Test/get bucket policy status

.github/workflows/system.yml

@@ -79,6 +79,20 @@ jobs:
             DELETE_BUCKETS_AFTER_TEST: "true"
             BACKEND: "posix"
             AWS_REGION: "us-west-1"
+          - set: "REST, posix, static, rest-get-bucket-policy-status, folder IAM"
+            IAM_TYPE: folder
+            RUN_SET: "rest-get-bucket-policy-status"
+            RECREATE_BUCKETS: "false"
+            DELETE_BUCKETS_AFTER_TEST: "false"
+            BACKEND: "posix"
+            AWS_REGION: "us-east-1"
+          - set: "REST, posix, non-static, rest-get-bucket-policy-status, folder IAM"
+            IAM_TYPE: folder
+            RUN_SET: "rest-put-bucket-tagging,rest-get-bucket-location,rest-put-object-tagging,rest-get-object-tagging,rest-list-object-versions"
+            RECREATE_BUCKETS: "true"
+            DELETE_BUCKETS_AFTER_TEST: "true"
+            BACKEND: "posix"
+            AWS_REGION: "us-west-1"
           - set: "s3, posix, non-file count, non-static, folder IAM"
             IAM_TYPE: folder
             RUN_SET: "s3-non-file-count"

tests/commands/put_bucket_policy.sh

@@ -30,7 +30,7 @@ put_bucket_policy() {
   elif [[ $1 == 'mc' ]]; then
     policy=$(send_command mc --insecure anonymous set-json "$3" "$MC_ALIAS/$2" 2>&1) || put_policy_result=$?
   elif [ "$1" == 'rest' ]; then
-    put_bucket_policy_rest "$2" "$3" || put_policy_result=$?
+    put_bucket_policy_rest_200_or_204 "$2" "$3" || put_policy_result=$?
     return $put_policy_result
   else
     log 2 "command 'put bucket policy' not implemented for '$1'"
@@ -77,3 +77,18 @@ put_bucket_policy_rest() {
   fi
   return 0
 }
+
+put_bucket_policy_rest_200_or_204() {
+  if ! check_param_count "put_bucket_policy_rest" "bucket, policy file" 2 $#; then
+    return 1
+  fi
+  if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" POLICY_FILE="$2" OUTPUT_FILE="$TEST_FILE_FOLDER/result.txt" ./tests/rest_scripts/put_bucket_policy.sh); then
+    log 2 "error putting bucket policy: $result"
+    return 1
+  fi
+  if [ "$result" != "200" ] && [ "$result" != "204" ]; then
+    log 2 "expected '200' or '204', was '$result' ($(cat "$TEST_FILE_FOLDER/result.txt"))"
+    return 1
+  fi
+  return 0
+}

tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bats
+
+# Copyright 2025 Versity Software
+# This file is licensed under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http:#www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+source ./tests/drivers/xml.sh
+
+check_policy_status() {
+  if ! check_param_count_v2 "data file" 1 $#; then
+    return 1
+  fi
+  log 5 "data: $(cat "$1")"
+  if ! check_xml_element "$1" "$expected_policy_status" "PolicyStatus" "IsPublic"; then
+    log 2 "error checking policy status"
+    return 1
+  fi
+  return 0
+}
+
+get_and_check_policy_status() {
+  if ! check_param_count_v2 "bucket, expected status" 2 $#; then
+    return 1
+  fi
+  expected_policy_status="$2"
+  if ! send_rest_go_command_callback "200" "check_policy_status" "-bucketName" "$1" "-query" "policyStatus="; then
+    log 2 "error sending REST go command or checking callback"
+    return 1
+  fi
+  return 0
+}

tests/drivers/put_bucket_policy/put_bucket_policy.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env bats
+
+# Copyright 2025 Versity Software
+# This file is licensed under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http:#www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+put_and_check_for_malformed_policy() {
+  if ! check_param_count "put_and_check_for_malformed_policy" "bucket, policy file" 2 $#; then
+    return 1
+  fi
+  if put_bucket_policy "s3api" "$1" "$2"; then
+    log 2 "put succeeded despite malformed policy"
+    return 1
+  fi
+  # shellcheck disable=SC2154
+  if [[ "$put_bucket_policy_error" != *"MalformedPolicy"*"invalid action"* ]]; then
+    log 2 "invalid policy error: $put_bucket_policy_error"
+    return 1
+  fi
+  return 0
+}

tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bats
+
+# Copyright 2025 Versity Software
+# This file is licensed under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http:#www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+put_simple_bucket_policy() {
+  if ! check_param_count_v2 "bucket" 1 $#; then
+    return 1
+  fi
+  if [ "$DIRECT" == "true" ]; then
+    user_id="$DIRECT_S3_ROOT_ACCOUNT_NAME"
+  else
+    user_id="$AWS_ACCESS_KEY_ID"
+  fi
+
+  if ! setup_policy_with_single_statement "$TEST_FILE_FOLDER/policy_file" "2012-10-17" "Allow" "$user_id" "s3:*" "arn:aws:s3:::$1"; then
+    log 2 "error setting up policy"
+    return 1
+  fi
+  log 5 "policy: $TEST_FILE_FOLDER/policy_file"
+  if ! put_bucket_policy_rest "$1" "$TEST_FILE_FOLDER/policy_file"; then
+    log 2 "error putting policy"
+    return 1
+  fi
+  return 0
+}
+
+put_public_bucket_policy() {
+  if ! check_param_count_v2 "bucket" 1 $#; then
+    return 1
+  fi
+
+  if ! setup_policy_with_single_statement "$TEST_FILE_FOLDER/policy_file" "2012-10-17" "Allow" "*" "s3:*" "arn:aws:s3:::$1"; then
+    log 2 "error setting up policy"
+    return 1
+  fi
+
+  if ! put_bucket_policy_rest "$1" "$TEST_FILE_FOLDER/policy_file"; then
+    log 2 "error putting policy"
+    return 1
+  fi
+  return 0
+}

tests/rest_scripts/put_bucket_policy.sh

@@ -41,7 +41,7 @@ $payload_hash"
 # shellcheck disable=SC2119
 create_canonical_hash_sts_and_signature
 
-curl_command+=(curl -ks -w "\"%{http_code}\"" -X PUT "$AWS_ENDPOINT_URL/$bucket_name?policy="
+curl_command+=(curl -iks -w "\"%{http_code}\"" -X PUT "$AWS_ENDPOINT_URL/$bucket_name?policy="
 -H "\"Authorization: AWS4-HMAC-SHA256 Credential=$aws_access_key_id/$year_month_day/$aws_region/s3/aws4_request,SignedHeaders=host;x-amz-content-sha256;x-amz-date,Signature=$signature\""
 -H "\"x-amz-content-sha256: $payload_hash\""
 -H "\"x-amz-date: $current_date_time\""

tests/run.sh

@@ -67,7 +67,7 @@ handle_param() {
       rest-create-bucket|rest-head-bucket|rest-list-buckets|rest-not-implemented|\
       rest-put-object|rest-versioning|rest-bucket|rest-multipart|rest-delete-bucket-ownership-controls|\
       rest-delete-bucket-tagging|setup-remove-static|rest-put-bucket-tagging|rest-get-bucket-location|\
-      rest-put-object-tagging|rest-get-object-tagging|rest-list-object-versions)
+      rest-put-object-tagging|rest-get-object-tagging|rest-list-object-versions|rest-get-bucket-policy-status)
           run_suite "$1"
           ;;
       *) # Handle unrecognized options or positional arguments
@@ -180,6 +180,8 @@ run_suite() {
         exit_code=1
       elif ! "$HOME"/bin/bats ./tests/test_rest_get_bucket_location.sh; then
         exit_code=1
+      elif ! "$HOME"/bin/bats ./tests/test_rest_get_bucket_policy_status.sh; then
+        exit_code=1
       elif ! "$HOME"/bin/bats ./tests/test_rest_get_object_tagging.sh; then
         exit_code=1
       elif ! "$HOME"/bin/bats ./tests/test_rest_head_bucket.sh; then
@@ -240,6 +242,10 @@ run_suite() {
       echo "Running REST get bucket location tests ..."
       "$HOME"/bin/bats ./tests/test_rest_get_bucket_location.sh || exit_code=$?
       ;;
+    rest-get-bucket-policy-status)
+      echo "Running REST get bucket policy status tests ..."
+      "$HOME"/bin/bats ./tests/test_rest_get_bucket_policy_status.sh || exit_code=$?
+      ;;
     rest-get-object-tagging)
       echo "Running REST get object tagging tests ..."
       "$HOME"/bin/bats ./tests/test_rest_get_object_tagging.sh || exit_code=$?

