Merge branch 'main' into next

11 files changed, 477 insertions, 125 deletions

diff --git a/src/garage/tests/admin.rs b/src/garage/tests/admin.rs
index 37aefe38..d3becf0a 100644
--- a/src/garage/tests/admin.rs
+++ b/src/garage/tests/admin.rs
@@ -21,14 +21,7 @@ async fn test_admin_bucket_perms() {
 
 	ctx.garage
 		.command()
-		.args([
-			"bucket",
-			"allow",
-			"--read",
-			"--key",
-			&ctx.garage.key.id,
-			BCKT_NAME,
-		])
+		.args(["bucket", "allow", "--read", "--key", &ctx.key.id, BCKT_NAME])
 		.quiet()
 		.expect_success_status("Could not create bucket");
 
@@ -36,14 +29,7 @@ async fn test_admin_bucket_perms() {
 
 	ctx.garage
 		.command()
-		.args([
-			"bucket",
-			"deny",
-			"--read",
-			"--key",
-			&ctx.garage.key.name,
-			BCKT_NAME,
-		])
+		.args(["bucket", "deny", "--read", "--key", &ctx.key.id, BCKT_NAME])
 		.quiet()
 		.expect_success_status("Could not create bucket");
 
@@ -51,14 +37,7 @@ async fn test_admin_bucket_perms() {
 
 	ctx.garage
 		.command()
-		.args([
-			"bucket",
-			"allow",
-			"--read",
-			"--key",
-			&ctx.garage.key.name,
-			BCKT_NAME,
-		])
+		.args(["bucket", "allow", "--read", "--key", &ctx.key.id, BCKT_NAME])
 		.quiet()
 		.expect_success_status("Could not create bucket");
 
diff --git a/src/garage/tests/bucket.rs b/src/garage/tests/bucket.rs
index 9c363013..0dec3cfa 100644
--- a/src/garage/tests/bucket.rs
+++ b/src/garage/tests/bucket.rs
@@ -13,7 +13,7 @@ async fn test_bucket_all() {
 		ctx.garage
 			.command()
 			.args(["key", "deny"])
-			.args(["--create-bucket", &ctx.garage.key.id])
+			.args(["--create-bucket", &ctx.key.id])
 			.quiet()
 			.expect_success_output("Could not deny key to create buckets");
 
@@ -26,7 +26,7 @@ async fn test_bucket_all() {
 		ctx.garage
 			.command()
 			.args(["key", "allow"])
-			.args(["--create-bucket", &ctx.garage.key.id])
+			.args(["--create-bucket", &ctx.key.id])
 			.quiet()
 			.expect_success_output("Could not deny key to create buckets");
 
diff --git a/src/garage/tests/common/client.rs b/src/garage/tests/common/client.rs
index 212588b5..e9d4849a 100644
--- a/src/garage/tests/common/client.rs
+++ b/src/garage/tests/common/client.rs
@@ -1,15 +1,9 @@
 use aws_sdk_s3::{Client, Config, Credentials, Endpoint};
 
-use super::garage::Instance;
+use super::garage::{Instance, Key};
 
-pub fn build_client(instance: &Instance) -> Client {
-	let credentials = Credentials::new(
-		&instance.key.id,
-		&instance.key.secret,
-		None,
-		None,
-		"garage-integ-test",
-	);
+pub fn build_client(instance: &Instance, key: &Key) -> Client {
+	let credentials = Credentials::new(&key.id, &key.secret, None, None, "garage-integ-test");
 	let endpoint = Endpoint::immutable(instance.s3_uri());
 
 	let config = Config::builder()
diff --git a/src/garage/tests/common/custom_requester.rs b/src/garage/tests/common/custom_requester.rs
index 1700cc90..609eda97 100644
--- a/src/garage/tests/common/custom_requester.rs
+++ b/src/garage/tests/common/custom_requester.rs
@@ -14,6 +14,7 @@ use garage_api::signature;
 /// You should ever only use this to send requests AWS sdk won't send,
 /// like to reproduce behavior of unusual implementations found to be
 /// problematic.
+#[derive(Clone)]
 pub struct CustomRequester {
 	key: Key,
 	uri: Uri,
@@ -22,18 +23,18 @@ pub struct CustomRequester {
 }
 
 impl CustomRequester {
-	pub fn new_s3(instance: &Instance) -> Self {
+	pub fn new_s3(instance: &Instance, key: &Key) -> Self {
 		CustomRequester {
-			key: instance.key.clone(),
+			key: key.clone(),
 			uri: instance.s3_uri(),
 			service: "s3",
 			client: Client::new(),
 		}
 	}
 
