mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-05 21:07:43 +00:00
Zhengchao An
1667 lines
59 KiB
Rust
1667 lines
59 KiB
Rust
// Copyright 2024 RustFS Team
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
//! Swift container operations
|
|
//!
|
|
//! This module implements Swift container CRUD operations and container-bucket translation.
|
|
|
|
use super::account::validate_account_access;
|
|
use super::metadata_update::{CONTAINER_META_TAG_PREFIX, MetadataUpdate};
|
|
use super::storage_api::container::{
|
|
BucketInfo, BucketOperations, BucketOptions, DeleteBucketOptions, ListOperations as _, MakeBucketOptions,
|
|
};
|
|
use super::types::Container;
|
|
use super::{SwiftError, SwiftResult};
|
|
use super::{get_swift_bucket_metadata, get_swift_bucket_usage, resolve_swift_object_store_handle, update_swift_bucket_tagging};
|
|
use rustfs_credentials::Credentials;
|
|
use s3s::dto::{Tag, Tagging};
|
|
use sha2::{Digest, Sha256};
|
|
use tracing::{debug, error};
|
|
|
|
fn required_bucket_usage(usage: &std::collections::HashMap<String, (u64, u64)>, bucket: &str) -> SwiftResult<(u64, u64)> {
|
|
usage
|
|
.get(bucket)
|
|
.copied()
|
|
.ok_or_else(|| SwiftError::ServiceUnavailable("Container usage is unavailable".to_string()))
|
|
}
|
|
|
|
const LOG_COMPONENT_PROTOCOLS: &str = "protocols";
|
|
const LOG_SUBSYSTEM_SWIFT_CONTAINER: &str = "swift_container";
|
|
const EVENT_SWIFT_CONTAINER_STORAGE_STATE: &str = "swift_container_storage_state";
|
|
|
|
/// Sanitize storage layer errors for client responses
|
|
///
|
|
/// Logs detailed error server-side while returning generic message to client.
|
|
/// This prevents information disclosure vulnerabilities.
|
|
fn sanitize_storage_error<E: std::fmt::Display>(operation: &str, error: E) -> SwiftError {
|
|
// Log detailed error server-side
|
|
error!(
|
|
event = EVENT_SWIFT_CONTAINER_STORAGE_STATE,
|
|
component = LOG_COMPONENT_PROTOCOLS,
|
|
subsystem = LOG_SUBSYSTEM_SWIFT_CONTAINER,
|
|
operation = %operation,
|
|
error = %error,
|
|
result = "failed",
|
|
"swift container storage state changed"
|
|
);
|
|
|
|
// Return generic error to client
|
|
SwiftError::InternalServerError(format!("{} operation failed", operation))
|
|
}
|
|
|
|
/// Convert S3 tags back to Swift container metadata
|
|
///
|
|
/// Extracts only tags with "swift-meta-" prefix, which represent Swift container metadata.
|
|
/// Other tags are ignored (they may be used for other purposes).
|
|
fn s3_tags_to_swift_metadata(tagging: &Tagging) -> std::collections::HashMap<String, String> {
|
|
let mut metadata = std::collections::HashMap::new();
|
|
|
|
for tag in &tagging.tag_set {
|
|
if let (Some(key), Some(value)) = (&tag.key, &tag.value)
|
|
&& let Some(meta_key) = key.strip_prefix(CONTAINER_META_TAG_PREFIX)
|
|
{
|
|
metadata.insert(meta_key.to_string(), value.clone());
|
|
}
|
|
}
|
|
|
|
metadata
|
|
}
|
|
|
|
/// Container name translation options
|
|
#[derive(Debug, Clone)]
|
|
pub struct ContainerMapperConfig {
|
|
/// Enable tenant prefixing for bucket names
|
|
/// When true, Swift container names are prefixed with SHA256 hash of project_id
|
|
/// Example: container "mycontainer" for project "abc123" becomes bucket "a1b2c3d4e5f6a1b2-mycontainer"
|
|
/// where "a1b2c3d4e5f6a1b2" is the first 16 hex chars of SHA256("abc123")
|
|
pub tenant_prefix_enabled: bool,
|
|
}
|
|
|
|
impl Default for ContainerMapperConfig {
|
|
fn default() -> Self {
|
|
Self {
|
|
tenant_prefix_enabled: true,
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Handles translation between Swift container names and S3 bucket names
|
|
pub struct ContainerMapper {
|
|
config: ContainerMapperConfig,
|
|
}
|
|
|
|
impl Default for ContainerMapper {
|
|
fn default() -> Self {
|
|
Self::new(ContainerMapperConfig::default())
|
|
}
|
|
}
|
|
|
|
impl ContainerMapper {
|
|
/// Create a new container mapper with given configuration
|
|
pub fn new(config: ContainerMapperConfig) -> Self {
|
|
Self { config }
|
|
}
|
|
|
|
/// Generate a deterministic hash prefix from project_id
|
|
///
|
|
/// Uses SHA256 to create a 16-character lowercase hex prefix that:
|
|
/// - Is deterministic (same project_id always produces same hash)
|
|
/// - Is collision-resistant (cryptographic hash)
|
|
/// - Uses only [a-z0-9] characters (S3 bucket name compatible)
|
|
/// - Has fixed length (16 chars from 8 bytes)
|
|
fn hash_project_id(&self, project_id: &str) -> String {
|
|
let mut hasher = Sha256::new();
|
|
hasher.update(project_id.as_bytes());
|
|
let result = hasher.finalize();
|
|
|
|
// Format first 8 bytes directly as hex (SHA256 always produces 32 bytes)
|
|
format!(
|
|
"{:02x}{:02x}{:02x}{:02x}{:02x}{:02x}{:02x}{:02x}",
|
|
result[0], result[1], result[2], result[3], result[4], result[5], result[6], result[7]
|
|
)
|
|
}
|
|
|
|
/// Convert Swift container name to S3 bucket name
|
|
///
|
|
/// When tenant_prefix_enabled is true:
|
|
/// container="mycontainer", project_id="abc123" -> "a1b2c3d4e5f6a1b2-mycontainer"
|
|
/// When tenant_prefix_enabled is false:
|
|
/// container="mycontainer", project_id="abc123" -> "mycontainer"
|
|
///
|
|
/// Note: Uses SHA256 hash of project_id as prefix, ensuring:
|
|
/// - No collision risk (cryptographic hash)
|
|
/// - S3 bucket name compatible (only uses [a-z0-9-])
|
|
/// - Deterministic mapping (same input always produces same bucket name)
|
|
/// - Fixed-length prefix (16 hex chars = 8 bytes)
|
|
#[allow(dead_code)] // Used in: create/delete container operations
|
|
pub fn swift_to_s3_bucket(&self, container: &str, project_id: &str) -> String {
|
|
if self.config.tenant_prefix_enabled {
|
|
let hash = self.hash_project_id(project_id);
|
|
format!("{}-{}", hash, container)
|
|
} else {
|
|
container.to_string()
|
|
}
|
|
}
|
|
|
|
/// Convert S3 bucket name to Swift container name
|
|
///
|
|
/// When tenant_prefix_enabled is true:
|
|
/// bucket="a1b2c3d4e5f6a1b2-mycontainer", project_id="abc123" -> "mycontainer"
|
|
/// When tenant_prefix_enabled is false:
|
|
/// bucket="mycontainer", project_id="abc123" -> "mycontainer"
|
|
///
|
|
/// Returns None if bucket doesn't belong to this tenant
|
|
pub fn s3_to_swift_container(&self, bucket: &str, project_id: &str) -> Option<String> {
|
|
if self.config.tenant_prefix_enabled {
|
|
let hash = self.hash_project_id(project_id);
|
|
let prefix = format!("{}-", hash);
|
|
bucket.strip_prefix(&prefix).map(|container| container.to_string())
|
|
} else {
|
|
Some(bucket.to_string())
|
|
}
|
|
}
|
|
|
|
/// Check if a bucket belongs to the specified project
|
|
pub fn bucket_belongs_to_project(&self, bucket: &str, project_id: &str) -> bool {
|
|
if self.config.tenant_prefix_enabled {
|
|
let hash = self.hash_project_id(project_id);
|
|
bucket.starts_with(&format!("{}-", hash))
|
|
} else {
|
|
// Without tenant prefixing, we can't determine ownership from name alone
|
|
true
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Convert BucketInfo to Swift Container
|
|
///
|
|
/// Maps S3 bucket metadata to Swift container format:
|
|
/// - name: Extracted from bucket name (removing tenant prefix if present)
|
|
/// - count: Number of objects (not available in BucketInfo, set to 0)
|
|
/// - bytes: Total bytes (not available in BucketInfo, set to 0)
|
|
/// - last_modified: ISO 8601 timestamp from created date
|
|
pub fn bucket_info_to_container(info: &BucketInfo, mapper: &ContainerMapper, project_id: &str) -> Option<Container> {
|
|
// Extract container name (removing tenant prefix if applicable)
|
|
let container_name = mapper.s3_to_swift_container(&info.name, project_id)?;
|
|
|
|
// Format timestamp as ISO 8601
|
|
