snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/credential/memory/memory_group.go

@@ -0,0 +1,89 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+)
+
+// cloneGroup creates a deep copy of an iam_pb.Group.
+func cloneGroup(g *iam_pb.Group) *iam_pb.Group {
+	if g == nil {
+		return nil
+	}
+	clone := &iam_pb.Group{
+		Name:     g.Name,
+		Disabled: g.Disabled,
+	}
+	if g.Members != nil {
+		clone.Members = make([]string, len(g.Members))
+		copy(clone.Members, g.Members)
+	}
+	if g.PolicyNames != nil {
+		clone.PolicyNames = make([]string, len(g.PolicyNames))
+		copy(clone.PolicyNames, g.PolicyNames)
+	}
+	return clone
+}
+
+func (store *MemoryStore) CreateGroup(ctx context.Context, group *iam_pb.Group) error {
+	if group == nil || group.Name == "" {
+		return fmt.Errorf("group name is required")
+	}
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if _, exists := store.groups[group.Name]; exists {
+		return credential.ErrGroupAlreadyExists
+	}
+	store.groups[group.Name] = cloneGroup(group)
+	return nil
+}
+
+func (store *MemoryStore) GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if g, exists := store.groups[groupName]; exists {
+		return cloneGroup(g), nil
+	}
+	return nil, credential.ErrGroupNotFound
+}
+
+func (store *MemoryStore) DeleteGroup(ctx context.Context, groupName string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if _, exists := store.groups[groupName]; !exists {
+		return credential.ErrGroupNotFound
+	}
+	delete(store.groups, groupName)
+	return nil
+}
+
+func (store *MemoryStore) ListGroups(ctx context.Context) ([]string, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	var names []string
+	for name := range store.groups {
+		names = append(names, name)
+	}
+	return names, nil
+}
+
+func (store *MemoryStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
+	if group == nil || group.Name == "" {
+		return fmt.Errorf("group name is required")
+	}
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if _, exists := store.groups[group.Name]; !exists {
+		return credential.ErrGroupNotFound
+	}
+	store.groups[group.Name] = cloneGroup(group)
+	return nil
+}

weed/credential/memory/memory_identity.go

@@ -0,0 +1,451 @@
+package memory
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func (store *MemoryStore) LoadConfiguration(ctx context.Context) (*iam_pb.S3ApiConfiguration, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	config := &iam_pb.S3ApiConfiguration{}
+
+	// Convert all users to identities
+	for _, user := range store.users {
+		config.Identities = append(config.Identities, store.deepCopyIdentity(user))
+	}
+
+	// Add all policies
+	for name, doc := range store.policies {
+		content, _ := json.Marshal(doc)
+		config.Policies = append(config.Policies, &iam_pb.Policy{
+			Name:    name,
+			Content: string(content),
+		})
+	}
+
+	// Groups are written via CreateGroup / AddUserToGroup / AttachGroupPolicy
+	// (never via SaveConfiguration), so they live in store.groups regardless
+	// of the bulk-config path. Surface them here so consumers that reload
+	// through cm.LoadConfiguration see a faithful snapshot — without this,
+	// iam.groups would never repopulate on memory-store reloads and group
+	// policy evaluation would silently no-op.
+	for _, g := range store.groups {
+		config.Groups = append(config.Groups, cloneGroup(g))
+	}
+
+	return config, nil
+}
+
+func (store *MemoryStore) SaveConfiguration(ctx context.Context, config *iam_pb.S3ApiConfiguration) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	// Clear existing data
+	store.users = make(map[string]*iam_pb.Identity)
+	store.accessKeys = make(map[string]string)
+	store.policies = make(map[string]policy_engine.PolicyDocument)
+
+	// Add all identities
+	for _, identity := range config.Identities {
+		store.users[identity.Name] = store.deepCopyIdentity(identity)
+
+		// Index access keys
+		for _, credential := range identity.Credentials {
+			store.accessKeys[credential.AccessKey] = identity.Name
+		}
+	}
+
+	// Add all policies
+	for _, policy := range config.Policies {
+		var doc policy_engine.PolicyDocument
+		if err := json.Unmarshal([]byte(policy.Content), &doc); err == nil {
+			store.policies[policy.Name] = doc
+		}
+	}
+
+	return nil
+}
+
+func (store *MemoryStore) CreateUser(ctx context.Context, identity *iam_pb.Identity) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	if _, exists := store.users[identity.Name]; exists {
+		return credential.ErrUserAlreadyExists
+	}
+
+	// Check for duplicate access keys
+	for _, cred := range identity.Credentials {
+		if _, exists := store.accessKeys[cred.AccessKey]; exists {
+			return fmt.Errorf("access key %s already exists", cred.AccessKey)
+		}
+	}
+
+	// Deep copy to avoid mutation issues
+	identityCopy := store.deepCopyIdentity(identity)
