唐小鸭 ce9b69d811 fix(replication): deny non-owner replication config edits under site replication ...

Under site replication a user holding only bucket-scoped
s3:PutReplicationConfiguration could rewrite or erase the operator-managed
site-repl-* rules, with the change broadcast to every peer (backlog#1948,
audit A1/P2-17).

- Gate PutBucketReplication/DeleteBucketReplication in the S3 handlers:
  when site replication is enabled and the requester is not the owner,
  return MinIO-parity XMinioReplicationDenyEdit (HTTP 400). The gate runs
  after policy authorization and only on the external S3 path; the
  reconciler and peer bucket-meta ingestion are unaffected.
- Defense in depth in the bucket usecase: PUT merges the incoming config
  with the stored site-repl-* rules (same merge as peer ingestion) instead
  of overwriting verbatim; DELETE keeps the site-repl-* rules and never
  garbage-collects a bucket target a surviving site-replication rule still
  references.
- Move is_site_replication_rule / merge_incoming_replication_config /
  replication_target_arn_deployment_id from the admin site-replication
  handler down to rustfs-replication so the app layer can reuse them
  without new layering violations.

2026-08-21 19:17:34 +08:00

..

src

fix(replication): deny non-owner replication config edits under site replication

2026-08-21 19:17:34 +08:00

tests

test(replication): add mixed-version MRF acceptance matrix (#5673)

2026-08-03 22:09:59 +08:00

Cargo.toml

feat: extend hotpath coverage across crates (#5505)

2026-07-31 05:42:19 +00:00