mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-07 05:43:14 +00:00
Zhengchao An
a7827ed91b
crates/policy had zero property tests: the wildcard Action/Resource matching and Deny-first evaluation in Policy::is_allowed — the algebra authorization safety rests on — were guarded only by example-based tests. Add crates/policy/tests/policy_eval_proptest.rs with three generated-input invariants (pure evaluation, no IO or global state, parallel-safe): - explicit_deny_anywhere_denies: a Deny matching the request denies it no matter how many broad Allow statements co-exist or at which index the Deny sits; a built-in sanity assertion first proves the Allows alone would permit, so the Deny is what flips the decision. - wildcard_superset_implies_concrete_match: any request allowed by an exact-action/exact-resource policy is also allowed after widening to s3:* on bucket/* and to * on arn:aws:s3:::*, checked both on the built grant and on random probe requests (implication form). - empty_policy_denies_everything: a statement-less policy and Policy::default() deny every non-owner request. Statements are built from JSON exactly as production policies arrive via PutPolicy. Generated names avoid wildcard metacharacters so the only wildcards in play are the ones the properties introduce deliberately. proptest joins crates/policy dev-deps following the filemeta/ecstore precedent. Refs: backlog#1151 (sec-9)
61 lines
2.0 KiB
TOML
61 lines
2.0 KiB
TOML
# Copyright 2024 RustFS Team
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
[package]
|
|
name = "rustfs-policy"
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
rust-version.workspace = true
|
|
version.workspace = true
|
|
homepage.workspace = true
|
|
description = "Policy management for RustFS, providing a framework for defining and enforcing policies across the system."
|
|
keywords = ["policy", "management", "enforcement", "rustfs", "Minio"]
|
|
categories = ["web-programming", "development-tools", "accessibility"]
|
|
documentation = "https://docs.rs/rustfs-policy/latest/rustfs_policy/"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
rustfs-credentials = { workspace = true }
|
|
rustfs-config = { workspace = true, features = ["constants", "opa"] }
|
|
tokio = { workspace = true, features = ["full"] }
|
|
time = { workspace = true, features = ["serde", "parsing", "formatting", "macros"] }
|
|
serde = { workspace = true, features = ["derive", "rc"] }
|
|
serde_json.workspace = true
|
|
thiserror.workspace = true
|
|
strum = { workspace = true, features = ["derive"] }
|
|
rustfs-crypto = { workspace = true }
|
|
ipnetwork = { workspace = true, features = ["serde"] }
|
|
base64-simd = { workspace = true }
|
|
jsonwebtoken = { workspace = true }
|
|
regex = { workspace = true }
|
|
reqwest.workspace = true
|
|
chrono.workspace = true
|
|
tracing.workspace = true
|
|
moka.workspace = true
|
|
async-trait.workspace = true
|
|
futures.workspace = true
|
|
pollster.workspace = true
|
|
|
|
[dev-dependencies]
|
|
pollster.workspace = true
|
|
proptest = "1"
|
|
test-case.workspace = true
|
|
temp-env = { workspace = true }
|
|
|
|
[lib]
|
|
doctest = false
|