+	store.users[identity.Name] = identityCopy
+
+	// Index access keys
+	for _, cred := range identity.Credentials {
+		store.accessKeys[cred.AccessKey] = identity.Name
+	}
+
+	return nil
+}
+
+func (store *MemoryStore) GetUser(ctx context.Context, username string) (*iam_pb.Identity, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		return nil, credential.ErrUserNotFound
+	}
+
+	// Return a deep copy to avoid mutation issues
+	return store.deepCopyIdentity(user), nil
+}
+
+func (store *MemoryStore) UpdateUser(ctx context.Context, username string, identity *iam_pb.Identity) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	existingUser, exists := store.users[username]
+	if !exists {
+		return credential.ErrUserNotFound
+	}
+
+	// Remove old access keys from index
+	for _, cred := range existingUser.Credentials {
+		delete(store.accessKeys, cred.AccessKey)
+	}
+
+	// Check for duplicate access keys (excluding current user)
+	for _, cred := range identity.Credentials {
+		if existingUsername, exists := store.accessKeys[cred.AccessKey]; exists && existingUsername != username {
+			return fmt.Errorf("access key %s already exists", cred.AccessKey)
+		}
+	}
+
+	// Deep copy to avoid mutation issues
+	identityCopy := store.deepCopyIdentity(identity)
+	store.users[username] = identityCopy
+
+	// Re-index access keys
+	for _, cred := range identity.Credentials {
+		store.accessKeys[cred.AccessKey] = username
+	}
+
+	return nil
+}
+
+func (store *MemoryStore) DeleteUser(ctx context.Context, username string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		return credential.ErrUserNotFound
+	}
+
+	// Remove access keys from index
+	for _, cred := range user.Credentials {
+		delete(store.accessKeys, cred.AccessKey)
+	}
+
+	// Remove user
+	delete(store.users, username)
+	delete(store.inlinePolicies, username)
+
+	return nil
+}
+
+// RenameUser implements credential.UserRenamer for the memory store.
+// Renames the user and re-points access-key and inline-policy indexes
+// to the new name. The whole operation is performed under the store
+// lock so it is atomic with respect to concurrent reads.
+func (store *MemoryStore) RenameUser(ctx context.Context, oldName, newName string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+	if oldName == newName {
+		return nil
+	}
+
+	user, exists := store.users[oldName]
+	if !exists {
+		return credential.ErrUserNotFound
+	}
+	if _, clash := store.users[newName]; clash {
+		return credential.ErrUserAlreadyExists
+	}
+
+	user.Name = newName
+	store.users[newName] = user
+	delete(store.users, oldName)
+
+	for _, cred := range user.Credentials {
+		store.accessKeys[cred.AccessKey] = newName
+	}
+
+	if policies, ok := store.inlinePolicies[oldName]; ok {
+		store.inlinePolicies[newName] = policies
+		delete(store.inlinePolicies, oldName)
+	}
+
+	return nil
+}
+
+func (store *MemoryStore) ListUsers(ctx context.Context) ([]string, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	var usernames []string
+	for username := range store.users {
+		usernames = append(usernames, username)
+	}
+
+	return usernames, nil
+}
+
+func (store *MemoryStore) GetUserByAccessKey(ctx context.Context, accessKey string) (*iam_pb.Identity, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	username, exists := store.accessKeys[accessKey]
+	if !exists {
+		return nil, credential.ErrAccessKeyNotFound
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		// This should not happen, but handle it gracefully
+		return nil, credential.ErrUserNotFound
+	}
+
+	// Return a deep copy to avoid mutation issues
+	return store.deepCopyIdentity(user), nil
+}
+
+func (store *MemoryStore) CreateAccessKey(ctx context.Context, username string, cred *iam_pb.Credential) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		return credential.ErrUserNotFound
+	}
+
+	// Check if access key already exists
+	if _, exists := store.accessKeys[cred.AccessKey]; exists {
+		return fmt.Errorf("access key %s already exists", cred.AccessKey)
+	}
+
+	// Add credential to user
+	user.Credentials = append(user.Credentials, &iam_pb.Credential{
+		AccessKey: cred.AccessKey,
+		SecretKey: cred.SecretKey,
+	})
+
+	// Index the access key
+	store.accessKeys[cred.AccessKey] = username
+
+	return nil
+}
+
+func (store *MemoryStore) DeleteAccessKey(ctx context.Context, username string, accessKey string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		return credential.ErrUserNotFound
+	}
+
+	// Find and remove the credential
+	var newCredentials []*iam_pb.Credential
+	found := false
+	for _, cred := range user.Credentials {
+		if cred.AccessKey == accessKey {
+			found = true
+			// Remove from access key index
+			delete(store.accessKeys, accessKey)
+		} else {
+			newCredentials = append(newCredentials, cred)
+		}
+	}
+
+	if !found {
+		return credential.ErrAccessKeyNotFound
