@cloud-cli/s3mini 1.47.2 → 1.48.0

package/README.md

@@ -24,7 +24,7 @@ the resulting `.env` file or any client secret.
 ```sh
 S3MINI_OIDC_CLIENT_ID=your-client-id
 S3MINI_OIDC_CLIENT_SECRET=your-client-secret
-S3MINI_OIDC_REDIRECT_URI=https://storage.example.com/admin/callback
+S3MINI_OIDC_REDIRECT_URI=https://storage.example.com/auth/callback
 S3MINI_OIDC_AUDIENCE=your-client-id
 S3MINI_OIDC_ADMIN_EMAILS=admin@example.com
 ```
@@ -35,11 +35,30 @@ The deployment may use the live provider names `AUTH_PROVIDER`,
 provider origin or the `/api` documentation URL; both are normalized to the
 OIDC endpoint origin.
 
-Register the exact redirect URI with the OIDC client. `S3MINI_OIDC_AUTH_URL`
+Register the exact `/auth/callback` redirect URI with the OIDC client. `S3MINI_OIDC_AUTH_URL`
 can override the provider base URL. The admin email allowlist is optional; when
 omitted, any authenticated provider user is accepted. Client secrets and
 allowlists must remain in environment variables or local untracked config.
 
+S3MINI follows the provider's Node client flow: authorization-code PKCE uses
+`/authorize` and `/token`, access tokens are verified as RS256 JWTs using
+`/.well-known/jwks.json`, and user identity is loaded from `/userinfo` with
+`X-Auth-Audience`.
+
+Provider API tokens can also call S3MINI directly with an `Authorization:
+Bearer` header. Create them through the provider's `/api-tokens/{clientId}`
+endpoint and grant these scopes as needed:
+
+```text
+s3:read   GET, HEAD, and OPTIONS requests
+s3:write  bucket/object mutations
+s3:admin  bucket policy/ACL/configuration and `/admin` control-plane actions
+```
+
+Use `s3:*` for a full-access token. S3MINI introspects opaque provider tokens
+through `/oauth/introspect` using the configured OIDC client credentials.
+
 Set `S3MINI_REPLICATION_QUORUM` to a positive number to expose a degraded
 state when fewer than that many configured peers are healthy. Current writes
-remain asynchronous; quorum acknowledgement enforcement is planned.
+remain asynchronous; quorum acknowledgement enforcement is intentionally
+deferred while the project focuses on core S3 behavior and small deployments.

package/dist/auth/oidc.d.ts

@@ -0,0 +1,5 @@
+export declare function verifyOidcToken(token: string, issuer: string, audience: string): Promise<void>;
+export declare function introspectOidcToken(token: string, issuer: string, clientId: string, clientSecret: string): Promise<{
+    active: boolean;
+    scopes: string[];
+}>;