let last_modified = info.created.map(|dt| {
|
|
dt.format(&time::format_description::well_known::Rfc3339)
|
|
.unwrap_or_else(|_| String::new())
|
|
});
|
|
|
|
Some(Container {
|
|
name: container_name,
|
|
count: 0, // Will be populated from bucket metadata in future
|
|
bytes: 0, // Will be populated from bucket metadata in future
|
|
last_modified,
|
|
})
|
|
}
|
|
|
|
/// List containers for a Swift account
|
|
///
|
|
/// This function:
|
|
/// 1. Validates account access using Keystone project_id
|
|
/// 2. Lists all S3 buckets
|
|
/// 3. Filters to buckets belonging to this tenant (using tenant prefix)
|
|
/// 4. Converts BucketInfo to Swift Container format
|
|
#[allow(dead_code)] // Used by handler: list containers
|
|
pub async fn list_containers(account: &str, credentials: &Credentials) -> SwiftResult<Vec<Container>> {
|
|
// Validate account access and extract project_id
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Create mapper with default config (tenant prefixing enabled)
|
|
let mapper = ContainerMapper::default();
|
|
|
|
// Get storage layer
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// List all buckets
|
|
let bucket_infos = store
|
|
.list_bucket(&BucketOptions::default())
|
|
.await
|
|
.map_err(|e| sanitize_storage_error("Container listing", e))?;
|
|
let usage = get_swift_bucket_usage()
|
|
.await
|
|
.map_err(|e| sanitize_storage_error("Container usage retrieval", e))?
|
|
.ok_or_else(|| SwiftError::ServiceUnavailable("Container usage is unavailable".to_string()))?;
|
|
|
|
// Filter and convert buckets to containers
|
|
let containers: Vec<Container> = bucket_infos
|
|
.iter()
|
|
.filter(|info| mapper.bucket_belongs_to_project(&info.name, &project_id))
|
|
.filter_map(|info| {
|
|
bucket_info_to_container(info, &mapper, &project_id).map(|mut container| {
|
|
let (count, bytes) = required_bucket_usage(&usage, &info.name)?;
|
|
container.count = count;
|
|
container.bytes = bytes;
|
|
Ok(container)
|
|
})
|
|
})
|
|
.collect::<SwiftResult<Vec<_>>>()?;
|
|
|
|
debug!(
|
|
event = EVENT_SWIFT_CONTAINER_STORAGE_STATE,
|
|
component = LOG_COMPONENT_PROTOCOLS,
|
|
subsystem = LOG_SUBSYSTEM_SWIFT_CONTAINER,
|
|
operation = "list_containers",
|
|
account = %account,
|
|
container_count = containers.len(),
|
|
result = "ok",
|
|
"swift container storage state changed"
|
|
);
|
|
|
|
Ok(containers)
|
|
}
|
|
|
|
/// Create a container for a Swift account
|
|
///
|
|
/// This function:
|
|
/// 1. Validates account access using Keystone project_id
|
|
/// 2. Converts Swift container name to S3 bucket name (with tenant prefix)
|
|
/// 3. Creates the bucket in S3 storage
|
|
///
|
|
/// Swift semantics:
|
|
/// - PUT /v1/{account}/{container} creates a container
|
|
/// - Returns 201 Created on success
|
|
/// - Returns 202 Accepted if container already exists
|
|
/// - Returns 400 Bad Request for invalid container names
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn create_container(account: &str, container: &str, credentials: &Credentials) -> SwiftResult<bool> {
|
|
// Validate account access and extract project_id
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Validate container name
|
|
validate_container_name(container)?;
|
|
|
|
// Create mapper with default config (tenant prefixing enabled)
|
|
let mapper = ContainerMapper::default();
|
|
|
|
// Convert Swift container name to S3 bucket name
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
// Get storage layer
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// Check if bucket already exists
|
|
let bucket_exists = store.get_bucket_info(&bucket_name, &BucketOptions::default()).await.is_ok();
|
|
|
|
if bucket_exists {
|
|
// Container already exists - Swift returns 202 Accepted
|
|
return Ok(false);
|
|
}
|
|
|
|
// Create the bucket
|
|
store
|
|
.make_bucket(
|
|
&bucket_name,
|
|
&MakeBucketOptions {
|
|
force_create: false,
|
|
lock_enabled: false,
|
|
versioning_enabled: false,
|
|
created_at: None,
|
|
no_lock: false,
|
|
},
|
|
)
|
|
.await
|
|
.map_err(|e| sanitize_storage_error("Container creation", e))?;
|
|
|
|
// Container created successfully - return true for 201 Created
|
|
Ok(true)
|
|
}
|
|
|
|
/// Validate Swift container name
|
|
///
|
|
/// Container names must:
|
|
/// - Be 1-256 characters
|
|
/// - Not contain '/' (reserved for objects)
|
|
/// - Not be empty
|
|
fn validate_container_name(container: &str) -> SwiftResult<()> {
|
|
if container.is_empty() {
|
|
return Err(SwiftError::BadRequest("Container name cannot be empty".to_string()));
|
|
}
|
|
|
|
if container.len() > 256 {
|
|
return Err(SwiftError::BadRequest("Container name too long (max 256 characters)".to_string()));
|
|
}
|
|
|
|
if container.contains('/') {
|
|
return Err(SwiftError::BadRequest("Container name cannot contain '/'".to_string()));
|
|
}
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Container metadata for HEAD response
|
|
#[allow(dead_code)] // TODO: Remove once Swift API integration is complete
|
|
#[derive(Debug, Clone)]
|
|
pub struct ContainerMetadata {
|
|
/// Number of objects in container
|
|
pub object_count: u64,
|
|
/// Total bytes used by objects
|
|
pub bytes_used: u64,
|
|
/// Container creation timestamp
|
|
pub created: Option<time::OffsetDateTime>,
|
|
/// Custom metadata (from X-Container-Meta-* headers)
|
|
pub custom_metadata: std::collections::HashMap<String, String>,
|
|
}
|
|
|
|
async fn get_container_metadata_base(
|
|
account: &str,
|
|
container: &str,
|
|
credentials: &Credentials,
|
|
) -> SwiftResult<(String, BucketInfo, std::collections::HashMap<String, String>)> {
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
validate_container_name(container)?;
|
|
let bucket_name = ContainerMapper::default().swift_to_s3_bucket(container, &project_id);
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
let bucket_info = store
|
|
.get_bucket_info(&bucket_name, &BucketOptions::default())
|
|
.await
|
|
.map_err(|e| {
|
|
if e.to_string().contains("not found") || e.to_string().contains("NoSuchBucket") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container metadata retrieval", e)
|
|
}
|
|
})?;
|
|
let custom_metadata = get_swift_bucket_metadata(&bucket_name)
|
|
.await
|
|
.ok()
|
|
.and_then(|bucket_meta| bucket_meta.tagging_config.as_ref().map(s3_tags_to_swift_metadata))
|
|
.unwrap_or_default();
|
|
Ok((bucket_name, bucket_info, custom_metadata))
|
|
}
|
|
|
|
pub(crate) async fn get_container_custom_metadata(
|
|
account: &str,
|
|
container: &str,
|
|
credentials: &Credentials,
|
|
) -> SwiftResult<std::collections::HashMap<String, String>> {
|
|
let (_, _, custom_metadata) = get_container_metadata_base(account, container, credentials).await?;
|
|
Ok(custom_metadata)
|
|
}
|
|
|
|
/// Get container metadata (for HEAD operation)
|
|
///
|
|
/// This function:
|
|
/// 1. Validates account access using Keystone project_id
|
|
/// 2. Converts Swift container name to S3 bucket name
|
|
/// 3. Retrieves bucket info from storage
|
|
/// 4. Returns container metadata
|
|
///
|
|
/// Swift semantics:
|
|
/// - HEAD /v1/{account}/{container} returns container metadata
|
|
/// - Returns 204 No Content on success with headers
|
|
/// - Returns 404 Not Found if container doesn't exist
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn get_container_metadata(account: &str, container: &str, credentials: &Credentials) -> SwiftResult<ContainerMetadata> {
|
|
let (bucket_name, bucket_info, custom_metadata) = get_container_metadata_base(account, container, credentials).await?;
|
|
|
|
// Ecstore serves the persisted scanner snapshot through a bounded in-process cache.
