refactor: rm sts_config

Author: alukach

crates/core/src/config/static_file.rs

@@ -8,6 +8,7 @@ use crate::error::ProxyError;
 use crate::s3::response::BucketOwner;
 use crate::types::{BucketConfig, RoleConfig, StoredCredential};
 use serde::Deserialize;
+use std::collections::HashSet;
 use std::sync::Arc;
 
 /// Full configuration file structure.
@@ -25,6 +26,77 @@ pub struct StaticConfig {
     pub credentials: Vec<StoredCredential>,
 }
 
+impl StaticConfig {
+    /// Validate the configuration, collecting all errors into a single message.
+    ///
+    /// Checks for:
+    /// - Empty bucket names, role_ids, or credential access_key_ids
+    /// - Duplicate bucket names, role_ids, or access_key_ids
+    /// - Roles with empty `trusted_oidc_issuers` (would never accept a token)
+    /// - `allowed_roles` referencing unknown role_ids (warning only, roles may come from a separate STS config)
+    pub fn validate(&self) -> Result<(), ProxyError> {
+        let mut errors = Vec::new();
+
+        // Check buckets
+        let mut bucket_names = HashSet::new();
+        for (i, bucket) in self.buckets.iter().enumerate() {
+            if bucket.name.is_empty() {
+                errors.push(format!("bucket[{}] has an empty name", i));
+            } else if !bucket_names.insert(&bucket.name) {
+                errors.push(format!("duplicate bucket name: {:?}", bucket.name));
+            }
+        }
+
+        // Check roles
+        let mut role_ids = HashSet::new();
+        for (i, role) in self.roles.iter().enumerate() {
+            if role.role_id.is_empty() {
+                errors.push(format!("role[{}] has an empty role_id", i));
+            } else if !role_ids.insert(&role.role_id) {
+                errors.push(format!("duplicate role_id: {:?}", role.role_id));
+            }
+            if role.trusted_oidc_issuers.is_empty() {
+                errors.push(format!(
+                    "role {:?} has no trusted_oidc_issuers (will never accept a token)",
+                    role.role_id
+                ));
+            }
+        }
+
+        // Check credentials
+        let mut access_key_ids = HashSet::new();
+        for (i, cred) in self.credentials.iter().enumerate() {
+            if cred.access_key_id.is_empty() {
+                errors.push(format!("credential[{}] has an empty access_key_id", i));
+            } else if !access_key_ids.insert(&cred.access_key_id) {
+                errors.push(format!(
+                    "duplicate credential access_key_id: {:?}",
+                    cred.access_key_id
+                ));
+            }
+        }
+
+        // Warn about allowed_roles referencing unknown role_ids
+        for bucket in &self.buckets {
+            for role_ref in &bucket.allowed_roles {
+                if !role_ids.contains(role_ref) {
+                    tracing::warn!(
+                        bucket = %bucket.name,
+                        role = %role_ref,
+                        "allowed_roles references unknown role_id (may be defined in a separate STS config)"
+                    );
+                }
+            }
+        }
+
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(ProxyError::ConfigError(errors.join("; ")))
+        }
+    }
+}
+
 /// Configuration provider backed by a static TOML/JSON file.
 ///
 /// # Example
@@ -45,11 +117,12 @@ pub struct StaticConfig {
 ///     secret_access_key = "..."
 /// "#)?;
 /// ```
-#[derive(Clone)]
+#[derive(Clone, Debug)]
 pub struct StaticProvider {
     inner: Arc<StaticProviderInner>,
 }
 
+#[derive(Debug)]
 struct StaticProviderInner {
     config: StaticConfig,
 }
@@ -59,14 +132,14 @@ impl StaticProvider {
     pub fn from_toml(toml_str: &str) -> Result<Self, ProxyError> {
         let config: StaticConfig =
             toml::from_str(toml_str).map_err(|e| ProxyError::ConfigError(e.to_string()))?;
-        Ok(Self::from_config(config))
+        Self::from_config(config)
     }
 
     /// Parse a JSON string into a provider.
     pub fn from_json(json_str: &str) -> Result<Self, ProxyError> {
         let config: StaticConfig =
             serde_json::from_str(json_str).map_err(|e| ProxyError::ConfigError(e.to_string()))?;
-        Ok(Self::from_config(config))
+        Self::from_config(config)
     }
 
     /// Read and parse a TOML file.
@@ -80,10 +153,11 @@ impl StaticProvider {
         }
     }
 
-    pub fn from_config(config: StaticConfig) -> Self {
-        Self {
+    pub fn from_config(config: StaticConfig) -> Result<Self, ProxyError> {
+        config.validate()?;
+        Ok(Self {
             inner: Arc::new(StaticProviderInner { config }),
-        }
+        })
     }
 }
 
