opendal 0.1.13 → 0.1.15

data/core/services/hf/src/reader.rs

@@ -16,9 +16,8 @@
 // under the License.
 
 use super::backend::*;
-#[cfg(test)]
 use super::core::HfDownloadMode;
-use super::core::{HfCore, HfReadResponse};
+use super::core::{HfCore, HfReadResponse, XetFileResponse};
 use asyncband::once::OnceCell;
 use http::Response;
 use opendal_core::raw::*;
@@ -103,6 +102,10 @@ pub struct HfReader {
     backend: HfBackend,
     ctx: OperationContext,
     path: String,
+    // Keep one XET file version for this reader, independently of the backend's
+    // optional cross-reader cache. Concurrent ranges share initialization;
+    // failed resolutions remain retryable. None means the first read used HTTP.
+    resolved: OnceCell<Option<XetFileResponse>>,
     // Built once per reader and reused for every later XET range, seeded
     // from `HfCore`'s cached CAS token. Reuse across concurrent ranges
     // relies on the `xet` crate's documented (not type-enforced) support
@@ -116,6 +119,7 @@ impl HfReader {
             backend,
             ctx,
             path: path.to_string(),
+            resolved: OnceCell::new(),
             xet_group: OnceCell::new(),
         }
     }
@@ -142,7 +146,33 @@ impl oio::StreamRead for HfReader {
         let core = &self.backend.core;
         let path = self.path.as_str();
 
-        let (rp, stream) = match core.read(&self.ctx, path, range).await? {
+        let mut first_http_response = None;
+        let resolved = if core.download_mode == HfDownloadMode::Xet {
+            self.resolved
+                .get_or_try_init(async || {
+                    match core.read(&self.ctx, path, range).await? {
+                        HfReadResponse::Xet(info) => Ok(Some(info)),
+                        HfReadResponse::Http(resp) => {
+                            // This response already contains the initializing caller's
+                            // range. Keep its bytes instead of probing and discarding them.
+                            first_http_response = Some(resp);
+                            Ok(None)
+                        }
+                    }
+                })
+                .await?
+                .as_ref()
+        } else {
+            None
+        };
+        let response = match resolved {
+            Some(info) => HfReadResponse::Xet(info.clone()),
+            None => match first_http_response {
+                Some(resp) => HfReadResponse::Http(resp),
+                None => core.read(&self.ctx, path, range).await?,
+            },
+        };
+        let (rp, stream) = match response {
             HfReadResponse::Xet(info) => {
                 self.xet_stream(core, &info.hash, info.size, range).await?
             }
@@ -313,38 +343,68 @@ mod tests {
         Ok(())
     }
 
