Add OCI Object Storage: buckets, objects, multipart, PARs

[arunesh-j]

Summary

• Implements OCI Object Storage against the existing portable storage driver.
• Namespaces, buckets, objects, multipart, versioning, retention rules, lifecycle policies, and Pre-Authenticated Requests.
• Nothing added to services/storage/driver — OCI-only behaviour is a consumer-side Extras interface, per the rule set in Move OCI-only capabilities out of shared driver packages #393.

Closes #410. Part of #376.

Changes

• providers/oci/objectstorage/ — Mock over memstore implementing driver.Bucket, guarded by a sync.RWMutex: namespace derivation, buckets, objects, versioning, multipart, retention, PARs.
• server/oci/objectstorage/ — the /n/{namespace}/b/{bucket}/o/{object} surface plus PAR redemption at /p/{token}/n/….
• Wiring is one line each in providers/oci/oci.go and server/oci/oci.go.

Operations

Namespace + metadata; bucket create/get/head/update/delete/list; object put/get/head/delete/list (prefix, delimiter, paging); rename and updateObjectStorageTier; async copyObject; multipart create/upload/list-parts/commit/abort/list; object versions (Disabled/Enabled/Suspended, version-addressable GET/HEAD/DELETE, delete markers, objectversions); retention rules with lock semantics; lifecycle policy PUT/GET/DELETE; PARs including redemption.

PARs are modelled as real resources

A PAR gets its own OCID, timeExpires, an opaque redemption token, and is listable and revocable — not a fabricated signature. GeneratePresignedURL creates one, so the URL it returns actually works and can be revoked. Demonstrated in the transcript: read-only PAR serves GET, refuses PUT with 403, and 404s after revocation.

Compartment scoping — one deliberate narrowing

Only ListBuckets calls RequireCompartmentID; it is the one collection real OCI scopes by compartment. Object, PAR, retention and upload lists are bucket-scoped and take no compartmentId, so requiring it would reject calls real OCI accepts. CreateBucket requires it in the body. Stated in the package doc.

Never accept-and-ignore

Rejected by name rather than silently dropped: bucket policies (→ Identity policies), CORS, object tags (→ opc-meta-), reencrypt, restoreObjects, multipart partsToExclude, cross-namespace copy, more than one lifecycle inclusionPrefix, disabling encryption, versioning back to Disabled, and unknown access types / tiers / time units.

reencrypt is a 501 rather than a 202: with no per-object key material there is nothing to re-wrap, and a 202 there would be theatre.

Provider Coverage

• AWS
• Azure
• GCP
• OCI

Checklist

• All tests pass (go test ./...) — exit 0, 272 packages
• Linter passes (golangci-lint run --timeout=9m) — 0 issues
• Every provider the change applies to implements the same behavior — OCI-only, additive
• Integration tests added to cloudemu_test.go — driver + handler tests instead
• Unit tests added to provider test files

Test Plan

go build ./...                                              clean
go test ./...                                               exit 0, 272 packages
go test -race ./providers/oci/... ./server/oci/...          11/11 ok
golangci-lint run --timeout=9m ./providers/oci/... ./server/oci/...   0 issues
go generate ./...                                           docs/coverage committed

Coverage leak check clean: no OCI operation appears in docs/coverage/{aws,azure,gcp}/*.md, and git diff development -- services/ is empty.

End-to-end on a running server (port 4611):

GET  /n                                     -> namespace 30aa137d4542
POST /n/{ns}/b                              -> 200, ocid1.bucket.oc1.iad..., etag, Standard tier
PUT  /o/holiday/beach.txt (opc-meta-owner)  -> 200, Etag + Opc-Content-Md5 + Opc-Meta-Owner
GET  /o/holiday/beach.txt                   -> 200 "sun and sea", metadata round-trips
GET  /o?prefix=holiday/&delimiter=/         -> 200, one object
GET  /b?compartmentId=...                   -> 200, one bucket
delete object / bucket / get deleted        -> 204, 204, 404

POST /n/{ns}/b/docs/p                       -> 200, PAR with accessUri
GET  /p/{token}/n/{ns}/b/docs/o/report.txt  -> 200 "quarterly"
PUT  (same URI, read-only PAR)              -> 403
DELETE the PAR, then GET                    -> 204, then 404
POST /b/docs/actions/copyObject             -> 202 + Opc-Work-Request-Id
poll work request                           -> SUCCEEDED, COPY_OBJECT, object CREATED

Note on the suite

Other Wave 2 branches see a pre-existing failure in cmd/cloudemu TestServeOutOfProcess ("AWS endpoint never became ready") which reproduces on clean development — it spawns a child process that cannot bind a listener in a sandbox. It passed on this run; flagging it as flaky-environmental rather than related to this change.

[NitinKumar004]

Review notes

Real data-plane engine (per #427): N/A — OCI Object Storage is object storage, which is explicitly NOT engine-eligible under the #427 model (ComputeEngine/DatabaseEngine/CacheEngine/FunctionEngine/ContainerEngine).

