snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/credential/test/inline_policy_test.go

@@ -0,0 +1,266 @@
+package test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/filer_etc"
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/postgres"
+)
+
+func TestInlinePolicyOperations(t *testing.T) {
+	ctx := context.Background()
+
+	credentialManager, err := credential.NewCredentialManager(credential.StoreTypeMemory, nil, "")
+	if err != nil {
+		t.Fatalf("Failed to create credential manager: %v", err)
+	}
+
+	store, ok := credentialManager.GetStore().(*memory.MemoryStore)
+	if !ok {
+		t.Fatal("Store is not a memory store")
+	}
+
+	userName := "testuser"
+	policyName := "read-bucket"
+	doc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::test-bucket/*"),
+			},
+		},
+	}
+
+	// Put
+	if err := store.PutUserInlinePolicy(ctx, userName, policyName, doc); err != nil {
+		t.Fatalf("PutUserInlinePolicy failed: %v", err)
+	}
+
+	// Get
+	got, err := store.GetUserInlinePolicy(ctx, userName, policyName)
+	if err != nil {
+		t.Fatalf("GetUserInlinePolicy failed: %v", err)
+	}
+	if got == nil {
+		t.Fatal("GetUserInlinePolicy returned nil")
+	}
+	if got.Version != "2012-10-17" {
+		t.Errorf("Expected version '2012-10-17', got '%s'", got.Version)
+	}
+	if len(got.Statement) != 1 {
+		t.Errorf("Expected 1 statement, got %d", len(got.Statement))
+	}
+
+	// Get non-existent
+	missing, err := store.GetUserInlinePolicy(ctx, userName, "no-such-policy")
+	if err != nil {
+		t.Fatalf("GetUserInlinePolicy for missing policy failed: %v", err)
+	}
+	if missing != nil {
+		t.Error("Expected nil for non-existent policy")
+	}
+
+	// Put second policy, same user
+	doc2 := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:PutObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::other-bucket/*"),
+			},
+		},
+	}
+	if err := store.PutUserInlinePolicy(ctx, userName, "write-bucket", doc2); err != nil {
+		t.Fatalf("PutUserInlinePolicy second policy failed: %v", err)
+	}
+
+	// List
+	names, err := store.ListUserInlinePolicies(ctx, userName)
+	if err != nil {
+		t.Fatalf("ListUserInlinePolicies failed: %v", err)
+	}
+	if len(names) != 2 {
+		t.Errorf("Expected 2 policies, got %d", len(names))
+	}
+
+	// List for non-existent user
+	emptyNames, err := store.ListUserInlinePolicies(ctx, "nobody")
+	if err != nil {
+		t.Fatalf("ListUserInlinePolicies for missing user failed: %v", err)
+	}
+	if len(emptyNames) != 0 {
+		t.Errorf("Expected 0 policies for missing user, got %d", len(emptyNames))
+	}
+
+	// LoadInlinePolicies (bulk)
+	all, err := store.LoadInlinePolicies(ctx)
+	if err != nil {
+		t.Fatalf("LoadInlinePolicies failed: %v", err)
+	}
+	if len(all) != 1 {
+		t.Errorf("Expected 1 user in LoadInlinePolicies, got %d", len(all))
+	}
+	if len(all[userName]) != 2 {
+		t.Errorf("Expected 2 policies for user in LoadInlinePolicies, got %d", len(all[userName]))
+	}
+
+	// Overwrite existing policy (upsert)
+	updatedDoc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectDeny,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::test-bucket/secret/*"),
+			},
+		},
+	}
+	if err := store.PutUserInlinePolicy(ctx, userName, policyName, updatedDoc); err != nil {
+		t.Fatalf("PutUserInlinePolicy overwrite failed: %v", err)
+	}
+	overwritten, err := store.GetUserInlinePolicy(ctx, userName, policyName)
+	if err != nil {
+		t.Fatalf("GetUserInlinePolicy after overwrite failed: %v", err)
+	}
+	if overwritten.Statement[0].Effect != policy_engine.PolicyEffectDeny {
+		t.Errorf("Expected Deny after overwrite, got %s", overwritten.Statement[0].Effect)
+	}
+
+	// Delete one policy
+	if err := store.DeleteUserInlinePolicy(ctx, userName, policyName); err != nil {
+		t.Fatalf("DeleteUserInlinePolicy failed: %v", err)
+	}
+	deleted, err := store.GetUserInlinePolicy(ctx, userName, policyName)
+	if err != nil {
+		t.Fatalf("GetUserInlinePolicy after delete failed: %v", err)
+	}
+	if deleted != nil {
+		t.Error("Expected nil after delete")
+	}
+
+	// Remaining policy still there
+	remaining, err := store.ListUserInlinePolicies(ctx, userName)
+	if err != nil {
+		t.Fatalf("ListUserInlinePolicies after delete failed: %v", err)
+	}
+	if len(remaining) != 1 {
+		t.Errorf("Expected 1 remaining policy, got %d", len(remaining))
+	}
+
+	// Delete last policy — user entry should be cleaned up
+	if err := store.DeleteUserInlinePolicy(ctx, userName, "write-bucket"); err != nil {
+		t.Fatalf("DeleteUserInlinePolicy last policy failed: %v", err)
+	}
+	allAfter, err := store.LoadInlinePolicies(ctx)
+	if err != nil {
+		t.Fatalf("LoadInlinePolicies after full cleanup failed: %v", err)
+	}
+	if len(allAfter) != 0 {
+		t.Errorf("Expected empty LoadInlinePolicies after cleanup, got %d users", len(allAfter))
+	}
+}
+
+// TestMemoryRenameUserMovesIdentityAndPolicies exercises the new
+// credential.UserRenamer path on the memory store: the identity row,
+// its access keys, and any inline policies all have to land under the
+// new name in a single operation.
