Reconcile S3 compatibility matrix

Author: seddonm1

docs/s3-compatibility-matrix.md

@@ -9,7 +9,7 @@ This document compares feature-level S3 coverage across:
 - `MinIO`: whether MinIO documents support for the equivalent S3 feature/API.
 - `s3ite`: whether this repository currently implements and tests the feature.
 
-The matrix was last reconciled on 2026-06-08. It uses colored status markers in
+The matrix was last reconciled on 2026-06-12. It uses colored status markers in
 the feature columns:
 
 - ✅ means covered/supported.
@@ -38,9 +38,9 @@ compatibility-limited, the note says so.
   [Amazon S3 Multi-Region Access Points](https://docs.aws.amazon.com/en_en/AmazonS3/latest/userguide/MultiRegionAccessPoints.html),
   [Amazon S3 Object Lambda availability change](https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazons3-ol-change.html),
   and [S3 Express One Zone](https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-express-getting-started.html).
-- MinIO surface: [MinIO S3 API Compatibility](https://minio.community/community/minio-object-store/reference/s3-api-compatibility.html),
+- MinIO surface: [MinIO S3 API Compatibility](https://docs.min.io/aistor/developers/s3-api-compatibility/),
   [MinIO server-side encryption](https://docs.min.io/aistor/installation/linux/server-side-encryption/),
-  [MinIO Object Lambda transforms](https://docs.min.io/enterprise/aistor-object-store/developers/transforms-with-object-lambda/),
+  [MinIO Object Lambda transforms](https://docs.min.io/aistor/developers/transforms-with-object-lambda/),
   and [MinIO S3 compatibility product overview](https://www.min.io/product/s3-compatibility).
 - s3ite surface: [README.md](../README.md), [src/s3](../src/s3),
   [src/s3/sse.rs](../src/s3/sse.rs), and [tests](../tests).
@@ -118,7 +118,7 @@ compatibility-limited, the note says so.
 | Multipart | UploadPart | ✅ | ✅ | ✅ | ✅ | Includes size and part-number validation. |
 | Multipart | CompleteMultipartUpload | ✅ | ✅ | ✅ | ✅ | Includes ordering, ETag, and missing/incorrect part validation. |
 | Multipart | AbortMultipartUpload | ✅ | ✅ | ✅ | ✅ | Includes missing upload behavior. |
-| Multipart | ListMultipartUploads | ✅ | ✅ | ✅ | ✅ | s3ite supports prefix, delimiter, pagination, and owner fields. |
+| Multipart | ListMultipartUploads | ✅ | ✅ | ✅ | ✅ | s3ite supports prefix, delimiter, pagination, and owner fields. MinIO documents an exact-prefix limitation. |
 | Multipart | ListParts | ✅ | ✅ | ✅ | ✅ | s3ite supports pagination and ETags. |
 | Multipart | UploadPartCopy | ✅ | ✅ | ✅ | ✅ | Includes ranges, conditions, special names, and versions. |
 | Multipart | Multipart idempotent complete retry | ✅ | ✅ | ✅ | ✅ | s3ite records completion results for retries. |
@@ -165,7 +165,7 @@ compatibility-limited, the note says so.
 | Lifecycle | Storage-class transitions | ✅ | ✅ | ✅ | ❌ | Out of scope for s3ite. |
 | Lifecycle | RestoreObject from archive/tier | ✅ | ✅ | ✅ | ❌ | MinIO lists `RestoreObject`; s3ite has no restore/tiering. |
 | Lifecycle | Restore status in list outputs | ✅ | ✅ | ✅ | ❌ | Out of scope for s3ite. |
-| CORS | Bucket CORS API | ✅ | ✅ | ❌ | ✅ | s3ite stores per-bucket CORS rules in each bucket DB; MinIO documents bucket CORS APIs as unsupported because CORS is enabled by default. |
+| CORS | Bucket CORS API | ✅ | ✅ | ✅ | ✅ | s3ite stores per-bucket CORS rules in each bucket DB; current MinIO docs list `PutBucketCors` and `DeleteBucketCors`. |
 | CORS | CORS preflight behavior | ✅ | ✅ | ✅ | ✅ | s3ite applies bucket CORS first and falls back to configurable server-level CORS when no bucket config exists. |
 | POST | POST Object form uploads | ✅ | ✅ | ✅ | ✅ | Browser form uploads reuse the normal object write path. |
 | POST | POST Object policy validation | ✅ | ✅ | ✅ | ✅ | SigV4 POST policy validation is handled by `s3s`. |
@@ -184,7 +184,7 @@ compatibility-limited, the note says so.
 | Logging | S3 server access logging | ✅ | ✅ | ❌ | ❌ | MinIO documents bucket logging APIs as unsupported; s3ite has application logs only. |
 | Website | Static website bucket configuration | ❌ | ✅ | ❌ | ❌ | MinIO documents website APIs as unsupported. |
 | Inventory | Bucket inventory configuration | ❌ | ✅ | ❌ | ❌ | MinIO documents inventory APIs as unsupported. |
-| Analytics | Bucket analytics configuration | ❌ | ✅ | ❌ | ❌ | MinIO documents analytics APIs as unsupported. |
+| Analytics | Bucket analytics configuration | ❌ | ✅ | ❌ | ❌ | MinIO documents some analytics operations but still lists `GetBucketAnalyticsConfiguration` as unsupported, so full configuration parity is not present. |
 | Metrics | Bucket metrics configuration | ❌ | ✅ | ❌ | ❌ | MinIO documents metrics APIs as unsupported. |
 | Accelerate | Bucket accelerate configuration | ❌ | ✅ | ❌ | ❌ | MinIO documents accelerate APIs as unsupported. |
 | Storage class | STANDARD storage-class reporting | ✅ | ✅ | ✅ | ✅ | s3ite reports `STANDARD` in list/object-attribute shapes. |

