rc_core/admin/
mod.rs

1//! Admin API module
2//!
3//! This module provides the AdminApi trait and types for managing
4//! IAM users, policies, groups, service accounts, and cluster operations.
5
6mod access_keys;
7mod bucket_metadata;
8mod capabilities;
9mod cluster;
10mod configuration;
11mod diagnostics;
12mod iam;
13mod inspect_archive;
14mod kms;
15mod kms_diagnostic;
16mod observability;
17mod oidc;
18mod replication;
19mod site;
20pub mod tier;
21mod types;
22
23pub use access_keys::{
24    AccessKeyKind, AccessKeyListType, AccessKeyProvider, AccessKeyRecord, BulkAccessKeyApi,
25    BulkAccessKeyQuery, IAM_ACCESS_KEYS_BULK_CAPABILITY, IAM_ACCESS_KEYS_BULK_LDAP_CAPABILITY,
26    IAM_ACCESS_KEYS_BULK_OPENID_CAPABILITY, MAX_IAM_ACCESS_KEY_RESULTS,
27    MAX_IAM_ACCESS_KEY_SELECTOR_BYTES, MAX_IAM_ACCESS_KEY_SELECTORS,
28    MAX_IAM_ACCESS_KEYS_RESPONSE_BYTES,
29};
30pub use bucket_metadata::{
31    BUCKET_METADATA_CAPABILITY, BucketMetadataApi, BucketMetadataArchive,
32    MAX_BUCKET_METADATA_ARCHIVE_BYTES,
33};
34pub use capabilities::{
35    CapabilityAvailability, CapabilityEntry, CapabilityReport, ClusterSnapshotMetadata,
36    ClusterSnapshotSummary, DiagnosticCapability, DiagnosticCapabilityGuardError,
37    ExtensionMetadata, ExtensionsCatalog, RuntimeCapabilitiesSnapshot, RuntimeCapabilitiesSummary,
38    RuntimeCapabilityState, RuntimeCapabilityStatus,
39};
40pub use cluster::{
41    BackendInfo, BackendType, BucketsInfo, ClusterInfo, DecommissionPoolStatus, DecommissionStatus,
42    DiskInfo, HealDriveInfo, HealDriveInfos, HealResultItem, HealRuntimeState, HealScanMode,
43    HealStartRequest, HealStatus, HealTaskRequest, HealingDiskInfo, MemStats, ObjectsInfo,
44    PoolDecommissionInfo, PoolErasureSetInfo, PoolStatus, PoolTarget, RebalanceCleanupWarnings,
45    RebalancePoolProgress, RebalancePoolStatus, RebalanceStartResult, RebalanceStatus, ServerInfo,
46    UsageInfo,
47};
48pub use configuration::{
49    ConfigApi, ConfigChange, ConfigDiff, ConfigDocument, ConfigHelp, ConfigHelpEntry,
50    ConfigHistoryEntry, ConfigMutationResult, ModuleSwitches, config_document_fields,
51    config_import_diff, config_mutation_diff, redact_config_document, validate_config_directive,
52    validate_config_import,
53};
54pub use diagnostics::{
55    ClientDevnullRequest, ClientDevnullResult, ClusterComponentSnapshot, ClusterComponentSnapshots,
56    ClusterListingSnapshot, ClusterSnapshotDocument, ClusterUsageSnapshot,
57    DEFAULT_CLIENT_DEVNULL_BYTES, DEFAULT_CLIENT_DEVNULL_CONCURRENCY,
58    DEFAULT_CLIENT_DEVNULL_TIMEOUT, DetailedHealthSnapshot, DiagnosticClusterSnapshot,
59    DiagnosticClusterSummary, DiagnosticReadApi, HealthCpuSnapshot, HealthDriveSnapshot,
60    HealthMemorySnapshot, HealthOsSnapshot, HealthProcessSnapshot,
61    MAX_CLIENT_DEVNULL_AGGREGATE_BYTES, MAX_CLIENT_DEVNULL_CONCURRENCY, MAX_CLIENT_DEVNULL_TIMEOUT,
62    MAX_DIAGNOSTIC_RESPONSE_BYTES,
63};
64pub use iam::{
65    GroupPolicyEntities, IAM_POLICY_DETACH_CAPABILITY, IAM_POLICY_ENTITIES_CAPABILITY,
66    IamArchiveApi, IamArchiveImportResult, IamArchiveImportSection, IamArchiveInventory,
67    IamArchiveResultEntities, IamMutationApi, IamReadApi, MAX_IAM_ARCHIVE_BYTES,
68    MAX_IAM_IMPORT_RESPONSE_BYTES, MAX_IAM_POLICY_DETACH_POLICIES,
69    MAX_IAM_POLICY_DETACH_REQUEST_BYTES, MAX_IAM_POLICY_DETACH_RESPONSE_BYTES,
70    MAX_IAM_POLICY_DETACH_SELECTOR_BYTES, MAX_IAM_POLICY_ENTITIES_RESPONSE_BYTES,
71    MAX_IAM_POLICY_ENTITY_SELECTOR_BYTES, MAX_IAM_POLICY_ENTITY_SELECTORS, PolicyDetachEntity,
72    PolicyDetachRequest, PolicyDetachResult, PolicyEntities, PolicyEntitiesQuery,
73    PolicyEntitiesResult, UserPolicyEntities,
74};