+func TestMemoryRenameUserMovesIdentityAndPolicies(t *testing.T) {
+	ctx := context.Background()
+
+	cm, err := credential.NewCredentialManager(credential.StoreTypeMemory, nil, "")
+	if err != nil {
+		t.Fatalf("Failed to create credential manager: %v", err)
+	}
+
+	const (
+		oldName    = "renameme"
+		newName    = "renamed"
+		policyName = "ReadBucket"
+	)
+
+	cred := &iam_pb.Credential{AccessKey: "AKIA-RENAME", SecretKey: "secret"}
+	if err := cm.CreateUser(ctx, &iam_pb.Identity{
+		Name:        oldName,
+		Credentials: []*iam_pb.Credential{cred},
+	}); err != nil {
+		t.Fatalf("CreateUser failed: %v", err)
+	}
+	doc := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{{
+			Effect:   policy_engine.PolicyEffectAllow,
+			Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+			Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::bucket/*"),
+		}},
+	}
+	if err := cm.PutUserInlinePolicy(ctx, oldName, policyName, doc); err != nil {
+		t.Fatalf("PutUserInlinePolicy failed: %v", err)
+	}
+
+	supported, err := cm.RenameUser(ctx, oldName, newName)
+	if err != nil {
+		t.Fatalf("RenameUser failed: %v", err)
+	}
+	if !supported {
+		t.Fatal("memory store should implement credential.UserRenamer")
+	}
+
+	if _, err := cm.GetUser(ctx, oldName); err == nil {
+		t.Errorf("expected old user %q to be gone after rename", oldName)
+	}
+	got, err := cm.GetUser(ctx, newName)
+	if err != nil {
+		t.Fatalf("GetUser(%q) after rename failed: %v", newName, err)
+	}
+	if got.Name != newName {
+		t.Errorf("renamed identity name = %q, want %q", got.Name, newName)
+	}
+	if len(got.Credentials) != 1 || got.Credentials[0].AccessKey != cred.AccessKey {
+		t.Errorf("renamed identity should still own its access key, got %+v", got.Credentials)
+	}
+
+	gotByKey, err := cm.GetUserByAccessKey(ctx, cred.AccessKey)
+	if err != nil {
+		t.Fatalf("GetUserByAccessKey failed: %v", err)
+	}
+	if gotByKey == nil || gotByKey.Name != newName {
+		t.Errorf("access key should resolve to %q, got %+v", newName, gotByKey)
+	}
+
+	gotPolicy, err := cm.GetUserInlinePolicy(ctx, newName, policyName)
+	if err != nil {
+		t.Fatalf("GetUserInlinePolicy under new name failed: %v", err)
+	}
+	if gotPolicy == nil {
+		t.Fatal("inline policy should be readable under the new name")
+	}
+	if gotPolicy.Statement[0].Effect != policy_engine.PolicyEffectAllow {
+		t.Errorf("policy effect: got %q want %q", gotPolicy.Statement[0].Effect, policy_engine.PolicyEffectAllow)
+	}
+	stalePolicy, err := cm.GetUserInlinePolicy(ctx, oldName, policyName)
+	if err != nil {
+		t.Fatalf("GetUserInlinePolicy under old name failed: %v", err)
+	}
+	if stalePolicy != nil {
+		t.Errorf("inline policy should be gone from the old name, got %+v", stalePolicy)
+	}
+
+	// Clean up — NewCredentialManager hands out a shared MemoryStore singleton
+	// so leftover state would leak into TestMemoryStoreIntegration.
