mirror of
https://github.com/chrislusf/seaweedfs
synced 2025-07-26 05:22:46 +02:00
26403e8a0d
* fix GetObjectLockConfigurationHandler * cache and use bucket object lock config * subscribe to bucket configuration changes * increase bucket config cache TTL * refactor * Update weed/s3api/s3api_server.go Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> * avoid duplidated work * rename variable * Update s3api_object_handlers_put.go * fix routing * admin ui and api handler are consistent now * use fields instead of xml * fix test * address comments * Update weed/s3api/s3api_object_handlers_put.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update test/s3/retention/s3_retention_test.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * Update weed/s3api/object_lock_utils.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * change error style * errorf * read entry once * add s3 tests for object lock and retention * use marker * install s3 tests * Update s3tests.yml * Update s3tests.yml * Update s3tests.conf * Update s3tests.conf * address test errors * address test errors With these fixes, the s3-tests should now: ✅ Return InvalidBucketState (409 Conflict) for object lock operations on invalid buckets ✅ Return MalformedXML for invalid retention configurations ✅ Include VersionId in response headers when available ✅ Return proper HTTP status codes (403 Forbidden for retention mode changes) ✅ Handle all object lock validation errors consistently * fixes With these comprehensive fixes, the s3-tests should now: ✅ Return InvalidBucketState (409 Conflict) for object lock operations on invalid buckets ✅ Return InvalidRetentionPeriod for invalid retention periods ✅ Return MalformedXML for malformed retention configurations ✅ Include VersionId in response headers when available ✅ Return proper HTTP status codes for all error conditions ✅ Handle all object lock validation errors consistently The workflow should now pass significantly more object lock tests, bringing SeaweedFS's S3 object lock implementation much closer to AWS S3 compatibility standards. * fixes With these final fixes, the s3-tests should now: ✅ Return MalformedXML for ObjectLockEnabled: 'Disabled' ✅ Return MalformedXML when both Days and Years are specified in retention configuration ✅ Return InvalidBucketState (409 Conflict) when trying to suspend versioning on buckets with object lock enabled ✅ Handle all object lock validation errors consistently with proper error codes * constants and fixes ✅ Return InvalidRetentionPeriod for invalid retention values (0 days, negative years) ✅ Return ObjectLockConfigurationNotFoundError when object lock configuration doesn't exist ✅ Handle all object lock validation errors consistently with proper error codes * fixes ✅ Return MalformedXML when both Days and Years are specified in the same retention configuration ✅ Return 400 (Bad Request) with InvalidRequest when object lock operations are attempted on buckets without object lock enabled ✅ Handle all object lock validation errors consistently with proper error codes * fixes ✅ Return 409 (Conflict) with InvalidBucketState for bucket-level object lock configuration operations on buckets without object lock enabled ✅ Allow increasing retention periods and overriding retention with same/later dates ✅ Only block decreasing retention periods without proper bypass permissions ✅ Handle all object lock validation errors consistently with proper error codes * fixes ✅ Include VersionId in multipart upload completion responses when versioning is enabled ✅ Block retention mode changes (GOVERNANCE ↔ COMPLIANCE) without bypass permissions ✅ Handle all object lock validation errors consistently with proper error codes ✅ Pass the remaining object lock tests * fix tests * fixes * pass tests * fix tests * fixes * add error mapping * Update s3tests.conf * fix test_object_lock_put_obj_lock_invalid_days * fixes * fix many issues * fix test_object_lock_delete_multipart_object_with_legal_hold_on * fix tests * refactor * fix test_object_lock_delete_object_with_retention_and_marker * fix tests * fix tests * fix tests * fix test itself * fix tests * fix test * Update weed/s3api/s3api_object_retention.go Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> * reduce logs * address comments --------- Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
662 lines
25 KiB
Go
662 lines
25 KiB
Go
package s3api
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http/httptest"
|
|
"strconv"
|
|
"testing"
|
|
"time"
|
|
|
|
"errors"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
|
|
"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
// TestExtractObjectLockMetadataFromRequest tests the function that extracts
|
|
// object lock headers from PUT requests and stores them in Extended attributes.
