snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/credential/postgres/postgres_group.go

@@ -0,0 +1,127 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+)
+
+func (store *PostgresStore) CreateGroup(ctx context.Context, group *iam_pb.Group) error {
+	if group == nil || group.Name == "" {
+		return fmt.Errorf("group name is required")
+	}
+	membersJSON, err := json.Marshal(group.Members)
+	if err != nil {
+		return fmt.Errorf("failed to marshal members: %w", err)
+	}
+	policyNamesJSON, err := json.Marshal(group.PolicyNames)
+	if err != nil {
+		return fmt.Errorf("failed to marshal policy_names: %w", err)
+	}
+
+	_, err = store.db.ExecContext(ctx,
+		`INSERT INTO groups (name, members, policy_names, disabled) VALUES ($1, $2, $3, $4)`,
+		group.Name, jsonbParam(membersJSON), jsonbParam(policyNamesJSON), group.Disabled)
+	if err != nil {
+		var pgErr *pgconn.PgError
+		if errors.As(err, &pgErr) && pgErr.Code == "23505" {
+			return credential.ErrGroupAlreadyExists
+		}
+		return fmt.Errorf("failed to create group: %w", err)
+	}
+	return nil
+}
+
+func (store *PostgresStore) GetGroup(ctx context.Context, groupName string) (*iam_pb.Group, error) {
+	var membersJSON, policyNamesJSON []byte
+	var disabled bool
+	err := store.db.QueryRowContext(ctx,
+		`SELECT members, policy_names, disabled FROM groups WHERE name = $1`, groupName).
+		Scan(&membersJSON, &policyNamesJSON, &disabled)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, credential.ErrGroupNotFound
+		}
+		return nil, fmt.Errorf("failed to get group: %w", err)
+	}
+
+	group := &iam_pb.Group{
+		Name:     groupName,
+		Disabled: disabled,
+	}
+	if err := json.Unmarshal(membersJSON, &group.Members); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal members: %w", err)
+	}
+	if err := json.Unmarshal(policyNamesJSON, &group.PolicyNames); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal policy_names: %w", err)
+	}
+	return group, nil
+}
+
+func (store *PostgresStore) DeleteGroup(ctx context.Context, groupName string) error {
+	result, err := store.db.ExecContext(ctx, `DELETE FROM groups WHERE name = $1`, groupName)
+	if err != nil {
+		return fmt.Errorf("failed to delete group: %w", err)
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+	if rows == 0 {
+		return credential.ErrGroupNotFound
+	}
+	return nil
+}
+
+func (store *PostgresStore) ListGroups(ctx context.Context) ([]string, error) {
+	rows, err := store.db.QueryContext(ctx, `SELECT name FROM groups ORDER BY name`)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list groups: %w", err)
+	}
+	defer rows.Close()
+
+	var names []string
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, fmt.Errorf("failed to scan group name: %w", err)
+		}
+		names = append(names, name)
+	}
+	return names, rows.Err()
+}
+
+func (store *PostgresStore) UpdateGroup(ctx context.Context, group *iam_pb.Group) error {
+	if group == nil || group.Name == "" {
+		return fmt.Errorf("group name is required")
+	}
+	membersJSON, err := json.Marshal(group.Members)
+	if err != nil {
+		return fmt.Errorf("failed to marshal members: %w", err)
+	}
+	policyNamesJSON, err := json.Marshal(group.PolicyNames)
+	if err != nil {
+		return fmt.Errorf("failed to marshal policy_names: %w", err)
+	}
+
+	result, err := store.db.ExecContext(ctx,
+		`UPDATE groups SET members = $1, policy_names = $2, disabled = $3, updated_at = CURRENT_TIMESTAMP WHERE name = $4`,
+		jsonbParam(membersJSON), jsonbParam(policyNamesJSON), group.Disabled, group.Name)
+	if err != nil {
+		return fmt.Errorf("failed to update group: %w", err)
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+	if rows == 0 {
+		return credential.ErrGroupNotFound
+	}
+	return nil
+}

weed/credential/postgres/postgres_group_inline_policy.go

@@ -0,0 +1,149 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func (store *PostgresStore) PutGroupInlinePolicy(ctx context.Context, groupName, policyName string, document policy_engine.PolicyDocument) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	docJSON, err := json.Marshal(document)
+	if err != nil {
+		glog.Errorf("credential postgres: PutGroupInlinePolicy marshal failed group=%s policy=%s: %v", groupName, policyName, err)
+		return fmt.Errorf("failed to marshal policy document: %w", err)
+	}
+
+	_, err = store.db.ExecContext(ctx,
+		`INSERT INTO group_inline_policies (group_name, policy_name, document)
+		 VALUES ($1, $2, $3)
+		 ON CONFLICT (group_name, policy_name)
+		 DO UPDATE SET document = $3, updated_at = CURRENT_TIMESTAMP`,
+		groupName, policyName, jsonbParam(docJSON))
+	if err != nil {
+		glog.Errorf("credential postgres: PutGroupInlinePolicy failed group=%s policy=%s: %v", groupName, policyName, err)
+		return fmt.Errorf("failed to upsert group inline policy: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: PutGroupInlinePolicy group=%s policy=%s", groupName, policyName)
+	return nil
+}
+
+func (store *PostgresStore) GetGroupInlinePolicy(ctx context.Context, groupName, policyName string) (*policy_engine.PolicyDocument, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	var docJSON []byte
+	err := store.db.QueryRowContext(ctx,
+		"SELECT document FROM group_inline_policies WHERE group_name = $1 AND policy_name = $2",
+		groupName, policyName).Scan(&docJSON)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, nil
+		}
+		glog.Errorf("credential postgres: GetGroupInlinePolicy query failed group=%s policy=%s: %v", groupName, policyName, err)
+		return nil, fmt.Errorf("failed to query group inline policy: %w", err)
+	}
+
+	var doc policy_engine.PolicyDocument
+	if err := json.Unmarshal(docJSON, &doc); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal group inline policy: %w", err)
+	}
+	return &doc, nil
+}
+
+func (store *PostgresStore) DeleteGroupInlinePolicy(ctx context.Context, groupName, policyName string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	result, err := store.db.ExecContext(ctx,
+		"DELETE FROM group_inline_policies WHERE group_name = $1 AND policy_name = $2",
+		groupName, policyName)
+	if err != nil {
+		glog.Errorf("credential postgres: DeleteGroupInlinePolicy failed group=%s policy=%s: %v", groupName, policyName, err)
+		return fmt.Errorf("failed to delete group inline policy: %w", err)
+	}
+
+	rowsAffected, _ := result.RowsAffected()
+	glog.V(0).Infof("credential postgres: DeleteGroupInlinePolicy group=%s policy=%s deleted=%d", groupName, policyName, rowsAffected)
+	return nil
+}
+
+func (store *PostgresStore) ListGroupInlinePolicies(ctx context.Context, groupName string) ([]string, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	rows, err := store.db.QueryContext(ctx,
+		"SELECT policy_name FROM group_inline_policies WHERE group_name = $1 ORDER BY policy_name",
+		groupName)
+	if err != nil {
+		glog.Errorf("credential postgres: ListGroupInlinePolicies query failed group=%s: %v", groupName, err)
+		return nil, fmt.Errorf("failed to query group inline policies: %w", err)
+	}
+	defer rows.Close()
+
+	var names []string
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, fmt.Errorf("failed to scan policy name: %w", err)
+		}
+		names = append(names, name)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating group inline policy rows: %w", err)
+	}
+	return names, nil
+}
+
+func (store *PostgresStore) LoadGroupInlinePolicies(ctx context.Context) (map[string]map[string]policy_engine.PolicyDocument, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	rows, err := store.db.QueryContext(ctx,
+		"SELECT group_name, policy_name, document FROM group_inline_policies ORDER BY group_name, policy_name")