+	if err := cm.DeleteUserInlinePolicy(ctx, newName, policyName); err != nil {
+		t.Fatalf("DeleteUserInlinePolicy cleanup failed: %v", err)
+	}
+	if err := cm.DeleteUser(ctx, newName); err != nil {
+		t.Fatalf("DeleteUser cleanup failed: %v", err)
+	}
+}

weed/credential/test/integration_test.go

@@ -0,0 +1,121 @@
+package test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+
+	// Import all store implementations to register them
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/filer_etc"
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/postgres"
+)
+
+func TestStoreRegistration(t *testing.T) {
+	// Test that stores are registered
+	storeNames := credential.GetAvailableStores()
+	if len(storeNames) == 0 {
+		t.Fatal("No credential stores registered")
+	}
+
+	expectedStores := []string{string(credential.StoreTypeFilerEtc), string(credential.StoreTypeMemory), string(credential.StoreTypePostgres)}
+
+	// Verify all expected stores are present
+	for _, expected := range expectedStores {
+		found := false
+		for _, storeName := range storeNames {
+			if string(storeName) == expected {
+				found = true
+				break
+			}
+		}
+		if !found {
+			t.Errorf("Expected store not found: %s", expected)
+		}
+	}
+
+	t.Logf("Available stores: %v", storeNames)
+}
+
+func TestMemoryStoreIntegration(t *testing.T) {
+	// Test creating credential manager with memory store
+	config := util.GetViper()
+	cm, err := credential.NewCredentialManager(credential.StoreTypeMemory, config, "test.")
+	if err != nil {
+		t.Fatalf("Failed to create memory credential manager: %v", err)
+	}
+	defer cm.Shutdown()
+
+	// Test that the store is of the correct type
+	if cm.GetStore().GetName() != credential.StoreTypeMemory {
+		t.Errorf("Expected memory store, got %s", cm.GetStore().GetName())
+	}
+
+	// Test basic operations
+	ctx := context.Background()
+
+	// Create test user
+	testUser := &iam_pb.Identity{
+		Name:    "testuser",
+		Actions: []string{"Read", "Write"},
+		Account: &iam_pb.Account{
+			Id:           "123456789012",
+			DisplayName:  "Test User",
+			EmailAddress: "test@example.com",
+		},
+		Credentials: []*iam_pb.Credential{
+			{
+				AccessKey: "AKIAIOSFODNN7EXAMPLE",
+				SecretKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
+			},
+		},
+	}
+
+	// Test CreateUser
+	err = cm.CreateUser(ctx, testUser)
+	if err != nil {
+		t.Fatalf("CreateUser failed: %v", err)
+	}
+
+	// Test GetUser
+	user, err := cm.GetUser(ctx, "testuser")
+	if err != nil {
+		t.Fatalf("GetUser failed: %v", err)
+	}
+	if user.Name != "testuser" {
+		t.Errorf("Expected user name 'testuser', got %s", user.Name)
+	}
+
+	// Test ListUsers
+	users, err := cm.ListUsers(ctx)
+	if err != nil {
+		t.Fatalf("ListUsers failed: %v", err)
+	}
+	if len(users) != 1 || users[0] != "testuser" {
+		t.Errorf("Expected ['testuser'], got %v", users)
+	}
+
+	// Test GetUserByAccessKey
+	userByKey, err := cm.GetUserByAccessKey(ctx, "AKIAIOSFODNN7EXAMPLE")
+	if err != nil {
+		t.Fatalf("GetUserByAccessKey failed: %v", err)
+	}
+	if userByKey.Name != "testuser" {
+		t.Errorf("Expected user name 'testuser', got %s", userByKey.Name)
+	}
+
+	// Test DeleteUser
+	err = cm.DeleteUser(ctx, "testuser")
+	if err != nil {
+		t.Fatalf("DeleteUser failed: %v", err)
+	}
+
+	// Verify user was deleted
+	_, err = cm.GetUser(ctx, "testuser")
+	if err != credential.ErrUserNotFound {
+		t.Errorf("Expected ErrUserNotFound, got %v", err)
+	}
+}

weed/credential/test/policy_test.go

@@ -0,0 +1,147 @@
+package test
+
+import (
+	"context"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/policy_engine"
+
+	// Import all store implementations to register them
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/filer_etc"
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/memory"
+	_ "github.com/seaweedfs/seaweedfs/weed/credential/postgres"
+)
+
+// TestPolicyManagement tests policy management across all credential stores
