[tcarmet]

A policy condition on s3:VersionId was compared with the copy source's internal version ID instead of the version ID the client sent. So a Deny on a specific version blocked a GetObject of that version but not a copy of it, in both bucket and identity policies. The copy source's version ID is now evaluated as sent, like for a direct GetObject. A repeated versionId in the copy source is rejected, so it never reaches policy evaluation as a list. Version IDs that decode to the same version under different spellings are still not normalized; that's tracked in CLDSRV-1038 and affects GetObject the same way.

Stacked on #6324.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.36%. Comparing base (4a58308) to head (dd591e5).
✅ All tests successful. No failed tests found.

Additional details and impacted files

Files with missing lines	Coverage Δ
lib/api/api.js	95.12% <100.00%> (+0.71%)	⬆️
lib/api/apiUtils/authorization/permissionChecks.js	97.32% <100.00%> (+0.01%)	⬆️
...i/apiUtils/authorization/prepareRequestContexts.js	95.62% <ø> (ø)
lib/api/apiUtils/object/parseCopySource.js	96.00% <100.00%> (+0.76%)	⬆️
lib/api/objectCopy.js	91.73% <ø> (ø)
lib/api/objectPutCopyPart.js	87.57% <ø> (+0.59%)	⬆️
lib/metadata/metadataUtils.js	94.73% <ø> (ø)

... and 2 files with indirect coverage changes

@@               Coverage Diff                @@
##           development/9.3    #6332   +/-   ##
================================================
  Coverage            85.35%   85.36%           
================================================
  Files                  207      207           
  Lines                13473    13480    +7     
================================================
+ Hits                 11500    11507    +7     
  Misses                1973     1973           

Flag	Coverage Δ
file-ft-tests	68.27% <81.81%> (-0.02%)	⬇️
file-ft-tests-null-compat	68.79% <81.81%> (+<0.01%)	⬆️
kmip-ft-tests	28.35% <72.72%> (+0.01%)	⬆️
mongo-v0-ft-tests	69.47% <81.81%> (-0.03%)	⬇️
mongo-v1-ft-tests	69.49% <81.81%> (+<0.01%)	⬆️
multiple-backend	36.83% <18.18%> (-0.02%)	⬇️
s3c-ft-tests-v0	64.07% <90.90%> (+0.02%)	⬆️
s3c-ft-tests-v0-null-compat	64.13% <90.90%> (+0.02%)	⬆️
s3c-ft-tests-v1	64.05% <90.90%> (-0.02%)	⬇️
sur-tests	37.01% <72.72%> (+0.11%)	⬆️
sur-tests-inflights	37.73% <72.72%> (-0.02%)	⬇️
unit	71.83% <100.00%> (+0.04%)	⬆️
utapi-v2-tests	34.63% <72.72%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[leif-scality]

A Deny on s3:VersionId now blocks copying that version, in bucket and IAM policies, and a repeated versionId in the copy source is rejected. I found no regressions. The new functional test fails without the fix and passes with it, and the stack's functional tests pass 20/20 against Vault 7.89.0. The other-spelling bypass stays in CLDSRV-1038, as the description says.

[bert-e]

Hello tcarmet,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
/after_pull_request	Wait for the given pull request id to be merged before continuing with the current one.
/bypass_author_approval	Bypass the pull request author's approval	⭐
/bypass_build_status	Bypass the build and test status	⭐
/bypass_commit_size	Bypass the check on the size of the changeset TBA	⭐
/bypass_incompatible_branch	Bypass the check on the source branch prefix	⭐
/bypass_jira_check	Bypass the Jira issue check	⭐
/bypass_peer_approval	Bypass the pull request peers' approval	⭐
/bypass_leader_approval	Bypass the pull request leaders' approval	⭐
/bypass_source_branch_lineage	Bypass the cross-branch contamination check	⭐
/approve	Instruct Bert-E that the author has approved the pull request.		✍️
/create_pull_requests	Allow the creation of integration pull requests.
/create_integration_branches	Allow the creation of integration branches.
/no_octopus	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
/unanimity	Change review acceptance criteria from one reviewer at least to all reviewers
/wait	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
/help	Print Bert-E's manual in the pull request.
/status	Print Bert-E's current status in the pull request.
/clear	Remove all comments from Bert-E from the history TBA
/retry	Re-start a fresh build TBA
/build	Re-start a fresh build TBA
/force_reset	Delete integration branches & pull requests, and restart merge process from the beginning.
/reset	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

[bert-e]

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.