|
|
// Single-node deployments overlay successful in-process mutations; distributed
|
|
// deployments use only the cluster-wide persisted snapshot.
|
|
let usage = get_swift_bucket_usage()
|
|
.await
|
|
.map_err(|e| sanitize_storage_error("Container usage retrieval", e))?
|
|
.ok_or_else(|| SwiftError::ServiceUnavailable("Container usage is unavailable".to_string()))?;
|
|
let (object_count, bytes_used) = required_bucket_usage(&usage, &bucket_name)?;
|
|
|
|
Ok(ContainerMetadata {
|
|
object_count,
|
|
bytes_used,
|
|
created: bucket_info.created,
|
|
custom_metadata,
|
|
})
|
|
}
|
|
|
|
/// Update container metadata (for POST operation)
|
|
///
|
|
/// This function:
|
|
/// 1. Validates account access using Keystone project_id
|
|
/// 2. Converts Swift container name to S3 bucket name
|
|
/// 3. Validates container exists
|
|
/// 4. Updates custom metadata (X-Container-Meta-* headers)
|
|
///
|
|
/// Swift semantics:
|
|
/// - POST /v1/{account}/{container} updates container metadata
|
|
/// - Returns 204 No Content on success
|
|
/// - Returns 404 Not Found if container doesn't exist
|
|
/// - Metadata is provided via X-Container-Meta-* headers
|
|
/// - The update is additive: items the request does not name keep their stored
|
|
/// value, and removal is explicit, via `X-Remove-Container-Meta-{name}` or an
|
|
/// empty value
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn update_container_metadata(
|
|
account: &str,
|
|
container: &str,
|
|
credentials: &Credentials,
|
|
update: MetadataUpdate,
|
|
) -> SwiftResult<()> {
|
|
// Validate account access and extract project_id
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Validate container name
|
|
validate_container_name(container)?;
|
|
|
|
// These tags are persisted into the bucket metadata file, which every
|
|
// later config write rewrites in full — so unbounded metadata inflates
|
|
// the cost of unrelated writes for the life of the container. The item
|
|
// count is capped against the merged result, inside the rewrite.
|
|
update.validate()?;
|
|
|
|
// Create mapper with default config (tenant prefixing enabled)
|
|
let mapper = ContainerMapper::default();
|
|
|
|
// Convert Swift container name to S3 bucket name
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
// Get storage layer
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// Verify container exists. Checked before the empty-update shortcut below,
|
|
// so a POST to a container that does not exist still answers 404 whether
|
|
// or not it carried metadata.
|
|
store
|
|
.get_bucket_info(&bucket_name, &BucketOptions::default())
|
|
.await
|
|
.map_err(|e| {
|
|
if e.to_string().contains("not found") || e.to_string().contains("NoSuchBucket") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container metadata retrieval", e)
|
|
}
|
|
})?;
|
|
|
|
// An update that names no item leaves stored metadata alone, so skip the
|
|
// persisted write and the peer reload it triggers rather than rewriting
|
|
// the config to its current value. The handler reaches here on every
|
|
// container POST, including ACL-only and versioning-only ones.
|
|
if update.is_empty() {
|
|
return Ok(());
|
|
}
|
|
|
|
// Merge into the persisted tags: only the swift-meta-* items this update
|
|
// names change, so the container's other metadata — and the ACL and
|
|
// versioning tags sharing this tag set — survive. An empty result clears
|
|
// the tagging config.
|
|
update_swift_bucket_tagging(bucket_name, |current| update.apply_to_tags(current, CONTAINER_META_TAG_PREFIX)).await
|
|
}
|
|
|
|
/// Delete a container
|
|
///
|
|
/// This function:
|
|
/// 1. Validates account access using Keystone project_id
|
|
/// 2. Converts Swift container name to S3 bucket name
|
|
/// 3. Verifies container exists
|
|
/// 4. Deletes the bucket from storage
|
|
///
|
|
/// Swift semantics:
|
|
/// - DELETE /v1/{account}/{container} deletes a container
|
|
/// - Returns 204 No Content on success
|
|
/// - Returns 404 Not Found if container doesn't exist
|
|
/// - Returns 409 Conflict if container is not empty
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn delete_container(account: &str, container: &str, credentials: &Credentials) -> SwiftResult<()> {
|
|
// Validate account access and extract project_id
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Validate container name
|
|
validate_container_name(container)?;
|
|
|
|
// Create mapper with default config (tenant prefixing enabled)
|
|
let mapper = ContainerMapper::default();
|
|
|
|
// Convert Swift container name to S3 bucket name
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
// Get storage layer
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// Verify container exists first
|
|
store
|
|
.get_bucket_info(&bucket_name, &BucketOptions::default())
|
|
.await
|
|
.map_err(|e| {
|
|
if e.to_string().contains("not found") || e.to_string().contains("NoSuchBucket") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container info retrieval", e)
|
|
}
|
|
})?;
|
|
|
|
// Delete the bucket
|
|
store
|
|
.delete_bucket(
|
|
&bucket_name,
|
|
&DeleteBucketOptions {
|
|
force: false, // Swift requires containers to be empty
|
|
no_lock: false,
|
|
no_recreate: false,
|
|
..Default::default()
|
|
},
|
|
)
|
|
.await
|
|
.map_err(|e| {
|
|
let error_msg = e.to_string();
|
|
// Check if bucket is not empty
|
|
if error_msg.contains("not empty") || error_msg.contains("BucketNotEmpty") {
|
|
SwiftError::Conflict(format!("Container '{}' is not empty. Delete all objects first.", container))
|
|
} else if error_msg.contains("not found") || error_msg.contains("NoSuchBucket") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container deletion", e)
|
|
}
|
|
})?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// List objects in a container (GET /v1/{account}/{container})
|
|
///
|
|
/// Returns a list of objects within the specified container.
