feat(iam): support accessPolicy parameter for readonly bucket access

pkg/driver/provisioner.go

@@ -185,6 +185,12 @@ func (s *provisionerServer) DriverGrantBucketAccess(ctx context.Context, req *co
 		return nil, status.Error(codes.InvalidArgument, "user or bucket empty")
 	}
 
+	// determine IAM actions based on accessPolicy parameter
+	actions, err := actionsForPolicy(req.GetParameters()["accessPolicy"])
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
 	accessKey, _ := GenerateAccessKeyID()
 	secretKey, _ := GenerateSecretAccessKey()
 
@@ -213,7 +219,7 @@ func (s *provisionerServer) DriverGrantBucketAccess(ctx context.Context, req *co
 		cfg.Identities = append(cfg.Identities, id)
 	}
 	id.Credentials = append(id.Credentials, &iam_pb.Credential{AccessKey: accessKey, SecretKey: secretKey})
-	for _, a := range []string{"Read", "Write", "List", "Tagging"} {
+	for _, a := range actions {
 		action := fmt.Sprintf("%s:%s", a, bucket)
 		if !contains(id.Actions, action) {
 			id.Actions = append(id.Actions, action)
@@ -412,6 +418,19 @@ func validateObjectLockParams(params map[string]string) error {
 	return nil
 }
 
+// actionsForPolicy returns the IAM action names for the given access policy.
+// Supported values: "readonly", "readwrite", "" (defaults to readwrite).
+func actionsForPolicy(policy string) ([]string, error) {
+	switch policy {
+	case "readonly":
+		return []string{"Read", "List"}, nil
+	case "readwrite", "":
+		return []string{"Read", "Write", "List", "Tagging"}, nil
+	default:
+		return nil, fmt.Errorf("unsupported accessPolicy %q, must be \"readonly\" or \"readwrite\"", policy)
+	}
+}
+
 func contains(ss []string, s string) bool {
 	for _, v := range ss {
 		if v == s {

pkg/driver/provisioner_test.go

@@ -24,10 +24,12 @@ import (
 	"fmt"
 	"net"
 	"reflect"
+	"sort"
 	"testing"
 
 	"github.com/seaweedfs/seaweedfs/weed/filer"
 	"github.com/seaweedfs/seaweedfs/weed/pb/filer_pb"
+	"github.com/seaweedfs/seaweedfs/weed/pb/iam_pb"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
@@ -126,6 +128,79 @@ func TestDriverGrantBucketAccess(t *testing.T) {
 	}
 }
 
+// iamActions parses the fakeFiler IAM buffer and returns sorted actions for the given identity.
+func iamActions(t *testing.T, ff *fakeFiler, identity string) []string {
+	t.Helper()
+	cfg := &iam_pb.S3ApiConfiguration{}
+	if ff.iam.Len() > 0 {
+		if err := filer.ParseS3ConfigurationFromBytes(ff.iam.Bytes(), cfg); err != nil {
+			t.Fatalf("parse IAM config: %v", err)
+		}
+	}
+	for _, id := range cfg.Identities {
+		if id.Name == identity {
+			actions := make([]string, len(id.Actions))
+			copy(actions, id.Actions)
+			sort.Strings(actions)
+			return actions
+		}
+	}
+	t.Fatalf("identity %q not found in IAM config", identity)
+	return nil
+}
+
+func TestDriverGrantBucketAccessPolicy(t *testing.T) {
+	cases := []struct {
+		name        string
+		params      map[string]string
+		wantActions []string
+		wantErr     bool
+	}{
+		{
+			name:        "readonly access",
+			params:      map[string]string{"accessPolicy": "readonly"},
+			wantActions: []string{"List:b", "Read:b"},
+		},
+		{
+			name:        "readwrite access",
+			params:      map[string]string{"accessPolicy": "readwrite"},
+			wantActions: []string{"List:b", "Read:b", "Tagging:b", "Write:b"},
+		},
+		{
+			name:        "default access (no param)",
+			params:      nil,
+			wantActions: []string{"List:b", "Read:b", "Tagging:b", "Write:b"},
+		},
+		{
+			name:    "invalid access policy",
+			params:  map[string]string{"accessPolicy": "invalid"},
+			wantErr: true,
+		},
+	}
+
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			p, ff := newProv(t)
+			req := &cosispec.DriverGrantBucketAccessRequest{
+				BucketId:   "b",
+				Name:       "u",
+				Parameters: c.params,
+			}
+			_, err := p.DriverGrantBucketAccess(context.Background(), req)
+			if (err != nil) != c.wantErr {
+				t.Fatalf("err=%v wantErr=%v", err, c.wantErr)
+			}
+			if c.wantErr {
+				return
+			}
+			got := iamActions(t, ff, "u")
+			if !reflect.DeepEqual(got, c.wantActions) {
+				t.Errorf("actions=%v want %v", got, c.wantActions)
+			}
+		})
+	}
+}
+
 func TestDriverRevokeBucketAccess(t *testing.T) {
 	p, _ := newProv(t)
 	_, _ = p.DriverGrantBucketAccess(context.Background(),