Findings

High · wire-fidelity — GetNamespaceMetadata (GET /n/{ns}) is misrouted to ListBuckets when the tenancy namespace begins with 'b'
server/oci/objectstorage/handler.go:287
If a user's tenancy hashes to a namespace starting with 'b' -> every GetNamespaceMetadata call (GET /n/{ns}) returns 400 'compartmentId is required' instead of the metadata body -> S3/Swift-compat setup and any SDK flow that reads namespace metadata breaks non-deterministically for ~6% of tenancies, while the identical code works for everyone else. Fix: carry a 'hadBucketSegment' bool out of parseNamespaced instead of re-sniffing the raw path.

serveBucketCollection distinguishes /n/{ns} from /n/{ns}/b with strings.Contains(r.URL.Path, "/"+segBuckets) (segBuckets=="b"). The parsed route already discards whether a /b segment was present, so this substring heuristic is the only signal. For a namespace whose first char is 'b', the path "/n/b25a97828eed" contains the substring "/b", so the request falls through to the GET branch = listBuckets, which requires compartmentId. Reproduced with tenancy "ocid1.tenancy.oc1..probe0100" -> namespace

Medium · docs — docs/services.md not updated with OCI Object Storage (Definition-of-done item)
docs/services.md:59
If a reader consults docs/services.md to learn which OCI services cloudemu emulates -> Object Storage is invisible there even though it is fully implemented -> the service is undiscoverable via the canonical human-facing doc, and the PR fails a stated done-criterion (a future migration-drift CI check keys off this file).

docs/oci-conventions.md Definition of done requires 'Operations added to docs/services.md'. The storage section header (line 59) still reads 'AWS: S3 | Azure: Blob Storage | GCP: GCS' with no 'OCI: ObjectStorage' entry, unlike networking (line 407 'OCI: VCN ...'), OCI Monitoring (623) and Identity (670) which each have OCI subsections. Only the generated docs/coverage/* files were updated in the diff; the hand-maintained services.md was not touched.

Medium · coverage — Changed packages below the 90% pillar; lifecycle-expiry and versioning wrappers untested
providers/oci/objectstorage/retention.go:366
If EvaluateLifecycle mis-evaluates expiry (e.g. off-by-one on the ExpirationDays*24h window, or a prefix mismatch) -> a caller relying on lifecycle-expiry reporting gets wrong object lists -> the regression ships silently because no test exercises the aged-out branch. Add a FakeClock test that advances past ExpirationDays and asserts the expired name, plus a HeadObjectVersion and portable-versioning round-trip.

go test -cover: providers/oci/objectstorage 66.2%, server/oci/objectstorage 71.6% (pillar target 90%). 0%-covered flows include EvaluateLifecycle + objectExpired (retention.go:366/399 — object age-out evaluation is never asserted by any test), HeadObjectVersion (versioning.go:228), and the portable SetBucketVersioning/GetBucketVersioning wrappers (versioning.go:140/159). TestBucketLifecycleCRUD stores and reads a policy but never drives an object past its ExpirationDays to confirm EvaluateLifecy

Low · wire-fidelity — ListObjects default page size is 100, not OCI's 1000
server/oci/objectstorage/object.go:233
If a client lists a bucket of 500 objects without an explicit limit -> it receives 100 + a nextStartWith cursor and must paginate 5x -> extra round-trips and a subtle behavioral difference from real OCI. Minor and partly a shared-ocirest.DefaultLimit choice; note only.

listOptions sets MaxKeys: ocirest.Limit(r), which returns ocirest.DefaultLimit (100) when 'limit' is absent and is always >=1, so the provider's defaultListLimit (1000, matching real OCI) at object.go:15 is never reached from the wire path. Real OCI ListObjects returns up to 1000 per page by default.

Low · coverage — No oci-go-sdk SDK-compat test
server/oci/objectstorage/handler_test.go:1
If the handler's wire shape drifts from what the real SDK emits/expects (header casing, envelope fields) -> hand-rolled tests that mirror the handler's own assumptions won't catch it -> a real SDK user hits the mismatch first. Recommended, not blocking.

Convention: 'An SDK-compat test using github.com/oracle/oci-go-sdk against httptest.NewServer is the strongest evidence the handler is right. Add one where the SDK makes it practical.' All wire tests are hand-rolled httptest requests; no oracle/oci-go-sdk client is driven against the handler.

[arunesh-j]

Rebased onto current development (now 58787e9a) and addressed the findings in f2854465.

High — GET /n/{ns} misrouted when the namespace starts with b

You were right about the cause and the fix. route now carries HasBucketSeg, set in parseNamespaced when a /b segment is genuinely parsed; serveBucketCollection branches on that instead of strings.Contains(r.URL.Path, "/b").