tests/test_rest_get_bucket_policy_status.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bats
+
+# Copyright 2025 Versity Software
+# This file is licensed under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http:#www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+load ./bats-support/load
+load ./bats-assert/load
+
+source ./tests/drivers/create_bucket/create_bucket_rest.sh
+source ./tests/drivers/get_bucket_policy_status/get_bucket_policy_status_rest.sh
+source ./tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh
+source ./tests/util/util_public_access_block.sh
+source ./tests/setup.sh
+
+@test "REST - GetBucketPolicyStatus" {
+  if [ "$DIRECT" != "true" ]; then
+    skip "https://github.com/versity/versitygw/issues/1712"
+  fi
+  run get_bucket_name "$BUCKET_ONE_NAME"
+  assert_success
+  bucket_name="$output"
+
+  run setup_bucket_v2 "$bucket_name"
+  assert_success
+
+  run put_simple_bucket_policy "$bucket_name"
+  assert_success
+
+  run get_and_check_policy_status "$bucket_name" "false"
+  assert_success
+}
+
+@test "REST - GetBucketPolicyStatus true" {
+  if [ "$DIRECT" != "true" ]; then
+    skip "https://github.com/versity/versitygw/issues/1712"
+  fi
+  run get_bucket_name "$BUCKET_ONE_NAME"
+  assert_success
+  bucket_name="$output"
+
+  run setup_bucket_v2 "$bucket_name"
+  assert_success
+
+  if [ "$DIRECT" == "true" ]; then
+    run allow_public_access "$bucket_name"
+    assert_success
+  fi
+
+  run put_public_bucket_policy "$bucket_name"
+  assert_success
+
+  run get_and_check_policy_status "$bucket_name" "true"
+  assert_success
+}

tests/test_rest_put_bucket_policy.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bats
+
+# Copyright 2025 Versity Software
+# This file is licensed under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http:#www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+load ./bats-support/load
+load ./bats-assert/load
+
+source ./tests/drivers/create_bucket/create_bucket_rest.sh
+source ./tests/drivers/put_bucket_policy/put_bucket_policy_rest.sh
+source ./tests/setup.sh
+
+@test "PutBucketPolicy - success returns 204" {
+  run get_bucket_name "$BUCKET_ONE_NAME"
+  assert_success
+  bucket_name="$output"
+
+  run setup_bucket_v2 "$bucket_name"
+  assert_success
+
+  run put_simple_bucket_policy "$bucket_name"
+  assert_success
+}

tests/test_s3api_policy_object.sh

@@ -14,6 +14,7 @@
 # specific language governing permissions and limitations
 # under the License.
 
+source ./tests/drivers/put_bucket_policy/put_bucket_policy.sh
 source ./tests/util/util_delete_object.sh
 
 test_s3api_policy_allow_deny() {

tests/util/util_policy.sh

@@ -43,7 +43,8 @@ check_for_empty_policy() {
 
 add_direct_user_to_principal() {
   if [ "${principals[$idx]}" == "*" ]; then
-    modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/$DIRECT_S3_ROOT_ACCOUNT_NAME\""
+    #modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/$DIRECT_S3_ROOT_ACCOUNT_NAME\""
+    modified_principal+="\"*\""
   else
     modified_principal+="\"arn:aws:iam::$DIRECT_AWS_USER_ID:user/${principals[$idx]}\""
   fi
@@ -238,22 +239,6 @@ check_policy() {
     return 0
 }
 
-put_and_check_for_malformed_policy() {
-  if ! check_param_count "put_and_check_for_malformed_policy" "bucket, policy file" 2 $#; then
-    return 1
-  fi
-  if put_bucket_policy "s3api" "$1" "$2"; then
-    log 2 "put succeeded despite malformed policy"
-    return 1
-  fi
-  # shellcheck disable=SC2154
-  if [[ "$put_bucket_policy_error" != *"MalformedPolicy"*"invalid action"* ]]; then
-    log 2 "invalid policy error: $put_bucket_policy_error"
-    return 1
-  fi
-  return 0
-}
-
 get_and_check_no_policy_error() {
   if ! check_param_count "get_and_check_no_policy_error" "bucket" 1 $#; then
     return 1

tests/util/util_public_access_block.sh

@@ -18,7 +18,7 @@ allow_public_access() {
   if ! check_param_count_v2 "bucket name" 1 $#; then
     return 1
   fi
-  if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" BLOCK_PUBLIC_ACLS="FALSE" IGNORE_PUBLIC_ACLS="FALSE" RESTRICT_PUBLIC_BUCKETS="FALSE" OUTPUT_FILE="$TEST_FILE_FOLDER/response.txt" ./tests/rest_scripts/put_public_access_block.sh 2>&1); then
+  if ! result=$(COMMAND_LOG="$COMMAND_LOG" BUCKET_NAME="$1" BLOCK_PUBLIC_ACLS="FALSE" BLOCK_PUBLIC_POLICY="FALSE" IGNORE_PUBLIC_ACLS="FALSE" RESTRICT_PUBLIC_BUCKETS="FALSE" OUTPUT_FILE="$TEST_FILE_FOLDER/response.txt" ./tests/rest_scripts/put_public_access_block.sh 2>&1); then
     log 2 "error getting public access block: $result"
     return 1
   fi