-    /// Same guarantee as the non-XET version below, but for a file that
-    /// classifies as XET-backed: concurrent opens must share both the one
-    /// classifying resolve and the one `xet_group` build (and, via that
-    /// group, the one CAS read-token fetch) rather than each independently
-    /// racing to build its own group.
     #[tokio::test]
-    async fn test_concurrent_cold_opens_on_xet_file_share_one_group() -> Result<()> {
-        let (mut core, ctx, mock_client) = create_test_core(
+    async fn test_concurrent_xet_ranges_reuse_reader_resolution() -> Result<()> {
+        for enabled in [false, true] {
+            let (mut core, ctx, mock_client) = create_test_core(
+                HfRepoType::Model,
+                "test-user/test-repo",
+                "main",
+                "https://huggingface.co",
+            );
+            core.enable_resolve_cache = enabled;
+            mock_client.set_xet_backed(&"00".repeat(32), 64);
+            let core = Arc::new(core);
+            let reader = hf_reader_from_arc(core.clone(), ctx.clone(), "xet-file.bin");
+
+            let (r1, r2, r3) = futures::join!(
+                reader.open(BytesRange::new(0, Some(1))),
+                reader.open(BytesRange::new(1, Some(1))),
+                reader.open(BytesRange::new(2, Some(1))),
+            );
+            r1?;
+            r2?;
+            r3?;
+            // One resolve and one CAS token request; actual CAS bytes are
+            // covered by the live multiple-range test below.
+            assert_eq!(mock_client.request_count(), 2);
+
+            mock_client.set_xet_backed(&"11".repeat(32), 128);
+            let (rp, _) = reader.open(BytesRange::new(3, Some(1))).await?;
+            assert_eq!(rp.metadata().unwrap().content_length(), 64);
+            assert_eq!(
+                reader.resolved.get().unwrap().as_ref().unwrap().hash,
+                "00".repeat(32)
+            );
+            assert_eq!(mock_client.request_count(), 2);
+
+            let fresh = hf_reader_from_arc(core, ctx, "xet-file.bin");
+            let (rp, _) = fresh.open(BytesRange::new(0, Some(1))).await?;
+            assert_eq!(
+                rp.metadata().unwrap().content_length(),
+                if enabled { 64 } else { 128 }
+            );
+            assert_eq!(mock_client.request_count(), if enabled { 2 } else { 3 });
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn test_reader_resolution_retries_after_failure() -> Result<()> {
+        let (core, ctx, mock_client) = create_test_core(
             HfRepoType::Model,
             "test-user/test-repo",
             "main",
             "https://huggingface.co",
         );
-        core.enable_resolve_cache = true;
-        mock_client.set_xet_backed(&"00".repeat(32), 4);
-        mock_client.set_xet_token_expires_at(u64::MAX);
+        mock_client.set_xet_backed(&"00".repeat(32), 64);
+        mock_client.fail_next_requests(1);
         let reader = hf_reader(core, ctx, "xet-file.bin");
-
-        let (r1, r2, r3) = futures::join!(
-            reader.open(BytesRange::new(0, Some(1))),
-            reader.open(BytesRange::new(1, Some(1))),
-            reader.open(BytesRange::new(2, Some(1))),
-        );
-        r1?;
-        r2?;
-        r3?;
-
-        // 1 shared classifying resolve + 1 shared xet-read-token fetch for
-        // the shared group build. Fetching actual bytes from the group would
-        // need a real CAS server, so this test only covers open().
-        assert_eq!(mock_client.request_count(), 2);
-
+        assert!(reader.open(BytesRange::new(0, Some(1))).await.is_err());
+        assert!(reader.resolved.get().is_none());
+        reader.open(BytesRange::new(0, Some(1))).await?;
+        reader.open(BytesRange::new(1, Some(1))).await?;
+        assert_eq!(mock_client.request_count(), 3);
         Ok(())
     }
 
@@ -406,33 +466,30 @@ mod tests {
         Ok(())
     }
 
-    /// Concurrent opens on a cold reader share exactly one classifying
-    /// resolve (`object_store::get_ranges` drives up to 8 by default) --
-    /// they must not each independently probe the path before finding out
-    /// it isn't XET-backed. Each still fetches its own range afterward.
     #[tokio::test]
-    async fn test_concurrent_cold_opens_share_one_classifying_resolve() -> Result<()> {
-        let (mut core, ctx, mock_client) = create_test_core(
-            HfRepoType::Model,
-            "test-user/test-repo",
-            "main",
-            "https://huggingface.co",
-        );
-        core.enable_resolve_cache = true;
-        let reader = hf_reader(core, ctx, "plain.txt");
-
-        let (r1, r2, r3) = futures::join!(
-            reader.open(BytesRange::new(0, Some(1))),
-            reader.open(BytesRange::new(1, Some(1))),
-            reader.open(BytesRange::new(2, Some(1))),
-        );
-        r1?.1.read().await?;
-        r2?.1.read().await?;
-        r3?.1.read().await?;
-
-        // 1 shared classifying resolve + 3 individual fetches.
-        assert_eq!(mock_client.request_count(), 4);
+    async fn test_concurrent_non_xet_ranges_keep_initial_response() -> Result<()> {
+        for enabled in [false, true] {
+            let (mut core, ctx, mock_client) = create_test_core(
+                HfRepoType::Model,
+                "test-user/test-repo",
+                "main",
+                "https://huggingface.co",
+            );
+            core.enable_resolve_cache = enabled;
+            let reader = hf_reader(core, ctx, "plain.txt");
 
