* Implement Policy Attachment support for Object Store Users
- Added policy_names field to iam.proto and regenerated protos.
- Updated S3 API and IAM integration to support direct policy evaluation for users.
- Enhanced Admin UI to allow attaching policies to users via modals.
- Renamed 'policies' to 'policy_names' to clarify that it stores identifiers.
- Fixed syntax error in user_management.go.
* Fix policy dropdown not populating
The API returns {policies: [...]} but JavaScript was treating response as direct array.
Updated loadPolicies() to correctly access data.policies property.
* Add null safety checks for policy dropdowns
Added checks to prevent "undefined" errors when:
- Policy select elements don't exist
- Policy dropdowns haven't loaded yet
- User is being edited before policies are loaded
* Fix policy dropdown by using correct JSON field name
JSON response has lowercase 'name' field but JavaScript was accessing 'Name'.
Changed policy.Name to policy.name to match the IAMPolicy JSON structure.
* Fix policy names not being saved on user update
Changed condition from len(req.PolicyNames) > 0 to req.PolicyNames != nil
to ensure policy names are always updated when present in the request,
even if it's an empty array (to allow clearing policies).
* Add debug logging for policy names update flow
Added console.log in frontend and glog in backend to trace
policy_names data through the update process.
* Temporarily disable auto-reload for debugging
Commented out window.location.reload() so console logs are visible
when updating a user.
* Add detailed debug logging and alert for policy selection
Added console.log for each step and an alert to show policy_names value
to help diagnose why it's not being included in the request.
* Regenerate templ files for object_store_users
Ran templ generate to ensure _templ.go files are up to date with
the latest .templ changes including debug logging.
* Remove debug logging and restore normal functionality
Cleaned up temporary debug code (console.log and alert statements)
and re-enabled automatic page reload after user update.
* Add step-by-step alert debugging for policy update
Added 5 alert checkpoints to trace policy data through the update flow:
1. Check if policiesSelect element exists
2. Show selected policy values
3. Show userData.policy_names
4. Show full request body
5. Confirm server response
Temporarily disabled auto-reload to see alerts.
* Add version check alert on page load
Added alert on DOMContentLoaded to verify new JavaScript is being executed
and not cached by the browser.
* Compile templates using make
Ran make to compile all template files and install the weed binary.
* Add button click detection and make handleUpdateUser global
- Added inline alert on button click to verify click is detected
- Made handleUpdateUser a window-level function to ensure it's accessible
- Added alert at start of handleUpdateUser function
* Fix handleUpdateUser scope issue - remove duplicate definition
Removed duplicate function definition that was inside DOMContentLoaded.
Now handleUpdateUser is defined only once in global scope (line 383)
making it accessible when button onclick fires.
* Remove all duplicate handleUpdateUser definitions
Now handleUpdateUser is defined only once at the very top of the script
block (line 352), before DOMContentLoaded, ensuring it's available when
the button onclick fires.
* Add function existence check and error catching
Added alerts to check if handleUpdateUser is defined and wrapped
the function call in try-catch to capture any JavaScript errors.
Also added console.log statements to verify function definition.
* Simplify handleUpdateUser to non-async for testing
Removed async/await and added early return to test if function
can be called at all. This will help identify if async is causing
the issue.
* Add cache-control headers to prevent browser caching
Added no-cache headers to ShowObjectStoreUsers handler to prevent
aggressive browser caching of inline JavaScript in the HTML page.
* Fix syntax error - make handleUpdateUser async
Changed function back to async to fix 'await is only valid in async functions' error.
The cache-control headers are working - browser is now loading new code.
* Update version check to v3 to verify cache busting
Changed version alert to 'v3 - WITH EARLY RETURN' to confirm
the new code with early return statement is being loaded.
* Remove all debug code - clean implementation
Removed all alerts, console.logs, and test code.
Implemented clean policy update functionality with proper error handling.