+	}
+
+	user.Credentials = newCredentials
+	return nil
+}
+
+// deepCopyIdentity creates a deep copy of an identity to avoid mutation issues
+func (store *MemoryStore) deepCopyIdentity(identity *iam_pb.Identity) *iam_pb.Identity {
+	if identity == nil {
+		return nil
+	}
+
+	// Use JSON marshaling/unmarshaling for deep copy
+	// This is simple and safe for protobuf messages
+	data, err := json.Marshal(identity)
+	if err != nil {
+		// Fallback to shallow copy if JSON fails
+		return &iam_pb.Identity{
+			Name:        identity.Name,
+			Account:     identity.Account,
+			Credentials: identity.Credentials,
+			Actions:     identity.Actions,
+			PolicyNames: identity.PolicyNames,
+		}
+	}
+
+	var copy iam_pb.Identity
+	if err := json.Unmarshal(data, &copy); err != nil {
+		// Fallback to shallow copy if JSON fails
+		return &iam_pb.Identity{
+			Name:        identity.Name,
+			Account:     identity.Account,
+			Credentials: identity.Credentials,
+			Actions:     identity.Actions,
+			PolicyNames: identity.PolicyNames,
+		}
+	}
+
+	return &copy
+}
+
+// AttachUserPolicy attaches a managed policy to a user by policy name
+func (store *MemoryStore) AttachUserPolicy(ctx context.Context, username string, policyName string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		return credential.ErrUserNotFound
+	}
+
+	// Verify policy exists
+	if _, exists := store.policies[policyName]; !exists {
+		return credential.ErrPolicyNotFound
+	}
+
+	// Check if already attached
+	for _, p := range user.PolicyNames {
+		if p == policyName {
+			return credential.ErrPolicyAlreadyAttached
+		}
+	}
+
+	user.PolicyNames = append(user.PolicyNames, policyName)
+	return nil
+}
+
+// DetachUserPolicy detaches a managed policy from a user
+func (store *MemoryStore) DetachUserPolicy(ctx context.Context, username string, policyName string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		return credential.ErrUserNotFound
+	}
+
+	found := false
+	var newPolicies []string
+	for _, p := range user.PolicyNames {
+		if p == policyName {
+			found = true
+		} else {
+			newPolicies = append(newPolicies, p)
+		}
+	}
+
+	if !found {
+		return credential.ErrPolicyNotAttached
+	}
+
+	user.PolicyNames = newPolicies
+	return nil
+}
+
+// ListAttachedUserPolicies returns the list of policy names attached to a user
+func (store *MemoryStore) ListAttachedUserPolicies(ctx context.Context, username string) ([]string, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	user, exists := store.users[username]
+	if !exists {
+		return nil, credential.ErrUserNotFound
+	}
+
+	// Return copy to prevent mutation
+	result := make([]string, len(user.PolicyNames))
+	copy(result, user.PolicyNames)
+	return result, nil
+}

weed/credential/memory/memory_policy.go

@@ -0,0 +1,283 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+// GetPolicies retrieves all IAM policies from memory
+func (store *MemoryStore) GetPolicies(ctx context.Context) (map[string]policy_engine.PolicyDocument, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	// Create a copy of the policies map to avoid mutation issues
+	policies := make(map[string]policy_engine.PolicyDocument)
+	for name, doc := range store.policies {
+		policies[name] = doc
+	}
+
+	return policies, nil
+}
+
+// ListPolicyNames returns all stored policy names.
+func (store *MemoryStore) ListPolicyNames(ctx context.Context) ([]string, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	names := make([]string, 0, len(store.policies))
+	for name := range store.policies {
+		names = append(names, name)
+	}
+
+	return names, nil
+}
+
+// GetPolicy retrieves a specific IAM policy by name from memory
+func (store *MemoryStore) GetPolicy(ctx context.Context, name string) (*policy_engine.PolicyDocument, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if policy, exists := store.policies[name]; exists {
+		return &policy, nil
+	}
+
+	return nil, nil // Policy not found
+}
+
+// CreatePolicy creates a new IAM policy in memory
+func (store *MemoryStore) CreatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	store.policies[name] = document
+	return nil
+}
+
+// UpdatePolicy updates an existing IAM policy in memory
+func (store *MemoryStore) UpdatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	store.policies[name] = document
+	return nil
+}
+
+// PutPolicy creates or updates an IAM policy in memory
+func (store *MemoryStore) PutPolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	store.policies[name] = document
+	return nil
+}
+
+// DeletePolicy deletes an IAM policy from memory
+func (store *MemoryStore) DeletePolicy(ctx context.Context, name string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	delete(store.policies, name)
+	return nil
+}
+
+// PutUserInlinePolicy stores a per-user inline policy document.
