mirror of
https://github.com/hanzoai/s3.git
synced 2026-10-30 14:59:09 +00:00
zooqueen
dd74d3e6d6
hanzoai/s3 was an AGPL-3.0 MinIO fork whose network-copyleft blocks embedding
and reselling as a managed service. Replace it wholesale with a fork of
SeaweedFS (github.com/seaweedfs/seaweedfs, Apache-2.0, Go) which ships a
built-in S3 gateway + Filer.
- License: AGPL-3.0 -> Apache-2.0 (upstream LICENSE kept verbatim, incl.
"Copyright 2025 Chris Lu"); NOTICE added crediting SeaweedFS. No AGPL/BUSL/
SSPL/GPL or enterprise ("ee") files remain.
- Module: go.mod path set to github.com/hanzoai/s3 with a self-replace
(replace github.com/seaweedfs/seaweedfs => ./) so the ~1800 internal Go files
keep their upstream import paths with zero churn. Internal identifiers and
import paths are intentionally NOT renamed.
- CLI rebrand: the binary is built as `s3` (was `weed`); root usage, per-command
help/usage/flag strings, shell autocomplete program name, and the product name
in CLI output now read "Hanzo S3" / `s3`. Users never see `weed`.
(e.g. `s3 server`, `s3 filer`, `s3 master`, `s3 volume`, `s3 s3`, `s3 mount`.)
- Build: `make` (or `go build -o s3 ./weed`) builds the `s3` binary green;
`cmd/weed-db` and `cmd/weed-sql` also build; `go vet ./weed/command/` clean.
- README/LLM.md rewritten for Hanzo S3; AGENTS.md/CLAUDE.md symlinks preserved.
- Dropped a 33MB prebuilt Mach-O `stress` binary upstream had committed; `.gitignore`
updated to ignore the `s3` build output.
313 lines
8.3 KiB
Go
313 lines
8.3 KiB
Go
package policy_engine
|
|
|
|
import (
|
|
"testing"
|
|
)
|
|
|
|
func TestExtractPrincipalVariables(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
principal string
|
|
expected map[string][]string
|
|
}{
|
|
{
|
|
name: "IAM User ARN",
|
|
principal: "arn:aws:iam::123456789012:user/alice",
|
|
expected: map[string][]string{
|
|
"aws:PrincipalAccount": {"123456789012"},
|
|
"aws:principaltype": {"IAMUser"},
|
|
"aws:username": {"alice"},
|
|
"aws:userid": {"alice"},
|
|
},
|
|
},
|
|
{
|
|
name: "Assumed Role ARN",
|
|
principal: "arn:aws:sts::123456789012:assumed-role/MyRole/session-alice",
|
|
expected: map[string][]string{
|
|
"aws:PrincipalAccount": {"123456789012"},
|
|
"aws:principaltype": {"AssumedRole"},
|
|
"aws:username": {"session-alice"},
|
|
"aws:userid": {"session-alice"},
|
|
},
|
|
},
|
|
{
|
|
name: "IAM Role ARN",
|
|
principal: "arn:aws:iam::123456789012:role/MyRole",
|
|
expected: map[string][]string{
|
|
"aws:PrincipalAccount": {"123456789012"},
|
|
"aws:principaltype": {"IAMRole"},
|
|
"aws:username": {"MyRole"},
|
|
},
|
|
},
|
|
{
|
|
name: "Non-ARN principal",
|
|
principal: "user:alice",
|
|
expected: map[string][]string{},
|
|
},
|
|
{
|
|
name: "Wildcard principal",
|
|
principal: "*",
|
|
expected: map[string][]string{},
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := ExtractPrincipalVariables(tt.principal)
|
|
|
|
// Check that all expected keys are present with correct values
|
|
for key, expectedValues := range tt.expected {
|
|
actualValues, ok := result[key]
|
|
if !ok {
|
|
t.Errorf("Expected key %s not found in result", key)
|
|
continue
|
|
}
|
|
|
|
if len(actualValues) != len(expectedValues) {
|
|
t.Errorf("For key %s: expected %d values, got %d", key, len(expectedValues), len(actualValues))
|
|
continue
|
|
}
|
|
|
|
for i, expectedValue := range expectedValues {
|
|
if actualValues[i] != expectedValue {
|
|
