snapshot of https://github.com/seaweedfs/seaweedfs.git (master, 2026-09-16; blobs > 131072B omitted)

weed/s3api/s3tables/manager_test.go

@@ -0,0 +1,99 @@
+package s3tables
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var errFilerReached = errors.New("filer reached")
+
+// recordingFilerClient reports whether the handler reached the filer. The
+// CreateTableBucket handler authorizes before touching the filer, so "filer
+// reached" is a proxy for "authorization passed".
+type recordingFilerClient struct {
+	called bool
+}
+
+func (c *recordingFilerClient) WithFilerClient(streamingMode bool, fn func(client filer_pb.SeaweedFilerClient) error) error {
+	c.called = true
+	return errFilerReached
+}
+
+// The Manager path (used by the Iceberg catalog) enforces authorization for
+// authenticated callers and only falls open for trusted/zero-config access.
+func TestManagerCreateTableBucketAuthorization(t *testing.T) {
+	lowPriv := &testIdentity{
+		Name:    "alice",
+		Account: &testIdentityAccount{Id: s3_constants.AccountAdminId},
+		Actions: []string{"Read"},
+	}
+
+	cases := []struct {
+		name         string
+		defaultAllow bool
+		trusted      bool
+		ctx          context.Context
+		identity     string
+		wantFiler    bool // true => authorization passed (filer reached)
+	}{
+		{
+			name:         "authenticated identity struct is enforced",
+			defaultAllow: true,
+			ctx:          s3_constants.SetIdentityInContext(context.Background(), lowPriv),
+			identity:     "alice",
+			wantFiler:    false,
+		},
+		{
+			name:         "secured manager denies a name without struct",
+			defaultAllow: false,
+			ctx:          context.Background(),
+			identity:     "alice",
+			wantFiler:    false,
+		},
+		{
+			name:         "untrusted name without struct is enforced",
+			defaultAllow: true,
+			ctx:          context.Background(),
+			identity:     "alice",
+			wantFiler:    false,
+		},
+		{
+			name:         "trusted manager allows a name without struct",
+			defaultAllow: true,
+			trusted:      true,
+			ctx:          context.Background(),
+			identity:     "alice",
+			wantFiler:    true,
+		},
+		{
+			name:         "admin principal is allowed",
+			defaultAllow: false,
+			ctx:          context.Background(),
+			identity:     s3_constants.AccountAdminId,
+			wantFiler:    true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			m := NewManager()
+			m.SetDefaultAllow(tc.defaultAllow)
+			m.SetTrusted(tc.trusted)
+			fc := &recordingFilerClient{}
+			err := m.Execute(tc.ctx, fc, "CreateTableBucket", &CreateTableBucketRequest{Name: "testbucket"}, nil, tc.identity)
+			require.Error(t, err) // denied (403) or the filer sentinel (reached); never nil here
+			assert.Equal(t, tc.wantFiler, fc.called, "filer reached should equal authorization passed")
+			if !tc.wantFiler {
+				var s3Err *S3TablesError
+				require.ErrorAs(t, err, &s3Err)
+				assert.Equal(t, ErrCodeAccessDenied, s3Err.Type)
+			}
+		})
+	}
+}