package/dist/auth/oidc.js

@@ -0,0 +1,69 @@
+import { createPublicKey, verify } from 'node:crypto';
+const jwksCache = new Map();
+const introspectionCache = new Map();
+function decodeBase64Url(value) {
+    return Buffer.from(value, 'base64url');
+}
+export async function verifyOidcToken(token, issuer, audience) {
+    const parts = token.split('.');
+    if (parts.length !== 3)
+        throw new Error('Invalid JWT');
+    let header;
+    let payload;
+    let signature;
+    try {
+        header = JSON.parse(decodeBase64Url(parts[0]).toString('utf8'));
+        payload = JSON.parse(decodeBase64Url(parts[1]).toString('utf8'));
+        signature = decodeBase64Url(parts[2]);
+    }
+    catch {
+        throw new Error('Invalid JWT');
+    }
+    if (header.alg !== 'RS256' || typeof header.kid !== 'string')
+        throw new Error('Unsupported JWT');
+    const cached = jwksCache.get(issuer);
+    let jwks;
+    if (cached && Date.now() < cached.expiresAt)
+        jwks = cached.keys;
+    else {
+        const response = await fetch(new URL('/.well-known/jwks.json', issuer));
+        if (!response.ok)
+            throw new Error(`Could not load JWKS: ${response.status}`);
+        jwks = await response.json();
+        jwksCache.set(issuer, { keys: jwks, expiresAt: Date.now() + 60 * 60 * 1000 });
+    }
+    const jwk = jwks.keys?.find(key => key.kid === header.kid && key.kty === 'RSA');
+    if (!jwk)
+        throw new Error('Unknown JWT signing key');
+    const key = createPublicKey({ key: jwk, format: 'jwk' });
+    if (!verify('RSA-SHA256', Buffer.from(`${parts[0]}.${parts[1]}`), key, signature))
+        throw new Error('Invalid JWT signature');
+    const now = Math.floor(Date.now() / 1000);
+    const audiences = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    if (payload.iss !== issuer || !audiences.includes(audience) || typeof payload.sub !== 'string')
+        throw new Error('Invalid JWT claims');
+    if (typeof payload.exp !== 'number' || payload.exp <= now)
+        throw new Error('Expired JWT');
+    if (typeof payload.nbf === 'number' && payload.nbf > now)
+        throw new Error('JWT is not active');
+}
+export async function introspectOidcToken(token, issuer, clientId, clientSecret) {
+    const cached = introspectionCache.get(token);
+    if (cached && Date.now() < cached.expiresAt)
+        return { active: cached.active, scopes: cached.scopes };
+    const credentials = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
+    const response = await fetch(new URL('/oauth/introspect', issuer), {
+        method: 'POST',
+        headers: { Authorization: `Basic ${credentials}`, 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ token, token_type_hint: 'access_token' }),
+    });
+    if (!response.ok)
+        throw new Error(`Could not introspect token: ${response.status}`);
+    const result = await response.json();
+    const scopes = Array.isArray(result.scope) ? result.scope : typeof result.scope === 'string' ? result.scope.split(/\s+/).filter(Boolean) : [];
+    const expiresAt = result.exp ? Math.min(result.exp * 1000, Date.now() + 30_000) : Date.now() + 30_000;
+    const value = { active: result.active === true, scopes, expiresAt };
+    introspectionCache.set(token, value);
+    return { active: value.active, scopes: value.scopes };
+}
+//# sourceMappingURL=oidc.js.map

package/dist/auth/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/auth/oidc.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAKtD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;AACvE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAoE,CAAC;AAEvG,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB;IACnF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IAEvD,IAAI,MAAsC,CAAC;IAC3C,IAAI,OAA4F,CAAC;IACjG,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,IAAU,CAAC;IACf,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;QAAE,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;SAC3D,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAU,CAAC;QACrC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IAChF,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,eAAe,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAE5H,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3E,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACtI,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;AACjG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,MAAc,EAAE,QAAgB,EAAE,YAAoB;IAC7G,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrG,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,mBAAmB,EAAE,MAAM,CAAC,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,WAAW,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QACvG,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC;KACtE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAmE,CAAC;IACtG,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9I,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACtG,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpE,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACxD,CAAC"}

