From 23c336a92586d516fb0c0c163ec58cbbefd0fd4e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=94=90=E5=B0=8F=E9=B8=AD?= <tangtang1251@qq.com>
Date: Thu, 12 Nov 2026 00:12:07 +0800
Subject: [PATCH] fix(kms): schedule a deletion before destroying a key in
 KMS-208

Key destruction is two steps: `force_immediate` only destroys a key that
is already pending deletion, and is refused with 400 for a key that was
never scheduled. KMS-208 sent a single confirmed immediate request and
expected the key to be destroyed.

Assert that the unscheduled request is refused and leaves the key usable,
then schedule the deletion, destroy the pending key, and check that the
key answers 404.
---
 rustfs-kms-test.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/rustfs-kms-test.sh b/rustfs-kms-test.sh
index 6f10223..d7fe054 100755
--- a/rustfs-kms-test.sh
+++ b/rustfs-kms-test.sh
@@ -1152,11 +1152,23 @@ test_kms208() {
     echo "immediate deletion unexpectedly allowed"; return 1
   fi
   echo "expected rejection of unconfirmed immediate deletion (HTTP ${code}): ${body}"
-  # positive path: env flag on + explicit confirm -> unreferenced key destroyed
+  # Destruction is two steps: a confirmed immediate request against a key that
+  # was never scheduled must be refused and must leave the key usable.
   kms_create_key "k208b" "env=ci" || return 1
-  local kid2="${KMS_KEY_ID}"
+  local kid2="${KMS_KEY_ID}" st
+  body="$(admin_api DELETE /rustfs/admin/v3/kms/keys/delete "" "{\"key_id\":\"${kid2}\",\"force_immediate\":true,\"confirm_key_id\":\"${kid2}\"}")"; code="$(admin_api_code)"
+  [ "${code}" = "400" ] || { echo "immediate deletion of an unscheduled key -> HTTP ${code}, expected 400: ${body}"; return 1; }
+  st="$(kms_describe_key "${kid2}")" || return 1
+  if printf '%s' "${st}" | grep -qiE 'pending'; then echo "refused immediate deletion still scheduled the key: ${st}"; return 1; fi
+  printf '%s' "${st}" | grep -qiE 'active|enabled|available|usable|ready' || { echo "key not usable after refused immediate deletion: ${st}"; return 1; }
+  # positive path: schedule first, then env flag on + explicit confirm destroys
+  # the pending key without waiting out its window
+  body="$(admin_api DELETE /rustfs/admin/v3/kms/keys/delete "" "{\"key_id\":\"${kid2}\",\"pending_window_in_days\":7}")"; code="$(admin_api_code)"
+  [ "${code}" = "200" ] || { echo "scheduling deletion failed: HTTP ${code}: ${body}"; return 1; }
   body="$(admin_api DELETE /rustfs/admin/v3/kms/keys/delete "" "{\"key_id\":\"${kid2}\",\"force_immediate\":true,\"confirm_key_id\":\"${kid2}\"}")"; code="$(admin_api_code)"
-  [ "${code}" = "200" ] || { echo "confirmed immediate deletion failed: HTTP ${code}: ${body}"; return 1; }
+  [ "${code}" = "200" ] || { echo "confirmed immediate deletion of a pending key failed: HTTP ${code}: ${body}"; return 1; }
+  body="$(admin_api GET "/rustfs/admin/v3/kms/keys/${kid2}" "")"; code="$(admin_api_code)"
+  [ "${code}" = "404" ] || { echo "destroyed key still answers HTTP ${code}: ${body}"; return 1; }
 }
 
 test_kms209() {