Release MStore v0.4.0 · moreum-tech/MBox

MStore v0.4.0

The admin API now requires administrator rights. /mstore/api/v1/*,
/mstore/console/* and /minio/admin/* previously accepted any
authenticated caller. They now require root, or an identity explicitly
granted s3:AdminAll on arn:mstore:admin:::*:
```
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:AdminAll", "Resource": "arn:mstore:admin:::*" }
  ]
}
```
The admin resource sits outside the arn:aws:s3::: namespace on purpose, so
an ordinary "full S3 access" policy does not confer admin rights. If you have
non-root tooling calling the admin API, attach the policy above before
upgrading or it will start receiving 403 AccessDenied.
Bucket operations are now authorized. CreateBucket, DeleteBucket and
HeadBucket were never policy-checked; any authenticated identity could
create or delete any bucket. They now require the corresponding grant
(s3:CreateBucket, s3:DeleteBucket, s3:HeadBucket, or s3:*) on the
bucket in question. An IAM user with no policy that previously created and
deleted buckets freely will now be denied.
ListBuckets is filtered per identity. It previously returned every
bucket on the server to any authenticated caller. It now returns only the
buckets the caller is allowed to list — root still sees everything, anonymous
sees only what a bucket policy opens up. This is a filter, not an error:
callers get a shorter list rather than a failure.

The version reported by /mstore/api/v1/version tracked the crate version,
which had not been bumped since v0.3.0 — v0.3.1 reported itself as 0.3.0.
The workspace version and Cargo.lock are now in step with the release tag.
installation.md showed an unsigned curl against /mstore/api/v1/version
in its smoke-test block. That path has always rejected anonymous callers, so
the example never worked.

resolve_identity_policies / collect_user_policies moved from
mstore-object::engine to mstore-auth::iam, shared by the object layer and
the new admin check.
The release pipeline builds tags (it previously only built main, so
scripts/release.sh pushed a tag that never triggered a build).

Linux (amd64):

tar xzf mstore-linux-amd64.tar.gz
sudo mv mstore-server mstore /usr/local/bin/
mstore-server /data

Docker:

docker load < mstore-docker.tar.gz
docker run -d --name mstore -p 9010:9010 -p 9011:9011 -v mstore-data:/data mstore:v0.4.0