* Add ETag header for cache-busting and update walkthrough
* Fix policy pre-selection in Edit User modal
- Updated admin.js editUser function to pre-select policies
- Root cause: duplicate editUser in admin.js overwrote inline version
- Added policy pre-selection logic to match inline template
- Verified working in browser: policies now pre-select correctly
* Fix policy persistence in handleUpdateUser
- Added policy_names field to userData payload in handleUpdateUser
- Policies were being lost because handleUpdateUser only sent email and actions
- Now collects selected policies from editPolicies dropdown
- Verified working: policies persist correctly across updates
* Fix XSS vulnerability in access keys display
- Escape HTML in access key display using escapeHtml utility
- Replace inline onclick handlers with data attributes
- Add event delegation for delete access key buttons
- Prevents script injection via malicious access key values
* Fix additional XSS vulnerabilities in user details display
- Escape HTML in actions badges (line 626)
- Escape HTML in policy_names badges (line 636)
- Prevents script injection via malicious action or policy names
* Fix XSS vulnerability in loadPolicies function
- Replace innerHTML string concatenation with DOM API
- Use createElement and textContent for safe policy name insertion
- Prevents script injection via malicious policy names
- Apply same pattern to both create and edit select elements
* Remove debug logging from UpdateObjectStoreUser
- Removed glog.V(0) debug statements
- Clean up temporary debugging code before production
* Remove duplicate handleUpdateUser function
- Removed inline handleUpdateUser that duplicated admin.js logic
- Removed debug console.log statement
- admin.js version is now the single source of truth
- Eliminates maintenance burden of keeping two versions in sync
* Refine user management and address code review feedback
- Preserve PolicyNames in UpdateUserPolicies
- Allow clearing actions in UpdateObjectStoreUser by checking for nil
- Remove version comment from object_store_users.templ
- Refactor loadPolicies for DRYness using cloneNode while keeping DOM API security
* IAM Authorization for Static Access Keys
* verified XSS Fixes in Templates
* fix div
* implement sse-c
* fix Content-Range
* adding tests
* Update s3_sse_c_test.go
* copy sse-c objects
* adding tests
* refactor
* multi reader
* remove extra write header call
* refactor
* SSE-C encrypted objects do not support HTTP Range requests
* robust
* fix server starts
* Update Makefile
* Update Makefile
* ci: remove SSE-C integration tests and workflows; delete test/s3/encryption/
* s3: SSE-C MD5 must be base64 (case-sensitive); fix validation, comparisons, metadata storage; update tests
* minor
* base64
* Update SSE-C_IMPLEMENTATION.md
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Update weed/s3api/s3api_object_handlers.go
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Update SSE-C_IMPLEMENTATION.md
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* address comments
* fix test
* fix compilation
* Bucket Default Encryption
To complete the SSE-KMS implementation for production use:
Add AWS KMS Provider - Implement weed/kms/aws/aws_kms.go using AWS SDK
Integrate with S3 Handlers - Update PUT/GET object handlers to use SSE-KMS
Add Multipart Upload Support - Extend SSE-KMS to multipart uploads
Configuration Integration - Add KMS configuration to filer.toml
Documentation - Update SeaweedFS wiki with SSE-KMS usage examples
* store bucket sse config in proto
* add more tests
* Update SSE-C_IMPLEMENTATION.md
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Fix rebase errors and restore structured BucketMetadata API
Merge Conflict Fixes:
- Fixed merge conflicts in header.go (SSE-C and SSE-KMS headers)
- Fixed merge conflicts in s3api_errors.go (SSE-C and SSE-KMS error codes)
- Fixed merge conflicts in s3_sse_c.go (copy strategy constants)
- Fixed merge conflicts in s3api_object_handlers_copy.go (copy strategy usage)
API Restoration:
- Restored BucketMetadata struct with Tags, CORS, and Encryption fields
- Restored structured API functions: GetBucketMetadata, SetBucketMetadata, UpdateBucketMetadata
- Restored helper functions: UpdateBucketTags, UpdateBucketCORS, UpdateBucketEncryption
- Restored clear functions: ClearBucketTags, ClearBucketCORS, ClearBucketEncryption
Handler Updates:
- Updated GetBucketTaggingHandler to use GetBucketMetadata() directly
- Updated PutBucketTaggingHandler to use UpdateBucketTags()
- Updated DeleteBucketTaggingHandler to use ClearBucketTags()
- Updated CORS handlers to use UpdateBucketCORS() and ClearBucketCORS()
- Updated loadCORSFromBucketContent to use GetBucketMetadata()
Internal Function Updates:
- Updated getBucketMetadata() to return *BucketMetadata struct
- Updated setBucketMetadata() to accept *BucketMetadata struct
- Updated getBucketEncryptionMetadata() to use GetBucketMetadata()
- Updated setBucketEncryptionMetadata() to use SetBucketMetadata()
Benefits:
- Resolved all rebase conflicts while preserving both SSE-C and SSE-KMS functionality
- Maintained consistent structured API throughout the codebase
- Eliminated intermediate wrapper functions for cleaner code
- Proper error handling with better granularity
- All tests passing and build successful
The bucket metadata system now uses a unified, type-safe, structured API
that supports tags, CORS, and encryption configuration consistently.
