diff --git a/portal-ui/src/common/Copyright.tsx b/portal-ui/src/common/Copyright.tsx index 072e161ff9..08706ad687 100644 --- a/portal-ui/src/common/Copyright.tsx +++ b/portal-ui/src/common/Copyright.tsx @@ -1,3 +1,19 @@ +// This file is part of MinIO Console Server +// Copyright (c) 2021 MinIO, Inc. +// +// This program is free software: you can redistribute it and/or modify +// it under the terms of the GNU Affero General Public License as published by +// the Free Software Foundation, either version 3 of the License, or +// (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU Affero General Public License for more details. +// +// You should have received a copy of the GNU Affero General Public License +// along with this program. If not, see . + import React from "react"; import Typography from "@mui/material/Typography"; import Link from "@mui/material/Link"; diff --git a/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ObjectDetails/ShareFile.tsx b/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ObjectDetails/ShareFile.tsx index 3ed2fb3c63..018b52767f 100644 --- a/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ObjectDetails/ShareFile.tsx +++ b/portal-ui/src/screens/Console/Buckets/ListBuckets/Objects/ObjectDetails/ShareFile.tsx @@ -141,7 +141,9 @@ const ShareFile = ({ const slDate = new Date(`${selectedDate}`); const currDate = new Date(); - const diffDate = Math.ceil((slDate.getTime() - currDate.getTime()) / 1000); + const diffDate = Math.ceil( + (slDate.getTime() - currDate.getTime()) / 1000 + ); if (diffDate > 0) { api diff --git a/restapi/admin_remote_buckets.go b/restapi/admin_remote_buckets.go index 300cde76f7..20f05e0ac5 100644 --- a/restapi/admin_remote_buckets.go +++ b/restapi/admin_remote_buckets.go @@ -458,7 +458,7 @@ func listExternalBucketsResponse(params user_api.ListExternalBucketsParams) (*mo // create a minioClient interface implementation // defining the client to be used remoteClient := AdminClient{Client: remoteAdmin} - buckets, err := getAccountBuckets(ctx, remoteClient) + buckets, err := getAccountBuckets(ctx, remoteClient, *params.Body.AccessKey) if err != nil { return nil, prepareError(err) } diff --git a/restapi/user_buckets.go b/restapi/user_buckets.go index 19fe94d05d..d1ea0f961c 100644 --- a/restapi/user_buckets.go +++ b/restapi/user_buckets.go @@ -290,43 +290,25 @@ func getBucketVersionedResponse(session *models.Principal, bucketName string) (* } // getAccountBuckets fetches a list of all buckets allowed to that particular client from MinIO Servers -func getAccountBuckets(ctx context.Context, client MinioAdmin) ([]*models.Bucket, error) { +func getAccountBuckets(ctx context.Context, client MinioAdmin, accessKey string) ([]*models.Bucket, error) { info, err := client.AccountInfo(ctx) if err != nil { return []*models.Bucket{}, err } - policyInfo, err := getAccountPolicy(ctx, client) if err != nil { return nil, err } - - bucketsPolicies := map[string]minioIAMPolicy.ActionSet{} - for _, statement := range policyInfo.Statements { - if statement.Effect == "Allow" { - for _, resource := range statement.Resources.ToSlice() { - resourceName := resource.String() - if actions, ok := bucketsPolicies[resourceName]; ok { - mergedActions := append(actions.ToSlice(), statement.Actions.ToSlice()...) - bucketsPolicies[resourceName] = minioIAMPolicy.NewActionSet(mergedActions...) - } else { - bucketsPolicies[resourceName] = statement.Actions - } - } - } - } var bucketInfos []*models.Bucket for _, bucket := range info.Buckets { var bucketAdminRole bool - bucketNameARN := fmt.Sprintf("arn:aws:s3:::%s/*", bucket.Name) - // match bucket name against policy that allows admin actions - if bucketPolicyActions, ok := bucketsPolicies[bucketNameARN]; ok { - bucketAdminRoleActions := bucketPolicyActions.Intersection(acl.BucketAdminRole) - bucketAdminRole = len(bucketAdminRoleActions) > 0 - } else if bucketPolicyActions, ok := bucketsPolicies["arn:aws:s3:::*"]; ok { - bucketAdminRoleActions := bucketPolicyActions.Intersection(acl.BucketAdminRole) - bucketAdminRole = len(bucketAdminRoleActions) > 0 + conditionValues := map[string][]string{ + condition.AWSUsername.Name(): {accessKey}, } + bucketActions := policyInfo.IsAllowedActions(bucket.Name, "", conditionValues) + bucketAdminRoleActions := bucketActions.Intersection(acl.BucketAdminRole) + bucketAdminRole = len(bucketAdminRoleActions) > 0 + bucketElem := &models.Bucket{ CreationDate: bucket.Created.Format(time.RFC3339), Details: &models.BucketDetails{ @@ -376,7 +358,7 @@ func getListBucketsResponse(session *models.Principal) (*models.ListBucketsRespo // create a minioClient interface implementation // defining the client to be used adminClient := AdminClient{Client: mAdmin} - buckets, err := getAccountBuckets(ctx, adminClient) + buckets, err := getAccountBuckets(ctx, adminClient, session.AccountAccessKey) if err != nil { return nil, prepareError(err) } @@ -486,7 +468,7 @@ func setBucketAccessPolicy(ctx context.Context, client MinioClient, bucketName s bucketAccessPolicy := policy.BucketAccessPolicy{Version: minioIAMPolicy.DefaultVersion} bucketAccessPolicy.Statements = policy.SetPolicy(bucketAccessPolicy.Statements, - policy.BucketPolicy(bucketPolicy), bucketName, "") + bucketPolicy, bucketName, "") // implemented like minio/mc/ s3Client.SetAccess() if len(bucketAccessPolicy.Statements) == 0 { return client.setBucketPolicyWithContext(ctx, bucketName, "") diff --git a/restapi/user_buckets_test.go b/restapi/user_buckets_test.go index 9afe749815..29c53ba32d 100644 --- a/restapi/user_buckets_test.go +++ b/restapi/user_buckets_test.go @@ -180,7 +180,7 @@ func TestListBucket(t *testing.T) { // get list buckets response this response should have Name, CreationDate, Size and Access // as part of of each bucket function := "getaAcountUsageInfo()" - bucketList, err := getAccountBuckets(ctx, adminClient) + bucketList, err := getAccountBuckets(ctx, adminClient, "") if err != nil { t.Errorf("Failed on %s:, error occurred: %s", function, err.Error()) } @@ -197,7 +197,7 @@ func TestListBucket(t *testing.T) { minioAccountInfoMock = func(ctx context.Context) (madmin.AccountInfo, error) { return madmin.AccountInfo{}, errors.New("error") } - _, err = getAccountBuckets(ctx, adminClient) + _, err = getAccountBuckets(ctx, adminClient, "") if assert.Error(err) { assert.Equal("error", err.Error()) }