+func TestPolicyManagement(t *testing.T) {
+	ctx := context.Background()
+
+	// Test with memory store (easiest to test)
+	credentialManager, err := credential.NewCredentialManager(credential.StoreTypeMemory, nil, "")
+	if err != nil {
+		t.Fatalf("Failed to create credential manager: %v", err)
+	}
+
+	// Test policy operations
+	testPolicyOperations(t, ctx, credentialManager)
+}
+
+func testPolicyOperations(t *testing.T, ctx context.Context, credentialManager *credential.CredentialManager) {
+	store := credentialManager.GetStore()
+
+	// Cast to memory store to access policy methods
+	memoryStore, ok := store.(*memory.MemoryStore)
+	if !ok {
+		t.Skip("Store is not a memory store")
+	}
+
+	// Test GetPolicies (should be empty initially)
+	policies, err := memoryStore.GetPolicies(ctx)
+	if err != nil {
+		t.Fatalf("Failed to get policies: %v", err)
+	}
+	if len(policies) != 0 {
+		t.Errorf("Expected 0 policies, got %d", len(policies))
+	}
+
+	// Test CreatePolicy
+	testPolicy := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::test-bucket/*"),
+			},
+		},
+	}
+
+	err = memoryStore.CreatePolicy(ctx, "test-policy", testPolicy)
+	if err != nil {
+		t.Fatalf("Failed to create policy: %v", err)
+	}
+
+	// Test GetPolicies (should have 1 policy now)
+	policies, err = memoryStore.GetPolicies(ctx)
+	if err != nil {
+		t.Fatalf("Failed to get policies: %v", err)
+	}
+	if len(policies) != 1 {
+		t.Errorf("Expected 1 policy, got %d", len(policies))
+	}
+
+	// Verify policy content
+	policy, exists := policies["test-policy"]
+	if !exists {
+		t.Error("test-policy not found")
+	}
+	if policy.Version != "2012-10-17" {
+		t.Errorf("Expected policy version '2012-10-17', got '%s'", policy.Version)
+	}
+	if len(policy.Statement) != 1 {
+		t.Errorf("Expected 1 statement, got %d", len(policy.Statement))
+	}
+
+	// Test UpdatePolicy
+	updatedPolicy := policy_engine.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy_engine.PolicyStatement{
+			{
+				Effect:   policy_engine.PolicyEffectAllow,
+				Action:   policy_engine.NewStringOrStringSlice("s3:GetObject", "s3:PutObject"),
+				Resource: policy_engine.NewStringOrStringSlicePtr("arn:aws:s3:::test-bucket/*"),
+			},
+		},
+	}
+
+	err = memoryStore.UpdatePolicy(ctx, "test-policy", updatedPolicy)
+	if err != nil {
+		t.Fatalf("Failed to update policy: %v", err)
+	}
+
+	// Verify the update
+	policies, err = memoryStore.GetPolicies(ctx)
+	if err != nil {
+		t.Fatalf("Failed to get policies after update: %v", err)
+	}
+
+	updatedPolicyResult, exists := policies["test-policy"]
+	if !exists {
+		t.Error("test-policy not found after update")
+	}
+	if len(updatedPolicyResult.Statement) != 1 {
+		t.Errorf("Expected 1 statement after update, got %d", len(updatedPolicyResult.Statement))
+	}
+	if len(updatedPolicyResult.Statement[0].Action.Strings()) != 2 {
+		t.Errorf("Expected 2 actions after update, got %d", len(updatedPolicyResult.Statement[0].Action.Strings()))
+	}
+
+	// Test DeletePolicy
+	err = memoryStore.DeletePolicy(ctx, "test-policy")
+	if err != nil {
+		t.Fatalf("Failed to delete policy: %v", err)
+	}
+
+	// Verify deletion
+	policies, err = memoryStore.GetPolicies(ctx)
+	if err != nil {
+		t.Fatalf("Failed to get policies after deletion: %v", err)
+	}
+	if len(policies) != 0 {
+		t.Errorf("Expected 0 policies after deletion, got %d", len(policies))
+	}
+}
+
+// TestPolicyManagementWithFilerEtc tests policy management with filer_etc store
+func TestPolicyManagementWithFilerEtc(t *testing.T) {
+	// Skip this test if we can't connect to a filer
+	t.Skip("Filer connection required for filer_etc store testing")
+}
+
+// TestPolicyManagementWithPostgres tests policy management with postgres store
+func TestPolicyManagementWithPostgres(t *testing.T) {
+	// Skip this test if we can't connect to PostgreSQL
+	t.Skip("PostgreSQL connection required for postgres store testing")
+}