From bff5f27aa8be3a039a2fd37da12ac628c145d983 Mon Sep 17 00:00:00 2001
From: Louis Ruch <louisruch@gmail.com>
Date: Thu, 27 Aug 2026 19:01:36 -0700
Subject: [PATCH] fix(validate): don't list all objects in bucket when
 validating permissions

---
 plugin/service/storage/plugin.go | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/plugin/service/storage/plugin.go b/plugin/service/storage/plugin.go
index 0258430..c77d647 100644
--- a/plugin/service/storage/plugin.go
+++ b/plugin/service/storage/plugin.go
@@ -893,7 +893,8 @@ func validateReadPermission(ctx context.Context, cl *minio.Client, bucket *stora
 		combinedErrors = multierror.Append(combinedErrors, fmt.Errorf("failed to get object at %q: %w", objectKey, err))
 	}
 
-	oiCh := cl.ListObjects(ctx, bucket.GetBucketName(), minio.ListObjectsOptions{Recursive: true})
+	// List just the object we created above
+	oiCh := cl.ListObjects(ctx, bucket.GetBucketName(), minio.ListObjectsOptions{Prefix: objectKey, MaxKeys: 1})
 	for oi := range oiCh {
 		if oi.Err != nil {
 			if permission.GetState() == pb.StateType_STATE_TYPE_OK {