@@ -143,3 +217,164 @@ impl ConfigProvider for StaticProvider {
             .cloned())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn valid_config() -> StaticConfig {
+        StaticConfig {
+            owner_id: None,
+            owner_display_name: None,
+            buckets: vec![BucketConfig {
+                name: "my-bucket".into(),
+                backend_type: "s3".into(),
+                backend_prefix: None,
+                anonymous_access: true,
+                allowed_roles: vec![],
+                backend_options: Default::default(),
+            }],
+            roles: vec![RoleConfig {
+                role_id: "my-role".into(),
+                name: "My Role".into(),
+                trusted_oidc_issuers: vec!["https://issuer.example.com".into()],
+                required_audience: None,
+                subject_conditions: vec![],
+                allowed_scopes: vec![],
+                max_session_duration_secs: 3600,
+            }],
+            credentials: vec![StoredCredential {
+                access_key_id: "AKID1".into(),
+                secret_access_key: "secret".into(),
+                principal_name: "user".into(),
+                allowed_scopes: vec![],
+                created_at: chrono::Utc::now(),
+                expires_at: None,
+                enabled: true,
+            }],
+        }
+    }
+
+    #[test]
+    fn test_valid_config_passes_validation() {
+        valid_config().validate().unwrap();
+    }
+
+    #[test]
+    fn test_empty_config_passes_validation() {
+        let config = StaticConfig {
+            owner_id: None,
+            owner_display_name: None,
+            buckets: vec![],
+            roles: vec![],
+            credentials: vec![],
+        };
+        config.validate().unwrap();
+    }
+
+    #[test]
+    fn test_empty_bucket_name() {
+        let mut config = valid_config();
+        config.buckets[0].name = "".into();
+        let err = config.validate().unwrap_err().to_string();
+        assert!(err.contains("bucket[0] has an empty name"), "{}", err);
+    }
+
+    #[test]
+    fn test_duplicate_bucket_names() {
+        let mut config = valid_config();
+        config.buckets.push(config.buckets[0].clone());
+        let err = config.validate().unwrap_err().to_string();
+        assert!(err.contains("duplicate bucket name"), "{}", err);
+    }
+
+    #[test]
+    fn test_empty_role_id() {
+        let mut config = valid_config();
+        config.roles[0].role_id = "".into();
+        let err = config.validate().unwrap_err().to_string();
+        assert!(err.contains("role[0] has an empty role_id"), "{}", err);
+    }
+
+    #[test]
+    fn test_duplicate_role_ids() {
+        let mut config = valid_config();
+        config.roles.push(config.roles[0].clone());
+        let err = config.validate().unwrap_err().to_string();
+        assert!(err.contains("duplicate role_id"), "{}", err);
+    }
+
+    #[test]
+    fn test_empty_trusted_oidc_issuers() {
+        let mut config = valid_config();
+        config.roles[0].trusted_oidc_issuers.clear();
+        let err = config.validate().unwrap_err().to_string();
+        assert!(err.contains("no trusted_oidc_issuers"), "{}", err);
+    }
+
+    #[test]
+    fn test_empty_access_key_id() {
+        let mut config = valid_config();
+        config.credentials[0].access_key_id = "".into();
+        let err = config.validate().unwrap_err().to_string();
+        assert!(
+            err.contains("credential[0] has an empty access_key_id"),
+            "{}",
+            err
+        );
+    }
+
+    #[test]
+    fn test_duplicate_access_key_ids() {
+        let mut config = valid_config();
+        config.credentials.push(config.credentials[0].clone());
+        let err = config.validate().unwrap_err().to_string();
+        assert!(
+            err.contains("duplicate credential access_key_id"),
+            "{}",
+            err
+        );
+    }
+
+    #[test]
+    fn test_multiple_errors_collected() {
+        let mut config = valid_config();
+        config.buckets[0].name = "".into();
+        config.roles[0].role_id = "".into();
+        config.credentials[0].access_key_id = "".into();
+        let err = config.validate().unwrap_err().to_string();
+        assert!(err.contains("bucket[0] has an empty name"), "{}", err);
+        assert!(err.contains("role[0] has an empty role_id"), "{}", err);
+        assert!(
+            err.contains("credential[0] has an empty access_key_id"),
+            "{}",
+            err
+        );
+    }
+
+    #[test]
+    fn test_from_config_runs_validation() {
+        let mut config = valid_config();
+        config.buckets[0].name = "".into();
+        assert!(StaticProvider::from_config(config).is_err());
+    }
+
+    #[test]
+    fn test_from_toml_runs_validation() {
+        let toml = r#"
+            [[roles]]
+            role_id = "bad-role"
+            name = "Bad"
+            max_session_duration_secs = 3600
+        "#;
+        let err = StaticProvider::from_toml(toml).unwrap_err().to_string();
+        assert!(err.contains("no trusted_oidc_issuers"), "{}", err);
+    }
+
+    #[test]
+    fn test_from_json_runs_validation() {
+        let json = r#"{"roles": [{"role_id": "bad-role", "name": "Bad", "max_session_duration_secs": 3600}]}"#;
+        let err = StaticProvider::from_json(json).unwrap_err().to_string();
+        assert!(err.contains("no trusted_oidc_issuers"), "{}", err);
+    }
+}

