Send signatureVersion and authType unswapped to Vault checkPolicies by benzekrimaha · Pull Request #6239 · scality/cloudserver

benzekrimaha · 2026-07-29T16:58:21Z

Summary

multiObjectDelete swapped signatureVersion and authType when building the checkPolicies request context sent to Vault, so each field was validated and evaluated against the other's value. Found while investigating RD-1890 (Veeam DeleteObjects failures).

Issue: CLDSRV-963

multiObjectDelete assigned authType to signatureVersion and vice versa when building the checkPolicies request context, so Vault validated and evaluated each field against the wrong value. Issue: CLDSRV-963

Issue: CLDSRV-963

bert-e · 2026-07-29T16:58:25Z

Hello benzekrimaha,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request `TBA`
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2026-07-29T16:58:31Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-963 contains:

None

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

9.1.15
9.2.42
9.3.15
9.4.0

Please check the Fix Version/s of CLDSRV-963, or the target
branch of this pull request.

bert-e · 2026-07-30T06:17:37Z

Incorrect fix version

The Fix Version/s in issue CLDSRV-963 contains:

None

Considering where you are trying to merge, I ignored possible hotfix versions and I expected to find:

9.1.15
9.2.42
9.3.16
9.4.0

Please check the Fix Version/s of CLDSRV-963, or the target
branch of this pull request.

bert-e · 2026-07-31T08:25:25Z

Request integration branches

Waiting for integration branch creation to be requested by the user.

To request integration branches, please comment on this pull request with the following command:

/create_integration_branches

Alternatively, the /approve and /create_pull_requests commands will automatically
create the integration branches.

benzekrimaha · 2026-08-04T17:54:00Z

/create_integration_branches

bert-e · 2026-08-04T17:54:12Z

Conflict

A conflict has been raised during the creation of
integration branch w/9.2/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies with contents from improvement/CLDSRV-963-fix-swapped-auth-params-check-policies
and development/9.2.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 git fetch
 git checkout -B w/9.2/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies origin/development/9.2
 git merge origin/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies
 # <intense conflict resolution>
 git commit
 git push -u origin w/9.2/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies

The following options are set: create_integration_branches

benzekrimaha · 2026-08-04T18:04:38Z

Integration branch w/9.2 created manually with the conflict resolved (version bumped to 9.2.42).

bert-e · 2026-08-04T18:04:50Z

Conflict

A conflict has been raised during the creation of
integration branch w/9.3/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies with contents from w/9.2/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies
and development/9.3.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 git fetch
 git checkout -B w/9.3/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies origin/development/9.3
 git merge origin/w/9.2/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies
 # <intense conflict resolution>
 git commit
 git push -u origin w/9.3/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies

The following options are set: create_integration_branches

benzekrimaha · 2026-08-04T18:08:48Z

Integration branch w/9.3 created with the conflict resolved (version bumped to 9.3.16).

bert-e · 2026-08-04T18:09:01Z

Conflict

A conflict has been raised during the creation of
integration branch w/9.4/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies with contents from w/9.3/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies
and development/9.4.

I have not created the integration branch.

Here are the steps to resolve this conflict:

 git fetch
 git checkout -B w/9.4/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies origin/development/9.4
 git merge origin/w/9.3/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies
 # <intense conflict resolution>
 git commit
 git push -u origin w/9.4/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies

The following options are set: create_integration_branches

benzekrimaha · 2026-08-04T18:11:13Z

Integration branch w/9.4 created with the conflict resolved (version bumped to 9.4.0-preview.7).

bert-e · 2026-08-04T18:11:27Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_integration_branches

benzekrimaha · 2026-08-04T18:22:30Z

/create_pull_requests

bert-e · 2026-08-04T18:22:48Z

Integration data created

I have created the integration data for the additional destination branches.

this pull request will merge improvement/CLDSRV-963-fix-swapped-auth-params-check-policies into
development/9.1
w/9.2/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies will be merged into development/9.2 (pull request INTEGRATION [PR#6239 > development/9.2] Send signatureVersion and authType unswapped to Vault checkPolicies #6244)
w/9.3/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies will be merged into development/9.3 (pull request INTEGRATION [PR#6239 > development/9.3] Send signatureVersion and authType unswapped to Vault checkPolicies #6245)
w/9.4/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies will be merged into development/9.4 (pull request INTEGRATION [PR#6239 > development/9.4] Send signatureVersion and authType unswapped to Vault checkPolicies #6246)

The following branches will NOT be impacted:

development/7.10
development/7.4
development/7.70
development/8.8
development/9.0

Follow integration pull requests if you would like to be notified of
build statuses by email.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2026-08-04T18:22:49Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2026-08-04T18:45:59Z

History mismatch

Merge commit #21a5ae9515c392527f62171b0fc879038716f81f on the integration branch
w/9.4/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies is merging a branch which is neither the current
branch improvement/CLDSRV-963-fix-swapped-auth-params-check-policies nor the development branch
development/9.4.