-	pub fn new_k2v(instance: &Instance) -> Self {
+	pub fn new_k2v(instance: &Instance, key: &Key) -> Self {
 		CustomRequester {
-			key: instance.key.clone(),
+			key: key.clone(),
 			uri: instance.k2v_uri(),
 			service: "k2v",
 			client: Client::new(),
diff --git a/src/garage/tests/common/garage.rs b/src/garage/tests/common/garage.rs
index dbebe5b1..3beed7c4 100644
--- a/src/garage/tests/common/garage.rs
+++ b/src/garage/tests/common/garage.rs
@@ -13,7 +13,7 @@ static GARAGE_TEST_SECRET: &str =
 
 #[derive(Debug, Default, Clone)]
 pub struct Key {
-	pub name: String,
+	pub name: Option<String>,
 	pub id: String,
 	pub secret: String,
 }
@@ -21,10 +21,11 @@ pub struct Key {
 pub struct Instance {
 	process: process::Child,
 	pub path: PathBuf,
-	pub key: Key,
+	pub default_key: Key,
 	pub s3_port: u16,
 	pub k2v_port: u16,
 	pub web_port: u16,
+	pub admin_port: u16,
 }
 
 impl Instance {
@@ -101,22 +102,36 @@ api_bind_addr = "127.0.0.1:{admin_port}"
 		Instance {
 			process: child,
 			path,
-			key: Key::default(),
+			default_key: Key::default(),
 			s3_port: port,
 			k2v_port: port + 1,
 			web_port: port + 3,
+			admin_port: port + 4,
 		}
 	}
 
 	fn setup(&mut self) {
-		use std::{thread, time::Duration};
-
-		// Wait for node to be ready
-		thread::sleep(Duration::from_secs(2));
-
+		self.wait_for_boot();
 		self.setup_layout();
+		self.default_key = self.key(Some("garage_test"));
+	}
+
+	fn wait_for_boot(&mut self) {
+		use std::{thread, time::Duration};
 
-		self.key = self.new_key("garage_test");
+		// 60 * 2 seconds = 120 seconds = 2min
+		for _ in 0..60 {
+			let termination = self
+				.command()
+				.args(["status"])
+				.quiet()
+				.status()
+				.expect("Unable to run command");
+			if termination.success() {
+				break;
+			}
+			thread::sleep(Duration::from_secs(2));
+		}
 	}
 
 	fn setup_layout(&self) {
@@ -167,13 +182,17 @@ api_bind_addr = "127.0.0.1:{admin_port}"
 			.expect("Could not build garage endpoint URI")
 	}
 
-	pub fn new_key(&self, name: &str) -> Key {
+	pub fn key(&self, maybe_name: Option<&str>) -> Key {
 		let mut key = Key::default();
 
-		let output = self
-			.command()
-			.args(["key", "create", name])
-			.expect_success_output("Could not create key");
+		let mut cmd = self.command();
+		let base = cmd.args(["key", "create"]);
+		let with_name = match maybe_name {
+			Some(name) => base.args([name]),
+			None => base,
+		};
+
+		let output = with_name.expect_success_output("Could not create key");
 		let stdout = String::from_utf8(output.stdout).unwrap();
 
 		for line in stdout.lines() {
@@ -190,7 +209,7 @@ api_bind_addr = "127.0.0.1:{admin_port}"
 		assert!(!key.secret.is_empty(), "Invalid key: Key secret is empty");
 
 		Key {
-			name: name.to_owned(),
+			name: maybe_name.map(String::from),
 			..key
 		}
 	}
diff --git a/src/garage/tests/common/mod.rs b/src/garage/tests/common/mod.rs
index 28874b02..eca3e42b 100644
--- a/src/garage/tests/common/mod.rs
+++ b/src/garage/tests/common/mod.rs
@@ -13,13 +13,16 @@ use custom_requester::CustomRequester;
 
 const REGION: Region = Region::from_static("garage-integ-test");
 
+#[derive(Clone)]
 pub struct Context {
 	pub garage: &'static garage::Instance,
+	pub key: garage::Key,
 	pub client: Client,
 	pub custom_request: CustomRequester,
 	pub k2v: K2VContext,
 }
 