examples/cf-workers/src/lib.rs

@@ -85,17 +85,14 @@ async fn fetch(req: web_sys::Request, env: Env, _ctx: Context) -> Result<web_sys
     // Build OIDC backend auth from env secrets/vars.
     let (oidc_auth, oidc_discovery) = load_oidc_auth(&env)?;
 
-    // Load STS config eagerly (config parsing is cheap).
-    let sts_config = load_sts_config(&env)?;
-
     let config = load_static_config(&env)?;
     let virtual_host_domain = env.var("VIRTUAL_HOST_DOMAIN").ok().map(|v| v.to_string());
-    let resolver = DefaultResolver::new(config, virtual_host_domain, token_key.clone());
+    let resolver = DefaultResolver::new(config.clone(), virtual_host_domain, token_key.clone());
 
     // Build the gateway with route handlers
     let mut gateway = Gateway::new(WorkerBackend, resolver)
         .with_oidc_auth(oidc_auth)
-        .with_route_handler(StsRouteHandler::new(sts_config, jwks_cache, token_key));
+        .with_route_handler(StsRouteHandler::new(config, jwks_cache, token_key));
     if let Some(discovery) = oidc_discovery {
         gateway = gateway.with_route_handler(discovery);
     }
@@ -302,7 +299,8 @@ fn load_config_from_env(env: &Env, var_name: &str) -> Result<StaticProvider> {
         let static_config: StaticConfig = env
             .object_var(var_name)
             .map_err(|e| worker::Error::RustError(format!("{} config error: {}", var_name, e)))?;
-        Ok(StaticProvider::from_config(static_config))
+        StaticProvider::from_config(static_config)
+            .map_err(|e| worker::Error::RustError(format!("{} config error: {}", var_name, e)))
     }
 }
 
@@ -322,11 +320,6 @@ fn load_token_key(env: &Env) -> Result<Option<TokenKey>> {
     }
 }
 
-/// Load STS config: tries STS_CONFIG first, falls back to PROXY_CONFIG.
-fn load_sts_config(env: &Env) -> Result<StaticProvider> {
-    load_config_from_env(env, "STS_CONFIG").or_else(|_| load_config_from_env(env, "PROXY_CONFIG"))
-}
-
 type OidcAuth = MaybeOidcAuth<FetchHttpExchange>;
 
 /// Load OIDC provider config from env secrets/vars.

examples/cf-workers/wrangler.toml

@@ -74,8 +74,7 @@ actions = [
 bucket = "private-uploads"
 prefixes = []
 
-[vars.STS_CONFIG]
-[[vars.STS_CONFIG.roles]]
+[[vars.PROXY_CONFIG.roles]]
 max_session_duration_secs = 3600
 name = "Example User"
 role_id = "example-user"
@@ -84,17 +83,17 @@ trusted_oidc_issuers = [
   "https://auth.example.com",
 ]
 
-[[vars.STS_CONFIG.roles.allowed_scopes]]
+[[vars.PROXY_CONFIG.roles.allowed_scopes]]
 actions = ["get_object", "head_object", "put_object", "list_bucket"]
 bucket = "{sub}"
 prefixes = []
 
-[[vars.STS_CONFIG.roles.allowed_scopes]]
+[[vars.PROXY_CONFIG.roles.allowed_scopes]]
 actions = ["get_object", "head_object", "put_object", "list_bucket"]
 bucket = "private-uploads"
 prefixes = []
 
-[[vars.STS_CONFIG.roles]]
+[[vars.PROXY_CONFIG.roles]]
 max_session_duration_secs = 3600
 name = "GitHub Actions"
 role_id = "github-actions"
@@ -103,12 +102,12 @@ trusted_oidc_issuers = [
   "https://token.actions.githubusercontent.com",
 ]
 
-[[vars.STS_CONFIG.roles.allowed_scopes]]
+[[vars.PROXY_CONFIG.roles.allowed_scopes]]
 actions = ["get_object", "head_object", "list_bucket"]
 bucket = "cholmes"
 prefixes = []
 
-[[vars.STS_CONFIG.roles]]
+[[vars.PROXY_CONFIG.roles]]
 max_session_duration_secs = 3600
 name = "GitHub Actions (No Access)"
 role_id = "github-actions-no-access"