Regression test TestNamespaceMetadataWithBPrefixedNamespace uses your exact repro tenancy ocid1.tenancy.oc1..probe0100 → namespace b25a97828eed. Reverting the fix:

--- FAIL: TestNamespaceMetadataWithBPrefixedNamespace
    expected: 200   actual: 400
    {"code":"InvalidParameter","message":"compartmentId is required"}

Confirmed live on the built binary, including that the collection is not over-corrected:

GET /n                  -> "b25a97828eed"
GET /n/b25a97828eed     -> 200 {"namespace":"b25a97828eed","defaultS3CompartmentId":...}
GET /n/b25a97828eed/b   -> 400 compartmentId is required   (still required, as it should be)

Medium — docs/services.md

Added an OCI Object Storage subsection under §1 Storage in the VCN/Monitoring/Identity format: a 36-row operation→route table plus prose on compartment-scoped ListBuckets, the 1000 page size, async copyObject, the versioning tri-state, retention locking, the storage-engine seam, and the two unemulated actions.

Medium — coverage

66.2% → 93.9% provider, 71.6% → 94.9% wire. Every gap you named is covered: EvaluateLifecycle/objectExpired via a config.FakeClock test that steps to one hour short of the window (asserts nothing expires) and then past it (asserts exactly the enabled logs/ names), plus HeadObjectVersion and a portable SetBucketVersioning/GetBucketVersioning round-trip.

Low — ListObjects page size

listLimit returns 0 when no limit is present, letting the provider's defaultListLimit (1000) apply. ocirest.DefaultLimit is untouched for other services. Live: 120 objects with no limit → all 120 and an empty cursor; limit=50 → 50 plus a cursor.

Low — SDK-compat test: not added, deliberately

oracle/oci-go-sdk/v65 requires a signed request built from an RSA keypair and a ConfigurationProvider. This emulator verifies no signature, so the client would mostly exercise its own signing rather than the handler's wire shape, and every sibling OCI service here is tested with hand-rolled httptest requests. I judged the dependency disproportionate. Instead I added contrib/realengine/blobstore/oci_test.go — a real over-HTTP E2E through httptest.NewServer plus the filesystem engine — with that reasoning recorded in its doc comment. Happy to revisit if you'd rather have the SDK dependency.

On the "engines N/A" note — I think Object Storage is engine-eligible

Your N/A referred to #427's compute-shaped engines, but services/storage/storageengine is a different seam, and its own package doc named AWS/Azure/GCP with OCI the only storage provider not wired to it. Now wired in providers/oci/objectstorage/engine.go across put, get, delete, rename, copy, multipart-commit and every versioned path, keyed by version id like S3.

Two design notes: the engine call happens under the write lock (S3 nils the byte slice after releasing it, which races a concurrent reader), and objectData/objectVersion gained a Size field so Head/List/approximateSize stay correct once bytes are offloaded.

Three defects found that were not in the review

1. Object Storage metrics were silently dropped. The provider publishes to oci_objectstorage; providers/oci/monitoring rejected any oci_-prefixed namespace as Oracle-reserved, and emitMetric discards its error — so no metric was ever recorded. The reservation exists to stop customer posts, so it now applies to PostMetricData (customer-facing) and not to PutMetricData (the seam Oracle's own emulated services use). This touches an already-merged service, so say the word and I'll split it into its own PR.
2. HeadObject returned no Content-Length and Content-Type: application/json (inherited from the JSON helper). A HEAD has no body, so SDKs read the size from the header. Now served by a dedicated writeHead.
3. Persistence guard. Upstream Evolve persist/ to per-driver, identity-preserving snapshotting (full-surface) #582 added TestSnapshotCompleteness, which failed the suite for this provider. Added snapshot.go plus round-trip tests covering buckets, objects, version chains, PARs with their redemption tokens, retention rules and lifecycle — so an access URI issued before a snapshot still redeems after restore.

One scope addition for your call

The tenancy was unreachable from the CLI (AWS account-id, Azure subscription and GCP project all are), so the b-prefixed namespace could not be driven through the shipped binary at all. Added --oci-tenancy (server/serveflags, its pinned flag-name guard, and docs/standalone-server.md). Cleanly separable if you'd rather keep this PR narrow.

Verification

go build ./...                                   clean
go test ./...                                    exit 0, 342 packages
go test -race ./providers/oci/... ./server/oci/...   11/11 ok
golangci-lint (all changed packages)             0 issues
go test -cover  provider 93.9%   wire 94.9%
go generate ./...                                docs/coverage committed
no OCI op in docs/coverage/{aws,azure,gcp}/*.md  confirmed

The only remaining lint in ./providers/oci/... is 7 pre-existing gocritic findings in vcn/nsg.go and identity/portable.go, which reproduce on clean development.

E2E on port 4611 also exercised: bucket CRUD and the versioning:"On" rejection, object put/get/head/list with prefix+delimiter, version list / read-by-version / delete markers, rename, async copy (202 + opc-work-request-id), storage tier, both 501s, multipart including the partsToExclude 501, PARs (redeem, write-refused, wrong-object refused, list, delete), retention (create/get/update, MONTHS refused, object held, delete) and lifecycle (YEARS→365 days, unknown action refused, multi-prefix refused). Happy to paste the full transcript if useful.