+#[derive(Clone)]
 pub struct K2VContext {
 	pub request: CustomRequester,
 }
@@ -27,13 +30,15 @@ pub struct K2VContext {
 impl Context {
 	fn new() -> Self {
 		let garage = garage::instance();
-		let client = client::build_client(garage);
-		let custom_request = CustomRequester::new_s3(garage);
-		let k2v_request = CustomRequester::new_k2v(garage);
+		let key = garage.key(None);
+		let client = client::build_client(garage, &key);
+		let custom_request = CustomRequester::new_s3(garage, &key);
+		let k2v_request = CustomRequester::new_k2v(garage, &key);
 
 		Context {
 			garage,
 			client,
+			key,
 			custom_request,
 			k2v: K2VContext {
 				request: k2v_request,
@@ -57,7 +62,7 @@ impl Context {
 			.args(["bucket", "allow"])
 			.args(["--owner", "--read", "--write"])
 			.arg(&bucket_name)
-			.args(["--key", &self.garage.key.name])
+			.args(["--key", &self.key.id])
 			.quiet()
 			.expect_success_status("Could not allow key for bucket");
 
diff --git a/src/garage/tests/k2v/batch.rs b/src/garage/tests/k2v/batch.rs
index 6abba1c5..595d0ba8 100644
--- a/src/garage/tests/k2v/batch.rs
+++ b/src/garage/tests/k2v/batch.rs
@@ -3,6 +3,7 @@ use std::collections::HashMap;
 use crate::common;
 
 use assert_json_diff::assert_json_eq;
+use base64::prelude::*;
 use serde_json::json;
 
