Hotfix storage API security with auth checks and policy updates - #1905

Open

ryoya-hayase wants to merge 19 commits into

RCOSDP:develop_v2.0.4from

ivis-weko3-dev:hotfix/s3-security

Commits on Aug 26, 2026

fix(weko-records-ui)!: add auth and permission checks to storage APIs

ivis-kuroda
and
claude
committed
83db3cd
fix(weko-records-ui)!: restrict public bucket policy to read-only

ivis-kuroda
and
claude
committed
ccc1222
fix(weko-records-ui)!: handle expired storage sessions

ivis-kuroda
and
claude
committed
c7a1a82
fix(invenio-files-rest): resolve storage locations by URI prefix

ivis-kuroda
and
claude
committed
da7aa4b

Commits on Aug 27, 2026

test(weko-records-ui): add storage API auth and permission tests

ivis-kuroda
and
claude
committed
08e8a79
test(weko-records-ui): update bucket policy tests for read-only access

ivis-kuroda
and
claude
committed
5b3fa11
test(invenio-files-rest): add pyfs storage factory location tests

ivis-kuroda
and
claude
committed
fbb1cc9
Merge branch 'hotfix/storage-api-permission' into hotfix/s3-security
ivis-kuroda
committed
ad91697
Merge branch 'hotfix/storage-bucket-policy' into hotfix/s3-security
ivis-kuroda
committed
513b8dd
Merge branch 'hotfix/storage-session-expiry' into hotfix/s3-security
ivis-kuroda
committed
91ce1c1
Merge branch 'hotfix/storage-location-lookup' into hotfix/s3-security
ivis-kuroda
committed
a757ff9
fix(tests): drop existing database before test
ivis-kuroda
committed
db3c2eb

Commits on Aug 28, 2026

fix(invenio-files-rest): require path boundary in location match

ivis-kuroda
and
claude
committed
344f672
fix(weko-records-ui): require pid on record-scoped storage APIs

ivis-kuroda
and
claude
committed
3031d62

Commits on Aug 29, 2026

Commits on Sep 1, 2026

refactor(weko-records-ui): drop checks duplicated by the decorator

ivis-kuroda
and
claude
committed
1c656af
test(weko-records-ui): consolidate similar tests with parametrize

ivis-kuroda
and
claude
committed
a5f7744
fix(weko-records-ui): validate the s3 replacement target unconditionally

ivis-kuroda
and
claude
committed
29e6fae