mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 14:02:56 +09:00
Myasnikov DaniilandClaude Opus 4.8
9e2347efaf
The viewer (readonly) S3 credential can still upload: the seaweedfs-cosi-driver does not yet honor accessPolicy=readonly (cozystack/cozystack#1921, blocked upstream on kubernetes-sigs/container-object-storage-interface#244). The whole cozystack chain is correct — Bucket.spec.users.viewer.readonly: true binds the viewer BucketAccess to the tenant-root-readonly BucketAccessClass whose parameters.accessPolicy is readonly — but the driver grants the identity write access anyway (verified live on dev10). The BATS original asserted the same denial; its retries and toothless gate hid the failure, which this migration surfaces. Keep exercising the path and verifying admin read/write + viewer read, but emit a ::warning:: instead of failing when the viewer can upload, so the suite is not blocked on an unimplemented upstream feature. TODO(#1921): restore the hard failure once the driver enforces read-only access. Assisted-By: Claude <noreply@anthropic.com> Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>