|
|
// This test would have caught the bug where object lock headers were ignored.
|
|
func TestExtractObjectLockMetadataFromRequest(t *testing.T) {
|
|
s3a := &S3ApiServer{}
|
|
|
|
t.Run("Extract COMPLIANCE mode and retention date", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
// Verify mode was stored
|
|
assert.Contains(t, entry.Extended, s3_constants.ExtObjectLockModeKey)
|
|
assert.Equal(t, "COMPLIANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
|
|
|
|
// Verify retention date was stored
|
|
assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
|
|
storedTimestamp, err := strconv.ParseInt(string(entry.Extended[s3_constants.ExtRetentionUntilDateKey]), 10, 64)
|
|
assert.NoError(t, err)
|
|
storedTime := time.Unix(storedTimestamp, 0)
|
|
assert.WithinDuration(t, retainUntilDate, storedTime, 1*time.Second)
|
|
})
|
|
|
|
t.Run("Extract GOVERNANCE mode and retention date", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(12 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
assert.Equal(t, "GOVERNANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
|
|
assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
|
|
})
|
|
|
|
t.Run("Extract legal hold ON", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
assert.Contains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
|
|
assert.Equal(t, "ON", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
|
|
})
|
|
|
|
t.Run("Extract legal hold OFF", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "OFF")
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
assert.Contains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
|
|
assert.Equal(t, "OFF", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
|
|
})
|
|
|
|
t.Run("Handle all object lock headers together", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
// All metadata should be stored
|
|
assert.Equal(t, "COMPLIANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
|
|
assert.Contains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
|
|
assert.Equal(t, "ON", string(entry.Extended[s3_constants.ExtLegalHoldKey]))
|
|
})
|
|
|
|
t.Run("Handle no object lock headers", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
// No object lock headers set
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
// No object lock metadata should be stored
|
|
assert.NotContains(t, entry.Extended, s3_constants.ExtObjectLockModeKey)
|
|
assert.NotContains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
|
|
assert.NotContains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
|
|
})
|
|
|
|
t.Run("Handle invalid retention date - should return error", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, "invalid-date")
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrInvalidRetentionDateFormat))
|
|
|
|
// Mode should be stored but not invalid date
|
|
assert.Equal(t, "GOVERNANCE", string(entry.Extended[s3_constants.ExtObjectLockModeKey]))
|
|
assert.NotContains(t, entry.Extended, s3_constants.ExtRetentionUntilDateKey)
|
|
})
|
|
|
|
t.Run("Handle invalid legal hold value - should return error", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "INVALID")
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrInvalidLegalHoldStatus))
|
|
|
|
// No legal hold metadata should be stored due to error
|
|
assert.NotContains(t, entry.Extended, s3_constants.ExtLegalHoldKey)
|
|
})
|
|
}
|
|
|
|
// TestAddObjectLockHeadersToResponse tests the function that adds object lock
|
|
// metadata from Extended attributes to HTTP response headers.
|
|
// This test would have caught the bug where HEAD responses didn't include object lock metadata.
