GatewayJ and GitHub
51e369be6c
fix(policy): accept legacy bucket policy ID field ( #6362 )
2026-08-23 01:40:44 +08:00
GatewayJ and GitHub
23a0f6324c
fix(iam): preserve MinIO permanent credentials in migration ( #6328 )
...
* fix(iam): preserve MinIO permanent credentials in migration
* test(iam): cover MinIO credential migration end to end
2026-08-21 15:34:25 +08:00
205337151a
fix(webdav): allow bucket-scoped root listings ( #6298 )
...
* fix(webdav): allow bucket-scoped root listings
* test(webdav): use public protocol export
* test(webdav): initialize identity inline
---------
Co-authored-by: cxymds <[email protected]
2026-08-21 00:15:33 +08:00
91c97f3416
chore(deps): update s3s to upstream main ( #6203 )
...
* deps: update s3s to upstream main
* deps: refresh s3s upstream revision
* deps: pin s3s to latest upstream main
---------
Co-authored-by: houseme <[email protected] [email protected]
2026-08-18 21:46:56 +08:00
GatewayJ and GitHub
36deab8670
perf(ecstore): retain remote shard HTTP chunks ( #5991 )
...
* perf(ecstore): retain remote shard HTTP chunks
* fix(ecstore): bound remote shard chunk retention
* fix(rio): persist empty chunk limit across polls
2026-08-13 15:00:44 +08:00
GatewayJ and GitHub
4c44bc649a
fix(admin): clarify invalid group name errors ( #5986 )
2026-08-12 20:44:35 +08:00
GatewayJ and GitHub
3fdf2964c8
perf(rpc): size remote shard read buffers ( #5972 )
2026-08-12 15:05:33 +08:00
e9728192e2
fix(select): enforce typed S3 Select error semantics ( #5942 )
...
* fix(select): enforce typed S3 Select error semantics
* fix(select): classify function argument planner errors
---------
Co-authored-by: overtrue <[email protected]
2026-08-11 23:59:38 +08:00
d51191f81b
build(deps): use RustFS s3s fork ( #5901 )
...
* build(deps): use RustFS s3s fork
* ci: allow RustFS s3s source
---------
Co-authored-by: houseme <[email protected]
2026-08-10 02:45:49 +00:00
GatewayJ and GitHub
70deb3284b
fix(select): pin object snapshot for query lifetime ( #5835 )
2026-08-09 14:08:53 +08:00
GatewayJ and GitHub
4a234c0fe3
fix(iam): stabilize OIDC provider ordering ( #5832 )
2026-08-08 19:29:04 +08:00
GatewayJ and GitHub
1b1b217826
fix(iam): preserve OIDC outbound policy errors ( #5762 )
2026-08-08 19:28:47 +08:00
GatewayJ and GitHub
87d32a6207
fix(auth): align ListBuckets discovery with IAM policies ( #5746 )
2026-08-06 22:13:47 +08:00
GatewayJ and GitHub
6028dad2f4
test(iam): freeze OIDC federation behavior ( #5627 )
2026-08-02 22:33:20 +08:00
GatewayJ and GitHub
4c83bff81c
fix(s3select): support two-byte CSV record delimiters ( #5565 )
2026-08-01 17:08:31 +00:00
GatewayJ and GitHub
51f9d1b74f
fix(s3select): guarantee terminal event delivery ( #5563 )
2026-08-02 00:53:04 +08:00
GatewayJ and GitHub
816849a8ee
fix(s3select): cancel queries after client disconnect ( #5560 )
2026-08-01 13:38:30 +00:00
GatewayJ and GitHub
6363263f09
fix(s3select): parse JSON source paths from SQL AST ( #5559 )
2026-08-01 11:20:33 +00:00
GatewayJ and GitHub
533896d045
fix(s3select): honor custom CSV record delimiters ( #5558 )
2026-08-01 11:18:04 +00:00
GatewayJ and GitHub
284faec03f
fix(s3select): preserve ScanRange across file partitions ( #5562 )
2026-08-01 19:15:51 +08:00
GatewayJ and GitHub
bc41e567a5
fix(oidc): warn on request-header redirect fallback ( #5561 )
...
* fix(oidc): warn on request-header redirect fallback
* test(oidc): cover startup warning publication
2026-08-01 18:10:37 +08:00
3d4f4bb86d
fix(sts): align AssumeRole authorization ( #5281 )
...