 use super::json_body;
@@ -36,12 +37,12 @@ async fn test_batch() {
 	{{"pk": "root", "sk": "d.2", "ct": null, "v": "{}"}},
 	{{"pk": "root", "sk": "e", "ct": null, "v": "{}"}}
 		]"#,
-				base64::encode(values.get(&"a").unwrap()),
-				base64::encode(values.get(&"b").unwrap()),
-				base64::encode(values.get(&"c").unwrap()),
-				base64::encode(values.get(&"d.1").unwrap()),
-				base64::encode(values.get(&"d.2").unwrap()),
-				base64::encode(values.get(&"e").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"a").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"b").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"c").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"d.1").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"d.2").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"e").unwrap()),
 			)
 			.into_bytes(),
 		)
@@ -120,12 +121,12 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "a", "ct": ct.get("a").unwrap(), "v": [base64::encode(values.get("a").unwrap())]},
-				  {"sk": "b", "ct": ct.get("b").unwrap(), "v": [base64::encode(values.get("b").unwrap())]},
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap())]},
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1").unwrap())]},
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap())]},
-				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [base64::encode(values.get("e").unwrap())]}
+				  {"sk": "a", "ct": ct.get("a").unwrap(), "v": [BASE64_STANDARD.encode(values.get("a").unwrap())]},
+				  {"sk": "b", "ct": ct.get("b").unwrap(), "v": [BASE64_STANDARD.encode(values.get("b").unwrap())]},
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap())]},
+				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [BASE64_STANDARD.encode(values.get("e").unwrap())]}
 				],
 				"more": false,
 				"nextStart": null,
@@ -141,10 +142,10 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap())]},
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1").unwrap())]},
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap())]},
-				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [base64::encode(values.get("e").unwrap())]}
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap())]},
+				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [BASE64_STANDARD.encode(values.get("e").unwrap())]}
 				],
 				"more": false,
 				"nextStart": null,
@@ -160,9 +161,9 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap())]},
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1").unwrap())]},
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap())]},
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -178,8 +179,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap())]},
-				  {"sk": "b", "ct": ct.get("b").unwrap(), "v": [base64::encode(values.get("b").unwrap())]},
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap())]},
+				  {"sk": "b", "ct": ct.get("b").unwrap(), "v": [BASE64_STANDARD.encode(values.get("b").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -195,8 +196,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap())]},
-				  {"sk": "b", "ct": ct.get("b").unwrap(), "v": [base64::encode(values.get("b").unwrap())]},
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap())]},
+				  {"sk": "b", "ct": ct.get("b").unwrap(), "v": [BASE64_STANDARD.encode(values.get("b").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -212,7 +213,7 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "a", "ct": ct.get("a").unwrap(), "v": [base64::encode(values.get("a").unwrap())]}
+				  {"sk": "a", "ct": ct.get("a").unwrap(), "v": [BASE64_STANDARD.encode(values.get("a").unwrap())]}
 				],
 				"more": true,
 				"nextStart": "b",
@@ -228,8 +229,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1").unwrap())]},
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap())]}
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap())]}
 				],
 				"more": false,
 				"nextStart": null,
@@ -255,10 +256,10 @@ async fn test_batch() {
 	{{"pk": "root", "sk": "d.2", "ct": null, "v": "{}"}}
 		]"#,
 				ct.get(&"b").unwrap(),
-				base64::encode(values.get(&"c'").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"c'").unwrap()),
 				ct.get(&"d.1").unwrap(),
-				base64::encode(values.get(&"d.1'").unwrap()),
-				base64::encode(values.get(&"d.2'").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"d.1'").unwrap()),
+				BASE64_STANDARD.encode(values.get(&"d.2'").unwrap()),
 			)
 			.into_bytes(),
 		)
@@ -333,11 +334,11 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "a", "ct": ct.get("a").unwrap(), "v": [base64::encode(values.get("a").unwrap())]},
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap()), base64::encode(values.get("c'").unwrap())]},
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1'").unwrap())]},
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap()), base64::encode(values.get("d.2'").unwrap())]},
-				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [base64::encode(values.get("e").unwrap())]}
+				  {"sk": "a", "ct": ct.get("a").unwrap(), "v": [BASE64_STANDARD.encode(values.get("a").unwrap())]},
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap()), BASE64_STANDARD.encode(values.get("c'").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1'").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap()), BASE64_STANDARD.encode(values.get("d.2'").unwrap())]},
+				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [BASE64_STANDARD.encode(values.get("e").unwrap())]}
 				],
 				"more": false,
 				"nextStart": null,
@@ -353,8 +354,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1'").unwrap())]},
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap()), base64::encode(values.get("d.2'").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1'").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap()), BASE64_STANDARD.encode(values.get("d.2'").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -370,7 +371,7 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1'").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1'").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -386,7 +387,7 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1'").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1'").unwrap())]},
 				],
 				"more": true,
 				"nextStart": "d.2",
@@ -402,7 +403,7 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap()), base64::encode(values.get("d.2'").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap()), BASE64_STANDARD.encode(values.get("d.2'").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -418,8 +419,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap()), base64::encode(values.get("d.2'").unwrap())]},
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1'").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap()), BASE64_STANDARD.encode(values.get("d.2'").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1'").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -435,8 +436,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap()), base64::encode(values.get("d.2'").unwrap())]},
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1'").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap()), BASE64_STANDARD.encode(values.get("d.2'").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1'").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -452,8 +453,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [base64::encode(values.get("d.1'").unwrap())]},
-				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [base64::encode(values.get("d.2").unwrap()), base64::encode(values.get("d.2'").unwrap())]},
+				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.1'").unwrap())]},
+				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [BASE64_STANDARD.encode(values.get("d.2").unwrap()), BASE64_STANDARD.encode(values.get("d.2'").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -563,8 +564,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap()), base64::encode(values.get("c'").unwrap())]},
-				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [base64::encode(values.get("e").unwrap())]}
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap()), BASE64_STANDARD.encode(values.get("c'").unwrap())]},
+				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [BASE64_STANDARD.encode(values.get("e").unwrap())]}
 				],
 				"more": false,
 				"nextStart": null,
@@ -580,8 +581,8 @@ async fn test_batch() {
 				"tombstones": false,
 				"singleItem": false,
 				"items": [
-				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [base64::encode(values.get("e").unwrap())]},
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap()), base64::encode(values.get("c'").unwrap())]},
+				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [BASE64_STANDARD.encode(values.get("e").unwrap())]},
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap()), BASE64_STANDARD.encode(values.get("c'").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
@@ -599,10 +600,10 @@ async fn test_batch() {
 				"items": [
 				  {"sk": "a", "ct": ct.get("a").unwrap(), "v": [null]},
 				  {"sk": "b", "ct": ct.get("b").unwrap(), "v": [null]},
-				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [base64::encode(values.get("c").unwrap()), base64::encode(values.get("c'").unwrap())]},
+				  {"sk": "c", "ct": ct.get("c").unwrap(), "v": [BASE64_STANDARD.encode(values.get("c").unwrap()), BASE64_STANDARD.encode(values.get("c'").unwrap())]},
 				  {"sk": "d.1", "ct": ct.get("d.1").unwrap(), "v": [null]},
 				  {"sk": "d.2", "ct": ct.get("d.2").unwrap(), "v": [null]},
-				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [base64::encode(values.get("e").unwrap())]},
+				  {"sk": "e", "ct": ct.get("e").unwrap(), "v": [BASE64_STANDARD.encode(values.get("e").unwrap())]},
 				],
 				"more": false,
 				"nextStart": null,
diff --git a/src/garage/tests/k2v/item.rs b/src/garage/tests/k2v/item.rs
index 2641386f..588836c7 100644
--- a/src/garage/tests/k2v/item.rs
+++ b/src/garage/tests/k2v/item.rs
@@ -3,6 +3,7 @@ use std::time::Duration;
 use crate::common;
 