+func (store *MemoryStore) PutUserInlinePolicy(ctx context.Context, userName, policyName string, document policy_engine.PolicyDocument) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	if store.inlinePolicies[userName] == nil {
+		store.inlinePolicies[userName] = make(map[string]policy_engine.PolicyDocument)
+	}
+	store.inlinePolicies[userName][policyName] = document
+	return nil
+}
+
+// GetUserInlinePolicy retrieves a per-user inline policy document.
+func (store *MemoryStore) GetUserInlinePolicy(ctx context.Context, userName, policyName string) (*policy_engine.PolicyDocument, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	if userPolicies := store.inlinePolicies[userName]; userPolicies != nil {
+		if doc, exists := userPolicies[policyName]; exists {
+			return &doc, nil
+		}
+	}
+	return nil, nil
+}
+
+// DeleteUserInlinePolicy removes a per-user inline policy document.
+func (store *MemoryStore) DeleteUserInlinePolicy(ctx context.Context, userName, policyName string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	if userPolicies := store.inlinePolicies[userName]; userPolicies != nil {
+		delete(userPolicies, policyName)
+		if len(userPolicies) == 0 {
+			delete(store.inlinePolicies, userName)
+		}
+	}
+	return nil
+}
+
+// ListUserInlinePolicies returns the names of all inline policies for a user.
+func (store *MemoryStore) ListUserInlinePolicies(ctx context.Context, userName string) ([]string, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	userPolicies := store.inlinePolicies[userName]
+	names := make([]string, 0, len(userPolicies))
+	for name := range userPolicies {
+		names = append(names, name)
+	}
+	return names, nil
+}
+
+// LoadInlinePolicies returns all inline policies keyed by username then policy name.
+func (store *MemoryStore) LoadInlinePolicies(ctx context.Context) (map[string]map[string]policy_engine.PolicyDocument, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	result := make(map[string]map[string]policy_engine.PolicyDocument, len(store.inlinePolicies))
+	for userName, userPolicies := range store.inlinePolicies {
+		copied := make(map[string]policy_engine.PolicyDocument, len(userPolicies))
+		for policyName, doc := range userPolicies {
+			copied[policyName] = doc
+		}
+		result[userName] = copied
+	}
+	return result, nil
+}
+
+// PutGroupInlinePolicy stores a per-group inline policy document.
+func (store *MemoryStore) PutGroupInlinePolicy(ctx context.Context, groupName, policyName string, document policy_engine.PolicyDocument) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	if store.groupInlinePolicies[groupName] == nil {
+		store.groupInlinePolicies[groupName] = make(map[string]policy_engine.PolicyDocument)
+	}
+	store.groupInlinePolicies[groupName][policyName] = document
+	return nil
+}
+
+// GetGroupInlinePolicy retrieves a per-group inline policy document.
+func (store *MemoryStore) GetGroupInlinePolicy(ctx context.Context, groupName, policyName string) (*policy_engine.PolicyDocument, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	if groupPolicies := store.groupInlinePolicies[groupName]; groupPolicies != nil {
+		if doc, exists := groupPolicies[policyName]; exists {
+			return &doc, nil
+		}
+	}
+	return nil, nil
+}
+
+// DeleteGroupInlinePolicy removes a per-group inline policy document.
+func (store *MemoryStore) DeleteGroupInlinePolicy(ctx context.Context, groupName, policyName string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if !store.initialized {
+		return fmt.Errorf("store not initialized")
+	}
+
+	if groupPolicies := store.groupInlinePolicies[groupName]; groupPolicies != nil {
+		delete(groupPolicies, policyName)
+		if len(groupPolicies) == 0 {
+			delete(store.groupInlinePolicies, groupName)
+		}
+	}
+	return nil
+}
+
+// ListGroupInlinePolicies returns the names of all inline policies for a group.
+func (store *MemoryStore) ListGroupInlinePolicies(ctx context.Context, groupName string) ([]string, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	groupPolicies := store.groupInlinePolicies[groupName]
+	names := make([]string, 0, len(groupPolicies))
+	for name := range groupPolicies {
+		names = append(names, name)
+	}
+	return names, nil
+}
+
+// LoadGroupInlinePolicies returns all group inline policies keyed by group name then policy name.
