995dfc4d5d
* chore: remove unreachable dead code across the codebase Remove ~50,000 lines of unreachable code identified by static analysis. Major removals: - weed/filer/redis_lua: entire unused Redis Lua filer store implementation - weed/wdclient/net2, resource_pool: unused connection/resource pool packages - weed/plugin/worker/lifecycle: unused lifecycle plugin worker - weed/s3api: unused S3 policy templates, presigned URL IAM, streaming copy, multipart IAM, key rotation, and various SSE helper functions - weed/mq/kafka: unused partition mapping, compression, schema, and protocol functions - weed/mq/offset: unused SQL storage and migration code - weed/worker: unused registry, task, and monitoring functions - weed/query: unused SQL engine, parquet scanner, and type functions - weed/shell: unused EC proportional rebalance functions - weed/storage/erasure_coding/distribution: unused distribution analysis functions - Individual unreachable functions removed from 150+ files across admin, credential, filer, iam, kms, mount, mq, operation, pb, s3api, server, shell, storage, topology, and util packages * fix(s3): reset shared memory store in IAM test to prevent flaky failure TestLoadIAMManagerFromConfig_EmptyConfigWithFallbackKey was flaky because the MemoryStore credential backend is a singleton registered via init(). Earlier tests that create anonymous identities pollute the shared store, causing LookupAnonymous() to unexpectedly return true. Fix by calling Reset() on the memory store before the test runs. * style: run gofmt on changed files * fix: restore KMS functions used by integration tests * fix(plugin): prevent panic on send to closed worker session channel The Plugin.sendToWorker method could panic with "send on closed channel" when a worker disconnected while a message was being sent. The race was between streamSession.close() closing the outgoing channel and sendToWorker writing to it concurrently. Add a done channel to streamSession that is closed before the outgoing channel, and check it in sendToWorker's select to safely detect closed sessions without panicking.
98 lines
3.0 KiB
Go
98 lines
3.0 KiB
Go
package credential
|
|
|
|
import (
|
|
"fmt"
|
|
|
|
"github.com/seaweedfs/seaweedfs/weed/glog"
|
|
"github.com/seaweedfs/seaweedfs/weed/util"
|
|
)
|
|
|
|
// CredentialConfig represents the credential configuration from credential.toml
|
|
type CredentialConfig struct {
|
|
Store string
|
|
Config util.Configuration
|
|
Prefix string
|
|
}
|
|
|
|
// LoadCredentialConfiguration loads credential configuration from credential.toml
|
|
// Returns the store type, configuration, and prefix for credential management
|
|
func LoadCredentialConfiguration() (*CredentialConfig, error) {
|
|
// Try to load credential.toml configuration
|
|
loaded := util.LoadConfiguration("credential", false)
|
|
if !loaded {
|
|
glog.V(1).Info("No credential.toml found, credential store disabled")
|
|
return nil, nil
|
|
}
|
|
|
|
viper := util.GetViper()
|
|
|
|
// Find which credential store is enabled
|
|
var enabledStore string
|
|
var storePrefix string
|
|
|
|
// Get available store types from registered stores
|
|
storeTypes := GetAvailableStores()
|
|
for _, storeType := range storeTypes {
|
|
key := fmt.Sprintf("credential.%s.enabled", string(storeType))
|
|
if viper.GetBool(key) {
|
|
if enabledStore != "" {
|
|
return nil, fmt.Errorf("multiple credential stores enabled: %s and %s. Only one store can be enabled", enabledStore, string(storeType))
|
|
}
|
|
enabledStore = string(storeType)
|
|
storePrefix = fmt.Sprintf("credential.%s.", string(storeType))
|
|
}
|
|
}
|
|
|
|
if enabledStore == "" {
|
|
glog.V(1).Info("No credential store enabled in credential.toml")
|
|
return nil, nil
|
|
}
|
|
|
|
glog.V(0).Infof("Loaded credential configuration: store=%s", enabledStore)
|
|
|
|
return &CredentialConfig{
|
|
Store: enabledStore,
|
|
Config: viper,
|
|
Prefix: storePrefix,
|
|
}, nil
|
|
}
|
|
|
|
// NewCredentialManagerWithDefaults creates a credential manager with fallback to defaults
|
|
// If explicitStore is provided, it will be used regardless of credential.toml
|
|
// If explicitStore is empty, it tries credential.toml first, then defaults to "filer_etc"
|
|
func NewCredentialManagerWithDefaults(explicitStore CredentialStoreTypeName) (*CredentialManager, error) {
|
|
var storeName CredentialStoreTypeName
|
|
var config util.Configuration
|
|
var prefix string
|
|
|
|
// If explicit store is provided, use it
|
|
if explicitStore != "" {
|
|
storeName = explicitStore
|
|
config = nil
|
|
prefix = ""
|
|
glog.V(0).Infof("Using explicit credential store: %s", storeName)
|
|
} else {
|
|
// Try to load from credential.toml first
|
|
if credConfig, err := LoadCredentialConfiguration(); err == nil && credConfig != nil {
|
|
storeName = CredentialStoreTypeName(credConfig.Store)
|
|
config = credConfig.Config
|
|
prefix = credConfig.Prefix
|
|
glog.V(0).Infof("Loaded credential configuration from credential.toml: store=%s", storeName)
|
|
} else {
|
|
// Default to filer_etc store
|
|
storeName = StoreTypeFilerEtc
|
|
config = nil
|
|
prefix = ""
|
|
glog.V(1).Info("No credential.toml found, defaulting to filer_etc store")
|
|
}
|
|
}
|
|
|
|
// Create the credential manager
|
|
credentialManager, err := NewCredentialManager(storeName, config, prefix)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("failed to initialize credential manager with store '%s': %v", storeName, err)
|
|
}
|
|
|
|
return credentialManager, nil
|
|
}
|