feat(policy): add the s3files action namespace for AIStor Files

[0xMALVEE]

Description

Adds the s3files:* policy action class (FilesAction) for the AIStor Files management API: adding, removing and configuring NFS exports. It is granted independently of AIStor admin, so it gets its own namespace rather than joining admin:.

Action	Grants
s3files:CreateExport	add an export
s3files:DeleteExport	remove an export
s3files:UpdateExport	change an export's settings, such as its quota
s3files:SetExportAccess	set or clear which clients may mount it
s3files:GetExportStatus	list exports, read one's configuration and status
s3files:GetExportStats	read per-export and fleet statistics
s3files:*	all of the above

It follows the other service-action classes: constants, SupportedFilesActions, IsValid, and a condition-key map with the common keys. It is wired into the ActionType union, the action-type exclusivity check, and statement validation.

Files statements take no Resource or NotResource, and refuse one rather than ignore it. An export is named by the request, not by an ARN. If a Resource were silently ignored, an Allow that looks scoped to one export would grant every export. Refusing it now also keeps export-scoped ARNs open as a later, additive change: no existing policy can hold one whose meaning would shift.

SetExportAccess is separate from UpdateExport on purpose. Access rules decide which hosts may mount an export, so a grant to resize an export should not also open it to more clients.

No canned policy grants the namespace, consoleAdmin included. That can follow separately, as memory:* did in #269.

Motivation and Context

AIStor's Files admin API needs these actions to authorize each endpoint. Landing them here first lets AIStor and mc bump to a release that carries them.

How Has This Been Tested?

go test ./... for the whole module, -race and the noasm, purego and nounsafe tag variants for ./policy/, and go tool golangci-lint (0 issues). New tests in policy/files-action_test.go:

• every action is valid, a misspelled or partial-wildcard name is not, and each has a condition-key set;
• parsing, through both ParseConfig and ParseConfigStrict, accepts single actions, s3files:*, Deny, and a common condition key. It refuses mixing with s3: or admin:, any Resource or NotResource (including *), and a non-common condition key;
• evaluation: a policy granting only s3files:GetExportStatus allows that and denies the other five; s3files:* grants all six and no s3:, admin: or memory: action; s3:* plus admin:* grants none of them; an explicit Deny wins; aws:SourceIp is enforced;
• no default policy grants any Files action.

Mutation-checked: removing the Resource refusal, or the Files arm of the exclusivity check, each fails the tests.

Summary by CodeRabbit

• New Features
  • Added policy support for AIStor Files management actions, including export creation, deletion, updates, access control, status, and statistics.
  • Policies can grant individual Files actions or use a wildcard to cover all Files actions.
  • Files actions support condition-key validation and authorization checks. Files statements cannot specify resources, and Files permissions are not included in default policies.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 627d44cf-bd59-41e9-acd3-f2835766da80

📥 Commits

Reviewing files that changed from the base of the PR and between 704c2f8 and 1cd7d2f.

📒 Files selected for processing (5)

• policy/action-constraint.go
• policy/actionset.go
• policy/files-action.go
• policy/files-action_test.go
• policy/statement.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The policy package adds a Files action namespace, supports Files actions in action sets and policy statements, and adds tests for parsing, validation, authorization, and default-policy behavior.

Changes

Files policy actions

Layer / File(s)	Summary
Define Files action contract policy/files-action.go, policy/action-constraint.go, policy/actionset.go	Adds Files action constants, validity and condition-key maps, and action-set conversion and validation methods.
Validate Files policy statements policy/statement.go, policy/files-action_test.go	Recognizes Files as a separate action namespace. Validates Files actions and condition keys, rejects resource fields, and tests policy parsing and action registration.
Test Files authorization policy/files-action_test.go	Tests action-specific and wildcard grants, namespace isolation, explicit-deny precedence, IP conditions, and default-policy behavior.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: harshavardhana

Merge Risk: ⚪ Minimal · up to 1cd7d

This change adds a separate Files action namespace to policy validation and evaluation. No concrete defects were found, and default policies do not grant Files actions, so the merge risk is minimal.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 1cd7d

Existing default policies do not gain Files permissions, and ordinary Files grants preserve action separation, conditions, and explicit-deny precedence. No introduced security defect was established. Production enforcement remains uncertain because the management endpoints and their identity mapping are not available for review.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The new contract can authorize export creation, deletion, settings changes, client-access changes, status, and statistics without export-ARN scoping. Its maximum independently reachable tenant, service, and export scope depends on the unavailable enforcement caller; service-wide or cross-tenant exposure cannot be established from the library alone.

Security Findings and Attack Paths

• observed — Files-specific validation examines Action, not NotAction. A Files NotAction therefore follows generic resource validation and complement matching rather than the new Files rules. The base revision already accepted these strings and used the same matching behavior, so this is an inherited policy-language behavior, not an established PR-introduced attack path. Production exposure remains unresolved.

Trust Boundaries and Controls

• observed — The library evaluates conditions after action and resource matching and scans explicit Deny statements before Allow statements. Files tests encode deny precedence and SourceIp filtering. These controls require the caller to select the correct action, supply trustworthy condition values, and enforce the decision before reaching a management sink.

Hardening Proposals

• proposed — Before deploying the consuming API, establish endpoint-to-action enforcement with authenticated identity and tenant context, including proof that UpdateExport alone cannot change client-access rules. Explicitly document the intended Files NotAction semantics rather than assuming positive-action isolation applies to complement statements.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 12.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 5 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding the s3files action namespace for AIStor Files policy support.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each Files action,
And follows rules through policy validation.
Wildcards grant, but namespaces stay apart,
A deny still holds its careful part.
Then hops away beneath the moon’s soft light.}

_{Comment @coderabbitai help to get the list of available commands.}

[shtripat]

lgtm