snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/s3api_sts_audit_routing_test.go

@@ -0,0 +1,188 @@
+package s3api
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/gorilla/mux"
+	"github.com/seaweedfs/seaweedfs/weed/credential"
+	"github.com/seaweedfs/seaweedfs/weed/iam/integration"
+	"github.com/seaweedfs/seaweedfs/weed/iam/policy"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
+	"github.com/seaweedfs/seaweedfs/weed/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// stsXMLNamespace appears on every STS response, success or error. IAM and S3
+// responses carry a different namespace, so this is what separates "the request
+// reached the STS handler" from "it reached some other handler that also
+// happened to answer".
+const stsXMLNamespace = "https://sts.amazonaws.com/doc/2011-06-15/"
+
+// setupAuditRoutingTestServer builds a server whose STS handler is backed by a
+// real STS service, so the routes under test actually execute instead of
+// short-circuiting on an uninitialized service.
+func setupAuditRoutingTestServer(t *testing.T) *S3ApiServer {
+	t.Helper()
+	ctx := context.Background()
+
+	manager := newTestSTSIntegrationManager(t)
+	require.NoError(t, manager.CreatePolicy(ctx, "", "AuditPolicy", &policy.PolicyDocument{
+		Version: "2012-10-17",
+		Statement: []policy.Statement{{
+			Effect:   "Allow",
+			Action:   []string{"s3:GetObject"},
+			Resource: []string{"arn:aws:s3:::*/*"},
+		}},
+	}))
+	require.NoError(t, manager.CreateRole(ctx, "", "AuditRole", &integration.RoleDefinition{
+		RoleName: "AuditRole",
+		TrustPolicy: &policy.PolicyDocument{
+			Version:   "2012-10-17",
+			Statement: []policy.Statement{{Effect: "Allow", Principal: "*", Action: []string{"sts:AssumeRole"}}},
+		},
+		AttachedPolicies: []string{"AuditPolicy"},
+	}))
+
+	opt := &S3ApiServerOption{EnableIam: true}
+	iam := NewIdentityAccessManagementWithStore(opt, nil, "memory")
+	iam.isAuthEnabled = true
+	iam.iamIntegration = NewS3IAMIntegration(manager, "")
+
+	if iam.credentialManager == nil {
+		cm, err := credential.NewCredentialManager("memory", util.GetViper(), "")
+		require.NoError(t, err)
+		iam.credentialManager = cm
+	}
+	// Mirror the production wiring in s3api_server.go: without a user store the
+	// manager cannot resolve caller policies and GetFederationToken fails closed.
+	manager.SetUserStore(iam.credentialManager)
+
+	testIdent := &Identity{
+		Name:     routingTestUser,
+		Actions:  []Action{s3_constants.ACTION_ADMIN},
+		IsStatic: true,
+		Credentials: []*Credential{{
+			AccessKey: routingTestAccessKey,
+			SecretKey: routingTestSecretKey,
+		}},
+	}
+	iam.m.Lock()
+	if iam.accessKeyIdent == nil {
+		iam.accessKeyIdent = make(map[string]*Identity)
+	}
+	if iam.nameToIdentity == nil {
+		iam.nameToIdentity = make(map[string]*Identity)
+	}
+	iam.identities = append(iam.identities, testIdent)
+	iam.accessKeyIdent[routingTestAccessKey] = testIdent
+	iam.nameToIdentity[routingTestUser] = testIdent
+	iam.m.Unlock()
+
+	return &S3ApiServer{
+		option:            opt,
+		iam:               iam,
+		credentialManager: iam.credentialManager,
+		embeddedIam:       NewEmbeddedIamApi(iam.credentialManager, iam, false),
+		stsHandlers:       NewSTSHandlers(manager.GetSTSService(), iam),
+	}
+}
+
+// Every STS route must be wrapped by track(), which is the only thing that
+// emits an audit entry for these handlers: the STS responses go out through
+// WriteXMLResponse, which never calls PostLog itself. A route registered
+// outside track() would therefore mint credentials with no audit trail at all,
+// and nothing else in the suite would notice. STS has three routing layers
+// (explicit query-param routes, the authenticated POST dispatcher, and the
+// anonymous fallback), so a new action is easy to attach to the wrong one.
