Admin Route Action Snapshot

This snapshot records the current admin routing and authorization surface before directory moves or crate extraction. It is a migration guardrail: later pure move PRs must preserve the route, handler, authorization action, public exception, and compatibility alias semantics listed here unless the PR is explicitly scoped as a behavior change.

Source Of Truth

• Router assembly: rustfs/src/admin/mod.rs::make_admin_route
• Route registration coverage: rustfs/src/admin/route_registration_test.rs
• Runtime dispatch: rustfs/src/admin/router.rs
• Admin auth helpers: rustfs/src/admin/auth.rs
• Handler route/action ownership: rustfs/src/admin/handlers/*.rs

The route registration test intentionally covers representative paths for every registered route family. This document uses route patterns from the registration functions and action names from the handler authorization calls.

Prefix And Alias Contract

The compatibility alias is not a second route table. canonicalize_admin_path maps /minio/admin/... to /rustfs/admin/... immediately before route lookup.

Dispatch And Auth Shape

flowchart LR
    A["Incoming request"] --> B{"S3Router::is_match"}
    B -->|"Replication or misc extension"| X["Extension handler"]
    B -->|"Health path"| H["Public health"]
    B -->|"OIDC public path"| O["OIDC public handler"]
    B -->|"POST / STS form"| S["STS handler"]
    B -->|"Admin or console path"| C{"S3Router::check_access"}
    C -->|"public exception"| P["No SigV4 required"]
    C -->|"admin route"| D["Credential required"]
    D --> E["canonicalize /minio/admin to /rustfs/admin"]
    E --> F["matchit route lookup"]
    F --> G["AdminOperation handler"]
    G --> I["handler-level validate_admin_request"]

Route-level credential presence and handler-level policy authorization are separate contracts. The router enforces credential presence for ordinary admin routes. Handler rows below record whether the current handler performs a precise AdminAction or S3Action check, or only repeats a credential presence check.

Public Exceptions

Registered Route Families

All rows with /rustfs/admin also accept the /minio/admin compatibility alias through router canonicalization unless the row explicitly says otherwise.

Table Catalog Routes

The table catalog API is registered by the admin router but is not under /rustfs/admin. It has its own prefix and Iceberg-style route shape.

Migration Rules

1. Pure move PRs may move handler modules, but must not change registered methods, patterns, handler ownership, alias canonicalization, or public exception behavior.
2. If an admin handler is wrapped to cut a dependency direction, the wrapper must preserve the same AdminAction or S3Action check and keep response compatibility unchanged.
3. Do not duplicate /minio/admin registrations. The alias remains a router canonicalization concern.
4. Do not move table catalog routes under /rustfs/admin during route cleanup.
5. Registered-but-NotImplemented routes are behavior contracts too. Removing or implementing them requires a behavior-change PR type.
6. Future route matrix automation should compare against this document and route_registration_test.rs before crate extraction begins.