fix(account)!: separate password permission and update coordinated dependencies

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+- **Breaking authorization change:** uses `admin:ChangeMyPassword` for the Change Password button and session capability; user creation remains governed by `admin:CreateUser`. With the matching Server, a saved CreateUser deny no longer locks the caller's password, and a ChangeMyPassword deny now locks it. Preserve the old combined restriction by denying both actions before upgrading. The updated built-in `readonly` also permits self-service password changes and no longer overrides a separate CreateUser Allow; saved policy overrides retain their old statements. Deploy Server, silo-pkg and Console together. See the [migration guide](https://github.com/pgsty/silo/blob/420340bc142b7dec00c26c28dd78102e3ed9d0f3/docs/iam/password-permissions.md) for affected policies, mixed-version behavior and rollback limits. This change is independent of the SDK update.
+- Pins upstream minio-go to `78bfa91607c2`, including streaming Content-Type signing and RDMA TLS trust fixes, and updates the maintained package/client dependency pins. The upstream region-whitespace fix (#2274) remains pending.
+- Updates knip's indirect smol-toml dependency to 1.7.1 for CVE-2026-85730.
+
 ## Release v2.4.0
 
 Correctness and usability:

CREDITS

@@ -6,7 +6,7 @@ Generated by `go run ./hack/credits update`; verified by `make verifiers` (Go se
 ==== Go modules linked into the Console binary ====
 
 The shipped binary satisfies these upstream import paths from PGSTY-maintained forks (go.mod replace directives); each is credited below under its import path with the fork's own license and notice files:
-  github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260908140805-c8aa5d25a63a
+  github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260910093317-e6a60edf0952
 
 ================================================================
 
@@ -9611,7 +9611,7 @@ of GNU Affero General Public License 3.0.
 
 ================================================================
 
-github.com/minio/mc (provided by github.com/pgsty/mc v0.0.0-20260908140805-c8aa5d25a63a)
+github.com/minio/mc (provided by github.com/pgsty/mc v0.0.0-20260910093317-e6a60edf0952)
 https://github.com/pgsty/mc
 ----------------------------------------------------------------
 -- LICENSE --

README.md

@@ -140,7 +140,8 @@ The retained Go module, import paths, environment variables, API fields, and
 protocol identifiers are compatibility interfaces, not product branding. Any
 future rename of those interfaces will require aliases and a migration period.
 
-Standalone Console directly requires `github.com/pgsty/silo-pkg/v3` v3.13.3
+Standalone Console directly requires `github.com/pgsty/silo-pkg/v3` at the
+revision selected by `go.mod` and recorded in `hack/deps-release.json`,
 and resolves `github.com/minio/minio-go/v7` upstream. The maintained mc source
 keeps the compatibility module path `github.com/minio/mc` and lives in
 `pgsty/mc`. Console pins an immutable Go pseudo-version: either a published
@@ -152,7 +153,7 @@ ignores replacements declared by dependency modules:
 <!-- silo-replacements:begin -->
 ```go
 replace (
-	github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260908140805-c8aa5d25a63a
+	github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260910093317-e6a60edf0952
 )
 ```
 <!-- silo-replacements:end -->
@@ -164,7 +165,7 @@ package is an ordinary direct requirement and needs no downstream replacement:
 
 | Module graph | Status |
 | :-- | :-- |
-| The single maintained replacement above | Supported; `downstream-embedder-compat` builds a minimal embedder from the published block and verifies `pgsty/silo-pkg` v3.13.3 is inherited directly |
+| The single maintained replacement above | Supported; `downstream-embedder-compat` builds a minimal embedder from the published block and verifies the exact `pgsty/silo-pkg` version selected by `go.mod` is inherited directly |
 | No mc replacement | Best-effort upstream compatibility signal, tested by the non-blocking `upstream-pkg-compat` job; it is neither the released SILO CLI behavior nor a dependency floor |
 | The retired three-replacement graph | Unsupported: do not replace `github.com/minio/pkg/v3` with silo-pkg v3.13.0 or later, whose declared module path is `github.com/pgsty/silo-pkg/v3` |
 

