Make a link key per bucket, limited to get and put of its objects and kept as minio's own secret, so links are not signed by the root account (issue 1594)

2026-10-21 14:47:14 +02:00
parent 671ab9a3ba
commit 5b3fd1008a
8 changed files with 297 additions and 57 deletions
@@ -228,9 +228,14 @@ export class MinioClient {
   * but the machine's process table shows it to every local user for the second `mc` runs (novox/hq
   * issue 282, open): replacing it means the admin API's encrypted request made here.
   */
-  async createAccessKey(bucket: string, accessKey: string, secretKey: string): Promise<AccessKey> {
+  async createAccessKey(
+    bucket: string,
+    accessKey: string,
+    secretKey: string,
+    policy: string = bucketPolicy(bucket),
+  ): Promise<AccessKey> {
    const policyPath = join(this.mcConfigDir, `policy-${accessKey}.json`);
-    writeFileSync(policyPath, bucketPolicy(bucket), { mode: 0o600 });
+    writeFileSync(policyPath, policy, { mode: 0o600 });
    try {
      await this.mc(
        "admin", "user", "svcacct", "add", "mesh", this.rootUser,
@@ -248,6 +253,16 @@ export class MinioClient {
    await this.mc("admin", "user", "svcacct", "rm", "mesh", accessKey);
  }

+  /** Whether a service account of this access key exists (`mc admin user svcacct info` fails when it does not). */
+  async accessKeyExists(accessKey: string): Promise<boolean> {
+    try {
+      await this.mc("admin", "user", "svcacct", "info", "mesh", accessKey);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
  /**
   * Run `mc` against the alias `mesh`, which it is given as MC_HOST_mesh in its environment — the
   * root user and password inside the URL — rather than by an `mc alias set` that carried the root
@@ -320,7 +335,7 @@ export class MinioClient {
 // is a line of this module's manifest, filled per consumer and delivered to both ends). Both
 // survived with no callers, which is the state a rule comes back from; they are gone.

-function bucketPolicy(bucket: string): string {
+export function bucketPolicy(bucket: string): string {
  return JSON.stringify({
    Version: "2012-10-17",
    Statement: [{