fix: validate replication within the rule prefix

Place synthetic permission-check objects under each enabled rule's effective prefix, so least-privilege target policies are validated against the namespace they will actually replicate.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/bucket-replication-handlers.go

@@ -617,7 +617,7 @@ func (api objectAPIHandlers) ValidateBucketReplicationCredsHandler(w http.Respon
 				ReplicationValidityCheck: true, // set this to validate the replication config
 			},
 		}
-		obj := path.Join(minioReservedBucket, globalLocalNodeNameHex, "deleteme")
+		obj := replicationValidationObject(rule)
 		ui, err := c.PutObject(ctx, clnt.Bucket, obj, reader, int64(len(buf)), "", "", putOpts)
 		if err != nil && !isReplicationPermissionCheck(ErrorRespToObjectError(err, bucket, obj)) {
 			writeErrorResponse(ctx, w, errorCodes.ToAPIErrWithErr(ErrReplicationValidationError, fmt.Errorf("s3:ReplicateObject permissions missing for replication user: %w", err)), r.URL)
@@ -658,3 +658,7 @@ func (api objectAPIHandlers) ValidateBucketReplicationCredsHandler(w http.Respon
 	// Write success response.
 	writeSuccessResponseHeadersOnly(w)
 }
+
+func replicationValidationObject(rule replication.Rule) string {
+	return path.Join(rule.Prefix(), minioReservedBucket, globalLocalNodeNameHex, "deleteme")
+}

cmd/bucket-replication_test.go

@@ -20,6 +20,7 @@ package cmd
 import (
 	"fmt"
 	"net/http"
+	"path"
 	"testing"
 	"time"
 
@@ -287,3 +288,22 @@ func TestReplicationResyncwrapper(t *testing.T) {
 		}
 	}
 }
+
+func TestReplicationValidationObjectUsesRulePrefix(t *testing.T) {
+	tests := []struct {
+		name string
+		rule replication.Rule
+		want string
+	}{
+		{name: "empty prefix", rule: replication.Rule{}, want: path.Join(minioReservedBucket, globalLocalNodeNameHex, "deleteme")},
+		{name: "filter prefix", rule: replication.Rule{Filter: replication.Filter{Prefix: "data/"}}, want: path.Join("data", minioReservedBucket, globalLocalNodeNameHex, "deleteme")},
+		{name: "and prefix", rule: replication.Rule{Filter: replication.Filter{And: replication.And{Prefix: "archive/"}}}, want: path.Join("archive", minioReservedBucket, globalLocalNodeNameHex, "deleteme")},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := replicationValidationObject(test.rule); got != test.want {
+				t.Fatalf("replicationValidationObject() = %q, want %q", got, test.want)
+			}
+		})
+	}
+}