+	if err != nil {
+		glog.Errorf("credential postgres: LoadGroupInlinePolicies query failed: %v", err)
+		return nil, fmt.Errorf("failed to query group inline policies: %w", err)
+	}
+	defer rows.Close()
+
+	result := make(map[string]map[string]policy_engine.PolicyDocument)
+	count := 0
+	for rows.Next() {
+		var groupName, policyName string
+		var docJSON []byte
+		if err := rows.Scan(&groupName, &policyName, &docJSON); err != nil {
+			return nil, fmt.Errorf("failed to scan group inline policy row: %w", err)
+		}
+
+		var doc policy_engine.PolicyDocument
+		if err := json.Unmarshal(docJSON, &doc); err != nil {
+			glog.Warningf("credential postgres: LoadGroupInlinePolicies unmarshal failed group=%s policy=%s: %v", groupName, policyName, err)
+			continue
+		}
+
+		if result[groupName] == nil {
+			result[groupName] = make(map[string]policy_engine.PolicyDocument)
+		}
+		result[groupName][policyName] = doc
+		count++
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating group inline policy rows: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: LoadGroupInlinePolicies loaded %d policies for %d groups", count, len(result))
+	return result, nil
+}

weed/credential/postgres/postgres_identity.go

@@ -0,0 +1,754 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+)
+
+func (store *PostgresStore) LoadConfiguration(ctx context.Context) (*iam_pb.S3ApiConfiguration, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	config := &iam_pb.S3ApiConfiguration{}
+
+	rows, err := store.db.QueryContext(ctx, "SELECT username, email, account_data, actions, policy_names FROM users")
+	if err != nil {
+		glog.Errorf("credential postgres: LoadConfiguration query failed: %v", err)
+		return nil, fmt.Errorf("failed to query users: %w", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var username, email string
+		var accountDataJSON, actionsJSON, policyNamesJSON []byte
+
+		if err := rows.Scan(&username, &email, &accountDataJSON, &actionsJSON, &policyNamesJSON); err != nil {
+			glog.Errorf("credential postgres: LoadConfiguration scan failed: %v", err)
+			return nil, fmt.Errorf("failed to scan user row: %w", err)
+		}
+
+		identity := &iam_pb.Identity{
+			Name: username,
+		}
+
+		if len(accountDataJSON) > 0 {
+			if err := json.Unmarshal(accountDataJSON, &identity.Account); err != nil {
+				return nil, fmt.Errorf("failed to unmarshal account data for user %s: %v", username, err)
+			}
+		}
+
+		if len(actionsJSON) > 0 {
+			if err := json.Unmarshal(actionsJSON, &identity.Actions); err != nil {
+				return nil, fmt.Errorf("failed to unmarshal actions for user %s: %v", username, err)
+			}
+		}
+
+		if len(policyNamesJSON) > 0 {
+			if err := json.Unmarshal(policyNamesJSON, &identity.PolicyNames); err != nil {
+				return nil, fmt.Errorf("failed to unmarshal policy names for user %s: %v", username, err)
+			}
+		}
+
+		credRows, err := store.db.QueryContext(ctx, "SELECT access_key, secret_key FROM credentials WHERE username = $1", username)
+		if err != nil {
+			return nil, fmt.Errorf("failed to query credentials for user %s: %v", username, err)
+		}
+
+		for credRows.Next() {
+			var accessKey, secretKey string
+			if err := credRows.Scan(&accessKey, &secretKey); err != nil {
+				credRows.Close()
+				return nil, fmt.Errorf("failed to scan credential row for user %s: %v", username, err)
+			}
+
+			identity.Credentials = append(identity.Credentials, &iam_pb.Credential{
+				AccessKey: accessKey,
+				SecretKey: secretKey,
+			})
+		}
+		credErr := credRows.Err()
+		credRows.Close()
+		if credErr != nil {
+			return nil, fmt.Errorf("failed iterating credential rows for user %s: %w", username, credErr)
+		}
+		config.Identities = append(config.Identities, identity)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating user rows: %w", err)
+	}
+
+	// groups are part of the snapshot: full-state reconciliation treats their
+	// absence as deletion
+	groupRows, err := store.db.QueryContext(ctx, "SELECT name, members, policy_names, disabled FROM groups")
+	if err != nil {
+		return nil, fmt.Errorf("failed to query groups: %w", err)
+	}
+	defer groupRows.Close()
+	for groupRows.Next() {
+		var name string
+		var membersJSON, policyNamesJSON []byte
+		var disabled bool
+		if err := groupRows.Scan(&name, &membersJSON, &policyNamesJSON, &disabled); err != nil {
+			return nil, fmt.Errorf("failed to scan group row: %w", err)
+		}
+		group := &iam_pb.Group{Name: name, Disabled: disabled}
+		if err := json.Unmarshal(membersJSON, &group.Members); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal members for group %s: %w", name, err)
+		}
+		if err := json.Unmarshal(policyNamesJSON, &group.PolicyNames); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal policy_names for group %s: %w", name, err)
+		}
+		config.Groups = append(config.Groups, group)
+	}
+	if err := groupRows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating group rows: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: LoadConfiguration loaded %d identities, %d groups", len(config.Identities), len(config.Groups))
+	return config, nil
+}
+
+func (store *PostgresStore) SaveConfiguration(ctx context.Context, config *iam_pb.S3ApiConfiguration) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction: %w", err)
+	}
+	defer tx.Rollback()
+
+	// Track which usernames are in the incoming config for pruning
+	configUsernames := make(map[string]bool, len(config.Identities))
+	for _, identity := range config.Identities {
+		configUsernames[identity.Name] = true
+	}
+
+	// Upsert each user's row.
+	for _, identity := range config.Identities {
+		var accountDataJSON []byte
+		if identity.Account != nil {
+			accountDataJSON, err = json.Marshal(identity.Account)
+			if err != nil {
+				return fmt.Errorf("failed to marshal account data for user %s: %v", identity.Name, err)
+			}
+		}
+
+		var actionsJSON []byte
+		if identity.Actions != nil {
+			actionsJSON, err = json.Marshal(identity.Actions)
+			if err != nil {
+				return fmt.Errorf("failed to marshal actions for user %s: %v", identity.Name, err)
+			}
+		}
+
+		var policyNamesJSON []byte
+		if identity.PolicyNames != nil {
+			policyNamesJSON, err = json.Marshal(identity.PolicyNames)
+			if err != nil {
+				return fmt.Errorf("failed to marshal policy names for user %s: %v", identity.Name, err)
+			}
+		}
+
+		// Upsert user — preserves the row (and its CASCADE dependents) if it already exists
+		_, err = tx.ExecContext(ctx,
+			`INSERT INTO users (username, email, account_data, actions, policy_names)
+			 VALUES ($1, $2, $3, $4, $5)
+			 ON CONFLICT (username) DO UPDATE SET
+				email = EXCLUDED.email,
+				account_data = EXCLUDED.account_data,
+				actions = EXCLUDED.actions,
+				policy_names = EXCLUDED.policy_names,
+				updated_at = CURRENT_TIMESTAMP`,
+			identity.Name, "", jsonbParam(accountDataJSON), jsonbParam(actionsJSON), jsonbParam(policyNamesJSON))
+		if err != nil {
+			return fmt.Errorf("failed to upsert user %s: %v", identity.Name, err)
+		}
+	}
+
+	// Prune users no longer in config BEFORE replacing credentials. The
+	// IAM rename path (s3api UpdateUser) renames an identity in place and
+	// keeps its access keys: the renamed user shows up in the incoming
+	// config, the old name shows up in the pruned set. If we inserted the
+	// new credentials first, the renamed user's access keys would still be
+	// owned by the old row in this transaction and the INSERT would
+	// violate the global UNIQUE constraint on credentials.access_key.
