HDDS-16408. Prevent DeletePublicAccessBlock from deleting buckets

[F64116045]

What changes were proposed in this pull request?

S3 Gateway does not recognize the publicAccessBlock query parameter. As a result, DELETE /{bucket}?publicAccessBlock is routed to DeleteBucket and deletes an empty bucket.

Ozone does not support Public Access Block yet, but this request should not delete the bucket. This change excludes publicAccessBlock requests from the regular bucket deletion path, so the request returns 501 NotImplemented and the bucket remains unchanged.

References
AWS DeletePublicAccessBlock API: https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeletePublicAccessBlock.html
ceph/s3-tests: test_get_undefined_public_block:
https://github.com/ceph/s3-tests/blob/fb8b73092bb1dd8db829f1205a9e52e73bf9a232/s3tests/functional/test_s3.py#L13830-L13847

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-16408

How was this patch tested?

mvn -pl hadoop-ozone/s3gateway \
  -Dtest=TestBucketDelete test

mvn -pl hadoop-ozone/integration-test-s3 -am \
  -DskipDocs -DskipShade -Dskip.npm \
  -Dtest=TestS3SDK \
  -Dsurefire.failIfNoSpecifiedTests=false test

CI: https://github.com/F64116045/ozone/actions/runs/34764029942
CI:

[chihsuan]

Thanks @F64116045 overall, the fix looks good. I left two inline comments.

Slightly out of scope, but DELETE ?policy, ?cors and others still fall through to DeleteBucket. Could we list all the remaining bucket subresources at once? A follow-up Jira would work too.

[chihsuan]

Have you considered a small handler before BucketCrudHandler, similar to BucketGetLocationHandler? It would also cover GET ?publicAccessBlock, which still returns a listing today, and other unsupported subresources could join it later.

[F64116045]

Thanks for the suggestion, yeah, I think this makes more sense.
moved it to a separate handler and we can add other unsupported subresources there later.

[chihsuan]

nit: The class javadoc above is missing ?lifecycle and ?publicAccessBlock. Maybe drop the examples and describe the rule instead? They go stale easily.

[F64116045]

updated thanks!

[F64116045]

Thanks @chihsuan for the review.

Slightly out of scope, but DELETE ?policy, ?cors and others still fall through to DeleteBucket. Could we list all the remaining bucket subresources at once? A follow-up Jira would work too.

Thanks for pointing this out. I also found 12 other unsupported bucket subresources that can fall through to DeleteBucket.
Once we agree on the handler approach here, I’ll open a follow-up Jira to cover them together. probably add them to the same UnsupportedBucketSubresourceHandler.