|
|
/// Supports pagination, prefix filtering, and delimiter-based hierarchical listing.
|
|
///
|
|
/// # Arguments
|
|
///
|
|
/// * `account` - Swift account identifier (AUTH_{project_id})
|
|
/// * `container` - Container name
|
|
/// * `credentials` - Keystone credentials from middleware
|
|
/// * `limit` - Maximum number of objects to return (default 10000)
|
|
/// * `marker` - Pagination marker (start after this object name)
|
|
/// * `prefix` - Filter objects by prefix
|
|
/// * `delimiter` - Delimiter for hierarchical listings (usually "/")
|
|
///
|
|
/// # Returns
|
|
///
|
|
/// A vector of Object structs containing object metadata
|
|
///
|
|
/// # Errors
|
|
///
|
|
/// Returns SwiftError if:
|
|
/// - Account validation fails
|
|
/// - Container doesn't exist
|
|
/// - Storage layer errors occur
|
|
#[allow(dead_code)] // Handler integration: GET container
|
|
pub async fn list_objects(
|
|
account: &str,
|
|
container: &str,
|
|
credentials: &Credentials,
|
|
limit: Option<i32>,
|
|
marker: Option<String>,
|
|
prefix: Option<String>,
|
|
delimiter: Option<String>,
|
|
) -> SwiftResult<Vec<super::types::Object>> {
|
|
use super::types::Object;
|
|
|
|
// Validate account access and extract project_id
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Map container to bucket
|
|
let mapper = ContainerMapper::default();
|
|
let bucket = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
// Get storage layer
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// Verify bucket exists
|
|
store.get_bucket_info(&bucket, &BucketOptions::default()).await.map_err(|e| {
|
|
if e.to_string().contains("does not exist") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container access", e)
|
|
}
|
|
})?;
|
|
|
|
// Prepare list parameters
|
|
let max_keys = limit.unwrap_or(10000).max(0);
|
|
let prefix_str = prefix.unwrap_or_default();
|
|
let delimiter_opt = delimiter.filter(|d| !d.is_empty());
|
|
|
|
// List objects from storage
|
|
let object_infos = store
|
|
.list_objects_v2(
|
|
&bucket,
|
|
&prefix_str,
|
|
marker,
|
|
delimiter_opt,
|
|
max_keys,
|
|
false, // fetch_owner
|
|
None, // start_after
|
|
false, // include_deleted
|
|
)
|
|
.await
|
|
.map_err(|e| sanitize_storage_error("Object listing", e))?;
|
|
|
|
// Convert ObjectInfo to Swift Object format
|
|
let mut swift_objects = Vec::new();
|
|
for obj_info in object_infos.objects {
|
|
// Skip empty names
|
|
if obj_info.name.is_empty() {
|
|
continue;
|
|
}
|
|
|
|
// Format last_modified as ISO 8601
|
|
let last_modified = if let Some(mod_time) = obj_info.mod_time {
|
|
mod_time
|
|
.format(&time::format_description::well_known::Rfc3339)
|
|
.unwrap_or_default()
|
|
} else {
|
|
String::new()
|
|
};
|
|
|
|
swift_objects.push(Object {
|
|
name: obj_info.name,
|
|
hash: obj_info.etag.unwrap_or_default(),
|
|
bytes: obj_info.size as u64,
|
|
content_type: obj_info
|
|
.content_type
|
|
.unwrap_or_else(|| "application/octet-stream".to_string()),
|
|
last_modified,
|
|
});
|
|
}
|
|
|
|
Ok(swift_objects)
|
|
}
|
|
|
|
/// Enable object versioning for a container
|
|
///
|
|
/// When versioning is enabled, old versions of objects are automatically
|
|
/// archived to the specified archive container when overwritten or deleted.
|
|
///
|
|
/// # Arguments
|
|
/// * `account` - Account identifier (e.g., "AUTH_7188e165...")
|
|
/// * `container` - Container name to enable versioning on
|
|
/// * `archive_container` - Container name where versions will be stored
|
|
/// * `credentials` - Keystone credentials
|
|
///
|
|
/// # Returns
|
|
/// - Ok(()) if versioning was enabled successfully
|
|
/// - Err if container doesn't exist or archive container is invalid
|
|
///
|
|
/// # Storage
|
|
/// Versioning configuration is stored as an S3 bucket tag:
|
|
/// - Tag key: `swift-versions-location`
|
|
/// - Tag value: archive container name
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn enable_versioning(
|
|
account: &str,
|
|
container: &str,
|
|
archive_container: &str,
|
|
credentials: &Credentials,
|
|
) -> SwiftResult<()> {
|
|
// Validate account access
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Validate container names
|
|
validate_container_name(container)?;
|
|
validate_container_name(archive_container)?;
|
|
|
|
// Cannot version a container to itself
|
|
if container == archive_container {
|
|
return Err(SwiftError::BadRequest(
|
|
"Archive container must be different from versioned container".to_string(),
|
|
));
|
|
}
|
|
|
|
// Create mapper
|
|
let mapper = ContainerMapper::default();
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
let archive_bucket_name = mapper.swift_to_s3_bucket(archive_container, &project_id);
|
|
|
|
// Get storage layer
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// Verify container exists
|
|
store
|
|
.get_bucket_info(&bucket_name, &BucketOptions::default())
|
|
.await
|
|
.map_err(|e| {
|
|
if e.to_string().contains("not found") || e.to_string().contains("NoSuchBucket") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container verification", e)
|
|
}
|
|
})?;
|
|
|
|
// Verify archive container exists (do NOT auto-create for security)
|
|
// Users must explicitly create the archive container before enabling versioning
|
|
store
|
|
.get_bucket_info(&archive_bucket_name, &BucketOptions::default())
|
|
.await
|
|
.map_err(|e| {
|
|
if e.to_string().contains("not found") || e.to_string().contains("NoSuchBucket") {
|
|
SwiftError::BadRequest(format!(
|
|
"Archive container '{}' does not exist. Please create it before enabling versioning.",
|
|
archive_container
|
|
))
|
|
} else {
|
|
sanitize_storage_error("Archive container verification", e)
|
|
}
|
|
})?;
|
|
|
|
// Rewrite the persisted tags: replace any versioning tag with the new
|
|
// archive location while preserving all other tags.
|
|
update_swift_bucket_tagging(bucket_name, |current| {
|
|
let mut tagging = current.cloned().unwrap_or_else(|| Tagging { tag_set: vec![] });
|
|
|
|
tagging
|
|
.tag_set
|
|
.retain(|tag| tag.key.as_deref() != Some("swift-versions-location"));
|
|
|
|
tagging.tag_set.push(Tag {
|
|
key: Some("swift-versions-location".to_string()),
|
|
value: Some(archive_container.to_string()), // Store Swift container name, not S3 bucket name
|
|
});
|
|
|
|
Ok(tagging)
|
|
})
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Disable object versioning for a container
|
|
///
|
|
/// Removes versioning configuration from the container. Existing archived
|
|
/// versions are NOT deleted.
|
|
///
|
|
/// # Arguments
|
|
/// * `account` - Account identifier
|
|
/// * `container` - Container name to disable versioning on
|
|
/// * `credentials` - Keystone credentials
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn disable_versioning(account: &str, container: &str, credentials: &Credentials) -> SwiftResult<()> {
|
|
// Validate account access
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Validate container name
|
|
validate_container_name(container)?;
|
|
|
|
// Create mapper
|
|
let mapper = ContainerMapper::default();
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// Verify container exists. Without this the rewrite below would persist a
|
|
// fabricated default for a container that does not exist: the metadata
|
|
// loader turns "no metadata on disk" into a fresh BucketMetadata, and
|
|
// writing that creates an orphan .metadata.bin and caches a fabricated
|
|
// default as authoritative.