 use assert_json_diff::assert_json_eq;
+use base64::prelude::*;
 use serde_json::json;
 
 use super::json_body;
@@ -222,7 +223,10 @@ async fn test_items_and_indices() {
 		let res_json = json_body(res).await;
 		assert_json_eq!(
 			res_json,
-			[base64::encode(&content2), base64::encode(&content3)]
+			[
+				BASE64_STANDARD.encode(&content2),
+				BASE64_STANDARD.encode(&content3)
+			]
 		);
 
 		// ReadIndex -- now there should be some stuff
@@ -411,7 +415,7 @@ async fn test_item_return_format() {
 		"application/json"
 	);
 	let res_body = json_body(res).await;
-	assert_json_eq!(res_body, json!([base64::encode(&single_value)]));
+	assert_json_eq!(res_body, json!([BASE64_STANDARD.encode(&single_value)]));
 
 	// f2: binary
 	let res = ctx
@@ -452,7 +456,7 @@ async fn test_item_return_format() {
 		"application/json"
 	);
 	let res_body = json_body(res).await;
-	assert_json_eq!(res_body, json!([base64::encode(&single_value)]));
+	assert_json_eq!(res_body, json!([BASE64_STANDARD.encode(&single_value)]));
 
 	// -- Test with a second, concurrent value --
 	let res = ctx
@@ -488,8 +492,8 @@ async fn test_item_return_format() {
 	assert_json_eq!(
 		res_body,
 		json!([
-			base64::encode(&single_value),
-			base64::encode(&concurrent_value)
+			BASE64_STANDARD.encode(&single_value),
+			BASE64_STANDARD.encode(&concurrent_value)
 		])
 	);
 
@@ -512,8 +516,8 @@ async fn test_item_return_format() {
 	assert_json_eq!(
 		res_body,
 		json!([
-			base64::encode(&single_value),
-			base64::encode(&concurrent_value)
+			BASE64_STANDARD.encode(&single_value),
+			BASE64_STANDARD.encode(&concurrent_value)
 		])
 	);
 
@@ -550,8 +554,8 @@ async fn test_item_return_format() {
 	assert_json_eq!(
 		res_body,
 		json!([
-			base64::encode(&single_value),
-			base64::encode(&concurrent_value)
+			BASE64_STANDARD.encode(&single_value),
+			BASE64_STANDARD.encode(&concurrent_value)
 		])
 	);
 
@@ -587,7 +591,10 @@ async fn test_item_return_format() {
 		"application/json"
 	);
 	let res_body = json_body(res).await;
-	assert_json_eq!(res_body, json!([base64::encode(&concurrent_value), null]));
+	assert_json_eq!(
+		res_body,
+		json!([BASE64_STANDARD.encode(&concurrent_value), null])
+	);
 
 	// f1: not specified
 	let res = ctx
@@ -612,7 +619,10 @@ async fn test_item_return_format() {
 		.unwrap()
 		.to_string();
 	let res_body = json_body(res).await;
-	assert_json_eq!(res_body, json!([base64::encode(&concurrent_value), null]));
+	assert_json_eq!(
+		res_body,
+		json!([BASE64_STANDARD.encode(&concurrent_value), null])
+	);
 
 	// f2: binary
 	let res = ctx
@@ -644,7 +654,10 @@ async fn test_item_return_format() {
 		"application/json"
 	);
 	let res_body = json_body(res).await;
-	assert_json_eq!(res_body, json!([base64::encode(&concurrent_value), null]));
+	assert_json_eq!(
+		res_body,
+		json!([BASE64_STANDARD.encode(&concurrent_value), null])
+	);
 
 	// -- Delete everything --
 	let res = ctx
diff --git a/src/garage/tests/k2v/poll.rs b/src/garage/tests/k2v/poll.rs
index e56705ae..dd44aed9 100644
--- a/src/garage/tests/k2v/poll.rs
+++ b/src/garage/tests/k2v/poll.rs
@@ -1,12 +1,17 @@
+use base64::prelude::*;
 use hyper::{Method, StatusCode};
 use std::time::Duration;
 