+            let (r1, r2, r3) = futures::join!(
+                reader.open(BytesRange::new(0, Some(1))),
+                reader.open(BytesRange::new(1, Some(1))),
+                reader.open(BytesRange::new(2, Some(1))),
+            );
+            for result in [r1, r2, r3] {
+                assert_eq!(result?.1.read().await?.to_vec(), b"hello");
+            }
+            // Each range fetches its bytes once. Only the backend cache's
+            // optional classification adds a one-byte probe.
+            assert_eq!(mock_client.request_count(), if enabled { 4 } else { 3 });
+        }
         Ok(())
     }
 
@@ -559,25 +616,63 @@ mod tests {
         assert_eq!(&bytes, PARQUET_MAGIC);
     }
 
-    /// Exercises the group-reuse path for real: two ranges fetched through
-    /// the same `Reader` (mirroring `object_store::get_ranges`) must both
-    /// return correct bytes while each call resolves the XET hash and the
-    /// reader reuses its CAS download group.
+    /// Read separated ranges through one Reader against a public XET file.
     #[tokio::test]
     #[ignore = "requires network access"]
     async fn test_read_xet_multiple_ranges_on_one_reader() {
-        let op = mbpp_operator();
-        let reader = op
-            .reader_with("full/train-00000-of-00001.parquet")
-            .await
-            .expect("opening a reader should succeed");
+        use std::sync::atomic::{AtomicUsize, Ordering};
 
-        let bufs = reader
-            .fetch(vec![0..4, 4..8])
-            .await
-            .expect("fetching two ranges on one reader should succeed");
-        assert_eq!(bufs.len(), 2);
+        #[derive(Debug, Clone, Default)]
+        struct CountingTransport {
+            inner: opendal_http_transport_reqwest::ReqwestTransport,
+            resolves: Arc<AtomicUsize>,
+        }
+
+        impl HttpTransport for CountingTransport {
+            async fn fetch(&self, req: http::Request<Buffer>) -> Result<Response<HttpBody>> {
+                if req.uri().path().contains("/resolve/") {
+                    self.resolves.fetch_add(1, Ordering::SeqCst);
+                }
+                self.inner.fetch(req).await
+            }
+        }
+
+        let transport = CountingTransport::default();
+        let op = Operator::new(
+            super::super::backend::HfBuilder::default()
+                .repo_type("dataset")
+                .repo_id("google-research-datasets/mbpp")
+                .download_mode("xet"),
+        )
+        .unwrap()
+        .with_context(
+            OperationContext::new().with_http_transport(HttpTransporter::new(transport.clone())),
+        );
+        let path = "full/train-00000-of-00001.parquet";
+        let reader = op.reader_with(path).concurrent(3).gap(0).await.unwrap();
+        let ranges = vec![0..4, 16..20, 32..36];
+        let bufs = reader.fetch(ranges.clone()).await.unwrap();
         assert_eq!(bufs[0].to_vec(), PARQUET_MAGIC);
-        assert_eq!(bufs[1].len(), 4);
+        assert!(bufs.iter().all(|buf| buf.len() == 4));
+        let first_resolves = transport.resolves.load(Ordering::SeqCst);
+        let repeated = reader.fetch(ranges.clone()).await.unwrap();
+        for (first, second) in bufs.iter().zip(repeated) {
+            assert_eq!(first.to_vec(), second.to_vec());
+        }
+        let repeated_resolves = transport.resolves.load(Ordering::SeqCst);
+        let fresh = op.read_with(path).range(0..36).await.unwrap().to_vec();
+        for (range, buf) in ranges.iter().zip(&bufs) {
+            assert_eq!(
+                buf.to_vec(),
+                fresh[range.start as usize..range.end as usize]
+            );
+        }
+        let fresh_resolves = transport.resolves.load(Ordering::SeqCst);
+        eprintln!(
+            "resolve counts: first batch={first_resolves}, repeated batch={repeated_resolves}, fresh reader={fresh_resolves}"
+        );
+        assert_eq!(first_resolves, 1);
+        assert_eq!(repeated_resolves, 1);
+        assert_eq!(fresh_resolves, 2);
     }
 }

data/core/services/http/Cargo.toml

@@ -22,7 +22,7 @@ license = "Apache-2.0"
 name = "opendal-service-http"
 readme = "README.md"
 repository = "https://github.com/apache/opendal"
-version = "0.59.2"
+version = "0.59.4"
 