|
|
store
|
|
.get_bucket_info(&bucket_name, &BucketOptions::default())
|
|
.await
|
|
.map_err(|e| {
|
|
if e.to_string().contains("not found") || e.to_string().contains("NoSuchBucket") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container verification", e)
|
|
}
|
|
})?;
|
|
|
|
// Rewrite the persisted tags: drop the versioning tag while preserving
|
|
// all other tags. An empty result clears the tagging config.
|
|
update_swift_bucket_tagging(bucket_name, |current| {
|
|
let mut tagging = current.cloned().unwrap_or_else(|| Tagging { tag_set: vec![] });
|
|
|
|
tagging
|
|
.tag_set
|
|
.retain(|tag| tag.key.as_deref() != Some("swift-versions-location"));
|
|
|
|
Ok(tagging)
|
|
})
|
|
.await?;
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Get the archive container name for a versioned container
|
|
///
|
|
/// Returns None if versioning is not enabled for the container.
|
|
///
|
|
/// # Arguments
|
|
/// * `account` - Account identifier
|
|
/// * `container` - Container name to check
|
|
/// * `credentials` - Keystone credentials
|
|
///
|
|
/// # Returns
|
|
/// - Some(archive_container_name) if versioning is enabled
|
|
/// - None if versioning is not enabled
|
|
#[allow(dead_code)] // Used by handler and object.rs
|
|
pub async fn get_versions_location(account: &str, container: &str, credentials: &Credentials) -> SwiftResult<Option<String>> {
|
|
// Validate account access
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Validate container name
|
|
validate_container_name(container)?;
|
|
|
|
// Create mapper
|
|
let mapper = ContainerMapper::default();
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
// Load bucket metadata
|
|
let bucket_meta = match get_swift_bucket_metadata(&bucket_name).await {
|
|
Ok(meta) => meta,
|
|
Err(_) => {
|
|
// Container doesn't exist
|
|
return Ok(None);
|
|
}
|
|
};
|
|
|
|
// Check for versioning tag
|
|
if let Some(tagging) = &bucket_meta.tagging_config {
|
|
for tag in &tagging.tag_set {
|
|
if tag.key.as_deref() == Some("swift-versions-location") {
|
|
return Ok(tag.value.clone());
|
|
}
|
|
}
|
|
}
|
|
|
|
Ok(None)
|
|
}
|
|
|
|
/// Set container ACLs (read and/or write)
|
|
///
|
|
/// Stores ACLs in S3 bucket tags for persistent storage.
|
|
///
|
|
/// # Arguments
|
|
/// * `account` - Account identifier
|
|
/// * `container` - Container name
|
|
/// * `read_acl` - Read ACL header value (X-Container-Read), or None to remove
|
|
/// * `write_acl` - Write ACL header value (X-Container-Write), or None to remove
|
|
/// * `credentials` - Keystone credentials
|
|
///
|
|
/// # Returns
|
|
/// - Ok(()) if ACLs were set successfully
|
|
/// - Err if validation fails or storage error occurs
|
|
///
|
|
/// # Storage
|
|
/// ACLs are stored as S3 bucket tags:
|
|
/// - Tag key: `swift-acl-read` with comma-separated grants
|
|
/// - Tag key: `swift-acl-write` with comma-separated grants
|
|
///
|
|
/// # Example
|
|
/// ```ignore
|
|
/// set_container_acl(
|
|
/// "AUTH_abc123",
|
|
/// "photos",
|
|
/// Some(".r:*,AUTH_def456"), // Public + specific account
|
|
/// Some("AUTH_def456"), // Only specific account can write
|
|
/// &credentials
|
|
/// ).await?;
|
|
/// ```
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn set_container_acl(
|
|
account: &str,
|
|
container: &str,
|
|
read_acl: Option<&str>,
|
|
write_acl: Option<&str>,
|
|
credentials: &Credentials,
|
|
) -> SwiftResult<()> {
|
|
use super::acl::ContainerAcl;
|
|
|
|
// Validate ACLs by parsing them
|
|
if let Some(read) = read_acl {
|
|
ContainerAcl::parse_read(read)?;
|
|
}
|
|
if let Some(write) = write_acl {
|
|
ContainerAcl::parse_write(write)?;
|
|
}
|
|
|
|
// Validate account access
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Validate container name
|
|
validate_container_name(container)?;
|
|
|
|
// Map container to S3 bucket
|
|
let mapper = ContainerMapper::default();
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
// Get storage layer
|
|
let Some(store) = resolve_swift_object_store_handle() else {
|
|
return Err(SwiftError::InternalServerError("Storage layer not initialized".to_string()));
|
|
};
|
|
|
|
// Verify container exists
|
|
store
|
|
.get_bucket_info(&bucket_name, &BucketOptions::default())
|
|
.await
|
|
.map_err(|e| {
|
|
if e.to_string().contains("not found") || e.to_string().contains("NoSuchBucket") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
sanitize_storage_error("Container verification", e)
|
|
}
|
|
})?;
|
|
|
|
// Rewrite the persisted tags: replace the ACL tags with the new grants
|
|
// while preserving all other tags. An empty result clears the tagging
|
|
// config.
|
|
update_swift_bucket_tagging(bucket_name, |current| {
|
|
let mut tagging = current.cloned().unwrap_or_else(|| Tagging { tag_set: vec![] });
|
|
|
|
tagging
|
|
.tag_set
|
|
.retain(|tag| tag.key.as_deref() != Some("swift-acl-read") && tag.key.as_deref() != Some("swift-acl-write"));
|
|
|
|
if let Some(read) = read_acl
|
|
&& !read.trim().is_empty()
|
|
{
|
|
tagging.tag_set.push(Tag {
|
|
key: Some("swift-acl-read".to_string()),
|
|
value: Some(read.to_string()),
|
|
});
|
|
}
|
|
|
|
if let Some(write) = write_acl
|
|
&& !write.trim().is_empty()
|
|
{
|
|
tagging.tag_set.push(Tag {
|
|
key: Some("swift-acl-write".to_string()),
|
|
value: Some(write.to_string()),
|
|
});
|
|
}
|
|
|
|
Ok(tagging)
|
|
})
|
|
.await?;
|
|
|
|
debug!(
|
|
"Set ACLs for container {}/{}: read={:?}, write={:?}",
|
|
account, container, read_acl, write_acl
|
|
);
|
|
|
|
Ok(())
|
|
}
|
|
|
|
/// Get container ACLs
|
|
///
|
|
/// Retrieves ACLs from S3 bucket tags and parses them.