+	// CASCADE on the old row releases those keys before the insert.
+	rows, err := tx.QueryContext(ctx, "SELECT username FROM users")
+	if err != nil {
+		return fmt.Errorf("failed to list existing users for pruning: %w", err)
+	}
+	var toDelete []string
+	for rows.Next() {
+		var username string
+		if err := rows.Scan(&username); err != nil {
+			rows.Close()
+			return fmt.Errorf("failed to scan username for pruning: %w", err)
+		}
+		if !configUsernames[username] {
+			toDelete = append(toDelete, username)
+		}
+	}
+	scanErr := rows.Err()
+	rows.Close()
+	if scanErr != nil {
+		return fmt.Errorf("failed iterating user rows for pruning: %w", scanErr)
+	}
+
+	if len(toDelete) > 0 {
+		var inlineCount int
+		if err := tx.QueryRowContext(ctx,
+			"SELECT COUNT(*) FROM user_inline_policies WHERE username = ANY($1)",
+			toDelete).Scan(&inlineCount); err != nil {
+			glog.Warningf("credential postgres: SaveConfiguration failed to count inline policies for prune candidates: %v", err)
+		} else if inlineCount > 0 {
+			glog.Warningf("credential postgres: SaveConfiguration pruning %d users will CASCADE-remove %d inline policies; if this was a rename, re-create them under the new name", len(toDelete), inlineCount)
+		}
+		if _, err := tx.ExecContext(ctx, "DELETE FROM users WHERE username = ANY($1)", toDelete); err != nil {
+			return fmt.Errorf("failed to prune users: %w", err)
+		}
+	}
+
+	// Two-pass credential replace: first clear every user we are about to
+	// rewrite in a single round-trip, then insert. Doing the per-user delete
+	// + insert in a single pass would violate the global UNIQUE constraint
+	// on credentials.access_key when an access key gets reassigned from one
+	// user to another within the same SaveConfiguration call.
+	usernames := make([]string, 0, len(configUsernames))
+	for name := range configUsernames {
+		usernames = append(usernames, name)
+	}
+	if _, err := tx.ExecContext(ctx, "DELETE FROM credentials WHERE username = ANY($1)", usernames); err != nil {
+		return fmt.Errorf("failed to clear credentials for incoming users: %w", err)
+	}
+	for _, identity := range config.Identities {
+		for _, cred := range identity.Credentials {
+			if _, err := tx.ExecContext(ctx,
+				"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
+				identity.Name, cred.AccessKey, cred.SecretKey); err != nil {
+				return fmt.Errorf("failed to insert credential for user %s: %v", identity.Name, err)
+			}
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		glog.Errorf("credential postgres: SaveConfiguration commit failed: %v", err)
+		return fmt.Errorf("failed to commit SaveConfiguration: %w", err)
+	}
+
+	if len(toDelete) > 0 {
+		glog.Warningf("credential postgres: SaveConfiguration saved %d identities, pruned %d", len(config.Identities), len(toDelete))
+	} else {
+		glog.V(0).Infof("credential postgres: SaveConfiguration saved %d identities", len(config.Identities))
+	}
+	return nil
+}
+
+func (store *PostgresStore) CreateUser(ctx context.Context, identity *iam_pb.Identity) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	var count int
+	err := store.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", identity.Name).Scan(&count)
+	if err != nil {
+		glog.Errorf("credential postgres: CreateUser check failed user=%s: %v", identity.Name, err)
+		return fmt.Errorf("failed to check user existence: %w", err)
+	}
+	if count > 0 {
+		glog.V(1).Infof("credential postgres: CreateUser user=%s already exists", identity.Name)
+		return credential.ErrUserAlreadyExists
+	}
+
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction: %w", err)
+	}
+	defer tx.Rollback()
+
+	var accountDataJSON []byte
+	if identity.Account != nil {
+		accountDataJSON, err = json.Marshal(identity.Account)
+		if err != nil {
+			return fmt.Errorf("failed to marshal account data: %w", err)
+		}
+	}
+
+	var actionsJSON []byte
+	if identity.Actions != nil {
+		actionsJSON, err = json.Marshal(identity.Actions)
+		if err != nil {
+			return fmt.Errorf("failed to marshal actions: %w", err)
+		}
+	}
+
+	var policyNamesJSON []byte
+	if identity.PolicyNames != nil {
+		policyNamesJSON, err = json.Marshal(identity.PolicyNames)
+		if err != nil {
+			return fmt.Errorf("failed to marshal policy names: %w", err)
+		}
+	}
+
+	_, err = tx.ExecContext(ctx,
+		"INSERT INTO users (username, email, account_data, actions, policy_names) VALUES ($1, $2, $3, $4, $5)",
+		identity.Name, "", jsonbParam(accountDataJSON), jsonbParam(actionsJSON), jsonbParam(policyNamesJSON))
+	if err != nil {
+		glog.Errorf("credential postgres: CreateUser insert failed user=%s: %v", identity.Name, err)
+		return fmt.Errorf("failed to insert user: %w", err)
+	}
+
+	for _, cred := range identity.Credentials {
+		_, err = tx.ExecContext(ctx,
+			"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
+			identity.Name, cred.AccessKey, cred.SecretKey)
+		if err != nil {
+			glog.Errorf("credential postgres: CreateUser insert credential failed user=%s accessKey=%s: %v", identity.Name, cred.AccessKey, err)
+			return fmt.Errorf("failed to insert credential: %w", err)
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		glog.Errorf("credential postgres: CreateUser commit failed user=%s: %v", identity.Name, err)
+		return fmt.Errorf("failed to commit create user %s: %w", identity.Name, err)
+	}
+
+	glog.V(0).Infof("credential postgres: CreateUser user=%s credentials=%d actions=%d", identity.Name, len(identity.Credentials), len(identity.Actions))
+	return nil
+}
+
+func (store *PostgresStore) GetUser(ctx context.Context, username string) (*iam_pb.Identity, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	var email string
+	var accountDataJSON, actionsJSON, policyNamesJSON []byte
+
+	err := store.db.QueryRowContext(ctx,
+		"SELECT email, account_data, actions, policy_names FROM users WHERE username = $1",
+		username).Scan(&email, &accountDataJSON, &actionsJSON, &policyNamesJSON)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			glog.V(2).Infof("credential postgres: GetUser user=%s not found", username)
