From db206adababfaaee35eb78c2d8c6ee4a29c7155a Mon Sep 17 00:00:00 2001
From: Klaus Post <klauspost@gmail.com>
Date: Tue, 7 Jul 2026 18:42:12 +0200
Subject: [PATCH] Add bucket compression admin actions.

---
 policy/admin-action.go | 29 ++++++++++++++++++++---------
 policy/constants.go    |  2 ++
 policy/policy_test.go  |  2 ++
 3 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/policy/admin-action.go b/policy/admin-action.go
index 3f547d76..462687e8 100644
--- a/policy/admin-action.go
+++ b/policy/admin-action.go
@@ -185,6 +185,13 @@ const (
 	// GetBucketQuotaAdminAction - allow getting bucket quota
 	GetBucketQuotaAdminAction = "admin:GetBucketQuota"
 
+	// Bucket compression Actions
+
+	// SetBucketCompressionAdminAction - allow setting per-bucket compression config
+	SetBucketCompressionAdminAction = "admin:SetBucketCompression"
+	// GetBucketCompressionAdminAction - allow getting per-bucket compression config
+	GetBucketCompressionAdminAction = "admin:GetBucketCompression"
+
 	// Bucket Target admin Actions
 
 	// SetBucketTargetAction - allow setting bucket target
@@ -355,6 +362,8 @@ var SupportedAdminActions = map[AdminAction]struct{}{
 	ListUserPoliciesAdminAction:      {},
 	SetBucketQuotaAdminAction:        {},
 	GetBucketQuotaAdminAction:        {},
+	SetBucketCompressionAdminAction:  {},
+	GetBucketCompressionAdminAction:  {},
 	SetBucketTargetAction:            {},
 	GetBucketTargetAction:            {},
 	ReplicationDiff:                  {},
@@ -427,15 +436,17 @@ var SupportedAdminActions = map[AdminAction]struct{}{
 // against the target bucket. All other admin actions are resource-less;
 // any Resource specified in the statement is ignored for them.
 var AdminActionsWithResource = map[AdminAction]struct{}{
-	SetBucketQuotaAdminAction:  {},
-	GetBucketQuotaAdminAction:  {},
-	SetBucketTargetAction:      {},
-	GetBucketTargetAction:      {},
-	ReplicationDiff:            {},
-	ImportBucketMetadataAction: {},
-	ExportBucketMetadataAction: {},
-	HealAdminAction:            {},
-	InventoryControlAction:     {},
+	SetBucketQuotaAdminAction:       {},
+	GetBucketQuotaAdminAction:       {},
+	SetBucketCompressionAdminAction: {},
+	GetBucketCompressionAdminAction: {},
+	SetBucketTargetAction:           {},
+	GetBucketTargetAction:           {},
+	ReplicationDiff:                 {},
+	ImportBucketMetadataAction:      {},
+	ExportBucketMetadataAction:      {},
+	HealAdminAction:                 {},
+	InventoryControlAction:          {},
 }
 
 // HasResource reports whether this admin action operates on a bucket resource.
diff --git a/policy/constants.go b/policy/constants.go
index 3c213b07..113b4d62 100644
--- a/policy/constants.go
+++ b/policy/constants.go
@@ -228,6 +228,8 @@ var DefaultPolicies = []struct {
 						// Bucket admin
 						SetBucketQuotaAdminAction,
 						GetBucketQuotaAdminAction,
+						SetBucketCompressionAdminAction,
+						GetBucketCompressionAdminAction,
 						// Tiers
 						SetTierAction,
 						ListTierAction,
diff --git a/policy/policy_test.go b/policy/policy_test.go
index 4603f5f1..a3ef64cc 100644
--- a/policy/policy_test.go
+++ b/policy/policy_test.go
@@ -2793,6 +2793,8 @@ func TestAdminActionHasResource(t *testing.T) {
 	bucketScoped := []AdminAction{
 		SetBucketQuotaAdminAction,
 		GetBucketQuotaAdminAction,
+		SetBucketCompressionAdminAction,
+		GetBucketCompressionAdminAction,
 		SetBucketTargetAction,
 		GetBucketTargetAction,
 		ReplicationDiff,