[I] Allow trusted custom endpoints for S3 Express CreateSession [opendal-reqsign]

["Xuanwo (via GitHub)" <gi...@apache.org>]

Xuanwo opened a new issue, #838:
URL: https://github.com/apache/opendal-reqsign/issues/838

   ## Context
   
   `S3ExpressSessionConfig` currently validates the AWS directory-bucket naming scheme and always constructs an AWS or AWS China Zonal endpoint. This is the correct safe default, but it leaves no explicit integration path for an S3-compatible service that implements the S3 Express CreateSession wire protocol at a custom endpoint.
   
   A storage client can expose an opt-in such as `enable_s3_express_session_auth` for endpoints that it cannot safely auto-detect. reqsign currently cannot represent that explicit trusted-endpoint configuration without the caller reimplementing CreateSession.
   
   This override is not a claim that an AWS general-purpose bucket supports CreateSession. AWS directory buckets should continue to use strict naming and derived Zonal endpoints. The custom path exists only when the caller explicitly identifies a compatible trusted endpoint.
   
   ## Proposed contract
   
   Add an additive trusted custom-endpoint configuration path, following the safety model used by `S3AccessGrantsConfig::with_trusted_endpoint` where appropriate.
   
   The contract should:
   
   - require explicit caller opt-in;
   - bind the bucket, signing Region, and trusted CreateSession endpoint before source credential loading;
   - allow a compatible endpoint to opt out of AWS directory-bucket name and DNS derivation rules;
   - validate the endpoint before I/O, including scheme, authority, user information, path, and query constraints;
   - document that AWS authorization headers and a source session token can be sent to this endpoint;
   - leave the existing strict AWS constructor behavior unchanged.
   
   The exact API shape is open to discussion. A separate constructor may be clearer than weakening validation in the standard AWS constructor.
   
   ## Acceptance criteria
   
   - Standard AWS configuration still rejects invalid directory-bucket names and derives the same endpoints.
   - A trusted custom endpoint produces the exact configured CreateSession authority and `/?session` request.
   - Invalid or untrusted endpoint forms fail before credential-provider I/O.
   - Standard and temporary source IAM credentials sign the custom request correctly.
   - Tests confirm that endpoint and credential material remain redacted from sensitive error paths and Debug output.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] Allow trusted custom endpoints for S3 Express CreateSession [opendal-reqsign]

["Xuanwo (via GitHub)" <gi...@apache.org>]

Xuanwo closed issue #838: Allow trusted custom endpoints for S3 Express CreateSession
URL: https://github.com/apache/opendal-reqsign/issues/838


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@opendal.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org