astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-11-09 17:21:51 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(iam): separate local policy evaluation from the plugin decision

Browse Source 
IsAllowed returns the authorization plugin's decision when a plugin is
configured, and evaluates the local policies otherwise. Move the local
evaluation into isAllowedLocally so that a caller can combine it with
the plugin's decision. IsAllowed is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Feng Ruohang <rh@vonng.com>
This commit is contained in:
Feng Ruohang
2026-11-05 04:14:06 +08:00
parent 57c2b0fb76
commit a717711b11
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/iam.go
+5
View File
@@ -2549,7 +2549,12 @@ func (sys *IAMSys) IsAllowed(args policy.Args) bool {
}
return ok
}
return sys.isAllowedLocally(args)
}
// isAllowedLocally evaluates args with the local policies only, as IsAllowed
// does when no authorization plugin is configured.
func (sys *IAMSys) isAllowedLocally(args policy.Args) bool {
// Policies don't apply to the owner.
if args.IsOwner {
return true