+			return nil, credential.ErrUserNotFound
+		}
+		glog.Errorf("credential postgres: GetUser query failed user=%s: %v", username, err)
+		return nil, fmt.Errorf("failed to query user: %w", err)
+	}
+
+	identity := &iam_pb.Identity{
+		Name: username,
+	}
+
+	if len(accountDataJSON) > 0 {
+		if err := json.Unmarshal(accountDataJSON, &identity.Account); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal account data: %w", err)
+		}
+	}
+
+	if len(actionsJSON) > 0 {
+		if err := json.Unmarshal(actionsJSON, &identity.Actions); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal actions: %w", err)
+		}
+	}
+
+	if len(policyNamesJSON) > 0 {
+		if err := json.Unmarshal(policyNamesJSON, &identity.PolicyNames); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal policy names: %w", err)
+		}
+	}
+
+	rows, err := store.db.QueryContext(ctx, "SELECT access_key, secret_key FROM credentials WHERE username = $1", username)
+	if err != nil {
+		return nil, fmt.Errorf("failed to query credentials: %w", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var accessKey, secretKey string
+		if err := rows.Scan(&accessKey, &secretKey); err != nil {
+			return nil, fmt.Errorf("failed to scan credential: %w", err)
+		}
+		identity.Credentials = append(identity.Credentials, &iam_pb.Credential{
+			AccessKey: accessKey,
+			SecretKey: secretKey,
+		})
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating credential rows: %w", err)
+	}
+
+	glog.V(2).Infof("credential postgres: GetUser user=%s credentials=%d actions=%d", username, len(identity.Credentials), len(identity.Actions))
+	return identity, nil
+}
+
+func (store *PostgresStore) UpdateUser(ctx context.Context, username string, identity *iam_pb.Identity) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction: %w", err)
+	}
+	defer tx.Rollback()
+
+	var count int
+	err = tx.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", username).Scan(&count)
+	if err != nil {
+		return fmt.Errorf("failed to check user existence: %w", err)
+	}
+	if count == 0 {
+		return credential.ErrUserNotFound
+	}
+
+	var accountDataJSON []byte
+	if identity.Account != nil {
+		accountDataJSON, err = json.Marshal(identity.Account)
+		if err != nil {
+			return fmt.Errorf("failed to marshal account data: %w", err)
+		}
+	}
+
+	var actionsJSON []byte
+	if identity.Actions != nil {
+		actionsJSON, err = json.Marshal(identity.Actions)
+		if err != nil {
+			return fmt.Errorf("failed to marshal actions: %w", err)
+		}
+	}
+
+	var policyNamesJSON []byte
+	if identity.PolicyNames != nil {
+		policyNamesJSON, err = json.Marshal(identity.PolicyNames)
+		if err != nil {
+			return fmt.Errorf("failed to marshal policy names: %w", err)
+		}
+	}
+
+	_, err = tx.ExecContext(ctx,
+		"UPDATE users SET email = $2, account_data = $3, actions = $4, policy_names = $5, updated_at = CURRENT_TIMESTAMP WHERE username = $1",
+		username, "", jsonbParam(accountDataJSON), jsonbParam(actionsJSON), jsonbParam(policyNamesJSON))
+	if err != nil {
+		glog.Errorf("credential postgres: UpdateUser failed user=%s: %v", username, err)
+		return fmt.Errorf("failed to update user: %w", err)
+	}
+
+	_, err = tx.ExecContext(ctx, "DELETE FROM credentials WHERE username = $1", username)
+	if err != nil {
+		return fmt.Errorf("failed to delete existing credentials: %w", err)
+	}
+
+	for _, cred := range identity.Credentials {
+		_, err = tx.ExecContext(ctx,
+			"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
+			username, cred.AccessKey, cred.SecretKey)
+		if err != nil {
+			return fmt.Errorf("failed to insert credential: %w", err)
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		glog.Errorf("credential postgres: UpdateUser commit failed user=%s: %v", username, err)
+		return fmt.Errorf("failed to commit update user %s: %w", username, err)
+	}
+
+	glog.V(0).Infof("credential postgres: UpdateUser user=%s credentials=%d", username, len(identity.Credentials))
+	return nil
+}
+
+func (store *PostgresStore) DeleteUser(ctx context.Context, username string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	result, err := store.db.ExecContext(ctx, "DELETE FROM users WHERE username = $1", username)
+	if err != nil {
+		glog.Errorf("credential postgres: DeleteUser failed user=%s: %v", username, err)
+		return fmt.Errorf("failed to delete user: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+
+	if rowsAffected == 0 {
+		glog.V(1).Infof("credential postgres: DeleteUser user=%s not found", username)
+		return credential.ErrUserNotFound
+	}
+
+	glog.V(0).Infof("credential postgres: DeleteUser user=%s", username)
+	return nil
+}
+
+// RenameUser atomically renames oldName to newName, re-pointing every
+// FK-backed dependent row in a single transaction. The schema's foreign
+// keys (credentials.username, user_inline_policies.username) reference
+// users.username with ON DELETE CASCADE and the default ON UPDATE
+// NO ACTION, which means a plain UPDATE users SET username = newName
+// would fail because the children still reference the old name. Instead:
+//  1. Insert the new users row by copying every non-key column from old.
+//  2. Re-point the dependent tables (credentials, user_inline_policies)
+//     to the new username — both rows now exist so the FK is satisfied.
+//  3. Delete the old users row, which has no remaining dependents.
+//
+// Implements credential.UserRenamer.
+func (store *PostgresStore) RenameUser(ctx context.Context, oldName, newName string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+	if oldName == newName {
+		return nil
+	}
+
+	tx, err := store.db.BeginTx(ctx, nil)
+	if err != nil {
+		return fmt.Errorf("failed to begin transaction: %w", err)
+	}
+	defer tx.Rollback()
+
+	// Refuse if oldName is missing or newName already exists, so the
+	// caller surfaces a recognisable error instead of a constraint
+	// violation midway through.