+use assert_json_diff::assert_json_eq;
+use serde_json::json;
+
+use super::json_body;
 use crate::common;
 
 #[tokio::test]
-async fn test_poll() {
+async fn test_poll_item() {
 	let ctx = common::context();
-	let bucket = ctx.create_bucket("test-k2v-poll");
+	let bucket = ctx.create_bucket("test-k2v-poll-item");
 
 	// Write initial value
 	let res = ctx
@@ -52,8 +57,8 @@ async fn test_poll() {
 	let poll = {
 		let bucket = bucket.clone();
 		let ct = ct.clone();
+		let ctx = ctx.clone();
 		tokio::spawn(async move {
-			let ctx = common::context();
 			ctx.k2v
 				.request
 				.builder(bucket.clone())
@@ -96,3 +101,165 @@ async fn test_poll() {
 		.to_vec();
 	assert_eq!(poll_res_body, b"New value");
 }
+
+#[tokio::test]
+async fn test_poll_range() {
+	let ctx = common::context();
+	let bucket = ctx.create_bucket("test-k2v-poll-range");
+
+	// Write initial value
+	let res = ctx
+		.k2v
+		.request
+		.builder(bucket.clone())
+		.method(Method::PUT)
+		.path("root")
+		.query_param("sort_key", Some("test1"))
+		.body(b"Initial value".to_vec())
+		.send()
+		.await
+		.unwrap();
+	assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+	// Retrieve initial value to get its causality token
+	let res2 = ctx
+		.k2v
+		.request
+		.builder(bucket.clone())
+		.path("root")
+		.query_param("sort_key", Some("test1"))
+		.signed_header("accept", "application/octet-stream")
+		.send()
+		.await
+		.unwrap();
+	assert_eq!(res2.status(), StatusCode::OK);
+	let ct = res2
+		.headers()
+		.get("x-garage-causality-token")
+		.unwrap()
+		.to_str()
+		.unwrap()
+		.to_string();
+
+	// Initial poll range, retrieve single item and first seen_marker
+	let res2 = ctx
+		.k2v
+		.request
+		.builder(bucket.clone())
+		.method(Method::POST)
+		.path("root")
+		.query_param("poll_range", None::<String>)
+		.body(b"{}".to_vec())
+		.send()
+		.await
+		.unwrap();
+	assert_eq!(res2.status(), StatusCode::OK);
+	let json_res = json_body(res2).await;
+	let seen_marker = json_res["seenMarker"].as_str().unwrap().to_string();
+	assert_json_eq!(
+		json_res,
+		json!(
+			{
+				"items": [
+				  {"sk": "test1", "ct": ct, "v": [BASE64_STANDARD.encode(b"Initial value")]},
+				],
+				"seenMarker": seen_marker,
+			}
+		)
+	);
+
+	// Second poll range, which will complete later
+	let poll = {
+		let bucket = bucket.clone();
+		let ctx = ctx.clone();
+		tokio::spawn(async move {
+			ctx.k2v
+				.request
+				.builder(bucket.clone())
+				.method(Method::POST)
+				.path("root")
+				.query_param("poll_range", None::<String>)
+				.body(format!(r#"{{"seenMarker": "{}"}}"#, seen_marker).into_bytes())
+				.send()
+				.await
+		})
+	};
+
+	// Write new value that supersedes initial one
+	let res = ctx
+		.k2v
+		.request
+		.builder(bucket.clone())
+		.method(Method::PUT)
+		.path("root")
+		.query_param("sort_key", Some("test1"))
+		.signed_header("x-garage-causality-token", ct)
+		.body(b"New value".to_vec())
+		.send()
+		.await
+		.unwrap();
+	assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+	// Check poll finishes with correct value
+	let poll_res = tokio::select! {
+		_ = tokio::time::sleep(Duration::from_secs(10)) => panic!("poll did not terminate in time"),
+		res = poll => res.unwrap().unwrap(),
+	};
+
+	assert_eq!(poll_res.status(), StatusCode::OK);
+	let json_res = json_body(poll_res).await;
+	let seen_marker = json_res["seenMarker"].as_str().unwrap().to_string();
+	assert_eq!(json_res["items"].as_array().unwrap().len(), 1);
+	assert_json_eq!(&json_res["items"][0]["sk"], json!("test1"));
+	assert_json_eq!(
+		&json_res["items"][0]["v"],
+		json!([BASE64_STANDARD.encode(b"New value")])
+	);
+
+	// Now we will add a value on a different key
+	// Start a new poll operation
+	let poll = {
+		let bucket = bucket.clone();
+		let ctx = ctx.clone();
+		tokio::spawn(async move {
+			ctx.k2v
+				.request
+				.builder(bucket.clone())
+				.method(Method::POST)
+				.path("root")
+				.query_param("poll_range", None::<String>)
+				.body(format!(r#"{{"seenMarker": "{}"}}"#, seen_marker).into_bytes())
+				.send()
+				.await
+		})
+	};
+
+	// Write value on different key
+	let res = ctx
+		.k2v
+		.request
+		.builder(bucket.clone())
+		.method(Method::PUT)
+		.path("root")
+		.query_param("sort_key", Some("test2"))
+		.body(b"Other value".to_vec())
+		.send()
+		.await
+		.unwrap();
+	assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+	// Check poll finishes with correct value
+	let poll_res = tokio::select! {
+		_ = tokio::time::sleep(Duration::from_secs(10)) => panic!("poll did not terminate in time"),
+		res = poll => res.unwrap().unwrap(),
+	};
+
+	assert_eq!(poll_res.status(), StatusCode::OK);
+	let json_res = json_body(poll_res).await;
+	assert_eq!(json_res["items"].as_array().unwrap().len(), 1);
+	assert_json_eq!(&json_res["items"][0]["sk"], json!("test2"));
+	assert_json_eq!(
+		&json_res["items"][0]["v"],
+		json!([BASE64_STANDARD.encode(b"Other value")])
+	);
+}
diff --git a/src/garage/tests/s3/streaming_signature.rs b/src/garage/tests/s3/streaming_signature.rs
index 48da7607..b7a1acae 100644
--- a/src/garage/tests/s3/streaming_signature.rs
+++ b/src/garage/tests/s3/streaming_signature.rs
@@ -109,7 +109,7 @@ async fn test_create_bucket_streaming() {
 	ctx.garage
 		.command()
 		.args(["key", "allow"])
-		.args(["--create-bucket", &ctx.garage.key.id])
+		.args(["--create-bucket", &ctx.key.id])
 		.quiet()
 		.expect_success_output("Could not allow key to create buckets");
 
