feat: add source bucket DID to authorize response

commands/s3/codec_test.go

@@ -74,7 +74,10 @@ func TestAuthorizeOKRoundTrip(t *testing.T) {
 
 	in := &request.AuthorizeOK{
 		Bucket: ptr(did.MustParse("did:key:z6MkmNBgCewjYfEDTdKLpHkbMWUogJk29CxmiVdLeW4Kz3UG")),
-		Tenant: did.MustParse("did:plc:ewvi7nxzyoun6zhxrhs64oiz"),
+		// A copy across buckets: the source is a distinct DID, so a wrong key,
+		// map count or pointer decode for it cannot hide behind Bucket.
+		SourceBucket: ptr(did.MustParse("did:key:z6MkjFRxLLGdBqQSLkZbVnuwUFiomK8eGBkPtim9ETvP7vec")),
+		Tenant:       did.MustParse("did:plc:ewvi7nxzyoun6zhxrhs64oiz"),
 		Permissions: s3.PermissionSet{Entries: map[did.DID][]string{
 			access: {"s3:GetObject", "s3:PutObject"},
 		}},
@@ -109,6 +112,10 @@ func TestAuthorizeOKRoundTrip(t *testing.T) {
 	if !reflect.DeepEqual(*in, outJSON) {
 		t.Fatalf("DAG-JSON round-trip mismatch:\n got %#v\nwant %#v", outJSON, *in)
 	}
+	// The source travels under its own key, distinct from the addressed bucket.
+	if got := jb.String(); !strings.Contains(got, `"sourceBucket":"did:key:z6MkjFRxLLGdBqQSLkZbVnuwUFiomK8eGBkPtim9ETvP7vec"`) {
+		t.Fatalf("expected sourceBucket in DAG-JSON, got: %s", got)
+	}
 }
 
 func TestAuthorizeOKEmptyValuesRoundTrip(t *testing.T) {
@@ -127,6 +134,7 @@ func TestAuthorizeOKEmptyValuesRoundTrip(t *testing.T) {
 		t.Fatalf("UnmarshalDagJSON: %v\njson: %s", err, jb.String())
 	}
 	require.Nil(t, out.Bucket)
+	require.Nil(t, out.SourceBucket)
 	if len(out.Permissions.Entries) != 0 || len(out.Keys.Entries) != 0 || len(out.Delegations.Entries) != 0 {
 		t.Fatalf("expected empty maps, got %#v", out)
 	}

commands/s3/request/types.go

@@ -12,9 +12,9 @@ type AuthorizeArguments struct {
 }
 
 // AuthorizeOK is the successful result of `/s3/request/authorize`. It carries
-// the resolved bucket DID, the tenant DID, the S3 permission set for the access
-// key, the derived signing key(s) and the (24-hour TTL) delegations
-// re-delegated to the invocation issuer.
+// the resolved bucket DID (and, for a copy, the source bucket's), the tenant
+// DID, the S3 permission set for the access key, the derived signing key(s)
+// and the (24-hour TTL) delegations re-delegated to the invocation issuer.
 //
 // Its Permissions, Keys and Delegations fields are slice-valued maps that
 // cbor-gen / dag-json-gen cannot generate inline, but they are wrapped in
@@ -25,6 +25,12 @@ type AuthorizeOK struct {
 	// requests are bucket-scoped, so this field may be nil. e.g. CreateBucket,
 	// ListAllMyBuckets, etc.
 	Bucket *did.DID `cborgen:"bucket,omitempty" dagjsongen:"bucket,omitempty"`
+	// SourceBucket is the DID of the bucket a copy (CopyObject, UploadPartCopy)
+	// reads from, as resolved and authorized by the service; nil for any other
+	// request. It equals Bucket for a copy within one bucket. The gateway keys
+	// what it caches about the request's buckets by the DIDs the service
+	// names, so a copy across buckets names both.
+	SourceBucket *did.DID `cborgen:"sourceBucket,omitempty" dagjsongen:"sourceBucket,omitempty"`
 	// Tenant is the DID of the tenant the access key belongs to (the tenant's
 	// did:plc). The gateway resolves its DID document to obtain the tenant's
 	// wrap key — the FEE tenant recipient every stored object is encrypted to.