+func (store *MemoryStore) LoadGroupInlinePolicies(ctx context.Context) (map[string]map[string]policy_engine.PolicyDocument, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if !store.initialized {
+		return nil, fmt.Errorf("store not initialized")
+	}
+
+	result := make(map[string]map[string]policy_engine.PolicyDocument, len(store.groupInlinePolicies))
+	for groupName, groupPolicies := range store.groupInlinePolicies {
+		copied := make(map[string]policy_engine.PolicyDocument, len(groupPolicies))
+		for policyName, doc := range groupPolicies {
+			copied[policyName] = doc
+		}
+		result[groupName] = copied
+	}
+	return result, nil
+}

weed/credential/memory/memory_service_account.go

@@ -0,0 +1,85 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+)
+
+func (store *MemoryStore) CreateServiceAccount(ctx context.Context, sa *iam_pb.ServiceAccount) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if _, exists := store.serviceAccounts[sa.Id]; exists {
+		return fmt.Errorf("service account already exists")
+	}
+	store.serviceAccounts[sa.Id] = sa
+	if sa.Credential != nil && sa.Credential.AccessKey != "" {
+		store.serviceAccountAccessKeys[sa.Credential.AccessKey] = sa.Id
+	}
+	return nil
+}
+
+func (store *MemoryStore) UpdateServiceAccount(ctx context.Context, id string, sa *iam_pb.ServiceAccount) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	_, exists := store.serviceAccounts[id]
+	if !exists {
+		return credential.ErrServiceAccountNotFound
+	}
+	if sa.Id != id {
+		return fmt.Errorf("service account ID mismatch")
+	}
+
+	// Update access key index: remove any existing keys for this SA
+	for k, v := range store.serviceAccountAccessKeys {
+		if v == id {
+			delete(store.serviceAccountAccessKeys, k)
+		}
+	}
+
+	store.serviceAccounts[id] = sa
+
+	if sa.Credential != nil && sa.Credential.AccessKey != "" {
+		store.serviceAccountAccessKeys[sa.Credential.AccessKey] = sa.Id
+	}
+	return nil
+}
+
+func (store *MemoryStore) DeleteServiceAccount(ctx context.Context, id string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if sa, ok := store.serviceAccounts[id]; ok {
+		if sa.Credential != nil && sa.Credential.AccessKey != "" {
+			delete(store.serviceAccountAccessKeys, sa.Credential.AccessKey)
+		}
+		delete(store.serviceAccounts, id)
+		return nil
+	}
+	return credential.ErrServiceAccountNotFound
+}
+
+func (store *MemoryStore) GetServiceAccount(ctx context.Context, id string) (*iam_pb.ServiceAccount, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if sa, exists := store.serviceAccounts[id]; exists {
+		return sa, nil
+	}
+	return nil, credential.ErrServiceAccountNotFound
+}
+
+func (store *MemoryStore) ListServiceAccounts(ctx context.Context) ([]*iam_pb.ServiceAccount, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	var accounts []*iam_pb.ServiceAccount
+	for _, sa := range store.serviceAccounts {
+		accounts = append(accounts, sa)
+	}
+	return accounts, nil
+}

weed/credential/memory/memory_store.go

@@ -0,0 +1,112 @@
+package memory
+
+import (
+	"context"
+	"sync"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func init() {
+	credential.Stores = append(credential.Stores, &MemoryStore{})
+}
+
+// MemoryStore implements CredentialStore using in-memory storage
+// This is primarily intended for testing purposes
+type MemoryStore struct {
+	mu                       sync.RWMutex
+	users                    map[string]*iam_pb.Identity                        // username -> identity
+	accessKeys               map[string]string                                  // access_key -> username
+	serviceAccounts          map[string]*iam_pb.ServiceAccount                  // id -> service_account
+	serviceAccountAccessKeys map[string]string                                  // access_key -> id
+	policies                 map[string]policy_engine.PolicyDocument            // policy_name -> policy_document
+	inlinePolicies           map[string]map[string]policy_engine.PolicyDocument // username -> policy_name -> document
+	groupInlinePolicies      map[string]map[string]policy_engine.PolicyDocument // group_name -> policy_name -> document
+	groups                   map[string]*iam_pb.Group                           // group_name -> group