75pub use inspect_archive::{
76    EncryptedInspectArchive, INSPECT_ARCHIVE_CAPABILITY, INSPECT_ARCHIVE_COMPLETION,
77    INSPECT_ARCHIVE_CONTENT_TYPE, INSPECT_ARCHIVE_ENCRYPTION, INSPECT_ARCHIVE_ROUTE,
78    INSPECT_ARCHIVE_VERSION, InspectArchiveApi, InspectArchiveCancellation,
79    InspectArchiveCapabilityContract, InspectArchiveKey, InspectArchiveManifest,
80    InspectArchiveTransportRequest, MAX_INSPECT_ARCHIVE_BYTES, MAX_INSPECT_ARCHIVE_DURATION,
81    MAX_INSPECT_ARCHIVE_METADATA_BYTES_PER_DRIVE, PublishedInspectArchive, VerifiedInspectArchive,
82    decrypt_and_validate_inspect_archive, decrypt_and_validate_inspect_archive_with_cancel,
83    publish_inspect_archive, validate_inspect_archive_output_directory,
84};
85pub use kms::{
86    KmsApi, KmsBackendKind, KmsCacheSummary, KmsCancelKeyDeletionResult, KmsConfigSummary,
87    KmsConfigureRequest, KmsCreateKeyRequest, KmsCreateKeyResult, KmsDeleteKeyRequest,
88    KmsDeleteKeyResult, KmsKey, KmsKeyPage, KmsKeyState, KmsKeyUsage, KmsLocalConfigureRequest,
89    KmsServiceState, KmsStatus, KmsVaultAuthMethod, KmsVaultKv2ConfigureRequest,
90    KmsVaultTransitConfigureRequest,
91};
92pub use kms_diagnostic::{
93    KMS_DIAGNOSTIC_CONTENT_BYTES, KmsDiagnosticStore, KmsRoundTripError, KmsRoundTripErrorClass,
94    KmsRoundTripPhase, KmsRoundTripReport, KmsRoundTripTimings, run_kms_round_trip,
95};
96pub use observability::{
97    MAX_METRICS_LINE_BYTES, MAX_METRICS_RESPONSE_BYTES, MAX_METRICS_SAMPLES, MetricGroup,
98    MetricGroups, MetricsBatch, MetricsQuery, MetricsScope, ObservabilityApi, RealtimeMetrics,
99    ScannerCycleSchedule, ScannerFreshness, ScannerHealth, ScannerMetrics, ScannerRuntimeConfig,
100    ScannerRuntimeConfigValue, ScannerStatus, StorageBackend, StorageBackendKind, StorageDisk,
101    StorageDiskMetrics, StorageInfo,
102};
103pub use oidc::{
104    MAX_OIDC_RESPONSE_BYTES, OidcMutationApi, OidcMutationRequest, OidcMutationResult,
105    OidcProvider, OidcProviderList, OidcProviderSource, OidcReadApi, OidcValidationRequest,
106    OidcValidationResult,
107};
108pub use replication::{
109    MAX_REPLICATION_DIFF_RESPONSE_BYTES, MAX_REPLICATION_INSPECTION_RESPONSE_BYTES,
110    ReplicationCountSize, ReplicationDiff, ReplicationDiffApi, ReplicationDiffEntry,
111    ReplicationInspectionApi, ReplicationLatencyMetric, ReplicationMetricScope, ReplicationMetrics,
112    ReplicationMrf, ReplicationMrfTarget, ReplicationQueueMetric, ReplicationTargetMetric,
113    ReplicationTransferRate,
114};
115pub use site::{
116    MAX_SITE_REPLICATION_CA_CERT_BYTES, MAX_SITE_REPLICATION_ERROR_RESPONSE_BYTES,
117    MAX_SITE_REPLICATION_REPAIR_RESPONSE_BYTES, MAX_SITE_REPLICATION_REQUEST_BYTES,
118    MAX_SITE_REPLICATION_SUCCESS_RESPONSE_BYTES, PeerSiteSpec, ReplicateEditStatus,
119    SITE_REPLICATION_REPAIR_CAPABILITY, ServiceActionResult, SiteRemoveSpec, SiteReplicationInfo,
120    SiteReplicationPeer, SiteReplicationRepairApi, SiteReplicationRepairCapabilityContract,
121    SiteReplicationRepairFamilyStatus, SiteReplicationRepairOperationStatus,
122    SiteReplicationRepairPreflight, SiteReplicationRepairRequest, SiteReplicationRepairSiteStatus,
123    SiteReplicationRepairTaskStatus, SiteReplicationResyncBucketStatus,
124    SiteReplicationResyncOperation, SiteReplicationResyncStatus, SiteStatusOptions,
125    validate_site_replication_ca_bundle, validate_site_replication_repair_operation_id,
126    validate_site_replication_repair_token,
127};
128pub use tier::{
129    ManualTransitionRunReport, ManualTransitionRunRequest, ManualTransitionRunResponse, TierAliyun,
130    TierAzure, TierConfig, TierCreds, TierGCS, TierHuaweicloud, TierMinIO, TierR2, TierRustFS,