package/dist/handlers/router.js

@@ -1,6 +1,8 @@
 import crypto from 'node:crypto';
 import { S3Error, VALID_STORAGE_CLASSES } from '../types/models.js';
 import { verifyPresignedSigV4, verifySigV4 } from '../auth/sigv4.js';
+import { introspectOidcToken, verifyOidcToken } from '../auth/oidc.js';
+import { CONTROL_PLANE_HTML } from '../ui/control-plane.js';
 export async function registerRoutes(fastify, s3, replication) {
     fastify.addContentTypeParser(['application/octet-stream', 'application/xml', 'text/xml', 'text/csv'], { parseAs: 'buffer' }, (_request, body, done) => {
         done(null, body);
@@ -14,6 +16,21 @@ export async function registerRoutes(fastify, s3, replication) {
         if (request.url === '/admin' || request.url.startsWith('/admin/'))
             return;
         const authorization = request.headers.authorization;
+        const bearerToken = authorization?.match(/^Bearer\s+(.+)$/i)?.[1];
+        let oidcScopes = [];
+        if (bearerToken) {
+            if (!oidcConfigured())
+                throw new S3Error('AccessDenied', 'OIDC bearer tokens are not configured.', 403);
+            try {
+                const introspection = await introspectOidcToken(bearerToken, oidcBaseUrl(), oidcClientId(), oidcClientSecret());
+                if (!introspection.active)
+                    throw new Error('The bearer token is inactive.');
+                oidcScopes = introspection.scopes;
+            }
+            catch {
+                throw new S3Error('AccessDenied', 'The bearer token is invalid or expired.', 403);
+            }
+        }
         const hasPresign = new URL(request.raw.url || '/', 'http://localhost').searchParams.has('X-Amz-Algorithm');
         const credentials = await resolveCredentials(s3, request, hasPresign);
         const accessKeyId = credentials?.accessKeyId;
@@ -22,19 +39,31 @@ export async function registerRoutes(fastify, s3, replication) {
         if (hasPresign && (!signingCredentials || !verifyPresignedSigV4({ method: request.method, url: request.raw.url || '/', headers: request.headers, body: Buffer.isBuffer(request.body) ? request.body : undefined }, signingCredentials))) {
             throw new S3Error('SignatureDoesNotMatch', 'The presigned URL signature does not match.', 403);
         }
-        if (authorization && (!signingCredentials || !verifySigV4({ method: request.method, url: request.raw.url || '/', headers: request.headers, body: Buffer.isBuffer(request.body) ? request.body : undefined }, signingCredentials))) {
+        if (authorization && !bearerToken && (!signingCredentials || !verifySigV4({ method: request.method, url: request.raw.url || '/', headers: request.headers, body: Buffer.isBuffer(request.body) ? request.body : undefined }, signingCredentials))) {
             throw new S3Error('SignatureDoesNotMatch', 'The request signature does not match.', 403);
         }
+        if (bearerToken && !hasOidcScope(oidcScopes, requiredOidcScope(request))) {
+            throw new S3Error('AccessDenied', `The bearer token lacks the required ${requiredOidcScope(request)} scope.`, 403);
+        }
         if (credentials && (authorization || hasPresign))
             await s3.markAccessKeyUsed(credentials.accessKeyId);
         const params = request.params;
         const query = request.query;
         const key = params['*'] ? normalizeObjectKey(params['*']) : undefined;
-        if (params.bucket && query.policy === undefined && query.acl === undefined && (key || request.method !== 'PUT')) {
-            const action = key
-                ? `${request.method === 'GET' || request.method === 'HEAD' ? 'Get' : request.method === 'PUT' ? 'Put' : request.method === 'DELETE' ? 'Delete' : request.method}Object`
-                : request.method === 'GET' ? 'ListBucket' : `${request.method}Bucket`;
-            const credentialsConfigured = Boolean(process.env.S3MINI_ACCESS_KEY && process.env.S3MINI_SECRET_KEY);
+        const credentialsConfigured = Boolean(process.env.S3MINI_ACCESS_KEY && process.env.S3MINI_SECRET_KEY);
+        if (params.bucket && credentialsConfigured && !authorization && !hasPresign && !['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
+            throw new S3Error('AccessDenied', 'Authentication is required.', 403, params.bucket, key);
+        }
+        const creatingBucket = !key && request.method === 'PUT' && Object.keys(query).every(name => name === 'locationConstraint');
+        if (params.bucket && !creatingBucket) {
+            const verb = request.method === 'GET' || request.method === 'HEAD' ? 'Get' : request.method === 'PUT' ? 'Put' : request.method === 'DELETE' ? 'Delete' : request.method;
+            const action = query.policy !== undefined