api/user_session_test.go

@@ -33,6 +33,31 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+func TestDefaultSessionActionsSeparatesPasswordAndUserManagement(t *testing.T) {
+	for _, tt := range []struct {
+		name       string
+		statements string
+		password   bool
+		createUser bool
+	}{
+		{"read-only", `{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::*"}`, true, false},
+		{"legacy deny", `{"Effect":"Deny","Action":"admin:CreateUser","Resource":"arn:aws:s3:::*"}`, true, false},
+		{"password denied", `{"Effect":"Deny","Action":"admin:ChangeMyPassword"}`, false, false},
+		{"user admin with password denied", `{"Effect":"Allow","Action":"admin:CreateUser"},{"Effect":"Deny","Action":"admin:ChangeMyPassword"}`, false, true},
+		{"wildcard denied", `{"Effect":"Deny","Action":"admin:*"}`, false, false},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			policy, err := minioIAMPolicy.ParseConfig(bytes.NewBufferString(`{"Version":"2012-10-17","Statement":[` + tt.statements + `]}`))
+			if err != nil {
+				t.Fatal(err)
+			}
+			actions := defaultSessionActions(policy, nil)
+			assert.Equal(t, tt.password, actions.Contains(minioIAMPolicy.ChangeMyPasswordAdminAction))
+			assert.Equal(t, tt.createUser, actions.Contains(minioIAMPolicy.CreateUserAdminAction))
+		})
+	}
+}
+
 func TestDefaultSessionActionsKeepsRequestScopedServiceAccountCapability(t *testing.T) {
 	policy, err := minioIAMPolicy.ParseConfig(bytes.NewBufferString(`{
 		"Version":"2012-10-17",

go.mod

@@ -15,7 +15,7 @@ tool github.com/go-swagger/go-swagger/cmd/swagger
 replace github.com/olekukonko/tablewriter => github.com/olekukonko/tablewriter v0.0.5 // needed for github.com/minio/mc
 
 // Use Pigsty's maintained mc fork while preserving upstream imports.
-replace github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260908140805-c8aa5d25a63a
+replace github.com/minio/mc => github.com/pgsty/mc v0.0.0-20260910093317-e6a60edf0952
 
 // v22.7.0 does not compile on NetBSD because its unix implementation uses
 // CLOCK_MONOTONIC, which is unavailable there. Keep the last portable release
@@ -45,11 +45,11 @@ require (
 	github.com/minio/mc v0.0.0-20251106162529-77f82e18b540
 	// Keep upstream master: v7.3.0 predates checksum and S3 Express fixes
 	// already included in this pseudo-version.
-	github.com/minio/minio-go/v7 v7.3.1-0.20260828014306-0e78d3f18efe
+	github.com/minio/minio-go/v7 v7.3.1-0.20260909183557-78bfa91607c2
 	github.com/minio/selfupdate v0.6.0
 	github.com/minio/websocket v1.6.0
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/pgsty/silo-pkg/v3 v3.13.3
+	github.com/pgsty/silo-pkg/v3 v3.13.4-0.20260910091716-2d8fd3cbbf07
 	github.com/rs/xid v1.6.0
 	github.com/secure-io/sio-go v0.3.1
 	github.com/stretchr/testify v1.12.1

go.sum

@@ -243,8 +243,8 @@ github.com/minio/madmin-go/v3 v3.0.110 h1:FIYekj7YPc430ffpXFWiUtyut3qBt/unIAcDzJ
 github.com/minio/madmin-go/v3 v3.0.110/go.mod h1:WOe2kYmYl1OIlY2DSRHVQ8j1v4OItARQ6jGyQqcCud8=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.3.1-0.20260828014306-0e78d3f18efe h1:By2FKNSOUGLOeb0x4D7xJMHr8x/X1ZW8PG780SpKUwQ=
-github.com/minio/minio-go/v7 v7.3.1-0.20260828014306-0e78d3f18efe/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk=
+github.com/minio/minio-go/v7 v7.3.1-0.20260909183557-78bfa91607c2 h1:nvX7IksPFOF/cBvkSg/Z+urBZkmhZrfUVmzdNFLjZ5Y=
+github.com/minio/minio-go/v7 v7.3.1-0.20260909183557-78bfa91607c2/go.mod h1:KUPWdecEO1LWyUz+sTGXAuf2jZHrPh5fCsRH86QbPfk=
 github.com/minio/mux v1.10.1 h1:grrK8SwRKbkNFE6qG7WAvFGH09bB46d5teOOtKfQ14s=
 github.com/minio/mux v1.10.1/go.mod h1:INYT4sMSTJy0QWUEA/E2DZNxJ5sAxIwbnyZjkzNFRfE=
 github.com/minio/pkg/v3 v3.6.1 h1:gaNT80BS/iuIany5ylTkVmfN4s6UYY30OtImFv4GQA8=
@@ -276,10 +276,10 @@ github.com/olekukonko/tablewriter v0.0.5/go.mod h1:hPp6KlRPjbx+hW8ykQs1w3UBbZlj6
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
 github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
 github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
-github.com/pgsty/mc v0.0.0-20260908140805-c8aa5d25a63a h1:JIVjuYP7yXjNFGzQX44zE9BsVPTRkdip8TlsmW7mTgE=
-github.com/pgsty/mc v0.0.0-20260908140805-c8aa5d25a63a/go.mod h1:VHif+uy3s+nOcQKy808NlNpYawINOeGSyisgjoSBNVs=
-github.com/pgsty/silo-pkg/v3 v3.13.3 h1:d2xYTn4LXoWIAIjBlW/17wtA/Ut1ap29t+1ww4TFa8o=
-github.com/pgsty/silo-pkg/v3 v3.13.3/go.mod h1:0GmaDA0ArQ8bkAI/obiSNTBQzdgBu6W0e0olDCbyXXo=
+github.com/pgsty/mc v0.0.0-20260910093317-e6a60edf0952 h1:b6jpBuZWUiZhBox64eF1cmNL4HWGwdSk/LVXNc3DBQ0=
+github.com/pgsty/mc v0.0.0-20260910093317-e6a60edf0952/go.mod h1:VsGNEmditljwBgmYKy7X+//dXLN8gEfSPR2m4lcMPmo=
+github.com/pgsty/silo-pkg/v3 v3.13.4-0.20260910091716-2d8fd3cbbf07 h1:IKm2AyPsvuL4NyniK3ixqqQz1CIargmhyCkL2eZvlhA=
+github.com/pgsty/silo-pkg/v3 v3.13.4-0.20260910091716-2d8fd3cbbf07/go.mod h1:1JdcUcM+TRXObb9QrC8FWhav0RKk6/u8RT2RgimfxRQ=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
 github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=