* fix(sts): align AssumeRole authorization with MinIO
* test(sts): cover AssumeRole OPA contract
* fix(iam): fail closed on unresolved policies
* fix(iam): fail closed while OPA initializes
---------
Co-authored-by: cxymds <[email protected] [email protected]
2026-08-01 11:48:58 +08:00
2dea4a9acf
fix(s3): correlate server-owned request IDs ( #5433 )
...
* fix(s3): correlate server-owned request IDs
* fix(server): preserve trace context and Swift routing
---------
Co-authored-by: houseme <[email protected]
2026-07-29 23:50:59 +08:00
5cedab09ab
fix(sts): return Query API-compatible responses ( #5282 )
...
* fix(sts): return Query API-compatible responses
* fix(sts): resolve review and CI failures
* fix(sts): harden query response conversion
* test(e2e): stabilize transition conflict coverage
* fix(ilm): retry vanished transition admission CAS
* test(e2e): narrow transition overlap coverage
---------
Co-authored-by: houseme <[email protected]
2026-07-28 10:39:17 +08:00
GatewayJ and GitHub
24cf2cdb78
fix(iam): align OIDC parent IDs with MinIO ( #5290 )
...
* fix(iam): align OIDC parent IDs with MinIO
* test(iam): cover OIDC STS binding policy lookup
* test(admin): use runtime facade for AppContext setup
* test(ilm): wait for lifecycle backfill before manual failure
* test(ilm): make overlapping admission check concurrent
2026-07-27 07:16:22 +00:00
GatewayJ and GitHub
0364523dad
fix(s3select): enforce query and resource limits ( #5028 )
...
* fix(s3select): enforce query and resource limits
* fix(s3select): close query resource limit gaps
* fix(s3select): preserve timeout and stream invariants
* fix(s3select): enforce staged query limits
* fix(s3select): preserve policy error compatibility
* fix(s3select): bound error source traversal
2026-07-25 18:44:53 +08:00
GatewayJ and GitHub
1c88aa43c1
fix(iam): virtualize OIDC service account parents ( #5152 )
...
* fix(iam): preserve OIDC service account policy boundary
* fix(iam): virtualize OIDC service account parents
* fix(iam): reject malformed OIDC policy boundaries
* test(iam): isolate federated policy regression
* fix(iam): keep OIDC replication envelope off claims
2026-07-24 17:41:52 +08:00
GatewayJ and GitHub
97b618bc2b
fix(iam): reject cross-identity access key collisions ( #5085 )
...
fix(iam): reject service account access key collisions
2026-07-21 20:36:25 +08:00
GatewayJ and GitHub
17f0bd2637
fix(iam): report duplicate access keys clearly ( #5066 )
...
* fix(iam): report duplicate access keys clearly
* fix(iam): narrow duplicate access key handling
2026-07-21 16:14:06 +08:00
GatewayJ and GitHub
48b2f3d6e3
fix(s3select): preserve CSV input as strings ( #5030 )
...
* fix(s3select): preserve CSV input as strings
* fix(s3select): address CSV schema review findings
2026-07-20 21:02:54 +08:00
GatewayJ and GitHub
8ebedddfa1
fix(s3select): reject truncated object streams ( #5027 )
...
* fix(s3select): reject truncated object streams
* fix(s3select): validate raw stream before conversion
2026-07-19 15:34:20 +00:00
GatewayJ and GitHub
f9e8440a04
refactor(iam): introduce federated identity boundary ( #5018 )
2026-07-19 14:28:08 +08:00
GatewayJ and GitHub
a269f8df05
fix(ecstore): require write quorum for metadata early stop ( #4300 )
2026-07-10 15:57:09 +08:00
GatewayJ and GitHub
d238b2d24e
fix(admin): support external OIDC browser redirects ( #4280 )
2026-07-09 18:07:49 +08:00
GatewayJ and GitHub
9cf211930d
fix(iam): expand OIDC auth diagnostics ( #4281 )
...
* fix(iam): expand OIDC auth diagnostics
* fix(iam): accept RFC3339 OIDC timestamps
* chore(iam): log OIDC policy mapping diagnostics
* chore(iam): log OIDC claim and policy details
* chore(iam): lower OIDC diagnostic log verbosity
* fix(iam): gate OIDC diagnostics behind debug
* chore: update yanked num-bigint lockfile
2026-07-05 18:05:23 +08:00
GatewayJ and GitHub
f730a5b3c5
test(s3tables): clarify durable draft failure test ( #4263 )
2026-07-04 23:57:56 +08:00
GatewayJ and GitHub
a9ac5f578d
fix(s3tables): harden durable-strong refresh ( #4230 )
2026-07-03 14:56:30 +08:00
GatewayJ and GitHub
b1582b3391
fix(iam): improve OIDC token exchange diagnostics ( #4232 )
2026-07-03 14:15:58 +08:00
GatewayJ and GitHub
7728c9f203
fix(ecstore): require commit quorum for latest metadata ( #4117 )
2026-07-02 00:41:11 +08:00
GatewayJ and GitHub
f7769884ff
fix(lifecycle): honor expired delete marker semantics ( #4124 )
2026-07-01 22:31:08 +08:00
GatewayJ and GitHub
a60b6310a7
fix(lifecycle): block actions on replication state ( #4125 )
2026-07-01 22:31:00 +08:00
GatewayJ and GitHub
4815d608a2
fix(ecstore): preserve recovery quorum identity ( #3937 )
...