It is likely due to a rebase of the branch improvement/CLDSRV-963-fix-swapped-auth-params-check-policies and the
merge is not possible until all related w/* branches are deleted or updated.

Please use the reset command to have me reinitialize these branches.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2026-08-04T18:46:43Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2026-08-04T18:49:46Z

History mismatch

Merge commit #39a5e96319a9a84100c04d190fd86af62dcd7d07 on the integration branch
w/9.4/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies is merging a branch which is neither the current
branch improvement/CLDSRV-963-fix-swapped-auth-params-check-policies nor the development branch
development/9.4.

It is likely due to a rebase of the branch improvement/CLDSRV-963-fix-swapped-auth-params-check-policies and the
merge is not possible until all related w/* branches are deleted or updated.

Please use the reset command to have me reinitialize these branches.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2026-08-04T18:50:16Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2026-08-04T18:52:38Z

History mismatch

Merge commit #3d83c119356101dccbbdea05430e9ba476fce84a on the integration branch
w/9.4/improvement/CLDSRV-963-fix-swapped-auth-params-check-policies is merging a branch which is neither the current
branch improvement/CLDSRV-963-fix-swapped-auth-params-check-policies nor the development branch
development/9.4.

It is likely due to a rebase of the branch improvement/CLDSRV-963-fix-swapped-auth-params-check-policies and the
merge is not possible until all related w/* branches are deleted or updated.

Please use the reset command to have me reinitialize these branches.

The following options are set: create_pull_requests, create_integration_branches

bert-e · 2026-08-04T18:53:32Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

Issue: CLDSRV-963

codecov · 2026-08-05T08:54:31Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.97%. Comparing base (dbedc1f) to head (0f2f742).
⚠️ Report is 5 commits behind head on development/9.1.
✅ All tests successful. No failed tests found.

Additional details and impacted files

Files with missing lines	Coverage Δ
lib/api/bucketPut.js	`100.00% <ø> (+3.88%)`	⬆️
lib/api/multiObjectDelete.js	`82.95% <ø> (+3.03%)`	⬆️

... and 2 files with indirect coverage changes

@@                 Coverage Diff                 @@
##           development/9.1    #6239      +/-   ##
===================================================
+ Coverage            83.85%   83.97%   +0.12%     
===================================================
  Files                  191      191              
  Lines                12352    12352              
===================================================
+ Hits                 10358    10373      +15     
+ Misses                1994     1979      -15

Flag	Coverage Δ
file-ft-tests	`66.93% <ø> (ø)`
kmip-ft-tests	`27.03% <ø> (ø)`
mongo-v0-ft-tests	`68.19% <ø> (+0.02%)`	⬆️
mongo-v1-ft-tests	`68.24% <ø> (ø)`
multiple-backend	`34.27% <ø> (ø)`
sur-tests	`34.55% <ø> (ø)`
sur-tests-inflights	`36.48% <ø> (ø)`
unit	`69.80% <ø> (+0.09%)`	⬆️
utapi-v2-tests	`33.40% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bert-e · 2026-08-05T08:57:04Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

The following options are set: create_pull_requests, create_integration_branches

Issue: CLDSRV-963

benzekrimaha · 2026-08-06T07:46:00Z

/approve

bert-e · 2026-08-06T07:46:22Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/9.1
✔️ development/9.2
✔️ development/9.3
✔️ development/9.4

The following branches have NOT changed:

development/7.10
development/7.4
development/7.70
development/8.8
development/9.0

This pull request did not target the following hotfix branch(es) so they
were left untouched:

hotfix/7.4.3
hotfix/7.10.3
hotfix/7.4.7
hotfix/7.4.9
hotfix/9.2.24
hotfix/7.10.49
hotfix/7.10.8
hotfix/7.4.10
hotfix/7.6.0
hotfix/7.10.15
hotfix/7.10.1
hotfix/7.70.73
hotfix/7.10.27
hotfix/7.70.11
hotfix/8.8.45
hotfix/7.10.0
hotfix/7.10.2
hotfix/7.70.45
hotfix/7.70.51
hotfix/7.8.0
hotfix/7.70.21
hotfix/7.10.28
hotfix/7.4.0
hotfix/7.4.1
hotfix/9.0.7
hotfix/7.7.0
hotfix/7.4.8
hotfix/7.4.2
hotfix/7.4.4
hotfix/7.4.5
hotfix/7.9.0
hotfix/9.2.36
hotfix/9.0.32
hotfix/6.4.7
hotfix/7.10.30
hotfix/7.10.4
hotfix/7.2.0
hotfix/7.4.6

Please check the status of the associated issue CLDSRV-963.

