s3tables: improve error handling and permission logic

- Update handleGetNamespace to distinguish between 404 and 500 errors
- Refactor CanManagePolicy to use CheckPermission for consistent enforcement
- Ensure empty identities are correctly handled in policy management checks

weed/s3api/s3tables/handler_namespace.go

@@ -167,7 +167,11 @@ func (h *S3TablesHandler) handleGetNamespace(w http.ResponseWriter, r *http.Requ
 	})
 
 	if err != nil {
-		h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", flattenNamespace(req.Namespace)))
+		if errors.Is(err, filer_pb.ErrNotFound) {
+			h.writeError(w, http.StatusNotFound, ErrCodeNoSuchNamespace, fmt.Sprintf("namespace %s not found", flattenNamespace(req.Namespace)))
+		} else {
+			h.writeError(w, http.StatusInternalServerError, ErrCodeInternalError, fmt.Sprintf("failed to get namespace: %v", err))
+		}
 		return err
 	}
 

weed/s3api/s3tables/permissions.go

@@ -159,8 +159,7 @@ func CanListTables(principal, owner string) bool {
 
 // CanManagePolicy checks if principal can manage policies
 func CanManagePolicy(principal, owner string) bool {
-	// Policy management requires owner permissions
-	return principal == owner
+	return CheckPermission("ManagePolicy", principal, owner)
 }
 
 // CanManageTags checks if principal can manage tags