* Fix updateEncryptionConfiguration for first-time bucket encryption setup
- Change getBucketEncryptionMetadata to getBucketMetadata to avoid failures when no encryption config exists
- Change setBucketEncryptionMetadata to setBucketMetadataWithEncryption for consistency
- This fixes the critical issue where bucket encryption configuration failed for buckets without existing encryption
Fixes: https://github.com/seaweedfs/seaweedfs/pull/7144#discussion_r2285669572
* Fix rebase conflicts and maintain structured BucketMetadata API
Resolved Conflicts:
- Fixed merge conflicts in s3api_bucket_config.go between structured API (HEAD) and old intermediate functions
- Kept modern structured API approach: UpdateBucketCORS, ClearBucketCORS, UpdateBucketEncryption
- Removed old intermediate functions: setBucketTags, deleteBucketTags, setBucketMetadataWithEncryption
API Consistency Maintained:
- updateCORSConfiguration: Uses UpdateBucketCORS() directly
- removeCORSConfiguration: Uses ClearBucketCORS() directly
- updateEncryptionConfiguration: Uses UpdateBucketEncryption() directly
- All structured API functions preserved: GetBucketMetadata, SetBucketMetadata, UpdateBucketMetadata
Benefits:
- Maintains clean separation between API layers
- Preserves atomic metadata updates with proper error handling
- Eliminates function indirection for better performance
- Consistent API usage pattern throughout codebase
- All tests passing and build successful
The bucket metadata system continues to use the unified, type-safe, structured API
that properly handles tags, CORS, and encryption configuration without any
intermediate wrapper functions.
* Fix complex rebase conflicts and maintain clean structured BucketMetadata API
Resolved Complex Conflicts:
- Fixed merge conflicts between modern structured API (HEAD) and mixed approach
- Removed duplicate function declarations that caused compilation errors
- Consistently chose structured API approach over intermediate functions
Fixed Functions:
- BucketMetadata struct: Maintained clean field alignment
- loadCORSFromBucketContent: Uses GetBucketMetadata() directly
- updateCORSConfiguration: Uses UpdateBucketCORS() directly
- removeCORSConfiguration: Uses ClearBucketCORS() directly
- getBucketMetadata: Returns *BucketMetadata struct consistently
- setBucketMetadata: Accepts *BucketMetadata struct consistently
Removed Duplicates:
- Eliminated duplicate GetBucketMetadata implementations
- Eliminated duplicate SetBucketMetadata implementations
- Eliminated duplicate UpdateBucketMetadata implementations
- Eliminated duplicate helper functions (UpdateBucketTags, etc.)
API Consistency Achieved:
- Single, unified BucketMetadata struct for all operations
- Atomic updates through UpdateBucketMetadata with function callbacks
- Type-safe operations with proper error handling
- No intermediate wrapper functions cluttering the API
Benefits:
- Clean, maintainable codebase with no function duplication
- Consistent structured API usage throughout all bucket operations
- Proper error handling and type safety
- Build successful and all tests passing
The bucket metadata system now has a completely clean, structured API
without any conflicts, duplicates, or inconsistencies.
* Update remaining functions to use new structured BucketMetadata APIs directly
Updated functions to follow the pattern established in bucket config:
- getEncryptionConfiguration() -> Uses GetBucketMetadata() directly
- removeEncryptionConfiguration() -> Uses ClearBucketEncryption() directly
Benefits:
- Consistent API usage pattern across all bucket metadata operations
- Simpler, more readable code that leverages the structured API
- Eliminates calls to intermediate legacy functions
- Better error handling and logging consistency
- All tests pass with improved functionality
This completes the transition to using the new structured BucketMetadata API
throughout the entire bucket configuration and encryption subsystem.
* Fix GitHub PR #7144 code review comments
Address all code review comments from Gemini Code Assist bot:
1. **High Priority - SSE-KMS Key Validation**: Fixed ValidateSSEKMSKey to allow empty KMS key ID
- Empty key ID now indicates use of default KMS key (consistent with AWS behavior)
- Updated ParseSSEKMSHeaders to call validation after parsing
- Enhanced isValidKMSKeyID to reject keys with spaces and invalid characters
2. **Medium Priority - KMS Registry Error Handling**: Improved error collection in CloseAll
- Now collects all provider close errors instead of only returning the last one
- Uses proper error formatting with %w verb for error wrapping
- Returns single error for one failure, combined message for multiple failures
3. **Medium Priority - Local KMS Aliases Consistency**: Fixed alias handling in CreateKey
- Now updates the aliases slice in-place to maintain consistency
- Ensures both p.keys map and key.Aliases slice use the same prefixed format
All changes maintain backward compatibility and improve error handling robustness.