|
|
///
|
|
/// # Arguments
|
|
/// * `account` - Account identifier
|
|
/// * `container` - Container name
|
|
/// * `credentials` - Keystone credentials
|
|
///
|
|
/// # Returns
|
|
/// ContainerAcl with read and write grants, or empty ACL if none set
|
|
///
|
|
/// # Example
|
|
/// ```ignore
|
|
/// let acl = get_container_acl("AUTH_abc123", "photos", &credentials).await?;
|
|
/// if acl.is_public_read() {
|
|
/// println!("Container is publicly readable");
|
|
/// }
|
|
/// ```
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn get_container_acl(
|
|
account: &str,
|
|
container: &str,
|
|
credentials: &Credentials,
|
|
) -> SwiftResult<super::acl::ContainerAcl> {
|
|
use super::acl::ContainerAcl;
|
|
|
|
// Validate account access
|
|
let project_id = validate_account_access(account, credentials)?;
|
|
|
|
// Map container to S3 bucket
|
|
let mapper = ContainerMapper::default();
|
|
let bucket_name = mapper.swift_to_s3_bucket(container, &project_id);
|
|
|
|
// Load bucket metadata
|
|
let bucket_meta = get_swift_bucket_metadata(&bucket_name).await.map_err(|e| {
|
|
if e.to_string().contains("not found") {
|
|
SwiftError::NotFound(format!("Container '{}' not found", container))
|
|
} else {
|
|
SwiftError::InternalServerError(format!("Failed to load bucket metadata: {}", e))
|
|
}
|
|
})?;
|
|
|
|
// Get tagging config
|
|
let tagging = bucket_meta.tagging_config.as_ref();
|
|
|
|
let mut read_grants = Vec::new();
|
|
let mut write_grants = Vec::new();
|
|
|
|
if let Some(tags) = tagging {
|
|
for tag in &tags.tag_set {
|
|
match (tag.key.as_deref(), tag.value.as_deref()) {
|
|
(Some("swift-acl-read"), Some(value)) => {
|
|
read_grants = ContainerAcl::parse_read(value)?;
|
|
}
|
|
(Some("swift-acl-write"), Some(value)) => {
|
|
write_grants = ContainerAcl::parse_write(value)?;
|
|
}
|
|
_ => {}
|
|
}
|
|
}
|
|
}
|
|
|
|
Ok(ContainerAcl {
|
|
read: read_grants,
|
|
write: write_grants,
|
|
})
|
|
}
|
|
|
|
/// Delete container ACLs
|
|
///
|
|
/// Removes both read and write ACL tags from the container.
|
|
///
|
|
/// # Arguments
|
|
/// * `account` - Account identifier
|
|
/// * `container` - Container name
|
|
/// * `credentials` - Keystone credentials
|
|
///
|
|
/// # Returns
|
|
/// Ok(()) if ACLs were deleted successfully
|
|
#[allow(dead_code)] // Used by handler
|
|
pub async fn delete_container_acl(account: &str, container: &str, credentials: &Credentials) -> SwiftResult<()> {
|
|
// Setting both ACLs to None removes them
|
|
set_container_acl(account, container, None, None, credentials).await
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
use time::OffsetDateTime;
|
|
|
|
#[test]
|
|
fn test_swift_to_s3_bucket_with_prefix() {
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
let bucket = mapper.swift_to_s3_bucket("mycontainer", "abc123");
|
|
let expected_hash = mapper.hash_project_id("abc123");
|
|
assert_eq!(bucket, format!("{}-mycontainer", expected_hash));
|
|
|
|
// Verify hash is 16 hex characters (lowercase)
|
|
assert_eq!(expected_hash.len(), 16);
|
|
assert!(
|
|
expected_hash
|
|
.chars()
|
|
.all(|c| c.is_ascii_hexdigit() && !c.is_ascii_uppercase())
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_swift_to_s3_bucket_without_prefix() {
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: false,
|
|
});
|
|
|
|
let bucket = mapper.swift_to_s3_bucket("mycontainer", "abc123");
|
|
assert_eq!(bucket, "mycontainer");
|
|
}
|
|
|
|
#[test]
|
|
fn test_s3_to_swift_container_with_prefix() {
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
// Test with correct tenant
|
|
let hash_abc123 = mapper.hash_project_id("abc123");
|
|
let bucket_name = format!("{}-mycontainer", hash_abc123);
|
|
let container = mapper.s3_to_swift_container(&bucket_name, "abc123");
|
|
assert_eq!(container, Some("mycontainer".to_string()));
|
|
|
|
// Different tenant should return None (different hash)
|
|
let container = mapper.s3_to_swift_container(&bucket_name, "xyz789");
|
|
assert_eq!(container, None);
|
|
}
|
|
|
|
#[test]
|
|
fn test_s3_to_swift_container_without_prefix() {
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: false,
|
|
});
|
|
|
|
let container = mapper.s3_to_swift_container("mycontainer", "abc123");
|
|
assert_eq!(container, Some("mycontainer".to_string()));
|
|
}
|
|
|
|
#[test]
|
|
fn test_bucket_belongs_to_project() {
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
let hash_abc123 = mapper.hash_project_id("abc123");
|
|
let hash_xyz789 = mapper.hash_project_id("xyz789");
|
|
|
|
let bucket_abc = format!("{}-mycontainer", hash_abc123);
|
|
let bucket_xyz = format!("{}-mycontainer", hash_xyz789);
|
|
|
|
assert!(mapper.bucket_belongs_to_project(&bucket_abc, "abc123"));
|
|
assert!(!mapper.bucket_belongs_to_project(&bucket_xyz, "abc123"));
|
|
assert!(!mapper.bucket_belongs_to_project("mycontainer", "abc123"));
|
|
}
|
|
|
|
#[test]
|
|
fn test_bucket_info_to_container() {
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
let hash = mapper.hash_project_id("abc123");
|
|
let bucket_name = format!("{}-mycontainer", hash);
|
|
|
|
let info = BucketInfo {
|
|
name: bucket_name,
|
|
created: Some(OffsetDateTime::now_utc()),
|
|
deleted: None,
|
|
versioning: false,
|
|
object_locking: false,
|
|
};
|
|
|
|
let container = bucket_info_to_container(&info, &mapper, "abc123");
|
|
assert!(container.is_some());
|
|
let container = container.unwrap();
|
|
assert_eq!(container.name, "mycontainer");
|
|
assert_eq!(container.count, 0);
|
|
assert_eq!(container.bytes, 0);
|
|
assert!(container.last_modified.is_some());
|
|
}
|
|
|
|
#[test]
|
|
fn test_bucket_info_to_container_wrong_tenant() {
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
let hash = mapper.hash_project_id("abc123");
|
|
let bucket_name = format!("{}-mycontainer", hash);
|
|
|
|
let info = BucketInfo {
|
|
name: bucket_name,
|
|
created: Some(OffsetDateTime::now_utc()),
|
|
deleted: None,
|
|
versioning: false,
|
|
object_locking: false,
|
|
};
|
|
|
|
// Different project_id should return None (different hash)
|
|
let container = bucket_info_to_container(&info, &mapper, "xyz789");
|
|
assert!(container.is_none());
|
|
}
|
|
|
|
#[test]
|
|
fn test_validate_container_name_valid() {
|
|
assert!(validate_container_name("mycontainer").is_ok());
|
|
assert!(validate_container_name("my-container").is_ok());
|
|
assert!(validate_container_name("my_container").is_ok());
|
|
assert!(validate_container_name("my.container").is_ok());
|
|
assert!(validate_container_name("123").is_ok());
|
|
}
|
|
|
|
#[test]
|
|
fn test_validate_container_name_empty() {
|
|
let result = validate_container_name("");
|
|
assert!(result.is_err());
|
|
match result {
|
|
Err(SwiftError::BadRequest(msg)) => {
|
|
assert!(msg.contains("empty"));
|
|
}
|
|
_ => panic!("Expected BadRequest error"),
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_validate_container_name_too_long() {
|
|
let long_name = "a".repeat(257);
|
|
let result = validate_container_name(&long_name);
|
|
assert!(result.is_err());
|
|
match result {
|
|
Err(SwiftError::BadRequest(msg)) => {
|
|
assert!(msg.contains("too long"));
|
|
}
|
|
_ => panic!("Expected BadRequest error"),
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_validate_container_name_with_slash() {
|
|
let result = validate_container_name("my/container");
|
|
assert!(result.is_err());
|
|
match result {
|
|
Err(SwiftError::BadRequest(msg)) => {
|
|
assert!(msg.contains("'/'"));
|
|
}
|
|
_ => panic!("Expected BadRequest error"),
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn test_no_tenant_collision_with_separator_in_names() {
|
|
// This test verifies that the collision vulnerability identified by Codex is fixed.