* fix(ecstore): preserve recovery quorum identity
* fix(get): hold read permits through response streaming
* fix(heal): queue read repair at low priority
* fix(ecstore): harden recovery read validation
2026-06-30 11:19:46 +08:00
GatewayJ and GitHub
14e9fa2c8d
fix(ecstore): avoid startup pool meta locks ( #4056 )
2026-06-29 20:19:38 +08:00
675597ec16
fix(ecstore): handle stalled recovery reads and listings ( #3790 )
...
* fix(ecstore): handle stalled recovery reads and listings
* fix(rio): start HTTP stall timeout on read
* fix(ecstore): handle stalled reads and partial lists
* fix(ecstore): retire stalled shards and list errors
* fix(ecstore): preserve list merge lookahead entries
* fix(ecstore): bound zero-copy shard reads
* fix(ecstore): hedge stalled shard reads
* fix(ecstore): retire abandoned shard reads
* fix(ecstore): include part identity in metadata quorum
* fix(ecstore): validate heal shard sources
* fix(ecstore): verify reconstructed read shards
* chore(ecstore): log slow object read stages
* fix(heal): throttle auto heal during recovery
* fix(scanner): yield to foreground reads
* fix(scanner): track streaming object reads
* fix(ecstore): avoid false read heal fanout
* fix(ecstore): verify codec streaming reconstruction sources
* fix(ecstore): preserve quorum progress on slow shards
* fix(storage): restore read timeout facade
* fix(ecstore): retain fallback readers after quorum
* chore: allow decode helper argument lists
---------
Co-authored-by: overtrue <[email protected]
2026-06-27 10:21:09 +08:00
GatewayJ and GitHub
06fdbecf9d
fix(s3tables): harden warehouse index races ( #3849 )
2026-06-25 14:35:24 +08:00
GatewayJ and GitHub
fe5961cc16
fix(s3tables): harden warehouse index consistency ( #3835 )
2026-06-25 11:31:25 +08:00
GatewayJ and GitHub
89dfb1357c
fix(s3tables): harden catalog guard checks ( #3801 )
2026-06-24 12:51:40 +08:00
GatewayJ and GitHub
c47dea0009
fix(scanner): preserve complete usage snapshots ( #3654 )
2026-06-21 08:21:20 +08:00
GatewayJ and GitHub
3e7e39a59c
fix(ecstore): retry transient endpoint DNS failures ( #3652 )
...
* fix(ecstore): retry transient endpoint DNS failures
* fix(ecstore): satisfy DNS retry clippy check
* fix(ecstore): harden endpoint DNS retry
* test(ecstore): stabilize DNS retry error test
2026-06-20 23:53:11 +08:00
GatewayJ and GitHub
a30cafa73f
fix(filemeta): detect physical data dirs for overwrite cleanup ( #3510 )
2026-06-18 11:58:12 +08:00
GatewayJ and GitHub
e29c136ad5
fix(table-catalog): stabilize standard commit metadata names ( #3435 )
2026-06-14 18:03:42 +08:00
GatewayJ and GitHub
3928117c8f
fix(policy): preserve IAM policy readback shape ( #3431 )
2026-06-14 16:36:28 +08:00
GatewayJ and GitHub
42d9d5247d
fix(policy): normalize IAM policy readback ( #3402 )
2026-06-13 18:47:08 +08:00
GatewayJ and GitHub
bda0b1f3dd
feat(table-catalog): add REST exists endpoints ( #3395 )
2026-06-13 13:54:39 +08:00
b5676dcc8e
fix(table-catalog): support PyIceberg REST commits ( #3342 )
...
Co-authored-by: houseme <[email protected]
2026-06-11 22:22:13 +08:00
4a28e3d671
fix: clean old data dirs on object overwrite ( #3244 )
...