Tests updated and passing for all scenarios including edge cases.
* Use errors.Join for KMS registry error handling
Replace manual string building with the more idiomatic errors.Join function:
- Removed manual error message concatenation with strings.Builder
- Simplified error handling logic by using errors.Join(allErrors...)
- Removed unnecessary string import
- Added errors import for errors.Join
This approach is cleaner, more idiomatic, and automatically handles:
- Returning nil for empty error slice
- Returning single error for one-element slice
- Properly formatting multiple errors with newlines
The errors.Join function was introduced in Go 1.20 and is the
recommended way to combine multiple errors.
* Update registry.go
* Fix GitHub PR #7144 latest review comments
Address all new code review comments from Gemini Code Assist bot:
1. **High Priority - SSE-KMS Detection Logic**: Tightened IsSSEKMSEncrypted function
- Now relies only on the canonical x-amz-server-side-encryption header
- Removed redundant check for x-amz-encrypted-data-key metadata
- Prevents misinterpretation of objects with inconsistent metadata state
- Updated test case to reflect correct behavior (encrypted data key only = false)
2. **Medium Priority - UUID Validation**: Enhanced KMS key ID validation
- Replaced simplistic length/hyphen count check with proper regex validation
- Added regexp import for robust UUID format checking
- Regex pattern: ^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}$
- Prevents invalid formats like '------------------------------------' from passing
3. **Medium Priority - Alias Mutation Fix**: Avoided input slice modification
- Changed CreateKey to not mutate the input aliases slice in-place
- Uses local variable for modified alias to prevent side effects
- Maintains backward compatibility while being safer for callers
All changes improve code robustness and follow AWS S3 standards more closely.
Tests updated and passing for all scenarios including edge cases.
* Fix failing SSE tests
Address two failing test cases:
1. **TestSSEHeaderConflicts**: Fixed SSE-C and SSE-KMS mutual exclusion
- Modified IsSSECRequest to return false if SSE-KMS headers are present
- Modified IsSSEKMSRequest to return false if SSE-C headers are present
- This prevents both detection functions from returning true simultaneously
- Aligns with AWS S3 behavior where SSE-C and SSE-KMS are mutually exclusive
2. **TestBucketEncryptionEdgeCases**: Fixed XML namespace validation
- Added namespace validation in encryptionConfigFromXMLBytes function
- Now rejects XML with invalid namespaces (only allows empty or AWS standard namespace)
- Validates XMLName.Space to ensure proper XML structure
- Prevents acceptance of malformed XML with incorrect namespaces
Both fixes improve compliance with AWS S3 standards and prevent invalid
configurations from being accepted. All SSE and bucket encryption tests
now pass successfully.
* Fix GitHub PR #7144 latest review comments
Address two new code review comments from Gemini Code Assist bot:
1. **High Priority - Race Condition in UpdateBucketMetadata**: Fixed thread safety issue
- Added per-bucket locking mechanism to prevent race conditions
- Introduced bucketMetadataLocks map with RWMutex for each bucket
- Added getBucketMetadataLock helper with double-checked locking pattern
- UpdateBucketMetadata now uses bucket-specific locks to serialize metadata updates
- Prevents last-writer-wins scenarios when concurrent requests update different metadata parts
2. **Medium Priority - KMS Key ARN Validation**: Improved robustness of ARN validation
- Enhanced isValidKMSKeyID function to strictly validate ARN structure
- Changed from 'len(parts) >= 6' to 'len(parts) != 6' for exact part count
- Added proper resource validation for key/ and alias/ prefixes
- Prevents malformed ARNs with incorrect structure from being accepted
- Now validates: arn:aws:kms:region:account:key/keyid or arn:aws:kms:region:account:alias/aliasname
Both fixes improve system reliability and prevent edge cases that could cause
data corruption or security issues. All existing tests continue to pass.