|
|
// With "--" separator: ("a", "b--c") and ("a--b", "c") both produced "a--b--c" (COLLISION!)
|
|
// With "/" separator: ("a", "b--c") → "a/b--c" and ("a--b", "c") → "a--b/c" (but "/" breaks S3)
|
|
// With hash: Uses SHA256 of project_id as prefix - cryptographically secure, no collisions
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
// These should map to DIFFERENT buckets using different hash prefixes
|
|
let bucket1 = mapper.swift_to_s3_bucket("b--c", "a");
|
|
let bucket2 = mapper.swift_to_s3_bucket("c", "a--b");
|
|
assert_ne!(bucket1, bucket2, "Collision detected! Tenant isolation broken.");
|
|
|
|
// Verify bucket names use hash prefixes
|
|
let hash_a = mapper.hash_project_id("a");
|
|
let hash_ab = mapper.hash_project_id("a--b");
|
|
assert_eq!(bucket1, format!("{}-b--c", hash_a));
|
|
assert_eq!(bucket2, format!("{}-c", hash_ab));
|
|
|
|
// Verify hashes are different (no collision)
|
|
assert_ne!(hash_a, hash_ab);
|
|
|
|
// Verify correct tenant ownership - each bucket belongs to only ONE tenant
|
|
assert!(mapper.bucket_belongs_to_project(&bucket1, "a"));
|
|
assert!(!mapper.bucket_belongs_to_project(&bucket1, "a--b"));
|
|
|
|
assert!(mapper.bucket_belongs_to_project(&bucket2, "a--b"));
|
|
assert!(!mapper.bucket_belongs_to_project(&bucket2, "a"));
|
|
|
|
// Verify reverse mapping works correctly
|
|
assert_eq!(mapper.s3_to_swift_container(&bucket1, "a"), Some("b--c".to_string()));
|
|
assert_eq!(mapper.s3_to_swift_container(&bucket1, "a--b"), None);
|
|
|
|
assert_eq!(mapper.s3_to_swift_container(&bucket2, "a--b"), Some("c".to_string()));
|
|
assert_eq!(mapper.s3_to_swift_container(&bucket2, "a"), None);
|
|
}
|
|
|
|
#[test]
|
|
fn test_hash_deterministic() {
|
|
// Verify that hashing is deterministic (same input always produces same output)
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
let hash1 = mapper.hash_project_id("test-project");
|
|
let hash2 = mapper.hash_project_id("test-project");
|
|
assert_eq!(hash1, hash2, "Hash must be deterministic");
|
|
|
|
// Verify hash format (16 lowercase hex characters)
|
|
assert_eq!(hash1.len(), 16);
|
|
assert!(hash1.chars().all(|c| c.is_ascii_hexdigit() && !c.is_ascii_uppercase()));
|
|
}
|
|
|
|
#[test]
|
|
fn test_hash_s3_compatible() {
|
|
// Verify bucket names are S3-compatible (only use [a-z0-9-])
|
|
let mapper = ContainerMapper::new(ContainerMapperConfig {
|
|
tenant_prefix_enabled: true,
|
|
});
|
|
|
|
let bucket = mapper.swift_to_s3_bucket("mycontainer", "test-project-123");
|
|
|
|
// Check all characters are S3-compatible
|
|
for c in bucket.chars() {
|
|
assert!(
|
|
c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-',
|
|
"Bucket name contains invalid character: {}",
|
|
c
|
|
);
|
|
}
|
|
|
|
// Verify starts with lowercase letter or digit (not dash)
|
|
let first_char = bucket.chars().next().unwrap();
|
|
assert!(first_char.is_ascii_lowercase() || first_char.is_ascii_digit());
|
|
}
|
|
|
|
#[test]
|
|
fn test_s3_tags_to_swift_metadata() {
|
|
let tagging = Tagging {
|
|
tag_set: vec![
|
|
Tag {
|
|
key: Some("swift-meta-color".to_string()),
|
|
value: Some("blue".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("swift-meta-description".to_string()),
|
|
value: Some("test container".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("other-tag".to_string()),
|
|
value: Some("should-be-ignored".to_string()),
|
|
},
|
|
],
|
|
};
|
|
|
|
let metadata = s3_tags_to_swift_metadata(&tagging);
|
|
assert_eq!(metadata.len(), 2);
|
|
assert_eq!(metadata.get("color"), Some(&"blue".to_string()));
|
|
assert_eq!(metadata.get("description"), Some(&"test container".to_string()));
|
|
assert!(!metadata.contains_key("other-tag"));
|
|
}
|
|
|
|
#[test]
|
|
fn test_s3_tags_to_swift_metadata_empty() {
|
|
let tagging = Tagging { tag_set: vec![] };
|
|
|
|
let metadata = s3_tags_to_swift_metadata(&tagging);
|
|
assert!(metadata.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn test_s3_tags_to_swift_metadata_no_swift_tags() {
|
|
let tagging = Tagging {
|
|
tag_set: vec![
|
|
Tag {
|
|
key: Some("env".to_string()),
|
|
value: Some("production".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("team".to_string()),
|
|
value: Some("backend".to_string()),
|
|
},
|
|
],
|
|
};
|
|
|
|
let metadata = s3_tags_to_swift_metadata(&tagging);
|
|
assert!(metadata.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn test_metadata_roundtrip() {
|
|
// What a POST writes must be what a HEAD reads back: run the items
|
|
// through the tag-merge write path and the tag-parse read path.
|
|
let update = MetadataUpdate::default()
|
|
.set("color", "blue")
|
|
.set("owner", "alice")
|
|
.set("priority", "high");
|
|
|
|
let tagging = update
|
|
.apply_to_tags(None, CONTAINER_META_TAG_PREFIX)
|
|
.expect("merge should be accepted");
|
|
let recovered = s3_tags_to_swift_metadata(&tagging);
|
|
|
|
assert_eq!(recovered.len(), 3);
|
|
assert_eq!(recovered.get("color").map(String::as_str), Some("blue"));
|
|
assert_eq!(recovered.get("owner").map(String::as_str), Some("alice"));
|
|
assert_eq!(recovered.get("priority").map(String::as_str), Some("high"));
|
|
}
|
|
|
|
#[test]
|
|
fn test_tag_preservation_merge_with_existing() {
|
|
// A container metadata POST shares its tag set with the container ACL
|
|
// and versioning tags, and with whatever S3 tags the bucket carries.
|
|
// Only the swift-meta-* items the POST names may change.
|
|
let existing = Tagging {
|
|
tag_set: vec![
|
|
Tag {
|
|
key: Some("swift-meta-color".to_string()),
|
|
value: Some("blue".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("swift-acl-read".to_string()),
|
|
value: Some(".r:*".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("swift-versions-location".to_string()),
|
|
value: Some("archive".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("env".to_string()),
|
|
value: Some("production".to_string()),
|
|
},
|
|
],
|
|
};
|
|
|
|
let merged = MetadataUpdate::default()
|
|
.set("description", "test")
|
|
.apply_to_tags(Some(&existing), CONTAINER_META_TAG_PREFIX)
|
|
.expect("merge should be accepted");
|
|
let tag = |key: &str| {
|
|
merged
|
|
.tag_set
|
|
.iter()
|
|
.find(|t| t.key.as_deref() == Some(key))
|
|
.and_then(|t| t.value.as_deref())
|
|
};
|
|
|
|
assert_eq!(tag("swift-meta-description"), Some("test"), "the new item should be added");
|
|
assert_eq!(tag("swift-meta-color"), Some("blue"), "an unnamed item should be preserved");
|
|
assert_eq!(tag("swift-acl-read"), Some(".r:*"), "the ACL tag should be preserved");
|
|
assert_eq!(tag("swift-versions-location"), Some("archive"), "the versioning tag should be preserved");
|
|
assert_eq!(tag("env"), Some("production"), "non-Swift tags should be preserved");
|
|
assert_eq!(merged.tag_set.len(), 5);
|
|
}
|
|
|
|
#[test]
|
|
fn test_tag_preservation_remove_only_swift() {
|
|
// Removing the last container metadata item leaves the other tags —
|
|
// and so must not clear the tagging config.