131    TierS3, TierTencent, TierType,
132};
133pub use types::{
134    AccessKeyDetails, AccessKeyInfo, BucketQuota, CreateServiceAccountRequest, Group, GroupStatus,
135    LdapAccessKeyInfo, OpenIdAccessKeyInfo, Policy, PolicyEntity, PolicyInfo, ServiceAccount,
136    ServiceAccountCreateResponse, ServiceAccountCredentials, SetPolicyRequest,
137    UpdateGroupMembersRequest, UpdateServiceAccountRequest, User, UserStatus,
138};
139
140use async_trait::async_trait;
141
142use crate::error::Result;
143
144/// Admin API trait for IAM and cluster management operations
145///
146/// This trait defines the interface for managing users, policies, groups,
147/// service accounts, and cluster operations on S3-compatible storage systems
148/// that support the RustFS Admin API.
149#[async_trait]
150pub trait AdminApi: Send + Sync {
151    // ==================== Cluster Operations ====================
152
153    /// Get cluster information including servers, disks, and usage
154    async fn cluster_info(&self) -> Result<ClusterInfo>;
155
156    /// Get current heal status
157    async fn heal_status(&self) -> Result<HealStatus>;
158
159    /// Start a heal operation
160    async fn heal_start(&self, request: HealStartRequest) -> Result<HealStatus>;
161
162    /// Get status for a token-scoped heal task
163    async fn heal_task_status(&self, request: HealTaskRequest) -> Result<HealStatus>;
164
165    /// Stop a running heal operation
166    async fn heal_stop(&self) -> Result<()>;
167
168    /// Stop a token-scoped heal task
169    async fn heal_task_stop(&self, request: HealTaskRequest) -> Result<HealStatus>;
170
171    /// List storage pools
172    async fn list_pools(&self) -> Result<Vec<PoolStatus>>;
173
174    /// Get storage pool status
175    async fn pool_status(&self, target: PoolTarget) -> Result<PoolStatus>;
176
177    /// Start decommissioning one or more storage pools
178    async fn decommission_start(&self, target: PoolTarget) -> Result<()>;
179
180    /// Cancel decommissioning a storage pool
181    async fn decommission_cancel(&self, target: PoolTarget) -> Result<()>;
182
183    /// Clear failed or canceled decommissioning metadata for a storage pool
184    async fn decommission_clear(&self, target: PoolTarget) -> Result<()>;
185
186    /// Get decommissioning status
187    async fn decommission_status(&self, target: Option<PoolTarget>) -> Result<DecommissionStatus>;
188
189    /// Start a rebalance operation
190    async fn rebalance_start(&self) -> Result<RebalanceStartResult>;
191
192    /// Get rebalance status
193    async fn rebalance_status(&self) -> Result<RebalanceStatus>;
194
195    /// Stop a running rebalance operation
196    async fn rebalance_stop(&self) -> Result<()>;
197
198    // ==================== User Operations ====================
199
200    /// List all users
201    async fn list_users(&self) -> Result<Vec<User>>;
202
203    /// Get user information
204    async fn get_user(&self, access_key: &str) -> Result<User>;
205
206    /// Create a new user
207    async fn create_user(&self, access_key: &str, secret_key: &str) -> Result<User>;
208
209    /// Delete a user
210    async fn delete_user(&self, access_key: &str) -> Result<()>;
211
212    /// Set user status (enable/disable)
213    async fn set_user_status(&self, access_key: &str, status: UserStatus) -> Result<()>;
214
215    // ==================== Policy Operations ====================
216
217    /// List all policies
218    async fn list_policies(&self) -> Result<Vec<PolicyInfo>>;
219
220    /// Get policy information
221    async fn get_policy(&self, name: &str) -> Result<Policy>;
222
223    /// Create a new policy