+	var oldExists, newExists bool
+	if err := tx.QueryRowContext(ctx, "SELECT EXISTS(SELECT 1 FROM users WHERE username = $1)", oldName).Scan(&oldExists); err != nil {
+		return fmt.Errorf("failed to check old user %s: %w", oldName, err)
+	}
+	if !oldExists {
+		return credential.ErrUserNotFound
+	}
+	if err := tx.QueryRowContext(ctx, "SELECT EXISTS(SELECT 1 FROM users WHERE username = $1)", newName).Scan(&newExists); err != nil {
+		return fmt.Errorf("failed to check new user %s: %w", newName, err)
+	}
+	if newExists {
+		return credential.ErrUserAlreadyExists
+	}
+
+	if _, err := tx.ExecContext(ctx,
+		`INSERT INTO users (username, email, account_data, actions, policy_names, created_at, updated_at)
+		 SELECT $1, email, account_data, actions, policy_names, created_at, CURRENT_TIMESTAMP
+		 FROM users WHERE username = $2`,
+		newName, oldName); err != nil {
+		return fmt.Errorf("failed to insert renamed user %s: %w", newName, err)
+	}
+
+	if _, err := tx.ExecContext(ctx,
+		"UPDATE credentials SET username = $1 WHERE username = $2", newName, oldName); err != nil {
+		return fmt.Errorf("failed to re-point credentials to %s: %w", newName, err)
+	}
+
+	if _, err := tx.ExecContext(ctx,
+		"UPDATE user_inline_policies SET username = $1 WHERE username = $2", newName, oldName); err != nil {
+		return fmt.Errorf("failed to re-point inline policies to %s: %w", newName, err)
+	}
+
+	if _, err := tx.ExecContext(ctx,
+		"DELETE FROM users WHERE username = $1", oldName); err != nil {
+		return fmt.Errorf("failed to drop old user %s: %w", oldName, err)
+	}
+
+	if err := tx.Commit(); err != nil {
+		glog.Errorf("credential postgres: RenameUser commit failed %s -> %s: %v", oldName, newName, err)
+		return fmt.Errorf("failed to commit rename %s -> %s: %w", oldName, newName, err)
+	}
+
+	glog.V(0).Infof("credential postgres: RenameUser %s -> %s", oldName, newName)
+	return nil
+}
+
+func (store *PostgresStore) ListUsers(ctx context.Context) ([]string, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	rows, err := store.db.QueryContext(ctx, "SELECT username FROM users ORDER BY username")
+	if err != nil {
+		glog.Errorf("credential postgres: ListUsers query failed: %v", err)
+		return nil, fmt.Errorf("failed to query users: %w", err)
+	}
+	defer rows.Close()
+
+	var usernames []string
+	for rows.Next() {
+		var username string
+		if err := rows.Scan(&username); err != nil {
+			return nil, fmt.Errorf("failed to scan username: %w", err)
+		}
+		usernames = append(usernames, username)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating user rows: %w", err)
+	}
+
+	glog.V(1).Infof("credential postgres: ListUsers count=%d", len(usernames))
+	return usernames, nil
+}
+
+func (store *PostgresStore) GetUserByAccessKey(ctx context.Context, accessKey string) (*iam_pb.Identity, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	var username string
+	err := store.db.QueryRowContext(ctx, "SELECT username FROM credentials WHERE access_key = $1", accessKey).Scan(&username)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			glog.V(2).Infof("credential postgres: GetUserByAccessKey accessKey=%s not found", accessKey)
+			return nil, credential.ErrAccessKeyNotFound
+		}
+		glog.Errorf("credential postgres: GetUserByAccessKey query failed accessKey=%s: %v", accessKey, err)
+		return nil, fmt.Errorf("failed to query access key: %w", err)
+	}
+
+	glog.V(2).Infof("credential postgres: GetUserByAccessKey accessKey=%s resolved to user=%s", accessKey, username)
+	return store.GetUser(ctx, username)
+}
+
+func (store *PostgresStore) CreateAccessKey(ctx context.Context, username string, cred *iam_pb.Credential) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	var count int
+	err := store.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", username).Scan(&count)
+	if err != nil {
+		return fmt.Errorf("failed to check user existence: %w", err)
+	}
+	if count == 0 {
+		return credential.ErrUserNotFound
+	}
+
+	_, err = store.db.ExecContext(ctx,
+		"INSERT INTO credentials (username, access_key, secret_key) VALUES ($1, $2, $3)",
+		username, cred.AccessKey, cred.SecretKey)
+	if err != nil {
+		glog.Errorf("credential postgres: CreateAccessKey failed user=%s accessKey=%s: %v", username, cred.AccessKey, err)
+		return fmt.Errorf("failed to insert credential: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: CreateAccessKey user=%s accessKey=%s", username, cred.AccessKey)
+	return nil
+}
+
+func (store *PostgresStore) DeleteAccessKey(ctx context.Context, username string, accessKey string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	result, err := store.db.ExecContext(ctx,
+		"DELETE FROM credentials WHERE username = $1 AND access_key = $2",
+		username, accessKey)
+	if err != nil {
+		glog.Errorf("credential postgres: DeleteAccessKey failed user=%s accessKey=%s: %v", username, accessKey, err)
+		return fmt.Errorf("failed to delete access key: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+
+	if rowsAffected == 0 {
+		var count int
+		err = store.db.QueryRowContext(ctx, "SELECT COUNT(*) FROM users WHERE username = $1", username).Scan(&count)
+		if err != nil {
+			return fmt.Errorf("failed to check user existence: %w", err)
+		}
+		if count == 0 {
+			return credential.ErrUserNotFound
+		}
+		return credential.ErrAccessKeyNotFound
+	}
+
+	glog.V(0).Infof("credential postgres: DeleteAccessKey user=%s accessKey=%s", username, accessKey)
+	return nil
+}
+
+func (store *PostgresStore) AttachUserPolicy(ctx context.Context, username string, policyName string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	identity, err := store.GetUser(ctx, username)
+	if err != nil {
+		return err
+	}
+
+	policy, err := store.GetPolicy(ctx, policyName)
+	if err != nil {
+		return err
+	}
+	if policy == nil {
+		return credential.ErrPolicyNotFound
+	}
+
+	for _, p := range identity.PolicyNames {
+		if p == policyName {
+			return credential.ErrPolicyAlreadyAttached
+		}
+	}
+
+	identity.PolicyNames = append(identity.PolicyNames, policyName)
+	if err := store.UpdateUser(ctx, username, identity); err != nil {
+		return err
+	}
+
+	glog.V(1).Infof("credential postgres: AttachUserPolicy user=%s policy=%s", username, policyName)
+	return nil
+}
+
+func (store *PostgresStore) DetachUserPolicy(ctx context.Context, username string, policyName string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	identity, err := store.GetUser(ctx, username)
+	if err != nil {
+		return err
+	}
+
+	found := false
+	var newPolicyNames []string
+	for _, p := range identity.PolicyNames {
+		if p == policyName {
+			found = true
+		} else {
+			newPolicyNames = append(newPolicyNames, p)
+		}
+	}
+
+	if !found {
+		return credential.ErrPolicyNotAttached
+	}
+
+	identity.PolicyNames = newPolicyNames
+	if err := store.UpdateUser(ctx, username, identity); err != nil {
+		return err
+	}
+
+	glog.V(1).Infof("credential postgres: DetachUserPolicy user=%s policy=%s", username, policyName)
+	return nil
+}
+
+func (store *PostgresStore) ListAttachedUserPolicies(ctx context.Context, username string) ([]string, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	identity, err := store.GetUser(ctx, username)
+	if err != nil {
+		return nil, err
+	}
+
+	return identity.PolicyNames, nil
+}

weed/credential/postgres/postgres_inline_policy.go