+                ? `${verb}BucketPolicy`
+                : query.acl !== undefined
+                    ? key ? `${verb}ObjectAcl` : `${verb}BucketAcl`
+                    : key
+                        ? `${verb}Object`
+                        : request.method === 'GET' ? 'ListBucket' : `${request.method}Bucket`;
             const authenticatedPrincipal = authorization || hasPresign ? accessKeyId || '' : 'anonymous';
             const context = {
                 's3:x-amz-acl': String(request.headers['x-amz-acl'] || ''),
@@ -44,7 +73,7 @@ export async function registerRoutes(fastify, s3, replication) {
             if (await s3.isRequestDenied(params.bucket, key, `s3:${action}`, authenticatedPrincipal, context)) {
                 throw new S3Error('AccessDenied', 'Access denied by bucket policy.', 403, params.bucket, key);
             }
-            if (credentialsConfigured && key && authenticatedPrincipal === 'anonymous' && ['GetObject', 'PutObject', 'DeleteObject'].includes(action) && await s3.isObjectRequestDenied(params.bucket, key, action, authenticatedPrincipal)) {
+            if (credentialsConfigured && key && authenticatedPrincipal === 'anonymous' && ['GetObject', 'PutObject', 'DeleteObject', 'GetObjectAcl', 'PutObjectAcl', 'DeleteObjectAcl'].includes(action) && await s3.isObjectRequestDenied(params.bucket, key, action, authenticatedPrincipal)) {
                 throw new S3Error('AccessDenied', 'Access denied by object ACL.', 403, params.bucket, key);
             }
         }
@@ -98,6 +127,17 @@ export async function registerRoutes(fastify, s3, replication) {
         const suppliedToken = request.headers.authorization?.startsWith('Bearer ') ? request.headers.authorization.slice(7) : undefined;
         if (configuredToken && suppliedToken && timingSafeTokenEqual(suppliedToken, configuredToken))
             return;
+        const bearerToken = request.headers.authorization?.match(/^Bearer\s+(.+)$/i)?.[1];
+        if (bearerToken && oidcConfigured()) {
+            try {
+                const introspection = await introspectOidcToken(bearerToken, oidcBaseUrl(), oidcClientId(), oidcClientSecret());
+                if (introspection.active && hasOidcScope(introspection.scopes, 's3:admin'))
+                    return;
+            }
+            catch {
+                // Fall through to the standard access-denied response.
+            }
+        }
         const oidcToken = getCookie(request, 's3mini_oidc_token');
         if (oidcToken && await isOidcAdmin(oidcToken))
             return;
@@ -126,7 +166,9 @@ export async function registerRoutes(fastify, s3, replication) {
     }
     async function isOidcAdmin(token) {
         try {
-            const response = await fetch(`${oidcBaseUrl()}/userinfo`, { headers: { authorization: `Bearer ${token}`, 'x-auth-audience': process.env.S3MINI_OIDC_AUDIENCE || oidcClientId() } });
+            const audience = process.env.S3MINI_OIDC_AUDIENCE || oidcClientId();
+            await verifyOidcToken(token, oidcBaseUrl(), audience);
+            const response = await fetch(`${oidcBaseUrl()}/userinfo`, { headers: { authorization: `Bearer ${token}`, 'x-auth-audience': audience } });
             if (!response.ok)
                 return false;
             const user = await response.json();
@@ -140,7 +182,7 @@ export async function registerRoutes(fastify, s3, replication) {
     fastify.get('/admin', async (request, reply) => {
         if (oidcConfigured() && !getCookie(request, 's3mini_oidc_token'))
             return reply.redirect('/admin/login');
-        return reply.type('text/html').send(ADMIN_HTML);
+        return reply.type('text/html').send(CONTROL_PLANE_HTML);
     });
     fastify.get('/admin/login', async (request, reply) => {
         if (!oidcConfigured())
@@ -148,14 +190,14 @@ export async function registerRoutes(fastify, s3, replication) {
         const verifier = crypto.randomBytes(32).toString('base64url');
         const state = crypto.randomBytes(24).toString('base64url');
         const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
-        const redirectUri = process.env.OIDC_REDIRECT_URI || process.env.S3MINI_OIDC_REDIRECT_URI || `${requestBaseUrl(request)}/admin/callback`;
+        const redirectUri = process.env.OIDC_REDIRECT_URI || process.env.S3MINI_OIDC_REDIRECT_URI || `${requestBaseUrl(request)}/auth/callback`;
         const stateCookie = Buffer.from(JSON.stringify({ state, verifier }), 'utf8').toString('base64url');
         reply.header('Set-Cookie', `s3mini_oidc_state=${stateCookie}; HttpOnly; Path=/admin; SameSite=Lax; Max-Age=600`);
         const url = new URL(`${oidcBaseUrl()}/authorize`);