|
|
func TestAddObjectLockHeadersToResponse(t *testing.T) {
|
|
s3a := &S3ApiServer{}
|
|
|
|
t.Run("Add COMPLIANCE mode and retention date to response", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
retainUntilTime := time.Now().Add(24 * time.Hour)
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtObjectLockModeKey: []byte("COMPLIANCE"),
|
|
s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// Verify headers were set
|
|
assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
|
|
// Verify the date format is correct
|
|
returnedDate := w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate)
|
|
parsedTime, err := time.Parse(time.RFC3339, returnedDate)
|
|
assert.NoError(t, err)
|
|
assert.WithinDuration(t, retainUntilTime, parsedTime, 1*time.Second)
|
|
})
|
|
|
|
t.Run("Add GOVERNANCE mode to response", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
})
|
|
|
|
t.Run("Add legal hold ON to response", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtLegalHoldKey: []byte("ON"),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Add legal hold OFF to response", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtLegalHoldKey: []byte("OFF"),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Add all object lock headers to response", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
retainUntilTime := time.Now().Add(12 * time.Hour)
|
|
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
|
|
s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
|
|
s3_constants.ExtLegalHoldKey: []byte("ON"),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// All headers should be set
|
|
assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Handle entry with no object lock metadata", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
"other-metadata": []byte("some-value"),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// No object lock headers should be set for entries without object lock metadata
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Handle entry with object lock mode but no legal hold - should default to OFF", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtObjectLockModeKey: []byte("GOVERNANCE"),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// Should set mode and default legal hold to OFF
|
|
assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Handle entry with retention date but no legal hold - should default to OFF", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
retainUntilTime := time.Now().Add(24 * time.Hour)
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtRetentionUntilDateKey: []byte(strconv.FormatInt(retainUntilTime.Unix(), 10)),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// Should set retention date and default legal hold to OFF
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
assert.Equal(t, "OFF", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Handle nil entry gracefully", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
|
|
// Should not panic
|
|
s3a.addObjectLockHeadersToResponse(w, nil)
|
|
|
|
// No headers should be set
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Handle entry with nil Extended map gracefully", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
entry := &filer_pb.Entry{
|
|
Extended: nil,
|
|
}
|
|
|
|
// Should not panic
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// No headers should be set
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
})
|
|
|
|
t.Run("Handle invalid retention timestamp gracefully", func(t *testing.T) {
|
|
w := httptest.NewRecorder()
|
|
entry := &filer_pb.Entry{
|
|
Extended: map[string][]byte{
|
|
s3_constants.ExtObjectLockModeKey: []byte("COMPLIANCE"),
|
|
s3_constants.ExtRetentionUntilDateKey: []byte("invalid-timestamp"),
|
|
},
|
|
}
|
|
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// Mode should be set but not retention date due to invalid timestamp
|
|
assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.Empty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
})
|
|
}
|
|
|
|
// TestObjectLockHeaderRoundTrip tests the complete round trip:
|
|
// extract from request → store in Extended attributes → add to response
|
|
func TestObjectLockHeaderRoundTrip(t *testing.T) {
|
|
s3a := &S3ApiServer{}
|
|
|
|
t.Run("Complete round trip for COMPLIANCE mode", func(t *testing.T) {
|
|
// 1. Create request with object lock headers
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
|
|
|
|
// 2. Extract and store in Extended attributes
|
|
entry := &filer_pb.Entry{
|
|
Extended: make(map[string][]byte),
|
|
}
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
// 3. Add to response headers
|
|
w := httptest.NewRecorder()
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
// 4. Verify round trip preserved all data
|
|