+func TestSTSRoutesEmitAuditEntries(t *testing.T) {
+	router := mux.NewRouter()
+	s3a := setupAuditRoutingTestServer(t)
+	s3a.registerRouter(router)
+
+	cases := []struct {
+		name       string
+		action     string
+		params     url.Values
+		signed     bool
+		inBody     bool
+		wantStatus int
+	}{
+		{name: "AssumeRole", action: "AssumeRole", signed: true, wantStatus: http.StatusOK, params: url.Values{
+			"RoleArn":         {"arn:aws:iam::" + defaultAccountID + ":role/AuditRole"},
+			"RoleSessionName": {"audit-session"},
+		}},
+		{name: "GetCallerIdentity", action: "GetCallerIdentity", signed: true, wantStatus: http.StatusOK},
+		{name: "GetFederationToken", action: "GetFederationToken", signed: true, wantStatus: http.StatusOK, params: url.Values{
+			"Name": {"audit-user"},
+		}},
+		// The anonymous actions still route to STS; they fail on the token or the
+		// missing provider, which is itself STS-handler behaviour we want to have
+		// reached rather than a 404 from somewhere else.
+		{name: "AssumeRoleWithWebIdentity", action: "AssumeRoleWithWebIdentity", params: url.Values{
+			"WebIdentityToken": {"not-a-real-token"},
+			"RoleArn":          {"arn:aws:iam::" + defaultAccountID + ":role/AuditRole"},
+			"RoleSessionName":  {"audit-session"},
+		}},
+		{name: "AssumeRoleWithLDAPIdentity", action: "AssumeRoleWithLDAPIdentity", params: url.Values{
+			"RoleArn":         {"arn:aws:iam::" + defaultAccountID + ":role/AuditRole"},
+			"RoleSessionName": {"audit-session"},
+			"LDAPUsername":    {"audit-user"},
+			"LDAPPassword":    {"audit-password"},
+		}},
+		// The authenticated POST dispatcher is a separate routing layer from the
+		// explicit query-param routes above, and it can also hand a request to
+		// its IAM branch - the STS namespace is what proves it did not.
+		{name: "AssumeRole via POST body", action: "AssumeRole", signed: true, inBody: true, wantStatus: http.StatusOK, params: url.Values{
+			"RoleArn":         {"arn:aws:iam::" + defaultAccountID + ":role/AuditRole"},
+			"RoleSessionName": {"audit-session"},
+		}},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			form := url.Values{"Action": {tc.action}, "Version": {"2011-06-15"}}
+			for k, vs := range tc.params {
+				form[k] = vs
+			}
+
+			var req *http.Request
+			var body string
+			if tc.inBody {
+				body = form.Encode()
+				req = httptest.NewRequest(http.MethodPost, "http://localhost/", strings.NewReader(body))
+				req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			} else {
+				req = httptest.NewRequest(http.MethodPost, "http://localhost/?"+form.Encode(), nil)
+				req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+			}
+			if tc.signed {
+				signRoutingTestRequest(t, req, body, "sts")
+			}
+
+			// track() installs both of these itself, but on a request copy this
+			// test would never see. Installing them up front shares the
+			// underlying pointers so the middleware's writes stay observable.
+			req = s3err.EnsureAuditTracking(req)
+			req = s3_constants.EnsureIdentityHolder(req)
+
+			rr := httptest.NewRecorder()
+			router.ServeHTTP(rr, req)
+
+			assert.Contains(t, rr.Body.String(), stsXMLNamespace,
+				"request did not reach the STS handler: status=%d body=%s", rr.Code, rr.Body.String())
+			if tc.wantStatus != 0 {
+				assert.Equal(t, tc.wantStatus, rr.Code, rr.Body.String())
+			}
+			assert.True(t, s3err.AuditAlreadyLogged(req),
+				"STS route emitted no audit entry - is the route wrapped in track()? status=%d body=%s",
+				rr.Code, rr.Body.String())
+		})
+	}
+}