@@ -0,0 +1,154 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+func (store *PostgresStore) PutUserInlinePolicy(ctx context.Context, userName, policyName string, document policy_engine.PolicyDocument) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	docJSON, err := json.Marshal(document)
+	if err != nil {
+		glog.Errorf("credential postgres: PutUserInlinePolicy marshal failed user=%s policy=%s: %v", userName, policyName, err)
+		return fmt.Errorf("failed to marshal policy document: %w", err)
+	}
+
+	_, err = store.db.ExecContext(ctx,
+		`INSERT INTO user_inline_policies (username, policy_name, document)
+		 VALUES ($1, $2, $3)
+		 ON CONFLICT (username, policy_name)
+		 DO UPDATE SET document = $3, updated_at = CURRENT_TIMESTAMP`,
+		userName, policyName, jsonbParam(docJSON))
+	if err != nil {
+		glog.Errorf("credential postgres: PutUserInlinePolicy failed user=%s policy=%s: %v", userName, policyName, err)
+		return fmt.Errorf("failed to upsert inline policy: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: PutUserInlinePolicy user=%s policy=%s", userName, policyName)
+	return nil
+}
+
+func (store *PostgresStore) GetUserInlinePolicy(ctx context.Context, userName, policyName string) (*policy_engine.PolicyDocument, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	var docJSON []byte
+	err := store.db.QueryRowContext(ctx,
+		"SELECT document FROM user_inline_policies WHERE username = $1 AND policy_name = $2",
+		userName, policyName).Scan(&docJSON)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			glog.V(2).Infof("credential postgres: GetUserInlinePolicy user=%s policy=%s not found", userName, policyName)
+			return nil, nil
+		}
+		glog.Errorf("credential postgres: GetUserInlinePolicy query failed user=%s policy=%s: %v", userName, policyName, err)
+		return nil, fmt.Errorf("failed to query inline policy: %w", err)
+	}
+
+	var doc policy_engine.PolicyDocument
+	if err := json.Unmarshal(docJSON, &doc); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal inline policy: %w", err)
+	}
+
+	glog.V(2).Infof("credential postgres: GetUserInlinePolicy user=%s policy=%s found", userName, policyName)
+	return &doc, nil
+}
+
+func (store *PostgresStore) DeleteUserInlinePolicy(ctx context.Context, userName, policyName string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	result, err := store.db.ExecContext(ctx,
+		"DELETE FROM user_inline_policies WHERE username = $1 AND policy_name = $2",
+		userName, policyName)
+	if err != nil {
+		glog.Errorf("credential postgres: DeleteUserInlinePolicy failed user=%s policy=%s: %v", userName, policyName, err)
+		return fmt.Errorf("failed to delete inline policy: %w", err)
+	}
+
+	rowsAffected, _ := result.RowsAffected()
+	glog.V(0).Infof("credential postgres: DeleteUserInlinePolicy user=%s policy=%s deleted=%d", userName, policyName, rowsAffected)
+	return nil
+}
+
+func (store *PostgresStore) ListUserInlinePolicies(ctx context.Context, userName string) ([]string, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	rows, err := store.db.QueryContext(ctx,
+		"SELECT policy_name FROM user_inline_policies WHERE username = $1 ORDER BY policy_name",
+		userName)
+	if err != nil {
+		glog.Errorf("credential postgres: ListUserInlinePolicies query failed user=%s: %v", userName, err)
+		return nil, fmt.Errorf("failed to query inline policies: %w", err)
+	}
+	defer rows.Close()
+
+	var names []string
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, fmt.Errorf("failed to scan policy name: %w", err)
+		}
+		names = append(names, name)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating inline policy rows: %w", err)
+	}
+
+	glog.V(1).Infof("credential postgres: ListUserInlinePolicies user=%s count=%d", userName, len(names))
+	return names, nil
+}
+
+func (store *PostgresStore) LoadInlinePolicies(ctx context.Context) (map[string]map[string]policy_engine.PolicyDocument, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	rows, err := store.db.QueryContext(ctx,
+		"SELECT username, policy_name, document FROM user_inline_policies ORDER BY username, policy_name")
+	if err != nil {
+		glog.Errorf("credential postgres: LoadInlinePolicies query failed: %v", err)
+		return nil, fmt.Errorf("failed to query inline policies: %w", err)
+	}
+	defer rows.Close()
+
+	result := make(map[string]map[string]policy_engine.PolicyDocument)
+	count := 0
+	for rows.Next() {
+		var username, policyName string
+		var docJSON []byte
+		if err := rows.Scan(&username, &policyName, &docJSON); err != nil {
+			return nil, fmt.Errorf("failed to scan inline policy row: %w", err)
+		}
+
+		var doc policy_engine.PolicyDocument
+		if err := json.Unmarshal(docJSON, &doc); err != nil {
+			glog.Warningf("credential postgres: LoadInlinePolicies unmarshal failed user=%s policy=%s: %v", username, policyName, err)
+			continue
+		}
+
+		if result[username] == nil {
+			result[username] = make(map[string]policy_engine.PolicyDocument)
+		}
+		result[username][policyName] = doc
+		count++
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("failed iterating inline policy rows: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: LoadInlinePolicies loaded %d policies for %d users", count, len(result))
+	return result, nil
+}

weed/credential/postgres/postgres_policy.go

@@ -0,0 +1,159 @@
+package postgres
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+)
+
+// GetPolicies retrieves all IAM policies from PostgreSQL
+func (store *PostgresStore) GetPolicies(ctx context.Context) (map[string]policy_engine.PolicyDocument, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	policies := make(map[string]policy_engine.PolicyDocument)
+
+	rows, err := store.db.QueryContext(ctx, "SELECT name, document FROM policies")
+	if err != nil {
+		return nil, fmt.Errorf("failed to query policies: %w", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var name string
+		var documentJSON []byte
+
+		if err := rows.Scan(&name, &documentJSON); err != nil {
+			return nil, fmt.Errorf("failed to scan policy row: %w", err)
+		}
+
+		var document policy_engine.PolicyDocument
+		if err := json.Unmarshal(documentJSON, &document); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal policy document for %s: %v", name, err)
+		}
+
+		policies[name] = document
+	}
+
+	return policies, nil
+}
+
+// ListPolicyNames returns all managed policy names from PostgreSQL.
+func (store *PostgresStore) ListPolicyNames(ctx context.Context) ([]string, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	var names []string
+	rows, err := store.db.QueryContext(ctx, "SELECT name FROM policies")
+	if err != nil {
+		return nil, fmt.Errorf("failed to query policy names: %w", err)
+	}
+	defer rows.Close()
+
+	for rows.Next() {
+		var name string
+		if err := rows.Scan(&name); err != nil {
+			return nil, fmt.Errorf("failed to scan policy name: %w", err)
+		}
+		names = append(names, name)
+	}
+
+	return names, nil
+}
+
+// CreatePolicy creates a new IAM policy in PostgreSQL
+func (store *PostgresStore) CreatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	documentJSON, err := json.Marshal(document)
+	if err != nil {
+		return fmt.Errorf("failed to marshal policy document: %w", err)
+	}
+
+	_, err = store.db.ExecContext(ctx,
+		"INSERT INTO policies (name, document) VALUES ($1, $2) ON CONFLICT (name) DO UPDATE SET document = $2, updated_at = CURRENT_TIMESTAMP",
+		name, jsonbParam(documentJSON))