[NitinKumar004]

Review — OCI Object Storage

Verdict: Approve (no blockers). This is the largest and highest-risk surface here (object bytes + multipart + PARs), and it's exemplary — it reuses the portable storagedriver.Bucket interface exactly as S3/GCS/Azure do, stores object bytes in-memory the way S3 does (no external engine required; optional engine offload), and follows the existing ocirest + server/oci/* conventions precisely.

Non-blocking

• Enabling versioning on a bucket that already has objects drops the pre-existing object — providers/oci/objectstorage/versioning.go:18-41 (setVersioningLocked/storeObjectLocked). Reproduced: create unversioned bucket → PUT object → enable versioning → PUT overwrite → objectversions lists only the new version; the original is neither a null version nor recoverable. Real OCI retains the pre-existing object as the null version and preserves it on the next overwrite. The common IaC path (versioning = "Enabled" declared at bucket create) works perfectly — this only bites a create-then-enable sequence.
• Object ETag is content-addressed (sha256 of bytes) — providers/oci/objectstorage/objectstorage.go:327 (objectETag). Real OCI mints a fresh opaque ETag per PUT; here an identical re-PUT yields the same ETag, and two distinct objects with identical content share one. A client using If-Match/If-None-Match on ETag could see a stale-looking match after an identical re-upload.
• Generic OCI error codes from the shared codec — server/wire/ocirest/ocirest.go:75-98 (statusFor). Bucket-not-empty → 409 IncorrectState and duplicate create → 409 Conflict, where real OCI uses BucketNotEmpty / BucketAlreadyExists. Pre-existing shared behavior (not introduced here); noting because it now affects object-storage fidelity for a client branching on the exact code string.
• CompleteMultipartUpload assembles the whole object via repeated append under the global write lock — providers/oci/objectstorage/multipart.go:155-164. A multi-GB commit does a large memcpy while holding m.mu, briefly blocking unrelated buckets. Bounded by uploaded data and consistent with the cohesive-mock single-mutex design; acceptable.

Verified good

Full lifecycle over the wire: get-namespace → create bucket → PUT object bytes → GET/HEAD bytes match with stable ETag/opc-content-md5 across GET/HEAD/List → multipart create/upload-parts/commit assembles in ascending part order → abort invalidates the upload → PAR create + redeem returns bytes, read-only PAR write → 403, GET PAR omits accessUri → versioning enable + overwrite lists versions with delete markers (newest-first, isLatest) → delete → 204 → GET-after-delete → 404 → delete non-empty bucket → 409. Computed IDs/namespace/etag/timeCreated stable across reads; Snapshottable present and auto-discovered (persistence round-trips objects + versions + PAR tokens); object size / part count / list page size all bounded; single-mutex spans check-then-set on every create (no TOCTOU race); reads deep-copy; -race clean; structure/lint/go generate and the full CI matrix all green.

[NitinKumar004]

This PR no longer merges with development, and against a running serve I hit a routing collision, PAR URLs that break after a restore, and lifecycle and conditional-request gaps that a real client would notice.

Earlier review points

• GET /n/{ns} misrouted for a namespace starting with b: fixed. HasBucketSeg is in place and TestNamespaceMetadataWithBPrefixedNamespace passes.
• docs/services.md: fixed.
• Coverage: fixed. It is now 96.0% (provider) and 95.5% (wire).
• ListObjects default page size: fixed. It is 1000 when no limit is given.
• oci-go-sdk compat test: not added. The author explained why. That is fine with me, but see the Terraform note under Checked.
• Enabling versioning after objects exist drops the original: still open. Details are under Medium.
• Content-addressed object ETag: still open. objectETag is still sha256 of the bytes.
• Generic error codes (Conflict / IncorrectState instead of BucketAlreadyExists / BucketNotEmpty): still open.
• Multipart commit runs under the global lock: unchanged, and acceptable as noted before.

High

1. Does not merge with current development

• Conflicts are in contrib/realengine/blobstore/blobstore.go, where development reworded the package doc, and in docs/coverage/README.md, which is generated.
• After resolving them, go run ./internal/coveragegen still changes docs/coverage/README.md, because the storage row has no OCI link. It also changes docs/coverage/oci/objectstorage.md.
• Fix: rebase on development, rerun go generate ./... and commit the output.
• On the merged tree, go build ./... and go vet are clean. Tests pass for providers/oci, server/oci, persist (TestSnapshotCompleteness), internal/coveragegen, serveflags, serverkit and seed. -race passes on providers/oci and server/oci.

