Ruben Fiszel 83ed011e26 feat(object-store): make GCS service account key optional for Workload Identity (#9842) ...

build_gcs_client always called `.with_service_account_key(...)`, so an
absent key (the settings UI stores "no key" as the empty JSON object `{}`)
was handed to the builder and failed to parse instead of falling through
to the object_store crate's InstanceCredentialProvider. Skip the call when
the key is blank so GCS uses the instance's ambient credentials (GKE
Workload Identity / the GCP metadata server).

"Blank" (empty/whitespace/`{}`/`null`) is centralized in a shared
`gcs_service_account_key_is_blank` predicate so the build path and the
non-super-admin connectivity-test SSRF guard (`validate_object_storage_test`)
agree on what counts as "no key" — otherwise a blank key would bypass the
guard yet still trigger the ambient-credential fallback, letting an
untrusted caller probe arbitrary buckets with the server's instance role.

Also clarify the settings UI hint that the key may be left empty for
ambient credentials, and add regression tests for the blank-key build path
and the guard.

Fixes WIN-2110

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-30 15:57:26 +00:00

..

src

feat(object-store): make GCS service account key optional for Workload Identity (#9842)

2026-06-30 15:57:26 +00:00

Cargo.toml

refactor: extract object store into dedicated crate with filesystem backend (#7996)

2026-02-18 12:24:45 +00:00