         url.search = new URLSearchParams({ response_type: 'code', client_id: oidcClientId(), redirect_uri: redirectUri, state, scope: 'openid profile email', code_challenge: challenge, code_challenge_method: 'S256' }).toString();
         return reply.redirect(url.toString());
     });
-    fastify.get('/admin/callback', async (request, reply) => {
+    fastify.get('/auth/callback', async (request, reply) => {
         if (!oidcConfigured())
             throw new S3Error('AccessDenied', 'OIDC is not configured.', 403);
         const query = request.query;
@@ -171,7 +213,7 @@ export async function registerRoutes(fastify, s3, replication) {
         }
         if (state.state !== query.state)
             throw new S3Error('AccessDenied', 'The OIDC state does not match.', 403);
-        const redirectUri = process.env.OIDC_REDIRECT_URI || process.env.S3MINI_OIDC_REDIRECT_URI || `${requestBaseUrl(request)}/admin/callback`;
+        const redirectUri = process.env.OIDC_REDIRECT_URI || process.env.S3MINI_OIDC_REDIRECT_URI || `${requestBaseUrl(request)}/auth/callback`;
         const tokenResponse = await fetch(`${oidcBaseUrl()}/token`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ grant_type: 'authorization_code', code: query.code, client_id: oidcClientId(), client_secret: oidcClientSecret(), redirect_uri: redirectUri, code_verifier: state.verifier }) });
         if (!tokenResponse.ok)
             throw new S3Error('AccessDenied', 'The OIDC token exchange failed.', 403);
@@ -377,7 +419,7 @@ export async function registerRoutes(fastify, s3, replication) {
             if (!sourceBucket || !source.length)
                 throw new S3Error('InvalidRequest', 'x-amz-copy-source is invalid.', 400);
             const obj = await s3.copyObject(sourceBucket, source.join('/'), params.bucket, key);
-            return reply.type('application/xml').code(200).send(wrapXml('CopyObjectResult', { ETag: obj.etag, LastModified: obj.lastModified.toISOString() }));
+            return reply.type('application/xml').code(200).header('ETag', obj.etag).header('x-amz-version-id', obj.versionId).send(wrapXml('CopyObjectResult', { ETag: obj.etag, LastModified: obj.lastModified.toISOString(), VersionId: obj.versionId }));
         }
         const body = request.body;
         const checksum = request.headers['x-amz-checksum-sha256'];
@@ -450,7 +492,7 @@ export async function registerRoutes(fastify, s3, replication) {
         if (legalHold)
             meta.legalHold = legalHold;
         const obj = await s3.putObject(params.bucket, key, body, meta);
-        reply.type('application/xml').code(200).header('x-amz-checksum-sha256', checksumSha256).send(wrapXml('PutObjectResult', { ETag: obj.etag, ChecksumSHA256: checksumSha256 }));
+        reply.type('application/xml').code(200).header('ETag', obj.etag).header('x-amz-version-id', obj.versionId).header('x-amz-checksum-sha256', checksumSha256).send(wrapXml('PutObjectResult', { ETag: obj.etag, ChecksumSHA256: checksumSha256, VersionId: obj.versionId }));
     }
     async function getObject(request, reply) {
         const params = request.params;
@@ -527,10 +569,14 @@ export async function registerRoutes(fastify, s3, replication) {
             .header('Content-Disposition', metadata.contentDisposition || '')
             .header('Content-Encoding', metadata.contentEncoding || '')
             .header('x-amz-checksum-sha256', checksumSha256)
+            .header('x-amz-storage-class', metadata.storageClass)
+            .header('x-amz-version-id', metadata.versionId)
             .header('Accept-Ranges', 'bytes')
             .code(status);
         if (metadata.serverSideEncryption)
             reply.header('x-amz-server-side-encryption', metadata.serverSideEncryption);
+        if (metadata.expires)
+            reply.header('Expires', metadata.expires.toUTCString());
         if (metadata.sseKmsKeyId)
             reply.header('x-amz-server-side-encryption-aws-kms-key-id', metadata.sseKmsKeyId);
         if (metadata.objectLockMode)
@@ -551,7 +597,8 @@ export async function registerRoutes(fastify, s3, replication) {
         if (!key)
             return headBucket(request, reply);
         const query = request.query;
-        const { metadata } = await s3.getObject(params.bucket, key, query.versionId);
+        const object = await s3.getObject(params.bucket, key, query.versionId);
+        const { metadata } = object;
         reply.code(200)
             .header('ETag', metadata.etag)
             .header('Last-Modified', metadata.lastModified.toUTCString())
@@ -561,7 +608,11 @@ export async function registerRoutes(fastify, s3, replication) {
             .header('Cache-Control', metadata.cacheControl || '')
