fix: validate replication within the rule prefix

Place synthetic permission-check objects under each enabled rule's effective prefix, so least-privilege target policies are validated against the namespace they will actually replicate.

Signed-off-by: Feng Ruohang <rh@vonng.com>

cmd/bucket-replication_test.go

@@ -20,6 +20,7 @@ package cmd
 import (
 	"fmt"
 	"net/http"
+	"path"
 	"testing"
 	"time"
 
@@ -287,3 +288,22 @@ func TestReplicationResyncwrapper(t *testing.T) {
 		}
 	}
 }
+
+func TestReplicationValidationObjectUsesRulePrefix(t *testing.T) {
+	tests := []struct {
+		name string
+		rule replication.Rule
+		want string
+	}{
+		{name: "empty prefix", rule: replication.Rule{}, want: path.Join(minioReservedBucket, globalLocalNodeNameHex, "deleteme")},
+		{name: "filter prefix", rule: replication.Rule{Filter: replication.Filter{Prefix: "data/"}}, want: path.Join("data", minioReservedBucket, globalLocalNodeNameHex, "deleteme")},
+		{name: "and prefix", rule: replication.Rule{Filter: replication.Filter{And: replication.And{Prefix: "archive/"}}}, want: path.Join("archive", minioReservedBucket, globalLocalNodeNameHex, "deleteme")},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := replicationValidationObject(test.rule); got != test.want {
+				t.Fatalf("replicationValidationObject() = %q, want %q", got, test.want)
+			}
+		})
+	}
+}