2. The work request handler takes over Object Storage paths (server/oci/oci.go:86, server/oci/workrequest/workrequest.go:200)

• The workrequest handler is registered first. It claims any GET whose path has a workRequests segment followed by at most two more segments. Object keys and bucket names are user data, so real objects become unreachable.
• Repro against serve:
  • PUT /n/{ns}/b/tfb/o/workRequests/x returns 200. GET on the same path returns 404 {"code":"NotAuthorizedOrNotFound","message":"work request x not found"}.
  • Create a bucket named workRequests, then GET /n/{ns}/b/workRequests returns 400 compartmentId is required.
• Fix: have the workrequest handler ignore /n/... and /p/... paths. Or register Object Storage before it, since its Matches is anchored at /n and /p/{token}/n. Add a test with a key and a bucket named workRequests.

Medium

3. PAR tokens collide after a persist restart (providers/oci/objectstorage/par.go:123)

• The redemption token comes from idgen.GenerateID(""), which is the process counter. On restart that counter starts again from 1 while restored PARs keep their tokens.
• Repro:
  1. Start serve --providers oci --persist --persist-strategy on-shutdown --state-file s.json.
  2. Create a PAR on bucket secret. Its access URI is /p/00000007/....
  3. Restart, then create a PAR on bucket public. It also gets /p/00000007/... and the same PAR OCID.
  4. Now GET /p/00000007/n/{ns}/b/secret/o/payroll.csv returns 403 on every attempt.
• This breaks the claim that an access URI issued before a snapshot still redeems after restore.
• Fix: mint the token from crypto/rand. idgen already has random helpers. Also check for collisions in ResolvePAR, or key PARs by token.

4. Enabling versioning after objects exist loses the original object (providers/oci/objectstorage/versioning.go:18)

• Repro: PUT k = "original", then UpdateBucket {"versioning":"Enabled"}, then PUT k = "second". GET /objectversions lists one version, and "original" is gone.
• setVersioningLocked only allocates the history map. It never seeds the existing objects as versions.
• Fix: when versioning moves to Enabled, add each current object to its chain before the first overwrite.

5. Lifecycle rules do not round-trip (server/oci/objectstorage/lifecycle.go:141, :129, types.go:221)

• PUT {"timeAmount":1,"timeUnit":"YEARS"} reads back as timeAmount:365,timeUnit:"DAYS". Any client that compares the policy it set with what it reads back will see a diff.
• target and objectNameFilter.inclusionPatterns / exclusionPatterns are silently dropped. Repro: PUT a DELETE rule with target:"previous-object-versions" and inclusionPatterns:["*.log"]. It is accepted with 200, and GET returns a plain DELETE rule with no target and no filter, so the rule would now act on live objects.
• The PR says nothing is accepted and then ignored, but that is not the case here.
• Fix: store the unit, target and all three filter lists as sent. Reject ABORT unless the target is multipart-uploads. Return the policy's timeCreated.

6. Conditional and range headers are ignored (server/oci/objectstorage/object.go:56, :94)

• PUT with if-none-match: * on an existing object returns 200 and overwrites it. PUT with if-match: bogus also returns 200 and overwrites. Real OCI answers 412 IfNoneMatchFailed / IfMatchFailed.
• GET with Range: bytes=0-2 returns 200 with the full body. Real OCI returns 206 with Content-Range. Ranged and parallel downloads (CLI, rclone, SDK range reads) get the wrong bytes.
• Fix: honour if-match and if-none-match on Put, Get, Head and Delete object and on UpdateBucket/DeleteBucket. Also support a single byte range on GetObject.

7. UpdateBucket silently ignores a rename (server/oci/objectstorage/types.go:28)

• UpdateBucketDetails.name renames the bucket in OCI. Here POST /n/{ns}/b/tfb {"name":"tfb2"} returns 200 with name:"tfb", and GET /b/tfb2 returns 404.
• Fix: support the rename and move the bucket's stores under the new key. If that is out of scope, reject a name that differs from the current one with 400.

8. Compartment existence is not checked (server/oci/objectstorage/bucket.go:36, providers/oci/objectstorage/bucket.go:112, :195)

• CreateBucket with compartmentId: "ocid1.compartment.oc1..doesnotexist" returns 200.
• Development now rejects that for VCN through SetCompartmentChecker (#1295). Real OCI answers 404 NotAuthorizedOrNotFound.
• Fix: wire the same identity-backed checker in server/oci/oci.go for create and for the compartmentId move on update.

9. PAR rules are stricter than OCI (providers/oci/objectstorage/par.go:16, :144, :96)

• A timeExpires three months out is rejected with exceeds the maximum lifetime of 168h0m0s. Seven days is the S3 presign limit. OCI PARs commonly live for months or years, for example a Terraform time_expires a year out.
• AnyObjectRead with objectName:"logs/" is rejected. OCI treats objectName on the AnyObject types as a prefix.
• Fix: drop the cap or raise it far enough not to reject realistic values, and support prefix-scoped bucket PARs in PARAllows.