* format
* address comments
* Configuration Adapter
* Regex Optimization
* Caching Integration
* add negative cache for non-existent buckets
* remove bucketMetadataLocks
* address comments
* address comments
* copying objects with sse-kms
* copying strategy
* store IV in entry metadata
* implement compression reader
* extract json map as sse kms context
* bucket key
* comments
* rotate sse chunks
* KMS Data Keys use AES-GCM + nonce
* add comments
* Update weed/s3api/s3_sse_kms.go
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Update s3api_object_handlers_put.go
* get IV from response header
* set sse headers
* Update s3api_object_handlers.go
* deterministic JSON marshaling
* store iv in entry metadata
* address comments
* not used
* store iv in destination metadata
ensures that SSE-C copy operations with re-encryption (decrypt/re-encrypt scenario) now properly store the destination encryption metadata
* add todo
* address comments
* SSE-S3 Deserialization
* add BucketKMSCache to BucketConfig
* fix test compilation
* already not empty
* use constants
* fix: critical metadata (encrypted data keys, encryption context, etc.) was never stored during PUT/copy operations
* address comments
* fix tests
* Fix SSE-KMS Copy Re-encryption
* Cache now persists across requests
* fix test
* iv in metadata only
* SSE-KMS copy operations should follow the same pattern as SSE-C
* fix size overhead calculation
* Filer-Side SSE Metadata Processing
* SSE Integration Tests
* fix tests
* clean up
* Update s3_sse_multipart_test.go
* add s3 sse tests
* unused
* add logs
* Update Makefile
* Update Makefile
* s3 health check
* The tests were failing because they tried to run both SSE-C and SSE-KMS tests
* Update weed/s3api/s3_sse_c.go
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* Update Makefile
* add back
* Update Makefile
* address comments
* fix tests
* Update s3-sse-tests.yml
* Update s3-sse-tests.yml
* fix sse-kms for PUT operation
* IV
* Update auth_credentials.go
* fix multipart with kms
* constants
* multipart sse kms
Modified handleSSEKMSResponse to detect multipart SSE-KMS objects
Added createMultipartSSEKMSDecryptedReader to handle each chunk independently
Each chunk now gets its own decrypted reader before combining into the final stream
* validate key id
* add SSEType
* permissive kms key format
* Update s3_sse_kms_test.go
* format
* assert equal
* uploading SSE-KMS metadata per chunk
* persist sse type and metadata
* avoid re-chunk multipart uploads
* decryption process to use stored PartOffset values
* constants
* sse-c multipart upload
* Unified Multipart SSE Copy
* purge
* fix fatalf
* avoid io.MultiReader which does not close underlying readers
* unified cross-encryption
* fix Single-object SSE-C
* adjust constants
* range read sse files
* remove debug logs
---------
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
* fix listing objects
* add more list testing
* address comments
* fix next marker
* fix isTruncated in listing
* fix tests
* address tests
* Update s3api_object_handlers_multipart.go
* fixes
* store json into bucket content, for tagging and cors
* switch bucket metadata from json to proto
* fix
* Update s3api_bucket_config.go
* fix test issue
* fix test_bucket_listv2_delimiter_prefix
* Update cors.go
* skip special characters
* passing listing
* fix test_bucket_list_delimiter_prefix
* ok. fix the xsd generated go code now
* fix cors tests
* fix test
* fix test_bucket_list_unordered and test_bucket_listv2_unordered
do not accept the allow-unordered and delimiter parameter combination
* fix test_bucket_list_objects_anonymous and test_bucket_listv2_objects_anonymous
The tests test_bucket_list_objects_anonymous and test_bucket_listv2_objects_anonymous were failing because they try to set bucket ACL to public-read, but SeaweedFS only supported private ACL.
Updated PutBucketAclHandler to use the existing ExtractAcl function which already supports all standard S3 canned ACLs
Replaced the hardcoded check for only private ACL with proper ACL parsing that handles public-read, public-read-write, authenticated-read, bucket-owner-read, bucket-owner-full-control, etc.
Added unit tests to verify all standard canned ACLs are accepted
* fix list unordered
The test is expecting the error code to be InvalidArgument instead of InvalidRequest
* allow anonymous listing( and head, get)
* fix test_bucket_list_maxkeys_invalid
Invalid values: max-keys=blah → Returns ErrInvalidMaxKeys (HTTP 400)
* updating IsPublicRead when parsing acl
* more logs
* CORS Test Fix
* fix test_bucket_list_return_data
* default to private
* fix test_bucket_list_delimiter_not_skip_special
* default no acl
* add debug logging
* more logs
* use basic http client
remove logs also
* fixes
* debug
* Update stats.go
* debugging
* fix anonymous test expectation
anonymous user can read, as configured in s3 json.
* fix nomore writables volumes while disk free space is sufficient by time delay
* reset
---------
Co-authored-by: wang wusong <wangwusong@virtaitech.com>