             .header('Content-Disposition', metadata.contentDisposition || '')
             .header('Content-Encoding', metadata.contentEncoding || '')
-            .header('x-amz-checksum-sha256', crypto.createHash('sha256').update((await s3.getObject(params.bucket, key)).data).digest('base64'));
+            .header('x-amz-checksum-sha256', crypto.createHash('sha256').update(object.data).digest('base64'))
+            .header('x-amz-storage-class', metadata.storageClass)
+            .header('x-amz-version-id', metadata.versionId);
+        if (metadata.expires)
+            reply.header('Expires', metadata.expires.toUTCString());
         if (metadata.serverSideEncryption)
             reply.header('x-amz-server-side-encryption', metadata.serverSideEncryption);
         if (metadata.sseKmsKeyId)
@@ -646,6 +697,36 @@ export async function registerRoutes(fastify, s3, replication) {
             const value = await s3.getBucketConfiguration(params.bucket, configuration);
             return reply.type('application/xml').send(wrapXml(configuration, value || {}));
         }
+        const listType = query['list-type'];
+        if (listType === '1') {
+            const marker = query.marker;
+            const result = await s3.listObjectsV2Advanced({
+                bucket: params.bucket,
+                prefix: query.prefix,
+                delimiter: query.delimiter,
+                maxKeys: query['max-keys'] ? Number(query['max-keys']) : undefined,
+                continuationToken: marker ? Buffer.from(marker).toString('base64url') : undefined,
+                encodingType: query['encoding-type'] === 'url' ? 'url' : undefined,
+            });
+            const encodeListValue = (value) => result.encodingType === 'url' ? encodeURIComponent(value) : value;
+            const lastKey = result.contents[result.contents.length - 1]?.key;
+            const lastPrefix = result.commonPrefixes[result.commonPrefixes.length - 1];
+            const nextMarker = lastPrefix || lastKey;
+            return reply.type('application/xml').send(wrapXml('ListBucketResult', {
+                Name: params.bucket,
+                Prefix: result.prefix,
+                Marker: marker,
+                NextMarker: result.isTruncated ? nextMarker : undefined,
+                MaxKeys: result.maxKeys,
+                IsTruncated: result.isTruncated,
+                Contents: result.contents.map(c => ({
+                    Key: encodeListValue(c.key), LastModified: c.lastModified.toISOString(), ETag: c.etag,
+                    Size: c.size, StorageClass: c.storageClass,
+                })),
+                CommonPrefixes: result.commonPrefixes.map(Prefix => ({ Prefix: encodeListValue(Prefix) })),
+                EncodingType: result.encodingType,
+            }));
+        }
         const result = await s3.listObjectsV2Advanced({
             bucket: params.bucket,
             prefix: query.prefix,
@@ -704,13 +785,22 @@ export async function registerRoutes(fastify, s3, replication) {
             .map(match => ({ partNumber: Number(readXmlTag(match[1], 'PartNumber')), etag: unescapeXml(readXmlTag(match[1], 'ETag') || '') }))
             .filter(part => Number.isInteger(part.partNumber) && part.partNumber > 0 && part.etag);
         const result = await s3.completeMultipartUpload({ bucket: params.bucket, key, uploadId: query.uploadId, parts });
-        reply.type('application/xml').send(wrapXml('CompleteMultipartUploadResult', { Bucket: result.bucket, Key: result.key, ETag: result.etag }));
+        reply.type('application/xml').header('ETag', result.etag).header('x-amz-version-id', result.versionId).send(wrapXml('CompleteMultipartUploadResult', { Bucket: result.bucket, Key: result.key, ETag: result.etag, VersionId: result.versionId }));
     });
     fastify.get('/:bucket/*', { exposeHeadRoute: false }, getObject);
     fastify.head('/:bucket/*', headObject);
     fastify.delete('/:bucket/*', deleteObject);
     fastify.get('/:bucket', { exposeHeadRoute: false }, listObjectsV2);
 }
+function hasOidcScope(scopes, required) {
+    return scopes.includes('*') || scopes.includes('s3:*') || scopes.includes(required);
+}
+function requiredOidcScope(request) {
+    const query = request.query;
+    if (query.policy !== undefined || query.acl !== undefined || query.encryption !== undefined || query.website !== undefined || query.logging !== undefined || query.notification !== undefined || query.replication !== undefined)
+        return 's3:admin';
+    return ['GET', 'HEAD', 'OPTIONS'].includes(request.method) ? 's3:read' : 's3:write';
+}
 function toXml(obj) {
     if (typeof obj !== 'object' || obj === null)
         return escapeXml(String(obj));