 [package.metadata.docs.rs]
 all-features = true
@@ -30,9 +30,9 @@ all-features = true
 [dependencies]
 http = "1.4"
 log = "0.4"
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { version = "1", features = ["derive"] }
 
 [dev-dependencies]
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 tokio = { version = "1.52", features = ["macros", "rt-multi-thread"] }

data/core/services/ipfs/Cargo.toml

@@ -35,7 +35,7 @@ all-features = true
 bytes = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 prost = "0.14.3"
 serde = { workspace = true, features = ["derive"] }
 

data/core/services/ipmfs/Cargo.toml

@@ -32,7 +32,7 @@ version = { workspace = true }
 all-features = true
 
 [dependencies]
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 
 bytes = { workspace = true }
 http = { workspace = true }

data/core/services/koofr/Cargo.toml

@@ -36,7 +36,7 @@ asyncband = { workspace = true, features = ["mutex", "once-cell"] }
 bytes = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 

data/core/services/lakefs/Cargo.toml

@@ -35,7 +35,7 @@ all-features = true
 bytes = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 

data/core/services/memcached/Cargo.toml

@@ -33,7 +33,7 @@ all-features = true
 
 [dependencies]
 asyncband = { workspace = true, features = ["pool"] }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 tokio = { workspace = true, features = ["io-util", "macros", "net", "time"] }
 url = { workspace = true }

data/core/services/mini_moka/Cargo.toml

@@ -34,5 +34,5 @@ all-features = true
 [dependencies]
 log = { workspace = true }
 mini-moka = "0.10"
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }

data/core/services/moka/Cargo.toml

@@ -34,7 +34,7 @@ all-features = true
 [dependencies]
 log = { workspace = true }
 moka = { version = "0.12", features = ["future", "sync"] }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 
 [dev-dependencies]

data/core/services/mongodb/Cargo.toml

@@ -34,7 +34,7 @@ all-features = true
 [dependencies]
 asyncband = { workspace = true, features = ["once-cell"] }
 mongodb = { version = "3.3.0" }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 
 [dev-dependencies]

data/core/services/monoiofs/Cargo.toml

@@ -41,7 +41,7 @@ monoio = { version = "0.2.4", features = [
   "unlinkat",
   "renameat",
 ] }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 
 [dev-dependencies]

data/core/services/mysql/Cargo.toml

@@ -33,7 +33,7 @@ all-features = true
 
 [dependencies]
 asyncband = { workspace = true, features = ["once-cell"] }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 sqlx = { version = "0.8.0", features = ["runtime-tokio-rustls", "mysql"] }
 

data/core/services/obs/Cargo.toml

@@ -35,7 +35,7 @@ all-features = true
 bytes = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false, features = [
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false, features = [
   "reqsign",
 ] }
 quick-xml = { workspace = true, features = ["serialize", "overlapped-lists"] }

data/core/services/onedrive/Cargo.toml

@@ -36,7 +36,7 @@ asyncband = { workspace = true, features = ["mutex"] }
 bytes = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tokio = { workspace = true, features = ["time"] }

data/core/services/opfs/Cargo.toml

@@ -35,7 +35,7 @@ targets = ["wasm32-unknown-unknown"]
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 js-sys = "0.3.77"
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 send_wrapper = "0.6"
 serde = { workspace = true, features = ["derive"] }
 wasm-bindgen = "0.2.100"

data/core/services/oss/Cargo.toml

@@ -35,7 +35,7 @@ all-features = true
 bytes = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false, features = [
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false, features = [
   "reqsign",
 ] }
 quick-xml = { workspace = true, features = ["serialize", "overlapped-lists"] }