t.Errorf("For key %s[%d]: expected %s, got %s", key, i, expectedValue, actualValues[i])
|
|
}
|
|
}
|
|
}
|
|
|
|
// Check that there are no unexpected keys
|
|
for key := range result {
|
|
if _, ok := tt.expected[key]; !ok {
|
|
t.Errorf("Unexpected key %s in result", key)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestSubstituteVariablesWithClaims(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
pattern string
|
|
context map[string][]string
|
|
claims map[string]interface{}
|
|
expected string
|
|
}{
|
|
{
|
|
name: "Standard context variable",
|
|
pattern: "arn:aws:s3:::bucket/${aws:username}/*",
|
|
context: map[string][]string{
|
|
"aws:username": {"alice"},
|
|
},
|
|
claims: nil,
|
|
expected: "arn:aws:s3:::bucket/alice/*",
|
|
},
|
|
{
|
|
name: "JWT claim substitution",
|
|
pattern: "arn:aws:s3:::bucket/${jwt:preferred_username}/*",
|
|
context: map[string][]string{},
|
|
claims: map[string]interface{}{
|
|
"preferred_username": "bob",
|
|
},
|
|
expected: "arn:aws:s3:::bucket/bob/*",
|
|
},
|
|
{
|
|
name: "Mixed variables",
|
|
pattern: "arn:aws:s3:::bucket/${jwt:sub}/files/${aws:principaltype}",
|
|
context: map[string][]string{
|
|
"aws:principaltype": {"IAMUser"},
|
|
},
|
|
claims: map[string]interface{}{
|
|
"sub": "user123",
|
|
},
|
|
expected: "arn:aws:s3:::bucket/user123/files/IAMUser",
|
|
},
|
|
{
|
|
name: "Variable not found",
|
|
pattern: "arn:aws:s3:::bucket/${jwt:missing}/*",
|
|
context: map[string][]string{},
|
|
claims: map[string]interface{}{},
|
|
expected: "arn:aws:s3:::bucket/${jwt:missing}/*",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := SubstituteVariables(tt.pattern, tt.context, tt.claims)
|
|
if result != tt.expected {
|
|
t.Errorf("Expected %s, got %s", tt.expected, result)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPolicyVariablesWithPrincipalType(t *testing.T) {
|
|
engine := NewPolicyEngine()
|
|
|
|
// Policy that requires specific principal type
|
|
policyJSON := `{
|
|
"Version": "2012-10-17",
|
|
"Statement": [{
|
|
"Effect": "Allow",
|
|
"Action": "s3:*",
|
|
"Resource": "arn:aws:s3:::bucket/*",
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"aws:principaltype": "IAMUser"
|
|
}
|
|
}
|
|
}]
|
|
}`
|
|
|
|
err := engine.SetBucketPolicy("bucket", policyJSON)
|
|
if err != nil {
|
|
t.Fatalf("Failed to set bucket policy: %v", err)
|
|
}
|
|
|
|
// Test with IAM User - should allow
|
|
args := &PolicyEvaluationArgs{
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/file.txt",
|
|
Principal: "arn:aws:iam::123456789012:user/alice",
|
|
Conditions: map[string][]string{
|
|
"aws:principaltype": {"IAMUser"},
|
|
"aws:username": {"alice"},
|
|
"aws:userid": {"alice"},
|
|
},
|
|
}
|
|
|
|
result := engine.EvaluatePolicy("bucket", args)
|
|
if result != PolicyResultAllow {
|
|
t.Errorf("Expected Allow for IAMUser principal, got %v", result)
|
|
}
|
|
|
|
// Test with AssumedRole - should return Indeterminate (condition doesn't match)
|
|
args.Principal = "arn:aws:sts::123456789012:assumed-role/MyRole/session"
|
|
args.Conditions["aws:principaltype"] = []string{"AssumedRole"}
|
|
|
|
result = engine.EvaluatePolicy("bucket", args)
|
|
if result != PolicyResultIndeterminate {
|
|
t.Errorf("Expected Indeterminate for AssumedRole principal, got %v", result)
|
|
}
|
|
}
|
|
|
|
func TestPolicyVariablesWithJWTClaims(t *testing.T) {
|
|
engine := NewPolicyEngine()
|
|
|
|
// Policy using JWT claim in resource
|
|
