kevinveenbirkenbachandClaude Opus 5 4a968bec1f test(seaweedfs): verify consumer uploads over the S3 API, not the filer UI ...

A consumer proved its upload by logging the administrator into the Filer UI in
a browser and walking its JSON listing. The filer moved into the optional
console role with the split, so that path depended on a role a node need not
deploy, and since the engine declares only the api canonical, the lookup for
the filer URL raised outright for every consumer with seaweedfs enabled.

The shared helper now lists the bucket through ListObjectsV2 on the engine,
signed with the consumer's own identity rather than the administrator's. That
drops the console dependency and the Keycloak round trip per check, and proves
the per-consumer identity in s3.json reaches its own bucket.

SigV4 for the browser side is hand-rolled on node:crypto; its vectors are the
ones the engine probe's Python signer is pinned to, and a test fails if the two
drift apart. The signer deliberately does not set Host: Playwright derives it
from the URL and that is the value signed.

isAuthChain moves to the keycloak helper, where it belongs; web-app-funkwhale
pulls it through the personas barrel.

Measured against SeaweedFS 4.47: ETag and LastModified are returned, nested
prefixes list flat and complete, an in-place overwrite changes the token while
an untouched object keeps it, and s3.js completes the round trip end to end.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-10-01 02:29:02 +02:00

..

roles

test(seaweedfs): verify consumer uploads over the S3 API, not the filer UI

2026-10-01 02:29:02 +02:00