Low

• Error codes (server/wire/ocirest/ocirest.go:75): a duplicate bucket returns 409 Conflict and a non-empty bucket returns 409 IncorrectState. OCI uses BucketAlreadyExists and BucketNotEmpty. Map these in the Object Storage handler rather than in the shared codec.
• ETag is a content hash (providers/oci/objectstorage/objectstorage.go:327): two identical PUTs return the same ETag. Once item 6 lands, if-match will treat a re-upload as unchanged. Mint an opaque ETag per write.
• Pagination is missing: ListBuckets, ListObjectVersions, ListPreauthenticatedRequests and ListMultipartUploads ignore limit and page and never set opc-next-page. objectversions?limit=1 returned all 3 versions.
• copyObject drops fields (server/oci/objectstorage/object.go:323): destinationRegion is required by OCI but not checked. eu-frankfurt-1 was copied locally with 202. destinationObjectMetadata, destinationObjectStorageTier and the if-match fields are dropped. Reject a foreign region and apply or reject the other fields.
• Multipart commit does not check ETags (server/oci/objectstorage/multipart.go:131): partsToCommit with "etag":"wrong-etag" commits successfully. Compare each part's ETag.
• Bucket names are not validated: "bad name!" is accepted. OCI allows letters, digits, -, _ and ., up to 256 characters.

Checked

• Real-user flow on serve --providers oci over raw HTTP:
  • Bucket create, then GET twice (byte-identical), update, list and delete.
  • Object put, get and head (Content-Length and type correct).
  • Version list and delete markers.
  • Async copy returns 202, and /workRequests/{id} reports SUCCEEDED.
  • Multipart create, upload and commit.
  • PAR redeem works, write through a read PAR returns 403, and redeem after revoke returns 404.
  • Wrong namespace returns 404, and deleting a missing object returns 404.
• Terraform with oracle/oci was not run. The provider has no per-service endpoint override I know of, so it cannot reach a local port without DNS and TLS interception.
• Wiring: provider factory, DriversFrom, monitoring wiring, resource discovery and the seed target all pick up Object Storage.
• Snapshot: Snapshottable is discovered by the persist completeness test.
• Architecture: behaviour lives in the provider and the wire layer delegates, so the library and serve behave the same.
• Lint and format: golangci-lint is clean on the new packages, and gofmt is clean.
• --enforce-auth: there is no OCI authorization gate on development, so there is nothing to declare for this handler.

[NitinKumar004]

Please merge the latest development into this branch (a merge is fine, no need to rebase). It is well behind now, and docs/coverage/README.md conflicts. After merging, run go generate ./... and commit the regenerated docs/coverage, then push. I'll re-review once it's up to date with the findings above addressed.

[arunesh-j]

Rebased onto 770204c3 and addressed every finding: the High, all Mediums and all Lows, with nothing deferred. The work is in a29e8483, plus 329035ec, which aligns the monitoring change with #421 (explained at the end).

High

1. Rebase. blobstore.go now uses development's "(no Docker)" wording with the OCI mention re-applied. docs/coverage/README.md is regenerated, so the storage row carries the OCI link and docs/coverage/oci/objectstorage.md is updated.

2. Work requests taking over Object Storage paths. Fixed at the root in server/oci/workrequest, because the matcher is shared by every OCI service. workRequests now matches only directly after a YYYYMMDD version segment, or as the first segment. Neither form can match a /n/... or /p/... path.

One deviation from a pure version-anchored rule: I kept the unversioned /workRequests/{id} form, because that is where Object Storage's own GetWorkRequest lives. Matching only /{date}/workRequests would have broken polling for a copy's work request.

TestWorkRequestsNamedObjectAndBucketStayReachable runs through the full server. On the old matcher it fails with your 400; it now passes, with both poll forms returning SUCCEEDED. Every server/oci/... test passes.

Medium

3. PAR tokens after a persist restart. Tokens are now 48 bytes from crypto/rand, base64url, with a collision check. The PAR OCID is also collision-checked, because it collided too. TestPARsDoNotCollideAfterRestore resets the id counter and replays the same sequence; without the fix it reproduces the duplicate OCID and token, with the old token resolving to the public bucket.

Worth flagging beyond this PR: every OCI service mints OCIDs from that process counter, and persist never advances it. That is the underlying cause, and it can affect any OCI service across a restore. I've fixed the PAR case here, but the general fix belongs in a separate change.

4. Versioning after objects exist. Turning versioning on now records every existing object as a version, moving its engine bytes to the versioned key. Covered for all three ways of enabling it, with and without an engine.

5. Lifecycle round-trip. The provider stores the OCI policy itself rather than the portable shape: unit, target, all three filter lists and timeCreated, all as sent. ABORT requires the multipart-uploads target. Only rules aimed at objects select live objects, with prefixes and patterns applied. A rule the portable shape cannot express is reported as Unimplemented on the portable read path rather than being flattened.

6. Conditional and Range headers. Preconditions are honoured everywhere you listed, plus both sides of copyObject. A failed write or delete precondition returns 412 IfMatchFailed/IfNoneMatchFailed. A single byte range returns 206 with Content-Range, an unsatisfiable range 416, and a multi-range request a 400 rather than the full body.

