kqjy/MyFSIO
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 42 Wiki Activity

42 Releases 42 Tags

RSS Feed
  • v0.5.2 cbe2c9cb19
    Compare

    MyFSIO v0.5.2 Beta Pre-Release

    kqjy released this 2026-05-03 07:33:01 +00:00 | 37 commits to main since this release

    S3 API correctness & conformance

    • Admin and KMS routes moved under the /myfsio/ namespace; only the myfsio bucket name is reserved (rejected at create_bucket). Fixes S3 error codes, LocationConstraint validation, and CORS preflight XML.
    • Atomic encrypt-before-publish CopyObject: snapshot-bound source metadata; atomic SSE-S3 plaintext ETag; finalize_put_sync now reserves __etag__ / __size__ / __last_modified__ / __version_id__ from caller metadata (fixes UI copy/move metadata leak).
    • IsLatest mis-flag fix; versioned retention / legal-hold; parse_range underflow; version_id validation; bucket_detail template crash fixed.
    • General S3 API compliance pass on response headers, conditional writes, replication, and security.

    Security

    • SigV4 host enforcement.
    • SelectObject SQL sandbox; SSRF guard with DNS-aware filtering and a custom AWS SDK HttpClient; CSRF for streaming requests; aws-chunked buffer cap; session DoS cap; IAM blank-policy rejection; restore-key dispatch hardening; create_bucket race fix.
    • UI session cookie: persistent Max-Age from SESSION_LIFETIME_DAYS with sliding expiry; SameSite reverted Strict → Lax so persistent cookies survive top-level navigations (bookmarks, new tabs, inbound links) while CSRF tokens still guard mutations.

    Replication, site sync & integrity

    • Large-object replication fixed: multipart upload, per-part timeout, background healer, status metadata.
    • Bidirectional-status no longer misclassifies auth-denied-but-reachable peers as REMOTE_UNREACHABLE (redundant peer-health pre-check removed).
    • Local site endpoint auto-syncs with the runtime bind address.

    Admin / IAM / auth

    • Bucket admin mutations gated on admin: POST-only bucket routes moved into the admin sub-router; mixed-method create / acl / cors / lifecycle handlers gained inline ensure_admin checks.
    • UI list authorisation split so a bucket-ARN policy Deny still binds while IAM prefix scoping is honoured.
    • UI bucket-encryption SSE-default shape (Rules[0].ApplyServerSideEncryptionByDefault.SSEAlgorithm) parsed correctly so existing UI-configured defaults still apply at PutObject.
    • Embedded peer-credential form submissions routed back to Sites.

    UI

    • GC and integrity-history initial render respect DISPLAY_TIMEZONE — no more zone flicker after refresh.
    • Optimistic retry-card always cleared on POST return; resume kind-conflict is peeked before re-enabling.
    Downloads