diff --git a/src/garage/tests/s3/website.rs b/src/garage/tests/s3/website.rs
index 244a2fa0..f61838e4 100644
--- a/src/garage/tests/s3/website.rs
+++ b/src/garage/tests/s3/website.rs
@@ -1,5 +1,8 @@
 use crate::common;
 use crate::common::ext::*;
+use crate::k2v::json_body;
+
+use assert_json_diff::assert_json_eq;
 use aws_sdk_s3::{
 	model::{CorsConfiguration, CorsRule, ErrorDocument, IndexDocument, WebsiteConfiguration},
 	types::ByteStream,
@@ -9,6 +12,7 @@ use hyper::{
 	body::{to_bytes, Body},
 	Client,
 };
+use serde_json::json;
 
 const BODY: &[u8; 16] = b"<h1>bonjour</h1>";
 const BODY_ERR: &[u8; 6] = b"erreur";
@@ -49,6 +53,31 @@ async fn test_website() {
 		BODY.as_ref()
 	); /* check that we do not leak body */
 
+	let admin_req = || {
+		Request::builder()
+			.method("GET")
+			.uri(format!(
+				"http://127.0.0.1:{0}/check?domain={1}",
+				ctx.garage.admin_port,
+				BCKT_NAME.to_string()
+			))
+			.body(Body::empty())
+			.unwrap()
+	};
+
+	let admin_resp = client.request(admin_req()).await.unwrap();
+	assert_eq!(admin_resp.status(), StatusCode::BAD_REQUEST);
+	let res_body = json_body(admin_resp).await;
+	assert_json_eq!(
+		res_body,
+		json!({
+			"code": "InvalidRequest",
+			"message": "Bad request: Bucket 'my-website' is not authorized for website hosting",
+			"region": "garage-integ-test",
+			"path": "/check",
+		})
+	);
+
 	ctx.garage
 		.command()
 		.args(["bucket", "website", "--allow", BCKT_NAME])
@@ -62,6 +91,25 @@ async fn test_website() {
 		BODY.as_ref()
 	);
 