hack/deps-release.json

@@ -11,19 +11,21 @@
     {
       "selection": "direct",
       "import": "github.com/pgsty/silo-pkg/v3",
-      "version": "v3.13.3",
+      "version": "v3.13.4",
       "kind": "module_tag",
-      "tag": "v3.13.3",
-      "commit": "a92c54d7ad910060dd6053c2fc38d41f3229bcfe",
+      "tag": "v3.13.4",
+      "commit": "2d8fd3cbbf07186855cf9d4e8177368027a62cd1",
+      "release_pending": true,
+      "current_pin": "v3.13.4-0.20260910091716-2d8fd3cbbf07",
       "repository": "pgsty/silo-pkg"
     },
     {
       "selection": "replace",
       "import": "github.com/minio/mc",
       "replacement": "github.com/pgsty/mc",
-      "version": "v0.0.0-20260908140805-c8aa5d25a63a",
+      "version": "v0.0.0-20260910093317-e6a60edf0952",
       "kind": "source_commit",
-      "commit": "c8aa5d25a63a617bb6d832ec3fb65257fea6078e",
+      "commit": "e6a60edf0952bed393dadab2a5915252f936b36f",
       "repository": "pgsty/mc"
     }
   ]

hack/embedder-compat.sh

@@ -9,6 +9,7 @@ set -euo pipefail
 
 console_root="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$console_root"
+pkg_version="$(go list -m -f '{{.Version}}' github.com/pgsty/silo-pkg/v3)"
 
 embedder="$(mktemp -d)"
 go run ./hack/replacements readme-block > "$embedder/readme-block.txt"
@@ -50,5 +51,5 @@ while read -r old new version; do
   got="$(go list -m -f '{{if .Replace}}{{.Replace.Path}} {{.Replace.Version}}{{end}}' "$old")"
   test "$got" = "$new $version" || { echo "$old resolved to '$got', README says '$new $version'" >&2; exit 1; }
 done < tuples.txt
-test "$(go list -m -f '{{.Version}}' github.com/pgsty/silo-pkg/v3)" = "v3.13.3" || { echo "embedder did not inherit silo-pkg v3.13.3" >&2; exit 1; }
+test "$(go list -m -f '{{.Version}}' github.com/pgsty/silo-pkg/v3)" = "$pkg_version" || { echo "embedder did not inherit silo-pkg $pkg_version" >&2; exit 1; }
 echo "embedder graph matches the README block"

hack/upstream-floor.sh

@@ -8,11 +8,12 @@
 # Console requires pgsty/silo-pkg directly and uses upstream minio-go, so mc is
 # now the only replacement an embedder has to copy.
 set -euo pipefail
+pkg_version="$(go list -m -f '{{.Version}}' github.com/pgsty/silo-pkg/v3)"
 
 go mod edit -dropreplace=github.com/minio/mc
 go mod tidy
 test -z "$(go list -m -f '{{if .Replace}}{{.Replace.Path}}{{end}}' github.com/minio/mc)"
-test "$(go list -m -f '{{.Version}}' github.com/pgsty/silo-pkg/v3)" = "v3.13.3"
+test "$(go list -m -f '{{.Version}}' github.com/pgsty/silo-pkg/v3)" = "$pkg_version"
 test -z "$(go list -m -f '{{if .Replace}}{{.Replace.Path}}{{end}}' github.com/minio/minio-go/v7)"
 go vet ./...
 go vet -tags=testrunmain ./...

