mirror of
https://github.com/rustfs/rustfs.git
synced 2026-11-01 16:50:45 +00:00
Martin Claesson
c47c8f9f74
* fix(sftp): allow bucket-scoped root listings Listing the SFTP root required s3:ListAllMyBuckets. Without it a bucket-scoped user got PermissionDenied on `ls /`; with it they saw every bucket on the instance. S3 ListBuckets and the WebDAV root (#6298) already fall back to a per-bucket filtered listing. When the global ListAllMyBuckets check is denied, list buckets through the session-aware ListBuckets path instead, so IAM filters the result to buckets the principal may ListBucket or GetBucketLocation. Principals with ListAllMyBuckets keep the unfiltered listing, and IAM outages and timeouts still fail as before. list_buckets_for_session and its request builder were WebDAV-only; they are now also compiled with the sftp feature. * fix(protocols): re-check the session key for bucket-scoped listings list_buckets_for_session built its request from the identity captured at login. Through the SFTP root-listing fallback, a service account disabled or expired after login could keep listing bucket names, unfiltered when its parent may list every bucket. Validate the session key with check_key_valid_with_context, as authorize_protocol_request does for every other protocol operation, build the request from the fresh credentials and is_owner, map an invalid key to AccessDenied, and attach the server context. The SFTP fallback now passes the session's request headers and transport security, like every other SFTP authorization. DummyBackend fails closed when no session listing is queued, matching the trait default, and gains a stall_authorization hook. New tests cover a service account disabled mid-session, IAM outage and timeout on the global check (no fallback), non-AccessDenied backend errors, truncation of fallback output and the fail-closed default. * test(protocols): compare error code without referencing s3s The session-listing test compared against s3s::S3ErrorCode, which made policy_test.rs a new s3s-referencing file and tripped the s3s footprint ratchet (210 files against a baseline of 209). Compare the code's string form instead. * fix(protocols): refresh session bucket discovery without stale copies Build bucket listing requests directly from freshly validated credentials and server-scoped ownership instead of cloning and replacing login state. Reuse the same authorization path for WebDAV capacity discovery. Preserve typed access-denied checks through the protocol facade, and cover request conditions, session-policy updates, revocation, listing bounds, and fallback deadlines with regression tests. Co-Authored-By: heihutu <heihutu@gmail.com> Co-Authored-By: zhi22915 <qiuzgang@gmail.com> --------- Co-authored-by: Hauser <housemecn@gmail.com> Co-authored-by: heihutu <heihutu@gmail.com> Co-authored-by: zhi22915 <qiuzgang@gmail.com>