+	initialized              bool
+}
+
+func (store *MemoryStore) GetName() credential.CredentialStoreTypeName {
+	return credential.StoreTypeMemory
+}
+
+func (store *MemoryStore) Initialize(configuration util.Configuration, prefix string) error {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if store.initialized {
+		return nil
+	}
+
+	store.users = make(map[string]*iam_pb.Identity)
+	store.accessKeys = make(map[string]string)
+	store.serviceAccounts = make(map[string]*iam_pb.ServiceAccount)
+	store.serviceAccountAccessKeys = make(map[string]string)
+	store.policies = make(map[string]policy_engine.PolicyDocument)
+	store.inlinePolicies = make(map[string]map[string]policy_engine.PolicyDocument)
+	store.groupInlinePolicies = make(map[string]map[string]policy_engine.PolicyDocument)
+	store.groups = make(map[string]*iam_pb.Group)
+	store.initialized = true
+
+	return nil
+}
+
+func (store *MemoryStore) Shutdown() {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	store.users = nil
+	store.accessKeys = nil
+	store.serviceAccounts = nil
+	store.serviceAccountAccessKeys = nil
+	store.policies = nil
+	store.inlinePolicies = nil
+	store.groupInlinePolicies = nil
+	store.groups = nil
+	store.initialized = false
+}
+
+// Reset clears all data in the store (useful for testing)
+func (store *MemoryStore) Reset() {
+	store.mu.Lock()
+	defer store.mu.Unlock()
+
+	if store.initialized {
+		store.users = make(map[string]*iam_pb.Identity)
+		store.accessKeys = make(map[string]string)
+		store.serviceAccounts = make(map[string]*iam_pb.ServiceAccount)
+		store.serviceAccountAccessKeys = make(map[string]string)
+		store.policies = make(map[string]policy_engine.PolicyDocument)
+		store.inlinePolicies = make(map[string]map[string]policy_engine.PolicyDocument)
+		store.groupInlinePolicies = make(map[string]map[string]policy_engine.PolicyDocument)
+		store.groups = make(map[string]*iam_pb.Group)
+	}
+}
+
+// GetUserCount returns the number of users in the store (useful for testing)
+func (store *MemoryStore) GetUserCount() int {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	return len(store.users)
+}
+
+// GetAccessKeyCount returns the number of access keys in the store (useful for testing)
+func (store *MemoryStore) GetAccessKeyCount() int {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	return len(store.accessKeys)
+}
+func (store *MemoryStore) GetServiceAccountByAccessKey(ctx context.Context, accessKey string) (*iam_pb.ServiceAccount, error) {
+	store.mu.RLock()
+	defer store.mu.RUnlock()
+
+	if id, ok := store.serviceAccountAccessKeys[accessKey]; ok {
+		return store.serviceAccounts[id], nil
+	}
+	return nil, credential.ErrAccessKeyNotFound
+}

weed/credential/memory/memory_store_test.go

@@ -0,0 +1,380 @@
+package memory
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+)
+
+func TestMemoryStore(t *testing.T) {
+	store := &MemoryStore{}
+
+	// Test initialization
+	config := util.GetViper()
+	if err := store.Initialize(config, "credential."); err != nil {
+		t.Fatalf("Failed to initialize store: %v", err)
+	}
+
+	ctx := context.Background()
+
+	// Test creating a user
+	identity := &iam_pb.Identity{
+		Name: "testuser",
+		Credentials: []*iam_pb.Credential{
+			{
+				AccessKey: "access123",
+				SecretKey: "secret123",
+			},
+		},
+	}
+
+	if err := store.CreateUser(ctx, identity); err != nil {
+		t.Fatalf("Failed to create user: %v", err)
+	}
+
+	// Test getting user
+	retrievedUser, err := store.GetUser(ctx, "testuser")
+	if err != nil {
+		t.Fatalf("Failed to get user: %v", err)
+	}
+
+	if retrievedUser.Name != "testuser" {
+		t.Errorf("Expected username 'testuser', got '%s'", retrievedUser.Name)
+	}
+
+	if len(retrievedUser.Credentials) != 1 {
+		t.Errorf("Expected 1 credential, got %d", len(retrievedUser.Credentials))
+	}
+
+	// Test getting user by access key
+	userByAccessKey, err := store.GetUserByAccessKey(ctx, "access123")
+	if err != nil {
+		t.Fatalf("Failed to get user by access key: %v", err)
+	}
+
+	if userByAccessKey.Name != "testuser" {
+		t.Errorf("Expected username 'testuser', got '%s'", userByAccessKey.Name)
+	}
+
+	// Test listing users
+	users, err := store.ListUsers(ctx)
+	if err != nil {