assert.Equal(t, "COMPLIANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.Equal(t, "ON", w.Header().Get(s3_constants.AmzObjectLockLegalHold))
|
|
|
|
returnedDate := w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate)
|
|
parsedTime, err := time.Parse(time.RFC3339, returnedDate)
|
|
assert.NoError(t, err)
|
|
assert.WithinDuration(t, retainUntilDate, parsedTime, 1*time.Second)
|
|
})
|
|
|
|
t.Run("Complete round trip for GOVERNANCE mode", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(12 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
entry := &filer_pb.Entry{Extended: make(map[string][]byte)}
|
|
err := s3a.extractObjectLockMetadataFromRequest(req, entry)
|
|
assert.NoError(t, err)
|
|
|
|
w := httptest.NewRecorder()
|
|
s3a.addObjectLockHeadersToResponse(w, entry)
|
|
|
|
assert.Equal(t, "GOVERNANCE", w.Header().Get(s3_constants.AmzObjectLockMode))
|
|
assert.NotEmpty(t, w.Header().Get(s3_constants.AmzObjectLockRetainUntilDate))
|
|
})
|
|
}
|
|
|
|
// TestValidateObjectLockHeaders tests the validateObjectLockHeaders function
|
|
// to ensure proper validation of object lock headers in PUT requests
|
|
func TestValidateObjectLockHeaders(t *testing.T) {
|
|
s3a := &S3ApiServer{}
|
|
|
|
t.Run("Valid COMPLIANCE mode with retention date on versioned bucket", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.NoError(t, err)
|
|
})
|
|
|
|
t.Run("Valid GOVERNANCE mode with retention date on versioned bucket", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(12 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.NoError(t, err)
|
|
})
|
|
|
|
t.Run("Valid legal hold ON on versioned bucket", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.NoError(t, err)
|
|
})
|
|
|
|
t.Run("Valid legal hold OFF on versioned bucket", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "OFF")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.NoError(t, err)
|
|
})
|
|
|
|
t.Run("Invalid object lock mode", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "INVALID_MODE")
|
|
retainUntilDate := time.Now().Add(24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrInvalidObjectLockMode))
|
|
})
|
|
|
|
t.Run("Invalid legal hold status", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "INVALID_STATUS")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrInvalidLegalHoldStatus))
|
|
})
|
|
|
|
t.Run("Object lock headers on non-versioned bucket", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
retainUntilDate := time.Now().Add(24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrObjectLockVersioningRequired))
|
|
})
|
|
|
|
t.Run("Invalid retention date format", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, "invalid-date-format")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrInvalidRetentionDateFormat))
|
|
})
|
|
|
|
t.Run("Retention date in the past", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
pastDate := time.Now().Add(-24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, pastDate.Format(time.RFC3339))
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrRetentionDateMustBeFuture))
|
|
})
|
|
|
|
t.Run("Mode without retention date", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "COMPLIANCE")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrObjectLockModeRequiresDate))
|
|
})
|
|
|
|
t.Run("Retention date without mode", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(24 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrRetentionDateRequiresMode))
|
|
})
|
|
|
|
t.Run("Governance bypass header on non-versioned bucket", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set("x-amz-bypass-governance-retention", "true")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, false) // non-versioned bucket
|
|
assert.Error(t, err)
|
|
assert.True(t, errors.Is(err, ErrGovernanceBypassVersioningRequired))
|
|
})
|
|
|
|
t.Run("Governance bypass header on versioned bucket should pass", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
req.Header.Set("x-amz-bypass-governance-retention", "true")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.NoError(t, err)
|
|
})
|
|
|
|
t.Run("No object lock headers should pass", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
// No object lock headers set
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.NoError(t, err)
|
|
})
|
|
|
|
t.Run("Mixed valid headers should pass", func(t *testing.T) {
|
|
req := httptest.NewRequest("PUT", "/bucket/object", nil)
|
|
retainUntilDate := time.Now().Add(48 * time.Hour)
|
|
req.Header.Set(s3_constants.AmzObjectLockMode, "GOVERNANCE")
|
|
req.Header.Set(s3_constants.AmzObjectLockRetainUntilDate, retainUntilDate.Format(time.RFC3339))
|
|
req.Header.Set(s3_constants.AmzObjectLockLegalHold, "ON")
|
|
|
|
err := s3a.validateObjectLockHeaders(req, true) // versioned bucket
|
|