+	if err != nil {
+		return fmt.Errorf("failed to insert policy: %w", err)
+	}
+
+	return nil
+}
+
+// PutPolicy creates or updates an IAM policy in PostgreSQL
+func (store *PostgresStore) PutPolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
+	return store.CreatePolicy(ctx, name, document)
+}
+
+// UpdatePolicy updates an existing IAM policy in PostgreSQL
+func (store *PostgresStore) UpdatePolicy(ctx context.Context, name string, document policy_engine.PolicyDocument) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	documentJSON, err := json.Marshal(document)
+	if err != nil {
+		return fmt.Errorf("failed to marshal policy document: %w", err)
+	}
+
+	result, err := store.db.ExecContext(ctx,
+		"UPDATE policies SET document = $2, updated_at = CURRENT_TIMESTAMP WHERE name = $1",
+		name, jsonbParam(documentJSON))
+	if err != nil {
+		return fmt.Errorf("failed to update policy: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+
+	if rowsAffected == 0 {
+		return fmt.Errorf("policy %s not found", name)
+	}
+
+	return nil
+}
+
+// DeletePolicy deletes an IAM policy from PostgreSQL
+func (store *PostgresStore) DeletePolicy(ctx context.Context, name string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	result, err := store.db.ExecContext(ctx, "DELETE FROM policies WHERE name = $1", name)
+	if err != nil {
+		return fmt.Errorf("failed to delete policy: %w", err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("failed to get rows affected: %w", err)
+	}
+
+	if rowsAffected == 0 {
+		return fmt.Errorf("policy %s not found", name)
+	}
+
+	return nil
+}
+
+// GetPolicy retrieves a specific IAM policy by name from PostgreSQL
+func (store *PostgresStore) GetPolicy(ctx context.Context, name string) (*policy_engine.PolicyDocument, error) {
+	policies, err := store.GetPolicies(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	if policy, exists := policies[name]; exists {
+		return &policy, nil
+	}
+
+	return nil, nil // Policy not found
+}

weed/credential/postgres/postgres_service_account.go

@@ -0,0 +1,173 @@
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+)
+
+func (store *PostgresStore) CreateServiceAccount(ctx context.Context, sa *iam_pb.ServiceAccount) error {
+	if sa == nil {
+		return fmt.Errorf("service account is nil")
+	}
+	if sa.Id == "" {
+		return fmt.Errorf("service account ID is required")
+	}
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	data, err := json.Marshal(sa)
+	if err != nil {
+		return fmt.Errorf("failed to marshal service account: %w", err)
+	}
+
+	accessKey := ""
+	if sa.Credential != nil {
+		accessKey = sa.Credential.AccessKey
+	}
+
+	_, err = store.db.ExecContext(ctx,
+		"INSERT INTO service_accounts (id, access_key, content) VALUES ($1, $2, $3)",
+		sa.Id, accessKey, jsonbParam(data))
+	if err != nil {
+		return fmt.Errorf("failed to insert service account: %w", err)
+	}
+	return nil
+}
+
+func (store *PostgresStore) UpdateServiceAccount(ctx context.Context, id string, sa *iam_pb.ServiceAccount) error {
+	if sa == nil {
+		return fmt.Errorf("service account is nil")
+	}
+	if id == "" {
+		return fmt.Errorf("service account ID is required")
+	}
+	if sa.Id != id {
+		return fmt.Errorf("service account ID mismatch")
+	}
+
+	data, err := json.Marshal(sa)
+	if err != nil {
+		return fmt.Errorf("failed to marshal service account: %w", err)
+	}
+
+	accessKey := ""
+	if sa.Credential != nil {
+		accessKey = sa.Credential.AccessKey
+	}
+
+	result, err := store.db.ExecContext(ctx,
+		"UPDATE service_accounts SET access_key = $2, content = $3, updated_at = CURRENT_TIMESTAMP WHERE id = $1",
+		id, accessKey, jsonbParam(data))
+	if err != nil {
+		return fmt.Errorf("failed to update service account: %w", err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows == 0 {
+		return credential.ErrServiceAccountNotFound
+	}
+	return nil
+}
+
+func (store *PostgresStore) DeleteServiceAccount(ctx context.Context, id string) error {
+	if !store.configured {
+		return fmt.Errorf("store not configured")
+	}
+
+	result, err := store.db.ExecContext(ctx, "DELETE FROM service_accounts WHERE id = $1", id)
+	if err != nil {
+		return fmt.Errorf("failed to delete service account: %w", err)
+	}
+
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rows == 0 {
+		return credential.ErrServiceAccountNotFound
+	}
+	return nil
+}
+
+func (store *PostgresStore) GetServiceAccount(ctx context.Context, id string) (*iam_pb.ServiceAccount, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	var content []byte
+	err := store.db.QueryRowContext(ctx, "SELECT content FROM service_accounts WHERE id = $1", id).Scan(&content)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, credential.ErrServiceAccountNotFound
+		}
+		return nil, fmt.Errorf("failed to get service account: %w", err)
+	}
+
+	sa := &iam_pb.ServiceAccount{}
+	if err := json.Unmarshal(content, sa); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal service account: %w", err)
+	}
+	return sa, nil
+}
+
+func (store *PostgresStore) ListServiceAccounts(ctx context.Context) ([]*iam_pb.ServiceAccount, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	rows, err := store.db.QueryContext(ctx, "SELECT content FROM service_accounts")
+	if err != nil {
+		return nil, fmt.Errorf("failed to list service accounts: %w", err)
+	}
+	defer rows.Close()
+
+	var accounts []*iam_pb.ServiceAccount
+	for rows.Next() {
+		var content []byte
+		if err := rows.Scan(&content); err != nil {
+			return nil, fmt.Errorf("failed to scan service account: %w", err)
+		}
+		sa := &iam_pb.ServiceAccount{}
+		if err := json.Unmarshal(content, sa); err != nil {
+			return nil, fmt.Errorf("failed to unmarshal service account: %w", err)
+		}
+		accounts = append(accounts, sa)
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("error iterating service accounts: %w", err)
+	}
+
+	return accounts, nil
+}
+
+func (store *PostgresStore) GetServiceAccountByAccessKey(ctx context.Context, accessKey string) (*iam_pb.ServiceAccount, error) {
+	if !store.configured {
+		return nil, fmt.Errorf("store not configured")
+	}
+
+	var content []byte
+	err := store.db.QueryRowContext(ctx, "SELECT content FROM service_accounts WHERE access_key = $1", accessKey).Scan(&content)
+	if err != nil {
+		if err == sql.ErrNoRows {
+			return nil, credential.ErrAccessKeyNotFound
+		}
+		return nil, fmt.Errorf("failed to query service account by access key: %w", err)
+	}
+
+	sa := &iam_pb.ServiceAccount{}
+	if err := json.Unmarshal(content, sa); err != nil {
+		return nil, fmt.Errorf("failed to unmarshal service account: %w", err)
+	}
+
+	return sa, nil
+}

weed/credential/postgres/postgres_store.go

@@ -0,0 +1,263 @@
+package postgres
+
+import (
+	"database/sql"
+	"fmt"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/glog"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/seaweedfs/seaweedfs/weed/util/pgxutil"
+)
+
+const (
+	defaultMaxOpenConns        = 25
+	defaultMaxIdleConns        = 5
+	defaultConnMaxLifetimeSecs = 300
+)
+
+// jsonbParam adapts JSON bytes for an ExecContext call against a JSONB
+// column. Returns nil (so the driver writes SQL NULL) when b is nil or
+// empty; otherwise returns string(b) so pgx drives it as JSONB text — []byte
+// would be encoded as bytea under simple_protocol (pgbouncer mode) and
+// rejected by Postgres with "invalid input syntax for type json".