+		t.Fatalf("Failed to list users: %v", err)
+	}
+
+	if len(users) != 1 || users[0] != "testuser" {
+		t.Errorf("Expected ['testuser'], got %v", users)
+	}
+
+	// Test creating access key
+	newCred := &iam_pb.Credential{
+		AccessKey: "access456",
+		SecretKey: "secret456",
+	}
+
+	if err := store.CreateAccessKey(ctx, "testuser", newCred); err != nil {
+		t.Fatalf("Failed to create access key: %v", err)
+	}
+
+	// Verify user now has 2 credentials
+	updatedUser, err := store.GetUser(ctx, "testuser")
+	if err != nil {
+		t.Fatalf("Failed to get updated user: %v", err)
+	}
+
+	if len(updatedUser.Credentials) != 2 {
+		t.Errorf("Expected 2 credentials, got %d", len(updatedUser.Credentials))
+	}
+
+	// Test deleting access key
+	if err := store.DeleteAccessKey(ctx, "testuser", "access456"); err != nil {
+		t.Fatalf("Failed to delete access key: %v", err)
+	}
+
+	// Verify user now has 1 credential again
+	finalUser, err := store.GetUser(ctx, "testuser")
+	if err != nil {
+		t.Fatalf("Failed to get final user: %v", err)
+	}
+
+	if len(finalUser.Credentials) != 1 {
+		t.Errorf("Expected 1 credential, got %d", len(finalUser.Credentials))
+	}
+
+	// Test deleting user
+	if err := store.DeleteUser(ctx, "testuser"); err != nil {
+		t.Fatalf("Failed to delete user: %v", err)
+	}
+
+	// Verify user is gone
+	_, err = store.GetUser(ctx, "testuser")
+	if err != credential.ErrUserNotFound {
+		t.Errorf("Expected ErrUserNotFound, got %v", err)
+	}
+
+	// Test error cases
+	if err := store.CreateUser(ctx, identity); err != nil {
+		t.Fatalf("Failed to create user for error tests: %v", err)
+	}
+
+	// Try to create duplicate user
+	if err := store.CreateUser(ctx, identity); err != credential.ErrUserAlreadyExists {
+		t.Errorf("Expected ErrUserAlreadyExists, got %v", err)
+	}
+
+	// Try to get non-existent user
+	_, err = store.GetUser(ctx, "nonexistent")
+	if err != credential.ErrUserNotFound {
+		t.Errorf("Expected ErrUserNotFound, got %v", err)
+	}
+
+	// Try to get user by non-existent access key
+	_, err = store.GetUserByAccessKey(ctx, "nonexistent")
+	if err != credential.ErrAccessKeyNotFound {
+		t.Errorf("Expected ErrAccessKeyNotFound, got %v", err)
+	}
+}
+
+func TestMemoryStoreConcurrency(t *testing.T) {
+	store := &MemoryStore{}
+	config := util.GetViper()
+	if err := store.Initialize(config, "credential."); err != nil {
+		t.Fatalf("Failed to initialize store: %v", err)
+	}
+
+	ctx := context.Background()
+
+	// Test concurrent access
+	done := make(chan bool, 10)
+	for i := 0; i < 10; i++ {
+		go func(i int) {
+			defer func() { done <- true }()
+
+			username := fmt.Sprintf("user%d", i)
+			identity := &iam_pb.Identity{
+				Name: username,
+				Credentials: []*iam_pb.Credential{
+					{
+						AccessKey: fmt.Sprintf("access%d", i),
+						SecretKey: fmt.Sprintf("secret%d", i),
+					},
+				},
+			}
+
+			if err := store.CreateUser(ctx, identity); err != nil {
+				t.Errorf("Failed to create user %s: %v", username, err)
+				return
+			}
+
+			if _, err := store.GetUser(ctx, username); err != nil {
+				t.Errorf("Failed to get user %s: %v", username, err)
+				return
+			}
+		}(i)
+	}
+
+	// Wait for all goroutines to complete
+	for i := 0; i < 10; i++ {
+		<-done
+	}
+
+	// Verify all users were created
+	users, err := store.ListUsers(ctx)
+	if err != nil {
+		t.Fatalf("Failed to list users: %v", err)
+	}
+
+	if len(users) != 10 {
+		t.Errorf("Expected 10 users, got %d", len(users))
+	}
+}
+
+func TestMemoryStoreReset(t *testing.T) {
+	store := &MemoryStore{}
+	config := util.GetViper()
+	if err := store.Initialize(config, "credential."); err != nil {
+		t.Fatalf("Failed to initialize store: %v", err)
+	}
+
+	ctx := context.Background()
+
+	// Create a user
+	identity := &iam_pb.Identity{
+		Name: "testuser",
+		Credentials: []*iam_pb.Credential{
+			{
+				AccessKey: "access123",
+				SecretKey: "secret123",
+			},
+		},
+	}
+
+	if err := store.CreateUser(ctx, identity); err != nil {
+		t.Fatalf("Failed to create user: %v", err)
+	}
+
+	// Verify user exists
+	if store.GetUserCount() != 1 {
+		t.Errorf("Expected 1 user, got %d", store.GetUserCount())
+	}
+
+	if store.GetAccessKeyCount() != 1 {
+		t.Errorf("Expected 1 access key, got %d", store.GetAccessKeyCount())