224    async fn create_policy(&self, name: &str, policy_document: &str) -> Result<()>;
225
226    /// Delete a policy
227    async fn delete_policy(&self, name: &str) -> Result<()>;
228
229    /// Attach policy to a user or group
230    async fn attach_policy(
231        &self,
232        policy_names: &[String],
233        entity_type: PolicyEntity,
234        entity_name: &str,
235    ) -> Result<()>;
236
237    /// Detach policy from a user or group
238    async fn detach_policy(
239        &self,
240        policy_names: &[String],
241        entity_type: PolicyEntity,
242        entity_name: &str,
243    ) -> Result<()>;
244
245    // ==================== Group Operations ====================
246
247    /// List all groups
248    async fn list_groups(&self) -> Result<Vec<String>>;
249
250    /// Get group information
251    async fn get_group(&self, name: &str) -> Result<Group>;
252
253    /// Create a new group
254    async fn create_group(&self, name: &str, members: Option<&[String]>) -> Result<Group>;
255
256    /// Delete a group
257    async fn delete_group(&self, name: &str) -> Result<()>;
258
259    /// Set group status (enable/disable)
260    async fn set_group_status(&self, name: &str, status: GroupStatus) -> Result<()>;
261
262    /// Add members to a group
263    async fn add_group_members(&self, group: &str, members: &[String]) -> Result<()>;
264
265    /// Remove members from a group
266    async fn remove_group_members(&self, group: &str, members: &[String]) -> Result<()>;
267
268    // ==================== Service Account Operations ====================
269
270    /// List service accounts for a user
271    async fn list_service_accounts(&self, user: Option<&str>) -> Result<Vec<ServiceAccount>>;
272
273    /// Get service account information
274    async fn get_service_account(&self, access_key: &str) -> Result<ServiceAccount>;
275
276    /// Create a new service account
277    async fn create_service_account(
278        &self,
279        request: CreateServiceAccountRequest,
280    ) -> Result<ServiceAccount>;
281
282    /// Update an existing service account
283    async fn update_service_account(
284        &self,
285        access_key: &str,
286        request: UpdateServiceAccountRequest,
287    ) -> Result<()>;
288
289    /// Delete a service account
290    async fn delete_service_account(&self, access_key: &str) -> Result<()>;
291
292    /// Get information for any access key type.
293    async fn get_access_key_info(&self, access_key: &str) -> Result<AccessKeyInfo>;
294
295    // ==================== Bucket Quota Operations ====================
296
297    /// Set bucket quota in bytes
298    async fn set_bucket_quota(&self, bucket: &str, quota: u64) -> Result<BucketQuota>;
299
300    /// Get bucket quota information
301    async fn get_bucket_quota(&self, bucket: &str) -> Result<BucketQuota>;
302
303    /// Clear bucket quota
304    async fn clear_bucket_quota(&self, bucket: &str) -> Result<BucketQuota>;
305
306    // ==================== Tier Operations ====================
307
308    /// List all configured storage tiers
309    async fn list_tiers(&self) -> Result<Vec<TierConfig>>;
310
311    /// Get tier statistics
312    async fn tier_stats(&self) -> Result<serde_json::Value>;
313
314    /// Add a new storage tier
315    async fn add_tier(&self, config: TierConfig) -> Result<()>;
316
317    /// Edit tier credentials
318    async fn edit_tier(&self, name: &str, creds: TierCreds) -> Result<()>;
319
320    /// Remove a storage tier
321    async fn remove_tier(&self, name: &str, force: bool) -> Result<()>;
322
323    /// Run bounded manual lifecycle transition evaluation for a bucket scope.
