mirror of
https://github.com/rustfs/rustfs.git
synced 2026-07-26 16:28:15 +00:00
Zhengchao An
776f7ee83f
The individual policy layers were tested in isolation, but the cross-layer resolution — which layer wins when IAM and bucket policy disagree — had no coverage. A priority error there is a data-exposure or data-lockout bug. Add crates/policy/tests/bucket_iam_authz_matrix.rs, a pure table-driven test (no globals, no IAM store, no server) that drives the real Policy::is_allowed and BucketPolicy::is_allowed through a helper modeling the request-layer orchestration in rustfs::storage::access::authorize_request (bucket explicit-Deny gate -> IAM allow -> bucket allow fallback; anonymous = bucket policy alone). It pins all four Allow/Deny quadrants plus the anonymous case, and adds intra-policy Deny-beats-Allow checks for both layers. The matrix surfaces the resolution invariant explicitly: a BUCKET explicit Deny is a hard gate and always wins, but an IAM explicit Deny is SOFT — a bucket Allow fallback overrides it, which diverges from AWS "an explicit Deny in any policy always wins". The test characterizes the current (MinIO-lineage) behavior; if IAM Deny is later hardened into a gate, iam_deny_x_bucket_allow flips to false and must be updated deliberately. Refs: backlog#1151 (sec-8) Co-authored-by: houseme <housemecn@gmail.com>