+	}
+
+	// Reset the store
+	store.Reset()
+
+	// Verify store is empty
+	if store.GetUserCount() != 0 {
+		t.Errorf("Expected 0 users after reset, got %d", store.GetUserCount())
+	}
+
+	if store.GetAccessKeyCount() != 0 {
+		t.Errorf("Expected 0 access keys after reset, got %d", store.GetAccessKeyCount())
+	}
+
+	// Verify user is gone
+	_, err := store.GetUser(ctx, "testuser")
+	if err != credential.ErrUserNotFound {
+		t.Errorf("Expected ErrUserNotFound after reset, got %v", err)
+	}
+}
+
+func TestMemoryStoreConfigurationSaveLoad(t *testing.T) {
+	store := &MemoryStore{}
+	config := util.GetViper()
+	if err := store.Initialize(config, "credential."); err != nil {
+		t.Fatalf("Failed to initialize store: %v", err)
+	}
+
+	ctx := context.Background()
+
+	// Create initial configuration
+	originalConfig := &iam_pb.S3ApiConfiguration{
+		Identities: []*iam_pb.Identity{
+			{
+				Name: "user1",
+				Credentials: []*iam_pb.Credential{
+					{
+						AccessKey: "access1",
+						SecretKey: "secret1",
+					},
+				},
+			},
+			{
+				Name: "user2",
+				Credentials: []*iam_pb.Credential{
+					{
+						AccessKey: "access2",
+						SecretKey: "secret2",
+					},
+				},
+			},
+		},
+	}
+
+	// Save configuration
+	if err := store.SaveConfiguration(ctx, originalConfig); err != nil {
+		t.Fatalf("Failed to save configuration: %v", err)
+	}
+
+	// Load configuration
+	loadedConfig, err := store.LoadConfiguration(ctx)
+	if err != nil {
+		t.Fatalf("Failed to load configuration: %v", err)
+	}
+
+	// Verify configuration matches
+	if len(loadedConfig.Identities) != 2 {
+		t.Errorf("Expected 2 identities, got %d", len(loadedConfig.Identities))
+	}
+
+	// Check users exist
+	user1, err := store.GetUser(ctx, "user1")
+	if err != nil {
+		t.Fatalf("Failed to get user1: %v", err)
+	}
+
+	if len(user1.Credentials) != 1 || user1.Credentials[0].AccessKey != "access1" {
+		t.Errorf("User1 credentials not correct: %+v", user1.Credentials)
+	}
+
+	user2, err := store.GetUser(ctx, "user2")
+	if err != nil {
+		t.Fatalf("Failed to get user2: %v", err)
+	}
+
+	if len(user2.Credentials) != 1 || user2.Credentials[0].AccessKey != "access2" {
+		t.Errorf("User2 credentials not correct: %+v", user2.Credentials)
+	}
+}
+
+func TestMemoryStoreServiceAccountByAccessKey(t *testing.T) {
+	store := &MemoryStore{}
+	config := util.GetViper()
+	if err := store.Initialize(config, "credential."); err != nil {
+		t.Fatalf("Failed to initialize store: %v", err)
+	}
+
+	ctx := context.Background()
+
+	// 1. Create service account
+	sa := &iam_pb.ServiceAccount{
+		Id:         "sa-test-1",
+		ParentUser: "user1",
+		Credential: &iam_pb.Credential{
+			AccessKey: "ACCESS-KEY-1",
+			SecretKey: "SECRET-KEY-1",
+		},
+	}
+
+	if err := store.CreateServiceAccount(ctx, sa); err != nil {
+		t.Fatalf("Failed to create service account: %v", err)
+	}
+
+	// 2. Lookup by access key
+	found, err := store.GetServiceAccountByAccessKey(ctx, "ACCESS-KEY-1")
+	if err != nil {
+		t.Fatalf("Failed to lookup by access key: %v", err)
+	}
+	if found.Id != "sa-test-1" {
+		t.Errorf("Expected sa-test-1, got %s", found.Id)
+	}
+
+	// 3. Update with new access key
+	sa.Credential.AccessKey = "ACCESS-KEY-2"
+	if err := store.UpdateServiceAccount(ctx, sa.Id, sa); err != nil {
+		t.Fatalf("Failed to update service account: %v", err)
+	}
+
+	// Verify old key is gone
+	_, err = store.GetServiceAccountByAccessKey(ctx, "ACCESS-KEY-1")
+	if err != credential.ErrAccessKeyNotFound {
+		t.Errorf("Expected ErrAccessKeyNotFound for old key, got %v", err)
+	}
+
+	// Verify new key works
+	found, err = store.GetServiceAccountByAccessKey(ctx, "ACCESS-KEY-2")
+	if err != nil {
+		t.Fatalf("Failed to lookup by new access key: %v", err)
+	}
+	if found.Id != "sa-test-1" {
+		t.Errorf("Expected sa-test-1, got %s", found.Id)
+	}
+
+	// 4. Delete service account
+	if err := store.DeleteServiceAccount(ctx, sa.Id); err != nil {
+		t.Fatalf("Failed to delete service account: %v", err)
+	}
+
+	// Verify key is gone
+	_, err = store.GetServiceAccountByAccessKey(ctx, "ACCESS-KEY-2")
+	if err != credential.ErrAccessKeyNotFound {
+		t.Errorf("Expected ErrAccessKeyNotFound after delete, got %v", err)
+	}
+}