refactor: core S3 session credentials and ${file.PATH} refs; drop qqq#1165 stand-ins (QQQ RC.15) #28

2026-10-15T21:00:43Z

KofTwentyTwo commented

2026-10-15 21:00:43 +00:00

(Migrated from github.com)

Summary

This removes the QRun-IO/qqq#1165 stand-ins now that core has the same features (qqq#1234, released in QQQ 4.1.0-RC.15, which this PR pins).

SessionCredentialsClient removed. The session token now goes through core S3BackendMetaData.sessionToken, and S3ClientFactory signs with AwsSessionCredentials. The presigner gets its credentials from core S3ClientFactory.buildCredentialsProvider (static keys plus token, or the SDK default chain). The token still applies only when both keys resolve, as before.
SecretRefs file reading removed. SecretRefs keeps only the qbit allow-list. ${env}, ${prop} and ${file} all resolve through core QMetaDataVariableInterpreter.
Both STAND-IN(core=QRun-IO/qqq#1165, removeBy=4.1.0-RC.9) markers are gone, and G4 passes (0 violations) on RC.15.

Behavior change (platform rule: no filesystem)

Core reads ${file.PATH} read-only. It only reads inside allowed roots (after symlinks resolve), which default to /var/run/secrets and /run/secrets. Files over 1 MiB are refused, and contents are never logged. The qbit's default allow-list (file./var/run/secrets/storage/*) is already inside those roots. A host that mounts storage secrets somewhere else must set qqq.fileReference.roots or QQQ_FILE_REFERENCE_ROOTS. This is noted in the CHANGELOG and docs/S3-FACTORY-MIGRATION.md.

Coordination

This PR is separate from #27 (cluster caches, pinned to RC.14), as agreed with the HA agent. If both merge, RC.15 is the higher pin and supersedes RC.14. I did not touch #27's branch.

Tests

./mvnw verify on RC.15 passes: all tests and qbit guardrails, including G4 and G7 (no SNAPSHOT dependencies).
ConnectionRuntimeTest and InternalsTest now point qqq.fileReference.roots at their temp dirs. InternalsTest also asserts that a file outside the roots is not read. The real signing tests are unchanged: x-amz-security-token on streaming, put and paginator requests, request overrides preserved, and a presigned X-Amz-Security-Token.

🤖 Generated with Claude Code

## Summary This removes the QRun-IO/qqq#1165 stand-ins now that core has the same features (qqq#1234, released in **QQQ 4.1.0-RC.15**, which this PR pins). - **`SessionCredentialsClient` removed.** The session token now goes through core `S3BackendMetaData.sessionToken`, and `S3ClientFactory` signs with `AwsSessionCredentials`. The presigner gets its credentials from core `S3ClientFactory.buildCredentialsProvider` (static keys plus token, or the SDK default chain). The token still applies only when both keys resolve, as before. - **`SecretRefs` file reading removed.** `SecretRefs` keeps only the qbit allow-list. `${env}`, `${prop}` and `${file}` all resolve through core `QMetaDataVariableInterpreter`. - Both `STAND-IN(core=QRun-IO/qqq#1165, removeBy=4.1.0-RC.9)` markers are gone, and **G4 passes** (0 violations) on RC.15. ### Behavior change (platform rule: no filesystem) Core reads `${file.PATH}` read-only. It only reads inside allowed roots (after symlinks resolve), which default to `/var/run/secrets` and `/run/secrets`. Files over 1 MiB are refused, and contents are never logged. The qbit's default allow-list (`file./var/run/secrets/storage/*`) is already inside those roots. A host that mounts storage secrets somewhere else must set `qqq.fileReference.roots` or `QQQ_FILE_REFERENCE_ROOTS`. This is noted in the CHANGELOG and `docs/S3-FACTORY-MIGRATION.md`. ### Coordination This PR is separate from #27 (cluster caches, pinned to RC.14), as agreed with the HA agent. If both merge, RC.15 is the higher pin and supersedes RC.14. I did not touch #27's branch. ## Tests - `./mvnw verify` on RC.15 passes: all tests and qbit guardrails, including G4 and G7 (no SNAPSHOT dependencies). - `ConnectionRuntimeTest` and `InternalsTest` now point `qqq.fileReference.roots` at their temp dirs. `InternalsTest` also asserts that a file outside the roots is not read. The real signing tests are unchanged: `x-amz-security-token` on streaming, put and paginator requests, request overrides preserved, and a presigned `X-Amz-Security-Token`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-object-storage#28