Co-authored-by: cxymds <[email protected]
2026-06-07 00:18:56 +00:00
8c742ede14
fix(admin): format policy JSON and improve error messages in service … ( #3242 )
...
* fix(admin): format policy JSON and improve error messages in service account API
- Use serde_json::to_string_pretty for policy serialization to match MinIO behavior
- Replace technical error messages with user-friendly ones for policy validation
- Fixes rustfs/rustfs#3233 (policy JSON not formatted)
- Fixes rustfs/rustfs#3232 (error messages not shown to users)
* Delete scripts/tempfile.zip
---------
Co-authored-by: houseme <[email protected] [email protected]
2026-06-06 16:39:59 +00:00
GatewayJ and GitHub
f1b8f8312d
fix(server): normalize empty request content length ( #3215 )
...
* fix(server): normalize empty S3 request content length
* fix(server): normalize empty console content length
* fix(server): keep console constants test scoped
* test(server): align empty body route expectations
2026-06-05 02:03:07 +00:00
785d53fce8
fix(s3select): validate scan_range protocol and parquet overlap ( #3176 )
...
* fix(s3select): enforce scan range protocol and parquet overlap
* fix(s3select): select row groups by start offset
---------
Co-authored-by: houseme <[email protected]
2026-06-03 15:57:17 +00:00
cc9e4bb207
fix(admin): normalize empty admin GET content length ( #3160 )
...
Co-authored-by: 安正超 <[email protected]
2026-06-03 04:12:04 +00:00
9ce9ec22d1
fix(ecstore): tighten object copy rename handling ( #3131 )
...
* fix(ecstore): tighten object copy rename handling
* fix(ecstore): narrow copy lock lifetime
* test(ecstore): cover reverse copy concurrency
* fix(multipart): ignore preconditions for internal lookup
* fix(ecstore): clean precondition lock bindings
---------
Co-authored-by: houseme <[email protected]
2026-05-31 23:19:21 +00:00
c257043b63
fix(iam): serialize IAM cache writes ( #3105 )
...
* fix(iam): serialize IAM cache writes
* fix(iam): timestamp rebuilt group memberships
* fix(iam): publish cache updates atomically
* fix(iam): reuse policy cache snapshots
* fix(iam): commit missing user notification cache updates atomically
* fix(iam): remove unused cache membership rebuild wrapper
---------
Co-authored-by: 季宏伟 <[email protected] [email protected]
2026-05-29 08:02:42 +00:00
8d20e89bf8
fix(iam): avoid stale cache replacement on walk errors ( #3094 )
...
* fix(iam): avoid stale cache replacement on walk errors
* fix(iam): guard full reload cache commits
---------
Co-authored-by: houseme <[email protected] [email protected] [email protected]
2026-05-28 09:54:06 +00:00
247973f34c
fix(lifecycle): make transition worker resize nonblocking ( #3090 )
...
Co-authored-by: 季宏伟 <[email protected] [email protected]
2026-05-28 01:36:08 +00:00
b0646be756
feat(s3select): improve SelectObjectContent streaming ( #3072 )
...
* feat(s3select): improve SelectObjectContent streaming
* fix(s3select): reject empty select expressions
* fix(s3select): address streaming review feedback
---------
Co-authored-by: loverustfs <[email protected]
2026-05-24 14:23:47 +00:00
GatewayJ and GitHub
c9f0f25f55
fix: bind run script to localhost ( #3063 )
2026-05-22 14:28:17 +00:00
GatewayJ and GitHub
e0729f5f4d
fix(policy): align action-family validation and defaults ( #2984 )
...
* fix(policy): align action-family validation and defaults
* test(e2e): add accountinfo service-account roundtrip
* test(policy): add mixed action family cases
2026-05-16 11:19:04 +00:00
GatewayJ and GitHub
fc8322ed64
bucket policy notify & pba ( #2968 )
2026-05-14 14:31:40 +00:00
b2ba2e5bb3
iam: handle sts claim policy names ( #2902 )
...
Co-authored-by: cxymds <[email protected]
2026-05-12 07:10:42 +00:00
GatewayJ and GitHub
3130670157
test(object-lock): cover default retention delete marker ( #2836 )
2026-05-06 21:14:00 +00:00
9e93d3f47a
fix(object-lock): materialize default retention metadata ( #2824 )
...
Signed-off-by: houseme <[email protected] [email protected] [email protected] [email protected] [email protected]
2026-05-06 13:48:12 +00:00
GatewayJ and GitHub
090d60e00a
fix(auth): authorize DeleteObjects per key ( #2814 )
2026-05-06 00:47:36 +00:00
c29c8a5a1e
fix(filemeta): harden and optimize metacache path ( #2724 )
...