324    async fn run_manual_transition(
325        &self,
326        request: ManualTransitionRunRequest,
327    ) -> Result<ManualTransitionRunResponse>;
328
329    // ==================== Replication Target Operations ====================
330
331    /// Set a remote replication target for a bucket, returns the ARN
332    async fn set_remote_target(
333        &self,
334        bucket: &str,
335        target: crate::replication::BucketTarget,
336        update: bool,
337    ) -> Result<String>;
338
339    /// List remote replication targets for a bucket
340    async fn list_remote_targets(
341        &self,
342        bucket: &str,
343    ) -> Result<Vec<crate::replication::BucketTarget>>;
344
345    /// Remove a remote replication target
346    async fn remove_remote_target(&self, bucket: &str, arn: &str) -> Result<()>;
347
348    // ==================== Service Control Operations ====================
349
350    /// Request a service action (restart, stop, freeze, unfreeze)
351    async fn service_action(&self, action: &str) -> Result<ServiceActionResult>;
352
353    // ==================== Site Replication Operations ====================
354
355    /// Get current site replication configuration
356    async fn site_replication_info(&self) -> Result<SiteReplicationInfo>;
357
358    /// Edit a peer using a complete read-modify-write snapshot
359    async fn site_replication_edit(
360        &self,
361        peer: &SiteReplicationPeer,
362    ) -> Result<ReplicateEditStatus>;
363
364    /// Start, inspect, or cancel a resync toward one complete peer snapshot
365    async fn site_replication_resync(
366        &self,
367        operation: SiteReplicationResyncOperation,
368        peer: &SiteReplicationPeer,
369    ) -> Result<SiteReplicationResyncStatus>;
370
371    /// Add peer sites to the site replication cluster
372    async fn site_replication_add(&self, sites: &[PeerSiteSpec]) -> Result<serde_json::Value>;
373
374    /// Get site replication status
375    async fn site_replication_status(
376        &self,
377        options: &SiteStatusOptions,
378    ) -> Result<serde_json::Value>;
379
380    /// Remove sites from the site replication cluster
381    async fn site_replication_remove(&self, spec: &SiteRemoveSpec) -> Result<serde_json::Value>;
382}
383
384/// Read-only RustFS runtime capability discovery.
385#[async_trait]
386pub trait CapabilityApi: Send + Sync {
387    /// Discover capabilities, bypassing the process cache when `refresh` is true.
388    async fn discover_capabilities(&self, refresh: bool) -> Result<CapabilityReport>;
389}
390
391/// Bounded active RustFS diagnostic probes.
392#[async_trait]
393pub trait DiagnosticApi: CapabilityApi {
394    /// Measure client-to-server upload throughput without persisting an object.
395    async fn client_devnull(&self, request: ClientDevnullRequest) -> Result<ClientDevnullResult>;
396}
397
398#[cfg(test)]
399mod tests {
400    use super::*;
401
402    // Test that types are re-exported correctly
403    #[test]
404    fn test_user_status_reexport() {
405        assert_eq!(UserStatus::Enabled.to_string(), "enabled");
406        assert_eq!(UserStatus::Disabled.to_string(), "disabled");
407    }
408
409    #[test]
410    fn test_group_status_reexport() {
411        assert_eq!(GroupStatus::Enabled.to_string(), "enabled");
412        assert_eq!(GroupStatus::Disabled.to_string(), "disabled");
413    }
414
415    #[test]
416    fn test_policy_entity_reexport() {
417        assert_eq!(PolicyEntity::User.to_string(), "user");
418        assert_eq!(PolicyEntity::Group.to_string(), "group");
419    }
420
421    #[test]
422    fn test_user_new() {
423        let user = User::new("testuser");
424        assert_eq!(user.access_key, "testuser");
425        assert_eq!(user.status, UserStatus::Enabled);
426    }
427
428    #[test]
429    fn test_group_new() {
430        let group = Group::new("developers");
431        assert_eq!(group.name, "developers");
432        assert_eq!(group.status, GroupStatus::Enabled);
433    }
434
435    #[test]
436    fn test_policy_new() {
437        let policy = Policy::new("readonly", r#"{"Version":"2012-10-17","Statement":[]}"#);
438        assert_eq!(policy.name, "readonly");
439        assert!(policy.parse_document().is_ok());
440    }
441
442    #[test]
443    fn test_service_account_new() {
444        let sa = ServiceAccount::new("AKIAIOSFODNN7EXAMPLE");
445        assert_eq!(sa.access_key, "AKIAIOSFODNN7EXAMPLE");
446        assert!(sa.secret_key.is_none());
447    }
448}
rc_core/admin/mod.rs

rc_core/admin/
mod.rs
