mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
Raúl MarínandClaude Opus 4.8
5c7ea696ca
Follow-up review threads on the server-managed S3 credential restriction: - The explicit `BACKUP/RESTORE ... TO S3(url, ak, sk)` form (no named collection) now drops the server-config SSE-C/SSE-KMS material under the restriction, like the named-collection and bare-URL `s3(...)` paths, so the server's encryption keys are not sent to the user-chosen endpoint alongside the query's own keys. - The post-`include` dynamic-disk per-child check now rejects a `locations.<name>` child that resolves `http_client = gcp_oauth` before treating a NOSIGN child as anonymous: NOSIGN only disables the AWS credentials provider, while the GCP OAuth client still mints and sends the server metadata bearer token. - `04325_s3_user_credentials_hardening`: drop the `BACKUP ... extra_credentials(role_arn)` negative case. A query-supplied `role_arn` with no keys is dropped to anonymous, and the backup write outcome is then bucket-policy dependent (succeeds on CI minio, 403 elsewhere). The role-drop is covered reliably by the `s3()` SELECT case (`S3_ERROR`) and the named-collection role-only case (`ACCESS_DENIED`). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>