src/s3/get.rs

@@ -234,6 +234,7 @@ fn response_checksum(
     }
 }
 
+/// Formats lifecycle expiration metadata for object read response headers.
 fn lifecycle_expiration_response_header(
     expiration: Option<LifecycleExpirationHeader>,
 ) -> S3Result<Option<String>> {
@@ -242,6 +243,7 @@ fn lifecycle_expiration_response_header(
         .transpose()
 }
 
+/// Loads the current or exact-version body reference for a `GetObject` read.
 fn load_object_body_reference(
     transaction: &rusqlite::Transaction<'_>,
     key: &str,
@@ -256,6 +258,7 @@ fn load_object_body_reference(
     })
 }
 
+/// Resolves range, part, and lifecycle metadata for a found object body.
 fn load_object_body_read_found(
     transaction: &rusqlite::Transaction<'_>,
     key: &str,
@@ -292,6 +295,7 @@ fn load_object_body_read_found(
     })
 }
 
+/// Decrypts encrypted object chunks when a body read needs plaintext slicing.
 fn decrypt_object_body_if_needed(
     transaction: &rusqlite::Transaction<'_>,
     object: &ObjectBodyReference,

src/s3/multipart.rs

@@ -701,6 +701,7 @@ async fn upload_part_copy_cross_bucket(
         .map_err(s3_error_from_sqlite)
 }
 
+/// Maps one storage multipart upload summary into the S3 listing DTO.
 fn multipart_upload_from_summary(
     summary: crate::sqlite::MultipartUploadSummary,
     encode_keys: bool,
@@ -719,6 +720,7 @@ fn multipart_upload_from_summary(
     }
 }
 
+/// Splits storage multipart listing entries into upload and common-prefix DTOs.
 fn multipart_upload_listing_entries(
     entries: Vec<MultipartUploadListEntry>,
     encode_keys: bool,
@@ -837,7 +839,7 @@ pub(super) async fn list_multipart_uploads(
     Ok(S3Response::new(output))
 }
 
-/// Creates multipart upload state for a future object.
+/// Validates that create-multipart ACL inputs are owner-equivalent no-ops.
 fn validate_create_multipart_upload_acl(input: &CreateMultipartUploadInput) -> S3Result<()> {
     validate_object_acl(&ObjectAclRequest {
         acl: input.acl.as_ref(),
@@ -854,6 +856,7 @@ fn validate_create_multipart_upload_acl(input: &CreateMultipartUploadInput) -> S
     })
 }
 
+/// Creates multipart upload state for a future object.
 pub(super) async fn create_multipart_upload(
     sqlite: &Sqlite,
     req: S3Request<CreateMultipartUploadInput>,
@@ -960,6 +963,7 @@ pub(super) async fn create_multipart_upload(
     Ok(S3Response::new(output))
 }
 
+/// Reads, encrypts, and stores one multipart upload part as encoded chunks.
 async fn upload_encrypted_part(
     sqlite: &Sqlite,
     context: UploadPartWriteContext,
@@ -1032,6 +1036,7 @@ async fn upload_encrypted_part(
     )))
 }
 