One deviation: a matching if-none-match on GET/HEAD returns 304, not 412, as HTTP and OCI's GetObject define it.

7. UpdateBucket rename. Implemented: objects, versions, PARs and engine bytes move to the new name. A taken name returns BucketAlreadyExists, and a different namespace is refused rather than ignored.

8. Compartment check. Mirrors development's VCN pattern exactly, wired from identity.Compartments in server/oci/oci.go, on create and on a compartmentId move.

9. PAR rules. The week cap is removed, so a PAR a year out is accepted. objectName on the AnyObject types is a prefix. timeExpires is now required, as in OCI; it used to be silently defaulted, and only the portable presign wrapper keeps a default.

Lows (all done)

• BucketAlreadyExists / BucketNotEmpty mapped in the Object Storage handler, not the shared codec.
• ETags are an opaque UUID per write, so if-match no longer treats a re-upload as unchanged.
• limit/page and opc-next-page work on ListBuckets, ListObjectVersions, ListPARs, ListMultipartUploads and ListParts.
• copyObject requires destinationRegion and rejects a foreign one; source version, both ETag preconditions, metadata and storage tier are all applied.
• Multipart commit requires and compares each part's etag.
• Bucket names are validated.

Aligning with #421 (329035ec)

This branch and #421 both touched providers/oci/monitoring, with different diffs, so whichever merged second would have conflicted. I took #421's version byte-for-byte: monitoring.go is back to development's version, and the only change is in metrics.go.

This also means PutMetricData again refuses oci_ namespaces from portable callers, which the #421 reviewer flagged as too permissive. Object Storage now emits through the dedicated PostServiceMetricData path, into the bucket's own compartment, keyed by resourceId. TestMetricsLandInTheBucketCompartment covers it and fails if the bucket-compartment lookup is removed. The existing TestMetricsEmission also still guards the original silent-drop bug, since an emitter going through PutMetricData would now record nothing.

Verification

go build ./...                                       clean
go test ./... (excluding cmd/cloudemu)               exit 0, 524 packages
go test -race providers/oci + server/oci             clean
golangci-lint (objectstorage x2, workrequest,
               server/oci, monitoring)               0 issues
coverage                                             provider 94.4%, wire 95.6%
go generate ./...                                    committed; idempotent
git diff origin/development -- cmd/                  empty

cmd/cloudemu was excluded locally only because parallel worktree suites collide on the shared ~/.cloudemu daemon; this branch touches nothing under cmd/, and CI runs it in isolation.

E2E against serve on :4611

PUT  /n/{ns}/b/tfb/o/workRequests/x      -> 200
GET  same                                -> "payload"
create bucket "workRequests"             -> 200
GET  /n/{ns}/b/workRequests              -> 200
copy work request, both poll forms       -> SUCCEEDED / SUCCEEDED
objectversions after PUT, enable, PUT    -> 2 items
PUT if-none-match: *                     -> 412
PUT if-match: bogus                      -> 412
GET Range: bytes=0-2                     -> 206 "hel"
lifecycle read-back                      -> target previous-object-versions, 1 YEARS, patterns ['*.log']
create into a nonexistent compartment    -> 404

For the PAR collision, serve --persist --persist-strategy on-shutdown was stopped with SIGINT and restarted from the same state file. Afterwards the secret PAR kept its token and still redeemed salaries, while a new public PAR got a different token and redeemed hello.

[NitinKumar004]

Every finding from the last round is fixed, and I confirmed each one against serve with the real oci-go-sdk (v65.126.1). Two new problems turned up in the same areas. Restored versions and retention rules can still be overwritten after a restart, and copy work requests report a status the Object Storage SDK does not define.