+func jsonbParam(b []byte) interface{} {
+	if len(b) == 0 {
+		return nil
+	}
+	return string(b)
+}
+
+func init() {
+	credential.Stores = append(credential.Stores, &PostgresStore{})
+}
+
+// PostgresStore implements CredentialStore using PostgreSQL
+type PostgresStore struct {
+	db         *sql.DB
+	configured bool
+}
+
+func (store *PostgresStore) GetName() credential.CredentialStoreTypeName {
+	return credential.StoreTypePostgres
+}
+
+func (store *PostgresStore) Initialize(configuration util.Configuration, prefix string) error {
+	if store.configured {
+		return nil
+	}
+
+	hostname := configuration.GetString(prefix + "hostname")
+	port := configuration.GetInt(prefix + "port")
+	username := configuration.GetString(prefix + "username")
+	password := configuration.GetString(prefix + "password")
+	database := configuration.GetString(prefix + "database")
+	schema := configuration.GetString(prefix + "schema")
+	sslmode := configuration.GetString(prefix + "sslmode")
+	sslcert := configuration.GetString(prefix + "sslcert")
+	sslkey := configuration.GetString(prefix + "sslkey")
+	sslrootcert := configuration.GetString(prefix + "sslrootcert")
+	sslcrl := configuration.GetString(prefix + "sslcrl")
+	pgbouncerCompatible := configuration.GetBool(prefix + "pgbouncer_compatible")
+	maxIdle := configuration.GetInt(prefix + "connection_max_idle")
+	maxOpen := configuration.GetInt(prefix + "connection_max_open")
+	maxLifetimeSeconds := configuration.GetInt(prefix + "connection_max_lifetime_seconds")
+
+	if hostname == "" {
+		hostname = "localhost"
+	}
+	if port == 0 {
+		port = 5432
+	}
+	if sslmode == "" {
+		sslmode = "disable"
+	}
+	if maxOpen == 0 {
+		maxOpen = defaultMaxOpenConns
+	}
+	if maxIdle == 0 {
+		maxIdle = defaultMaxIdleConns
+	}
+	if maxLifetimeSeconds == 0 {
+		maxLifetimeSeconds = defaultConnMaxLifetimeSecs
+	}
+
+	glog.V(0).Infof("credential postgres: initializing store host=%s port=%d user=%s db=%s sslmode=%s pgbouncer=%v",
+		hostname, port, username, database, sslmode, pgbouncerCompatible)
+
+	dsn, adaptedDSN := pgxutil.BuildDSN(pgxutil.DSNOptions{
+		Hostname:            hostname,
+		Port:                port,
+		User:                username,
+		Password:            password,
+		Database:            database,
+		Schema:              schema,
+		SSLMode:             sslmode,
+		SSLCert:             sslcert,
+		SSLKey:              sslkey,
+		SSLRootCert:         sslrootcert,
+		SSLCRL:              sslcrl,
+		PgBouncerCompatible: pgbouncerCompatible,
+	})
+
+	db, err := pgxutil.OpenDB(dsn, adaptedDSN, pgbouncerCompatible, maxIdle, maxOpen, maxLifetimeSeconds)
+	if err != nil {
+		glog.Errorf("credential postgres: failed to open database: %v", err)
+		return fmt.Errorf("failed to open database: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: connection established")
+
+	store.db = db
+
+	if err := store.createTables(); err != nil {
+		db.Close()
+		store.db = nil
+		glog.Errorf("credential postgres: failed to create tables: %v", err)
+		return fmt.Errorf("failed to create tables: %w", err)
+	}
+
+	glog.V(0).Infof("credential postgres: tables verified, store ready")
+
+	store.configured = true
+	return nil
+}
+
+func (store *PostgresStore) createTables() error {
+	usersTable := `
+		CREATE TABLE IF NOT EXISTS users (
+			username VARCHAR(255) PRIMARY KEY,
+			email VARCHAR(255),
+			account_data JSONB,
+			actions JSONB,
+			policy_names JSONB DEFAULT '[]',
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);
+		CREATE INDEX IF NOT EXISTS idx_users_email ON users(email);
+	`
+
+	addPolicyNamesColumn := `
+		ALTER TABLE users ADD COLUMN IF NOT EXISTS policy_names JSONB DEFAULT '[]';
+	`
+
+	credentialsTable := `
+		CREATE TABLE IF NOT EXISTS credentials (
+			id SERIAL PRIMARY KEY,
+			username VARCHAR(255) REFERENCES users(username) ON DELETE CASCADE,
+			access_key VARCHAR(255) UNIQUE NOT NULL,
+			secret_key VARCHAR(255) NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);
+		CREATE INDEX IF NOT EXISTS idx_credentials_username ON credentials(username);
+		CREATE INDEX IF NOT EXISTS idx_credentials_access_key ON credentials(access_key);
+	`
+
+	policiesTable := `
+		CREATE TABLE IF NOT EXISTS policies (
+			name VARCHAR(255) PRIMARY KEY,
+			document JSONB NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);
+		CREATE INDEX IF NOT EXISTS idx_policies_name ON policies(name);
+	`
+
+	serviceAccountsTable := `
+		CREATE TABLE IF NOT EXISTS service_accounts (
+			id VARCHAR(255) PRIMARY KEY,
+			access_key VARCHAR(255) UNIQUE,
+			content JSONB NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);
+	`
+
+	inlinePoliciesTable := `
+		CREATE TABLE IF NOT EXISTS user_inline_policies (
+			username VARCHAR(255) REFERENCES users(username) ON DELETE CASCADE,
+			policy_name VARCHAR(255) NOT NULL,
+			document JSONB NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			PRIMARY KEY (username, policy_name)
+		);
+		CREATE INDEX IF NOT EXISTS idx_user_inline_policies_username ON user_inline_policies(username);
+	`
+
+	groupsTable := `
+		CREATE TABLE IF NOT EXISTS groups (
+			name VARCHAR(255) PRIMARY KEY,
+			members JSONB DEFAULT '[]',
+			policy_names JSONB DEFAULT '[]',
+			disabled BOOLEAN DEFAULT FALSE,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		);
+	`
+
+	groupInlinePoliciesTable := `
+		CREATE TABLE IF NOT EXISTS group_inline_policies (
+			group_name VARCHAR(255) REFERENCES groups(name) ON DELETE CASCADE,
+			policy_name VARCHAR(255) NOT NULL,
+			document JSONB NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			PRIMARY KEY (group_name, policy_name)
+		);
+		CREATE INDEX IF NOT EXISTS idx_group_inline_policies_group_name ON group_inline_policies(group_name);
+	`
+
+	if _, err := store.db.Exec(usersTable); err != nil {
+		return fmt.Errorf("failed to create users table: %w", err)
+	}
+
+	if _, err := store.db.Exec(addPolicyNamesColumn); err != nil {
+		return fmt.Errorf("failed to add policy_names column: %w", err)
+	}
+
+	if _, err := store.db.Exec(credentialsTable); err != nil {
+		return fmt.Errorf("failed to create credentials table: %w", err)
+	}
+
+	if _, err := store.db.Exec(policiesTable); err != nil {
+		return fmt.Errorf("failed to create policies table: %w", err)
+	}
+
+	if _, err := store.db.Exec(serviceAccountsTable); err != nil {
+		return fmt.Errorf("failed to create service_accounts table: %w", err)
+	}
+
+	if _, err := store.db.Exec(inlinePoliciesTable); err != nil {
+		return fmt.Errorf("failed to create user_inline_policies table: %w", err)
+	}
+
+	if _, err := store.db.Exec(groupsTable); err != nil {
+		return fmt.Errorf("failed to create groups table: %w", err)
+	}
+
+	if _, err := store.db.Exec(groupInlinePoliciesTable); err != nil {
+		return fmt.Errorf("failed to create group_inline_policies table: %w", err)
+	}
+
+	groupsDisabledIndex := `CREATE INDEX IF NOT EXISTS idx_groups_disabled ON groups (disabled);`
+	if _, err := store.db.Exec(groupsDisabledIndex); err != nil {
+		return fmt.Errorf("failed to create groups disabled index: %w", err)
+	}
+
+	groupsMembersIndex := `CREATE INDEX IF NOT EXISTS idx_groups_members_gin ON groups USING GIN (members);`
+	if _, err := store.db.Exec(groupsMembersIndex); err != nil {
+		return fmt.Errorf("failed to create groups members index: %w", err)
+	}
+
+	return nil
+}
+
+func (store *PostgresStore) Shutdown() {
+	if store.db != nil {
+		glog.V(0).Infof("credential postgres: shutting down")
+		store.db.Close()
+		store.db = nil
+	}
+	store.configured = false
+}