>
Co-authored-by: houseme <housemecn@gmail.com>
 2026-04-27 09:21:22 +00:00
houseme 59f41eb86a feat(obs): improve metrics coverage and dashboard performance (#2682) 2026-04-25 18:51:29 +00:00
GatewayJ f255b8a9f1 fix(admin): align accountinfo policy with IAM prepare_auth for OIDC console (#2568) 
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: houseme <housemecn@gmail.com>
 2026-04-17 05:38:18 +00:00
Tunglies 49366ee200 chore(lint): clippy rules redundant_clone (#2554) 2026-04-15 13:54:07 +00:00
GatewayJ 8db55de72c fix(iam): return policy JSON object from info_policy (#2395) (#2436) 
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
 2026-04-09 21:45:22 +08:00
weisd 898857d1c9 fix(iam): keep service account JWT expiry consistent (#2410) 2026-04-07 11:00:07 +08:00
Alexander Kharkevich 740e4399af fix: skip missing groups in policy_db_get instead of aborting (#2393) 
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
 2026-04-07 09:17:39 +08:00
GatewayJ 3366bd2464 feat(iam,admin): prepared IAM auth, ExistingObjectTag, admin permission checks (#2315) 
Signed-off-by: GatewayJ <835269233@qq.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: GatewayJ <8352692332qq.com>
 2026-03-29 19:18:16 +08:00
GatewayJ 19d3a23a13 fix(admin): console self password for STS sessions (#1923) (#2250) 
Co-authored-by: GatewayJ <8352692332qq.com>
 2026-03-21 22:10:38 +08:00
weisd b9b7d86ae4 feat: improve legacy metadata and admin compatibility (#2202) 2026-03-18 21:05:09 +08:00
安正超 9d03029959 fix(iam): sync user cache on load-user notifications (#2104) 2026-03-09 09:36:02 +08:00
安正超 40692f18ed fix(iam): address PR 1875 review issues for OIDC STS flows (#1969) 2026-02-26 14:38:57 +08:00
Jeff Poegel c35ef84a8c feat(iam): add OpenID Connect SSO with claim-based policy resolution (#1875) 
Signed-off-by: houseme <housemecn@gmail.com>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: heihutu <30542132+heihutu@users.noreply.github.com>
Co-authored-by: loverustfs <hello@rustfs.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
 2026-02-26 14:03:17 +08:00
GatewayJ fb0267981d fix(iam): STS parent groups fallback and session policy debug for #1423 (#1804) 
Co-authored-by: 安正超 <anzhengchao@gmail.com>
 2026-02-14 11:40:36 +08:00
Tyooughtul 1184806c3f Fix/resolve pr 1710 (#1743) 2026-02-11 08:24:55 +08:00
houseme 8d7cd4cb1b chore: upgrade dependencies and migrate to aws-lc-rs (#1333) 2026-01-02 00:02:34 +08:00
yxrxy b8aa8214e2 Feat/ftps&sftp (#1308) 
[feat] ftp / sftp
 2025-12-31 09:01:15 +08:00
houseme eb33e82b56 fix: Prevent panic in GetMetrics gRPC handler on invalid input (#1291) 
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: houseme <4829346+houseme@users.noreply.github.com>
 2025-12-29 03:10:23 +08:00
houseme 82a6e78845 Inject GlobalReadiness into HTTP server pipeline and gate traffic until FullReady (#1255) 2025-12-25 00:19:03 +08:00
yxrxy 8821fcc1e7 feat: Replace LRU cache with Moka async cache in policy variables (#1166) 
Co-authored-by: houseme <housemecn@gmail.com>
 2025-12-17 00:19:31 +08:00
Jitter 76d25d9a20 Fix/issue #1001 dead node detection (#1054) 
Co-authored-by: weisd <im@weisd.in>
Co-authored-by: Jitterx69 <mohit@example.com>
 2025-12-08 12:29:46 +08:00
weisd 769778e565 fix iam (#783) 2025-11-03 17:39:51 +08:00
weisd cd1e244c68 Refactor: Introduce content checksums and improve multipart/object metadata handling (#671) 
* feat:  adapt to s3s typed etag support

* refactor: move replication struct to rustfs_filemeta, fix filemeta transition bug

* add head_object checksum, filter object metadata output

* fix multipart checksum

* fix multipart checksum

* add content md5,sha256 check

* fix test

* fix cargo

---------

Co-authored-by: overtrue <anzhengchao@gmail.com>
 2025-10-20 23:46:13 +08:00
songhahaha66 46797dc815 fix(export): fix the policy and service account export (#665) 
* fix(export): fix the policy export mechanism

* fix: correct service account check logic in IamSys
 2025-10-20 19:40:54 +08:00
gatewayJ aae768f446 feat: Simple OPA support (#644) 
* opa-feature

* Update crates/policy/src/policy/opa.rs

* add the content related to 'Copyright'

---------

Co-authored-by: root <root@debian.localdomain>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
 2025-10-16 10:35:26 +08:00
weisd 7622b37f7b add iam notification (#604) 
move tonic service to rustfs
 2025-09-30 17:32:23 +08:00
Chrislearn Young 823d4b6f79 Add typos github actions and fix typos (#265) 
* Add typo github actions and fix typos

* cargo fmt
 2025-07-19 22:08:50 +08:00
weisd 982cc66c74 fix: Refactor session policy handling and fix owner permission check (#226) 2025-07-16 16:40:51 +08:00
houseme 5826396cd0 refactor: Restructure project layout and clean up dependencies (#30) 
This commit introduces a significant reorganization of the project structure to improve maintainability and clarity.

Key changes include:
- Adjusted the directory layout for a more logical module organization.
- Removed unused crate dependencies, reducing the overall project size and potentially speeding up build times.
- Updated import paths and configuration files to reflect the structural changes.
 2025-07-02 19:33:12 +08:00