+/// Reads and stores one plain multipart upload part.
 async fn upload_plain_part(
     sqlite: &Sqlite,
     context: UploadPartWriteContext,
@@ -1099,6 +1104,7 @@ async fn upload_plain_part(
     )))
 }
 
+/// Loads active multipart upload state before an `UploadPart` body is consumed.
 async fn load_upload_part_state(
     sqlite: &Sqlite,
     bucket: &str,
@@ -1524,6 +1530,7 @@ async fn precompute_encrypted_full_object_checksum(
         .map_err(s3_error_from_sqlite)
 }
 
+/// Normalizes and validates the S3 complete-multipart request shape.
 fn normalize_multipart_completion_request(
     input: CompleteMultipartUploadInput,
     access_key: Option<String>,
@@ -1577,6 +1584,7 @@ fn normalize_multipart_completion_request(
     })
 }
 
+/// Precomputes completion checksums that require reading encrypted part bodies.
 async fn precompute_multipart_completion_checksum(
     sqlite: &Sqlite,
     request: &MultipartCompletionRequest,
@@ -1596,6 +1604,7 @@ async fn precompute_multipart_completion_checksum(
     .await
 }
 
+/// Prepares multipart completion against a read snapshot before the write.
 async fn prepare_multipart_completion(
     sqlite: &Sqlite,
     request: MultipartCompletionRequest,
@@ -1614,6 +1623,7 @@ async fn prepare_multipart_completion(
         .map_err(s3_error_from_sqlite)
 }
 
+/// Writes a prepared multipart completion or returns an idempotent retry result.
 async fn write_multipart_completion(
     sqlite: &Sqlite,
     bucket: &str,
@@ -1637,6 +1647,7 @@ async fn write_multipart_completion(
     }
 }
 
+/// Builds the S3 completion response from stored completion metadata.
 fn complete_multipart_upload_output(
     bucket: String,
     key: String,

src/s3/put.rs

@@ -125,6 +125,7 @@ fn validate_put_object_acl_input(input: &PutObjectInput) -> S3Result<()> {
     })
 }
 
+/// Returns whether the request explicitly asks for SSE-S3 encryption.
 fn requested_put_object_sse_s3(input: &PutObjectInput) -> S3Result<bool> {
     requested_sse_s3(
         input.server_side_encryption.as_ref(),
@@ -158,6 +159,7 @@ fn put_object_output(
     }
 }
 
+/// Reads, encrypts, and writes a `PutObject` body as encoded encrypted chunks.
 async fn put_encrypted_object(
     sqlite: &Sqlite,
     body: StreamingBlob,
@@ -238,6 +240,7 @@ async fn put_encrypted_object(
     ))
 }
 
+/// Reads and writes a plain buffered `PutObject` body.
 async fn put_plain_object(
     sqlite: &Sqlite,
     body: StreamingBlob,
@@ -312,6 +315,7 @@ async fn put_plain_object(
     ))
 }
 
+/// Dispatches a normalized object write to the encrypted or plain storage path.
 async fn write_put_object(
     sqlite: &Sqlite,
     body: StreamingBlob,

src/sqlite/list.rs

@@ -11,6 +11,7 @@ const OBJECT_ENTRY_KIND: i64 = 0;
 const COMMON_PREFIX_ENTRY_KIND: i64 = 1;
 
 impl ObjectVersionListEntry {
+    /// Returns the key/version pair used as the next listing marker.
     fn marker(&self) -> (&str, &str) {
         match self {
             Self::Object(summary) => (&summary.key, &summary.version_id),
@@ -89,6 +90,7 @@ fn object_version_marker_state(
     Ok((marker_kind, after_sequence))
 }
 
+/// Decodes one emitted object-version listing row from the storage query.
 fn object_version_entry_from_row(
     row: &rusqlite::Row<'_>,
 ) -> rusqlite::Result<ObjectVersionListEntry> {

src/sqlite/multipart.rs

@@ -54,6 +54,7 @@ impl<'a> From<&'a MultipartMetadata> for CompletionPartMetadata<'a> {
 }
 
 impl MultipartUploadListEntry {
+    /// Returns the key/upload pair used as the next multipart listing marker.
     fn marker(&self) -> (&str, Option<Uuid>) {
         match self {
             Self::Upload(summary) => (&summary.key, Some(summary.upload_id)),
@@ -101,6 +102,7 @@ fn multipart_upload_list_page(
     }
 }
 
+/// Decodes one emitted multipart-upload listing row from the storage query.
 fn multipart_upload_entry_from_row(
     row: &rusqlite::Row<'_>,
 ) -> rusqlite::Result<MultipartUploadListEntry> {