|
|
let existing = Tagging {
|
|
tag_set: vec![
|
|
Tag {
|
|
key: Some("swift-meta-color".to_string()),
|
|
value: Some("blue".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("env".to_string()),
|
|
value: Some("production".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("cost-center".to_string()),
|
|
value: Some("engineering".to_string()),
|
|
},
|
|
],
|
|
};
|
|
|
|
let merged = MetadataUpdate::default()
|
|
.remove("color")
|
|
.apply_to_tags(Some(&existing), CONTAINER_META_TAG_PREFIX)
|
|
.expect("merge should be accepted");
|
|
|
|
assert_eq!(merged.tag_set.len(), 2);
|
|
assert!(merged.tag_set.iter().any(|t| t.key.as_deref() == Some("env")));
|
|
assert!(merged.tag_set.iter().any(|t| t.key.as_deref() == Some("cost-center")));
|
|
assert!(
|
|
!merged
|
|
.tag_set
|
|
.iter()
|
|
.any(|t| t.key.as_ref().is_some_and(|k| k.starts_with(CONTAINER_META_TAG_PREFIX))),
|
|
"the removed item should be gone"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_tag_preservation_empty_after_swift_removal() {
|
|
// Removing every item when nothing else is tagged empties the tag set,
|
|
// which is how the caller knows to clear the tagging config.
|
|
let existing = Tagging {
|
|
tag_set: vec![
|
|
Tag {
|
|
key: Some("swift-meta-color".to_string()),
|
|
value: Some("blue".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("swift-meta-owner".to_string()),
|
|
value: Some("alice".to_string()),
|
|
},
|
|
],
|
|
};
|
|
|
|
let merged = MetadataUpdate::default()
|
|
.remove("color")
|
|
.remove("owner")
|
|
.apply_to_tags(Some(&existing), CONTAINER_META_TAG_PREFIX)
|
|
.expect("merge should be accepted");
|
|
|
|
assert!(merged.tag_set.is_empty(), "tagging should be empty after removing every swift-meta-* tag");
|
|
}
|
|
|
|
// Object Versioning Tests
|
|
|
|
#[test]
|
|
fn test_validate_versioning_container_names() {
|
|
// Test that container and archive must be different
|
|
// This is a unit test that doesn't require storage layer
|
|
let container = "mycontainer";
|
|
let archive = "mycontainer"; // Same as container
|
|
|
|
// In enable_versioning, this would return an error
|
|
assert_eq!(container, archive);
|
|
// Would fail: enable_versioning(account, container, archive, creds).await
|
|
}
|
|
|
|
#[test]
|
|
fn test_versioning_tag_format() {
|
|
// Test versioning tag format
|
|
let mut tagging = Tagging { tag_set: vec![] };
|
|
|
|
tagging.tag_set.push(Tag {
|
|
key: Some("swift-versions-location".to_string()),
|
|
value: Some("archive-container".to_string()),
|
|
});
|
|
|
|
assert_eq!(tagging.tag_set.len(), 1);
|
|
assert_eq!(tagging.tag_set[0].key.as_deref(), Some("swift-versions-location"));
|
|
assert_eq!(tagging.tag_set[0].value.as_deref(), Some("archive-container"));
|
|
}
|
|
|
|
#[test]
|
|
fn test_versioning_tag_extraction() {
|
|
// Test extracting versioning location from tags
|
|
let tagging = Tagging {
|
|
tag_set: vec![
|
|
Tag {
|
|
key: Some("swift-meta-color".to_string()),
|
|
value: Some("red".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("swift-versions-location".to_string()),
|
|
value: Some("my-archive".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("env".to_string()),
|
|
value: Some("prod".to_string()),
|
|
},
|
|
],
|
|
};
|
|
|
|
// Find versioning tag
|
|
let versions_location = tagging
|
|
.tag_set
|
|
.iter()
|
|
.find(|tag| tag.key.as_deref() == Some("swift-versions-location"))
|
|
.and_then(|tag| tag.value.clone());
|
|
|
|
assert_eq!(versions_location, Some("my-archive".to_string()));
|
|
}
|
|
|
|
#[test]
|
|
fn test_versioning_tag_removal() {
|
|
// Test removing versioning tag while preserving others
|
|
let mut tagging = Tagging {
|
|
tag_set: vec![
|
|
Tag {
|
|
key: Some("swift-meta-color".to_string()),
|
|
value: Some("red".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("swift-versions-location".to_string()),
|
|
value: Some("my-archive".to_string()),
|
|
},
|
|
Tag {
|
|
key: Some("env".to_string()),
|
|
value: Some("prod".to_string()),
|
|
},
|
|
],
|
|
};
|
|
|
|
// Remove versioning tag
|
|
tagging
|
|
.tag_set
|
|
.retain(|tag| tag.key.as_deref() != Some("swift-versions-location"));
|
|
|
|
// Verify: versioning tag removed, others preserved
|
|
assert_eq!(tagging.tag_set.len(), 2);
|
|
assert!(tagging.tag_set.iter().any(|t| t.key.as_deref() == Some("swift-meta-color")));
|
|
assert!(tagging.tag_set.iter().any(|t| t.key.as_deref() == Some("env")));
|
|
assert!(
|
|
!tagging
|
|
.tag_set
|
|
.iter()
|
|
.any(|t| t.key.as_deref() == Some("swift-versions-location"))
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_versioning_tag_update() {
|
|
// Test updating versioning location
|
|
let mut tagging = Tagging {
|
|
tag_set: vec![Tag {
|
|
key: Some("swift-versions-location".to_string()),
|
|
value: Some("old-archive".to_string()),
|
|
}],
|
|
};
|
|
|
|
// Remove old versioning tag
|
|
tagging
|
|
.tag_set
|
|
.retain(|tag| tag.key.as_deref() != Some("swift-versions-location"));
|
|
|
|
// Add new versioning tag
|
|
tagging.tag_set.push(Tag {
|
|
key: Some("swift-versions-location".to_string()),
|
|
value: Some("new-archive".to_string()),
|
|
});
|
|
|
|
// Verify update
|
|
assert_eq!(tagging.tag_set.len(), 1);
|
|
assert_eq!(tagging.tag_set[0].value.as_deref(), Some("new-archive"));
|
|
}
|
|
|
|
#[test]
|
|
fn nonempty_container_usage_preserves_authoritative_totals() {
|
|
let usage = std::collections::HashMap::from([("tenant-container".to_string(), (7, 4097))]);
|
|
|
|
assert_eq!(
|
|
required_bucket_usage(&usage, "tenant-container").expect("authoritative bucket usage"),
|
|
(7, 4097)
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn missing_container_usage_fails_closed() {
|
|
let usage = std::collections::HashMap::new();
|
|
|
|
assert!(matches!(
|
|
required_bucket_usage(&usage, "tenant-container"),
|
|
Err(SwiftError::ServiceUnavailable(_))
|
|
));
|
|
}
|
|
}
|