diff options
| author | Chris Lu <chrislusf@users.noreply.github.com> | 2025-11-12 22:14:50 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-11-12 22:14:50 -0800 |
| commit | 508d06d9a5c763668ba149a8f1182e8552505c2b (patch) | |
| tree | a34d21d801d2b71dc3c6968cbb4ff8568e0fa8da /weed/s3api/policy_engine/engine_test.go | |
| parent | 50f067bcfd99ecf1821ba2d34fc2f109e90428bb (diff) | |
| download | seaweedfs-508d06d9a5c763668ba149a8f1182e8552505c2b.tar.xz seaweedfs-508d06d9a5c763668ba149a8f1182e8552505c2b.zip | |
S3: Enforce bucket policy (#7471)
* evaluate policies during authorization
* cache bucket policy
* refactor
* matching with regex special characters
* Case Sensitivity, pattern cache, Dead Code Removal
* Fixed Typo, Restored []string Case, Added Cache Size Limit
* hook up with policy engine
* remove old implementation
* action mapping
* validate
* if not specified, fall through to IAM checks
* fmt
* Fail-close on policy evaluation errors
* Explicit `Allow` bypasses IAM checks
* fix error message
* arn:seaweed => arn:aws
* remove legacy support
* fix tests
* Clean up bucket policy after this test
* fix for tests
* address comments
* security fixes
* fix tests
* temp comment out
Diffstat (limited to 'weed/s3api/policy_engine/engine_test.go')
| -rw-r--r-- | weed/s3api/policy_engine/engine_test.go | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/weed/s3api/policy_engine/engine_test.go b/weed/s3api/policy_engine/engine_test.go index 799579ce6..1bb36dc4a 100644 --- a/weed/s3api/policy_engine/engine_test.go +++ b/weed/s3api/policy_engine/engine_test.go @@ -76,8 +76,8 @@ func TestPolicyEngine(t *testing.T) { } result = engine.EvaluatePolicy("test-bucket", args) - if result != PolicyResultDeny { - t.Errorf("Expected Deny for non-matching action, got %v", result) + if result != PolicyResultIndeterminate { + t.Errorf("Expected Indeterminate for non-matching action (should fall through to IAM), got %v", result) } // Test GetBucketPolicy @@ -471,8 +471,8 @@ func TestPolicyEvaluationWithConditions(t *testing.T) { // Test non-matching IP args.Conditions["aws:SourceIp"] = []string{"10.0.0.1"} result = engine.EvaluatePolicy("test-bucket", args) - if result != PolicyResultDeny { - t.Errorf("Expected Deny for non-matching IP, got %v", result) + if result != PolicyResultIndeterminate { + t.Errorf("Expected Indeterminate for non-matching IP (should fall through to IAM), got %v", result) } } |