Feng Ruohang 2f55347f78 fix(iam): bind policy conditions to effective request values ...

Policy evaluation mixed server-derived identity and transport values with raw headers and query parameters. A client could therefore shadow internal condition keys, synthesize LDAP or JWT resource variables, substitute request tags for stored tags, or make a condition observe a value different from the one the handler actually used.

Partition condition sources, reserve internal names, adopt exact-name lookup from silo-pkg, and bind authorization to the effective request state. Preserve compatible query forms for storage class and upload tags with explicit header precedence, while restricting signature age and existing-object tags to authenticated or server-resolved values.

Tests sweep every supported key across header and query routes and exercise LDAP/OIDC variables, object-lock spelling, STS tags, metadata extraction, and end-to-end policy decisions.

Co-authored-by: ChatGPT <noreply@openai.com>
Co-authored-by: Claude <noreply@anthropic.com>

2026-08-04 23:00:30 +08:00

..

forwarder.go

tests: Do not allow forced type asserts (#20905)

2025-02-18 08:25:55 -08:00

proxy_test.go

Allow disabling of all X-Forwarded-For header processing (#20977)

2025-02-26 11:25:49 -08:00

proxy.go

fix(iam): bind policy conditions to effective request values

2026-08-04 23:00:30 +08:00