data/core/services/oss/src/backend.rs

@@ -523,8 +523,8 @@ impl Builder for OssBuilder {
         }
         let mut provider = provider
             .push(EnvCredentialProvider::new())
-            .push(EcsRamRoleCredentialProvider::new())
-            .push(assume_role);
+            .push(assume_role)
+            .push(EcsRamRoleCredentialProvider::new());
 
         if let Some(role_arn) = &self.config.role_arn {
             let mut assume_role_with_ak = AssumeRoleCredentialProvider::new()
@@ -859,3 +859,144 @@ impl Service for OssBackend {
         )))
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+    use std::sync::Mutex;
+
+    use bytes::Bytes;
+    use reqsign_core::{FileRead, HttpSend};
+
+    use super::*;
+
+    #[derive(Debug)]
+    struct OidcTokenFile;
+
+    impl FileRead for OidcTokenFile {
+        async fn file_read(&self, path: &str) -> reqsign_core::Result<Vec<u8>> {
+            assert_eq!(path, "/test/oidc-token");
+            Ok(b"test-oidc-token".to_vec())
+        }
+    }
+
+    #[derive(Clone, Debug, Default)]
+    struct CredentialHttpSend {
+        requests: Arc<Mutex<Vec<String>>>,
+    }
+
+    impl HttpSend for CredentialHttpSend {
+        async fn http_send(
+            &self,
+            req: http::Request<Bytes>,
+        ) -> reqsign_core::Result<http::Response<Bytes>> {
+            let host = req.uri().host().unwrap();
+            let path = req.uri().path();
+            self.requests.lock().unwrap().push(format!("{host}{path}"));
+            let body = match (host, path) {
+                ("sts.aliyuncs.com", "/") => {
+                    assert!(
+                        req.uri()
+                            .query()
+                            .unwrap()
+                            .contains("Action=AssumeRoleWithOIDC")
+                    );
+                    r#"{"Credentials":{"AccessKeyId":"oidc-ak","AccessKeySecret":"oidc-secret","SecurityToken":"oidc-token","Expiration":"2099-01-01T00:00:00Z"}}"#
+                }
+                ("100.100.100.200", "/latest/api/token") => "metadata-token",
+                ("100.100.100.200", "/latest/meta-data/ram/security-credentials/") => "node-role",
+                ("100.100.100.200", "/latest/meta-data/ram/security-credentials/node-role") => {
+                    r#"{"Code":"Success","AccessKeyId":"ecs-ak","AccessKeySecret":"ecs-secret","SecurityToken":"ecs-token","Expiration":"2099-01-01T00:00:00Z"}"#
+                }
+                _ => panic!("unexpected credential request: {}", req.uri()),
+            };
+            Ok(http::Response::new(Bytes::from_static(body.as_bytes())))
+        }
+    }
+
+    #[tokio::test]
+    async fn test_credential_precedence() {
+        for (static_keys, env_keys, oidc, expected_key, expected_token) in [
+            (true, true, true, "static-ak", "static-token"),
+            (false, true, true, "env-ak", "env-token"),
+            (false, false, true, "oidc-ak", "oidc-token"),
+            (false, false, false, "ecs-ak", "ecs-token"),
+        ] {
+            let mut builder = OssBuilder::default()
+                .bucket("test-bucket")
+                .endpoint("https://oss-cn-hangzhou.aliyuncs.com");
+            if static_keys {
+                builder = builder
+                    .access_key_id("static-ak")
+                    .access_key_secret("static-secret")
+                    .security_token("static-token");
+            }
+            let backend = builder.build().unwrap();
+            let backend = (&backend as &dyn std::any::Any)
+                .downcast_ref::<OssBackend>()
+                .unwrap();
+            let mut envs = HashMap::new();
+            if env_keys {
+                envs.extend([
+                    ("ALIBABA_CLOUD_ACCESS_KEY_ID".into(), "env-ak".into()),
+                    (
+                        "ALIBABA_CLOUD_ACCESS_KEY_SECRET".into(),
+                        "env-secret".into(),
+                    ),
+                    ("ALIBABA_CLOUD_SECURITY_TOKEN".into(), "env-token".into()),
+                ]);
+            }
+            if oidc {
+                envs.extend([
+                    (
+                        "ALIBABA_CLOUD_ROLE_ARN".into(),
+                        "acs:ram::123456789012:role/pod-role".into(),
+                    ),
+                    (
+                        "ALIBABA_CLOUD_OIDC_PROVIDER_ARN".into(),
+                        "acs:ram::123456789012:oidc-provider/test".into(),
+                    ),
+                    (
+                        "ALIBABA_CLOUD_OIDC_TOKEN_FILE".into(),
+                        "/test/oidc-token".into(),
+                    ),
+                ]);
+            }
+            let http = CredentialHttpSend::default();
+            let ctx = Context::new()
+                .with_env(StaticEnv {
+                    home_dir: None,
+                    envs,
+                })
+                .with_file_read(OidcTokenFile)
+                .with_http_send(http.clone());
+            let signer = backend.core.signer.clone().with_context(ctx);
+            let (mut parts, _) = http::Request::builder()
+                .method(http::Method::PUT)
+                .uri("https://test-bucket.oss-cn-hangzhou.aliyuncs.com/manifest.json")
+                .body(())
+                .unwrap()
+                .into_parts();
+            signer.sign(&mut parts, None).await.unwrap();
+            assert!(
+                parts.headers[http::header::AUTHORIZATION]
+                    .to_str()
+                    .unwrap()
+                    .starts_with(&format!("OSS {expected_key}:"))
+            );
+            assert_eq!(parts.headers["x-oss-security-token"], expected_token);
+            let expected_requests = if static_keys || env_keys {
+                vec![]
+            } else if oidc {
+                vec!["sts.aliyuncs.com/"]
+            } else {
+                vec![
+                    "100.100.100.200/latest/api/token",
+                    "100.100.100.200/latest/meta-data/ram/security-credentials/",
+                    "100.100.100.200/latest/meta-data/ram/security-credentials/node-role",
+                ]
+            };
+            assert_eq!(*http.requests.lock().unwrap(), expected_requests);
+        }
+    }
+}