assert.NoError(t, err)
|
|
})
|
|
}
|
|
|
|
// TestMapValidationErrorToS3Error tests the error mapping function
|
|
func TestMapValidationErrorToS3Error(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
inputError error
|
|
expectedCode s3err.ErrorCode
|
|
}{
|
|
{
|
|
name: "ErrObjectLockVersioningRequired",
|
|
inputError: ErrObjectLockVersioningRequired,
|
|
expectedCode: s3err.ErrInvalidRequest,
|
|
},
|
|
{
|
|
name: "ErrInvalidObjectLockMode",
|
|
inputError: ErrInvalidObjectLockMode,
|
|
expectedCode: s3err.ErrInvalidRequest,
|
|
},
|
|
{
|
|
name: "ErrInvalidLegalHoldStatus",
|
|
inputError: ErrInvalidLegalHoldStatus,
|
|
expectedCode: s3err.ErrMalformedXML,
|
|
},
|
|
{
|
|
name: "ErrInvalidRetentionDateFormat",
|
|
inputError: ErrInvalidRetentionDateFormat,
|
|
expectedCode: s3err.ErrMalformedDate,
|
|
},
|
|
{
|
|
name: "ErrRetentionDateMustBeFuture",
|
|
inputError: ErrRetentionDateMustBeFuture,
|
|
expectedCode: s3err.ErrInvalidRequest,
|
|
},
|
|
{
|
|
name: "ErrObjectLockModeRequiresDate",
|
|
inputError: ErrObjectLockModeRequiresDate,
|
|
expectedCode: s3err.ErrInvalidRequest,
|
|
},
|
|
{
|
|
name: "ErrRetentionDateRequiresMode",
|
|
inputError: ErrRetentionDateRequiresMode,
|
|
expectedCode: s3err.ErrInvalidRequest,
|
|
},
|
|
{
|
|
name: "ErrGovernanceBypassVersioningRequired",
|
|
inputError: ErrGovernanceBypassVersioningRequired,
|
|
expectedCode: s3err.ErrInvalidRequest,
|
|
},
|
|
{
|
|
name: "Unknown error defaults to ErrInvalidRequest",
|
|
inputError: fmt.Errorf("unknown error"),
|
|
expectedCode: s3err.ErrInvalidRequest,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := mapValidationErrorToS3Error(tt.inputError)
|
|
assert.Equal(t, tt.expectedCode, result)
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestObjectLockPermissionLogic documents the correct behavior for object lock permission checks
|
|
// in PUT operations for both versioned and non-versioned buckets
|
|
func TestObjectLockPermissionLogic(t *testing.T) {
|
|
t.Run("Non-versioned bucket PUT operation logic", func(t *testing.T) {
|
|
// In non-versioned buckets, PUT operations overwrite existing objects
|
|
// Therefore, we MUST check if the existing object has object lock protections
|
|
// that would prevent overwrite before allowing the PUT operation.
|
|
//
|
|
// This test documents the expected behavior:
|
|
// 1. Check object lock headers validity (handled by validateObjectLockHeaders)
|
|
// 2. Check if existing object has object lock protections (handled by checkObjectLockPermissions)
|
|
// 3. If existing object is under retention/legal hold, deny the PUT unless governance bypass is valid
|
|
|
|
t.Log("For non-versioned buckets:")
|
|
t.Log("- PUT operations overwrite existing objects")
|
|
t.Log("- Must check existing object lock protections before allowing overwrite")
|
|
t.Log("- Governance bypass headers can be used to override GOVERNANCE mode retention")
|
|
t.Log("- COMPLIANCE mode retention and legal holds cannot be bypassed")
|
|
})
|
|
|
|
t.Run("Versioned bucket PUT operation logic", func(t *testing.T) {
|
|
// In versioned buckets, PUT operations create new versions without overwriting existing ones
|
|
// Therefore, we do NOT need to check existing object permissions since we're not modifying them.
|
|
// We only need to validate the object lock headers for the new version being created.
|
|
//
|
|
// This test documents the expected behavior:
|
|
// 1. Check object lock headers validity (handled by validateObjectLockHeaders)
|
|
// 2. Skip checking existing object permissions (since we're creating a new version)
|
|
// 3. Apply object lock metadata to the new version being created
|
|
|
|
t.Log("For versioned buckets:")
|
|
t.Log("- PUT operations create new versions without overwriting existing objects")
|
|
t.Log("- No need to check existing object lock protections")
|
|
t.Log("- Only validate object lock headers for the new version being created")
|
|
t.Log("- Each version has independent object lock settings")
|
|
})
|
|
|
|
t.Run("Governance bypass header validation", func(t *testing.T) {
|
|
// Governance bypass headers should only be used in specific scenarios:
|
|
// 1. Only valid on versioned buckets (consistent with object lock headers)
|
|
// 2. For non-versioned buckets: Used to override existing object's GOVERNANCE retention
|
|
// 3. For versioned buckets: Not typically needed since new versions don't conflict with existing ones
|
|
|
|
t.Log("Governance bypass behavior:")
|
|
t.Log("- Only valid on versioned buckets (header validation)")
|
|
t.Log("- For non-versioned buckets: Allows overwriting objects under GOVERNANCE retention")
|
|
t.Log("- For versioned buckets: Not typically needed for PUT operations")
|
|
t.Log("- Must have s3:BypassGovernanceRetention permission")
|
|
})
|
|
}
|