Co-authored-by: houseme <[email protected]
2026-04-30 07:47:31 +00:00
09be06a4d2
fix(ecstore): log walk failures in IAM listing path ( #2705 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: loverustfs <[email protected] [email protected]
2026-04-27 14:13:40 +00:00
cfbd094bc4
fix(iam): propagate cache miss load failures ( #2692 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: loverustfs <[email protected] [email protected]
2026-04-27 09:21:22 +00:00
37a3cbc497
fix(admin): map IAM not found errors to 404 ( #2685 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-04-26 14:13:14 +00:00
ecf0db9bb7
fix(admin): enforce owner check for service account update ( #2646 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-04-23 01:54:43 +00:00
a5de275875
fix(oidc): prefer username for session identity ( #2588 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-04-18 11:13:45 +00:00
dc5ce7d0af
test(scanner): avoid flaky noncurrent version counting ( #2589 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-04-18 11:13:35 +00:00
03f8270a60
fix(admin): restore access key listing and guard boot-time uptime ( #2580 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-04-17 18:55:38 +00:00
f255b8a9f1
fix(admin): align accountinfo policy with IAM prepare_auth for OIDC console ( #2568 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: houseme <[email protected]
2026-04-17 05:38:18 +00:00
16b9189e9b
feat(oidc): add roles_claim and jwt:roles policy support ( #2509 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: houseme <[email protected] [email protected]
2026-04-15 09:30:24 +08:00
8db55de72c
fix(iam): return policy JSON object from info_policy ( #2395 ) ( #2436 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: 安正超 <[email protected]
2026-04-09 21:45:22 +08:00
c244943313
feat(iam): retry OIDC discovery with issuer URL slash variants ( #2360 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: 安正超 <[email protected]
2026-04-03 21:10:27 +08:00
84f58af628
fix(admin): percent-decode group name in DELETE /v3/group/{group} ( #2358 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-04-02 23:52:04 +08:00
3366bd2464
feat(iam,admin): prepared IAM auth, ExistingObjectTag, admin permission checks ( #2315 )
...
Signed-off-by: GatewayJ <[email protected] [email protected]
2026-03-29 19:18:16 +08:00
19d3a23a13
fix(admin): console self password for STS sessions ( #1923 ) ( #2250 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-03-21 22:10:38 +08:00
16946c5a54
fix: allow root to bypass bucket policy deny for policy management APIs ( #2102 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: houseme <[email protected] [email protected] [email protected]
2026-03-09 20:36:29 +08:00
2cb8db36a5
fix(iam): user group policy and delete group ( fixes #2028 ) ( #2043 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-03-02 14:19:01 +08:00
ba32fd9d96
fix(s3): allow anonymous access when PublicAccessBlock config is miss… ( #2039 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-03-02 11:37:00 +08:00
55396f13d4
feat: policy add object tag ( #1908 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: loverustfs <[email protected] [email protected]
2026-02-27 22:24:57 +08:00
62b51b5649
feat: admin permission check ( #1783 )
...
Signed-off-by: GatewayJ <[email protected] [email protected] [email protected]
2026-02-25 11:58:30 +08:00
fb0267981d
fix(iam): STS parent groups fallback and session policy debug for #1423 ( #1804 )
...
Co-authored-by: 安正超 <[email protected]
2026-02-14 11:40:36 +08:00
GatewayJ and GitHub
c8411fd62c
fix: bucket policy id field serde ( #1726 )
2026-02-05 18:38:57 +08:00
GatewayJ and GitHub
9285acba06
feat: object retention ( #1589 )
2026-01-24 22:12:45 +08:00
55e4cdec5d
feat: add Cors ( #1496 )
...
Signed-off-by: GatewayJ <[email protected] [email protected] [email protected] [email protected]
2026-01-15 20:03:26 +08:00
GatewayJ and GitHub
e3a7eb2d3d
fix: standart policy format ( #1508 )
2026-01-15 15:33:22 +08:00
d532c7c972
feat: object-list access ( #1457 )
...
Signed-off-by: loverustfs <[email protected] [email protected] [email protected] [email protected]
2026-01-10 10:11:08 +08:00
356dc7e0c2
feat: Add permission verification for account creation ( #1401 )
...
Co-authored-by: loverustfs <[email protected]
2026-01-06 21:47:18 +08:00
GatewayJ and GitHub
b95bee64b2
fix: Correct import permissions ( #1402 )
2026-01-06 14:53:26 +08:00