web-app/build/index.html

@@ -29,7 +29,7 @@
     <link href="./manifest.json" rel="manifest" />
     <link color="#007FA8" href="./safari-pinned-tab.svg" rel="mask-icon" />
     <title>SILO Console</title>
-    <script type="module" crossorigin src="./assets/index-BQ0PzI_G.js"></script>
+    <script type="module" crossorigin src="./assets/index-BvVSYA6O.js"></script>
     <link rel="modulepreload" crossorigin href="./assets/jsx-runtime-OPrhpiUg.js">
     <link rel="modulepreload" crossorigin href="./assets/es-BbPD0nNI.js">
     <link rel="modulepreload" crossorigin href="./assets/get-D-5ICXMN.js">

web-app/e2e/account-password.spec.ts

@@ -0,0 +1,64 @@
+// Copyright (c) 2026 Pigsty
+// SPDX-License-Identifier: AGPL-3.0-or-later
+
+import { expect, test } from "./fixtures/baseFixture";
+import { minioadminFile, SERVER_ENDPOINT } from "./consts";
+import {
+  CONSOLE_UI_RESOURCE,
+  IAM_SCOPES,
+} from "../src/common/SecureComponent/permissions";
+
+test.use({ storageState: minioadminFile });
+
+for (const scenario of [
+  {
+    name: "self-service permission",
+    password: true,
+    create: false,
+    idp: false,
+  },
+  {
+    name: "user creation permission only",
+    password: false,
+    create: true,
+    idp: false,
+  },
+  {
+    name: "no password permission",
+    password: false,
+    create: false,
+    idp: false,
+  },
+  {
+    name: "external identity provider",
+    password: true,
+    create: false,
+    idp: true,
+  },
+]) {
+  test(`Change Password respects ${scenario.name}`, async ({ page }) => {
+    await page.route("**/api/v1/session", async (route) => {
+      const response = await route.fetch();
+      const session = await response.json();
+      const actions: string[] = [IAM_SCOPES.ADMIN_CREATE_SERVICEACCOUNT];
+      if (scenario.password) actions.push(IAM_SCOPES.ADMIN_CHANGE_MY_PASSWORD);
+      if (scenario.create) actions.push(IAM_SCOPES.ADMIN_CREATE_USER);
+      session.permissions = { [CONSOLE_UI_RESOURCE]: actions };
+      if (scenario.idp) session.features.push("external-idp");
+      await route.fulfill({ response, json: session });
+    });
+
+    await page.goto(`${SERVER_ENDPOINT}/access-keys`);
+    const button = page.locator("#change-password");
+    await expect(button).toBeVisible();
+    if (scenario.password && !scenario.idp) {
+      await expect(button).toBeEnabled();
+      await button.click();
+      await expect(
+        page.getByLabel("Current Password", { exact: true }),
+      ).toBeVisible();
+    } else {
+      await expect(button).toBeDisabled();
+    }
+  });
+}

web-app/src/common/SecureComponent/permissions.ts

@@ -63,6 +63,7 @@ export const IAM_SCOPES = {
   ADMIN_GET_POLICY: "admin:GetPolicy",
   ADMIN_LIST_USERS: "admin:ListUsers",
   ADMIN_CREATE_USER: "admin:CreateUser",
+  ADMIN_CHANGE_MY_PASSWORD: "admin:ChangeMyPassword",
   ADMIN_DELETE_USER: "admin:DeleteUser",
   ADMIN_ENABLE_USER: "admin:EnableUser",
   ADMIN_DISABLE_USER: "admin:DisableUser",

web-app/src/screens/Console/Account/Account.tsx

@@ -259,7 +259,7 @@ const Account = () => {
                 />
               </TooltipWrapper>
               <SecureComponent
-                scopes={[IAM_SCOPES.ADMIN_CREATE_USER]}
+                scopes={[IAM_SCOPES.ADMIN_CHANGE_MY_PASSWORD]}
                 resource={CONSOLE_UI_RESOURCE}
                 matchAll
                 errorProps={{ disabled: true }}

web-app/yarn.lock

@@ -9495,9 +9495,9 @@ __metadata:
   linkType: hard
 
 "smol-toml@npm:^1.6.1":
-  version: 1.6.1
-  resolution: "smol-toml@npm:1.6.1"
-  checksum: 10c0/511a78722f99c7616fdb46af708de3d7e81434b5a3d58061166da73f28bfc6cae4f0cd04683f60515b9c490cd10152fce72287c960b337419c0299cc1f0f2a22
+  version: 1.7.1
+  resolution: "smol-toml@npm:1.7.1"
+  checksum: 10c0/c2494e19e748578cf9f81f918dd66a548dfe5a0e581ab9f980d5420f2319c882c661a62d01d216a43f2db490faaccd2185bcdb6f2ba0658eb303eda9db871d76
   languageName: node
   linkType: hard