Earlier findings

• High 1, merge with development: fixed. The branch is based on the current tip of development (770204c), so it merges cleanly. go run ./internal/coveragegen leaves no diff in docs/coverage.
• High 2, work requests taking over Object Storage paths: fixed. PUT and GET of tfb/o/workRequests/x return payload. A bucket named workRequests can be created, read, written to and listed. Copy work requests still answer on /workRequests/{id} through GetWorkRequest, and ListWorkRequests works too.
• Medium 3, PAR tokens after a persist restart: fixed. I ran the original repro: start with --persist --persist-strategy on-shutdown, create a PAR on secret, send SIGINT, restart, then create a PAR on public. The two PARs got different OCIDs and different tokens, and the secret URI still returns salaries.
• Medium 4, enabling versioning after objects exist: fixed. The sequence PUT original, enable versioning, PUT second now lists 2 versions, and both bodies come back by versionId. Suspending, writing, re-enabling and writing again keeps all 5 versions.
• Medium 5, lifecycle round-trip: fixed. A rule set as 1 YEARS with target previous-object-versions and all three filter lists reads back exactly as sent, and timeCreated is set. ABORT on the objects target returns 400.
• Medium 6, conditional and range headers: fixed. PUT with if-none-match: * returns 412 IfNoneMatchFailed. A bogus if-match returns 412 IfMatchFailed on PUT, GET, DELETE and UpdateBucket. A matching if-none-match on GET and HEAD returns 304. Ranges bytes=0-2, bytes=-3 and bytes=6- return 206 with the right bytes and Content-Range. bytes=50-60 returns 416.
• Medium 7, UpdateBucket rename: fixed. rb renamed to rb2 keeps its objects, the old name returns 404, and renaming onto a taken name returns 409 BucketAlreadyExists.
• Medium 8, compartment check: fixed. CreateBucket and a compartment move both return 404 NotAuthorizedOrNotFound for a compartment that does not exist.
• Medium 9, PAR rules: fixed. A PAR that expires a year out is accepted. With objectName: "logs/" on AnyObjectRead, logs/a.txt redeems and other/b.txt returns 403. A missing timeExpires returns 400.
• Low, error codes: fixed. Duplicate bucket returns 409 BucketAlreadyExists. A non-empty delete returns 409 BucketNotEmpty.
• Low, ETag: fixed. Two identical PUTs now return different ETags.
• Low, pagination: fixed. objectversions?limit=1 returns 1 item plus opc-next-page, and page 2 returns a different version. Paging ListBuckets with limit=2 returns the same total as one unpaged call.
• Low, copyObject: fixed. destinationRegion: eu-frankfurt-1 returns 400.
• Low, multipart ETags: fixed. wrong-etag is rejected with 400, and the real part ETag commits.
• Low, bucket names: fixed. bad name! returns 400.

New findings

Medium 1. Version ids and retention rule OCIDs still collide after a persist restore (providers/oci/objectstorage/versioning.go:15, providers/oci/objectstorage/retention.go:82)

This is the same root cause as the PAR token issue. The PAR fix did not cover the other ids this service mints. newVersionID and the retention rule OCID both come from the process counter, which starts again from 1 on restart.

Repro for versions:

1. Start serve --providers oci --persist --persist-strategy on-shutdown.
2. Create bucket vb with versioning Enabled and PUT k six times.
3. Send SIGINT and restart, then PUT k twelve more times.
4. GET /objectversions returns 18 items but only 13 distinct ids. 0000000f, 0000000d, 0000000b, 00000009 and 00000007 each appear twice.
5. GET /o/k?versionId=0000000f returns before-6. The newer version with the same id cannot be read, and a delete by that versionId is ambiguous. With a storage engine wired, engineRef(bucket, key, version) is the same for both versions, so the new write replaces the old version's bytes.

Repro for retention rules:

1. Before the restart, create three 365-day rules on rb. They get the OCIDs ...05, ...07 and ...09.
2. After the restart, create six 1-day rules.
3. The list now shows six rules, all 1-day. The new rules reused ...05, ...07 and ...09, and bkt.retention.Set(rule.ID, rule) silently replaced the original 365-day rules. A rule with timeRuleLocked set can be replaced the same way.

Fix: mint version ids with idgen.UUID(), since real OCI version ids are opaque UUIDs. Give retention rule OCIDs a random suffix as well, or refuse a Set that would replace an existing id. Bucket OCIDs collide the same way: after the restart a new bucket got ...12, the same OCID as vb. You already called that out as the general OCI counter problem, so a tracked follow-up is fine for buckets. Versions and retention rules lose data here, so they should be fixed in this PR. Add a restore test for both, like TestPARsDoNotCollideAfterRestore.

Medium 2. Copy work requests report SUCCEEDED, which is not an Object Storage status (server/oci/objectstorage/object.go:482, server/oci/workrequest/workrequest.go:93)

The Object Storage WorkRequestStatusEnum is ACCEPTED, IN_PROGRESS, FAILED, COMPLETED, CANCELING and CANCELED. The shared store always writes SUCCEEDED, which is the right value for VCN and Identity but not for Object Storage.

Repro: run CopyObject, then GetWorkRequest on the returned opc-work-request-id. The status is SUCCEEDED, and objectstorage.GetMappingWorkRequestStatusEnum("SUCCEEDED") returns false. A copy waiter that polls for COMPLETED never finishes. That includes the Terraform object copy and oci os object copy --wait-for-state COMPLETED.

Fix: let Accept take the terminal status, or add an Object Storage variant, and record COMPLETED for COPY_OBJECT. Add an SDK-shaped test that checks the status against the Object Storage enum.

Checked

• The branch merges cleanly with origin/development, and coveragegen leaves no diff.
• go build ./... is clean. go vet is clean on providers/oci, server/oci, services/storage, serveflags, persist and internal/coveragegen.
• Tests pass on those packages and on contrib/realengine/blobstore. -race passes on providers/oci and server/oci.
• golangci-lint --new-from-rev=origin/development reports 0 issues.
• The metrics.go hunks match #421 line for line, so whichever PR merges second will not conflict there.
• Every earlier repro was run against serve with oci-go-sdk v65, including a real SIGINT restart for the persist cases.
• Terraform was not run, for the same reason as before. The oracle/oci provider has no per-service endpoint override.