data/core/services/oss/src/docs.md

@@ -21,6 +21,18 @@ Use [`crate::OssConfig`] for serializable configuration and this builder's
 methods for direct construction. The field and method documentation defines
 accepted values, defaults, and environment interaction.
 
+### Credential resolution
+
+OSS tries explicit access keys, environment credentials, OIDC assume-role
+credentials, and ECS instance RAM role credentials, in that order. The first
+provider that returns credentials is used. In ACK RRSA deployments, OIDC
+credentials therefore take precedence over the node's ECS metadata credentials.
+If a provider returns no credentials or fails, the chain tries the next provider.
+An OSS permission error does not trigger a switch to another credential provider.
+
+When `role_arn` is set in the service configuration, these providers supply the
+base credentials for the additional AK-based AssumeRole request.
+
 ## Example
 
 ### Via Builder

data/core/services/pcloud/Cargo.toml

@@ -35,7 +35,7 @@ all-features = true
 bytes = { workspace = true }
 http = { workspace = true }
 log = { workspace = true }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 

data/core/services/persy/Cargo.toml

@@ -32,7 +32,7 @@ version = { workspace = true }
 all-features = true
 
 [dependencies]
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 persy = "1.7.1"
 serde = { workspace = true, features = ["derive"] }
 

data/core/services/postgresql/Cargo.toml

@@ -33,7 +33,7 @@ all-features = true
 
 [dependencies]
 asyncband = { workspace = true, features = ["once-cell"] }
-opendal-core = { path = "../../core", version = "0.59.2", default-features = false }
+opendal-core = { path = "../../core", version = "0.59.4", default-features = false }
 serde = { workspace = true, features = ["derive"] }
 sqlx = { version = "0.8.0", features = ["runtime-tokio-rustls", "postgres"] }