+	let admin_req = || {
+		Request::builder()
+			.method("GET")
+			.uri(format!(
+				"http://127.0.0.1:{0}/check?domain={1}",
+				ctx.garage.admin_port,
+				BCKT_NAME.to_string()
+			))
+			.body(Body::empty())
+			.unwrap()
+	};
+
+	let mut admin_resp = client.request(admin_req()).await.unwrap();
+	assert_eq!(admin_resp.status(), StatusCode::OK);
+	assert_eq!(
+		to_bytes(admin_resp.body_mut()).await.unwrap().as_ref(),
+		format!("Bucket '{BCKT_NAME}' is authorized for website hosting").as_bytes()
+	);
+
 	ctx.garage
 		.command()
 		.args(["bucket", "website", "--deny", BCKT_NAME])
@@ -74,6 +122,31 @@ async fn test_website() {
 		to_bytes(resp.body_mut()).await.unwrap().as_ref(),
 		BODY.as_ref()
 	); /* check that we do not leak body */
+
+	let admin_req = || {
+		Request::builder()
+			.method("GET")
+			.uri(format!(
+				"http://127.0.0.1:{0}/check?domain={1}",
+				ctx.garage.admin_port,
+				BCKT_NAME.to_string()
+			))
+			.body(Body::empty())
+			.unwrap()
+	};
+
+	let admin_resp = client.request(admin_req()).await.unwrap();
+	assert_eq!(admin_resp.status(), StatusCode::BAD_REQUEST);
+	let res_body = json_body(admin_resp).await;
+	assert_json_eq!(
+		res_body,
+		json!({
+			"code": "InvalidRequest",
+			"message": "Bad request: Bucket 'my-website' is not authorized for website hosting",
+			"region": "garage-integ-test",
+			"path": "/check",
+		})
+	);
 }
 
 #[tokio::test]
@@ -322,3 +395,103 @@ async fn test_website_s3_api() {
 		);
 	}
 }
+
+#[tokio::test]
+async fn test_website_check_website_enabled() {
+	let ctx = common::context();
+
+	let client = Client::new();
+
+	let admin_req = || {
+		Request::builder()
+			.method("GET")
+			.uri(format!("http://127.0.0.1:{}/check", ctx.garage.admin_port))
+			.body(Body::empty())
+			.unwrap()
+	};
+
+	let admin_resp = client.request(admin_req()).await.unwrap();
+	assert_eq!(admin_resp.status(), StatusCode::BAD_REQUEST);
+	let res_body = json_body(admin_resp).await;
+	assert_json_eq!(
+		res_body,
+		json!({
+			"code": "InvalidRequest",
+			"message": "Bad request: No domain query string found",
+			"region": "garage-integ-test",
+			"path": "/check",
+		})
+	);
+
+	let admin_req = || {
+		Request::builder()
+			.method("GET")
+			.uri(format!(
+				"http://127.0.0.1:{}/check?domain=",
+				ctx.garage.admin_port
+			))
+			.body(Body::empty())
+			.unwrap()
+	};
+
+	let admin_resp = client.request(admin_req()).await.unwrap();
+	assert_eq!(admin_resp.status(), StatusCode::NOT_FOUND);
+	let res_body = json_body(admin_resp).await;
+	assert_json_eq!(
+		res_body,
+		json!({
+			"code": "NoSuchBucket",
+			"message": "Bucket not found: ",
+			"region": "garage-integ-test",
+			"path": "/check",
+		})
+	);
+
+	let admin_req = || {
+		Request::builder()
+			.method("GET")
+			.uri(format!(
+				"http://127.0.0.1:{}/check?domain=foobar",
+				ctx.garage.admin_port
+			))
+			.body(Body::empty())
+			.unwrap()
+	};
+
+	let admin_resp = client.request(admin_req()).await.unwrap();
+	assert_eq!(admin_resp.status(), StatusCode::NOT_FOUND);
+	let res_body = json_body(admin_resp).await;
+	assert_json_eq!(
+		res_body,
+		json!({
+			"code": "NoSuchBucket",
+			"message": "Bucket not found: foobar",
+			"region": "garage-integ-test",
+			"path": "/check",
+		})
+	);
+
+	let admin_req = || {
+		Request::builder()
+			.method("GET")
+			.uri(format!(
+				"http://127.0.0.1:{}/check?domain=%E2%98%B9",
+				ctx.garage.admin_port
+			))
+			.body(Body::empty())
+			.unwrap()
+	};
+
+	let admin_resp = client.request(admin_req()).await.unwrap();
+	assert_eq!(admin_resp.status(), StatusCode::NOT_FOUND);
+	let res_body = json_body(admin_resp).await;
+	assert_json_eq!(
+		res_body,
+		json!({
+			"code": "NoSuchBucket",
+			"message": "Bucket not found: ☹",
+			"region": "garage-integ-test",
+			"path": "/check",
+		})
+	);
+}