Goodbye benzekrimaha.

The following options are set: approve, create_pull_requests, create_integration_branches

benzekrimaha added 2 commits July 29, 2026 18:27

Send signatureVersion and authType unswapped to Vault checkPolicies

760ab89

multiObjectDelete assigned authType to signatureVersion and vice versa when building the checkPolicies request context, so Vault validated and evaluated each field against the wrong value. Issue: CLDSRV-963

Bump project version

ea42afc

Issue: CLDSRV-963

benzekrimaha changed the title ~~CLDSRV-963: Send signatureVersion and authType unswapped to Vault checkPolicies~~ Send signatureVersion and authType unswapped to Vault checkPolicies Jul 31, 2026

benzekrimaha requested review from a team, SylvainSenechal and delthas July 31, 2026 07:03

SylvainSenechal approved these changes Jul 31, 2026

View reviewed changes

delthas approved these changes Aug 3, 2026

View reviewed changes

This was referenced Aug 4, 2026

INTEGRATION [PR#6239 > development/9.2] Send signatureVersion and authType unswapped to Vault checkPolicies #6244

Merged

INTEGRATION [PR#6239 > development/9.3] Send signatureVersion and authType unswapped to Vault checkPolicies #6245

Merged

bert-e mentioned this pull request Aug 4, 2026

INTEGRATION [PR#6239 > development/9.4] Send signatureVersion and authType unswapped to Vault checkPolicies #6246

Merged

Send signatureVersion and authType unswapped in bucketPut checkPolicies

9b02cb4

Issue: CLDSRV-963

benzekrimaha added 2 commits August 5, 2026 12:29

Assert the exact error in the bucketPut checkPolicies test

5564b2c

Issue: CLDSRV-963

Report the received error in the bucketPut checkPolicies test assertion

0f2f742

Issue: CLDSRV-963

scality deleted a comment from bert-e Aug 6, 2026

bert-e merged commit 0f2f742 into development/9.1 Aug 6, 2026
50 of 53 checks passed

bert-e deleted the improvement/CLDSRV-963-fix-swapped-auth-params-check-policies branch August 6, 2026 07:46

Uh oh!

Conversation

benzekrimaha commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

bert-e commented Jul 29, 2026

Hello benzekrimaha,

Uh oh!

bert-e commented Jul 29, 2026

Incorrect fix version

Uh oh!

bert-e commented Jul 30, 2026

Incorrect fix version

Uh oh!

bert-e commented Jul 31, 2026

Request integration branches

Uh oh!

benzekrimaha commented Aug 4, 2026

Uh oh!

bert-e commented Aug 4, 2026

Conflict

Uh oh!

benzekrimaha commented Aug 4, 2026

Uh oh!

bert-e commented Aug 4, 2026

Conflict

Uh oh!

benzekrimaha commented Aug 4, 2026

Uh oh!

bert-e commented Aug 4, 2026

Conflict

Uh oh!

benzekrimaha commented Aug 4, 2026

Uh oh!

bert-e commented Aug 4, 2026

Waiting for approval

Uh oh!

benzekrimaha commented Aug 4, 2026

Uh oh!

bert-e commented Aug 4, 2026

Integration data created

Uh oh!

bert-e commented Aug 4, 2026

Waiting for approval

Uh oh!

bert-e commented Aug 4, 2026

History mismatch

Uh oh!

bert-e commented Aug 4, 2026

Waiting for approval

Uh oh!

bert-e commented Aug 4, 2026

History mismatch

Uh oh!

bert-e commented Aug 4, 2026

Waiting for approval

Uh oh!

bert-e commented Aug 4, 2026

History mismatch

Uh oh!

bert-e commented Aug 4, 2026

Waiting for approval

Uh oh!

codecov Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bert-e commented Aug 5, 2026

Waiting for approval

Uh oh!

benzekrimaha commented Aug 6, 2026

Uh oh!

bert-e commented Aug 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

benzekrimaha commented Jul 29, 2026 •

edited

Loading

codecov Bot commented Aug 5, 2026 •

edited

Loading