policyJSON := `{
|
|
"Version": "2012-10-17",
|
|
"Statement": [{
|
|
"Effect": "Allow",
|
|
"Action": "s3:*",
|
|
"Resource": "arn:aws:s3:::bucket/${jwt:preferred_username}/*"
|
|
}]
|
|
}`
|
|
|
|
err := engine.SetBucketPolicy("bucket", policyJSON)
|
|
if err != nil {
|
|
t.Fatalf("Failed to set bucket policy: %v", err)
|
|
}
|
|
|
|
// Test with matching JWT claim
|
|
args := &PolicyEvaluationArgs{
|
|
Action: "s3:GetObject",
|
|
Resource: "arn:aws:s3:::bucket/alice/file.txt",
|
|
Principal: "arn:aws:iam::123456789012:user/alice",
|
|
Conditions: map[string][]string{},
|
|
Claims: map[string]interface{}{
|
|
"preferred_username": "alice",
|
|
},
|
|
}
|
|
|
|
result := engine.EvaluatePolicy("bucket", args)
|
|
if result != PolicyResultAllow {
|
|
t.Errorf("Expected Allow when JWT claim matches resource, got %v", result)
|
|
}
|
|
|
|
// Test with mismatched JWT claim
|
|
args.Resource = "arn:aws:s3:::bucket/bob/file.txt"
|
|
|
|
result = engine.EvaluatePolicy("bucket", args)
|
|
if result != PolicyResultIndeterminate {
|
|
t.Errorf("Expected Indeterminate when JWT claim doesn't match resource, got %v", result)
|
|
}
|
|
}
|
|
|
|
func TestExtractPrincipalVariablesWithAccount(t *testing.T) {
|
|
principal := "arn:aws:iam::123456789012:user/alice"
|
|
vars := ExtractPrincipalVariables(principal)
|
|
|
|
if account, ok := vars["aws:PrincipalAccount"]; !ok {
|
|
t.Errorf("Expected aws:PrincipalAccount to be present")
|
|
} else if len(account) == 0 {
|
|
t.Errorf("Expected aws:PrincipalAccount to have values")
|
|
} else if account[0] != "123456789012" {
|
|
t.Errorf("Expected aws:PrincipalAccount=123456789012, got %v", account[0])
|
|
}
|
|
}
|
|
|
|
func TestSubstituteVariablesWithLDAP(t *testing.T) {
|
|
pattern := "arn:aws:s3:::bucket/${ldap:username}/*"
|
|
context := map[string][]string{}
|
|
claims := map[string]interface{}{
|
|
"username": "jdoe",
|
|
}
|
|
|
|
result := SubstituteVariables(pattern, context, claims)
|
|
expected := "arn:aws:s3:::bucket/jdoe/*"
|
|
|
|
if result != expected {
|
|
t.Errorf("Expected %s, got %s", expected, result)
|
|
}
|
|
|
|
// Test ldap:dn
|
|
pattern = "arn:aws:s3:::bucket/${ldap:dn}/*"
|
|
claims = map[string]interface{}{
|
|
"dn": "uid=jdoe,ou=people,dc=example,dc=com",
|
|
}
|
|
result = SubstituteVariables(pattern, context, claims)
|
|
expected = "arn:aws:s3:::bucket/uid=jdoe,ou=people,dc=example,dc=com/*"
|
|
if result != expected {
|
|
t.Errorf("Expected %s, got %s", expected, result)
|
|
}
|
|
}
|
|
|
|
func TestSubstituteVariablesSpecialChars(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
pattern string
|
|
context map[string][]string
|
|
claims map[string]interface{}
|
|
expected string
|
|
}{
|
|
{
|
|
name: "Comparison operators in claims/vars",
|
|
pattern: "resource/${jwt:scope}",
|
|
context: map[string][]string{},
|
|
claims: map[string]interface{}{
|
|
"scope": "read/write",
|
|
},
|
|
expected: "resource/read/write",
|
|
},
|
|
{
|
|
name: "Path traversal attempt (should just substitute text)",
|
|
pattern: "bucket/${jwt:user}",
|
|
context: map[string][]string{},
|
|
claims: map[string]interface{}{
|
|
"user": "../../../etc/passwd",
|
|
},
|
|
expected: "bucket/../../../etc/passwd",
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := SubstituteVariables(tt.pattern, tt.context, tt.claims)
|
|
if result != tt.expected {
|
|
t.Errorf("Expected %s, got %s", tt.expected, result)
|
|
}
|
|
})
|
|
}
|
|
}
|