From df2de6d1a49184ccaaf0a75c0bc218ed4c5fa4f7 Mon Sep 17 00:00:00 2001
From: Chris Lu <chrislusf@users.noreply.github.com>
Date: Fri, 13 Nov 2026 02:56:59 -0800
Subject: [PATCH] iceberg: give the catalog's table handler the local accounts
 and issuer set

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 weed/s3api/iceberg/server.go |  8 ++++++++
 weed/s3api/s3api_server.go   | 16 ++++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/weed/s3api/iceberg/server.go b/weed/s3api/iceberg/server.go
index 1849f2e6e8..a19b43c47d 100644
--- a/weed/s3api/iceberg/server.go
+++ b/weed/s3api/iceberg/server.go
@@ -73,6 +73,14 @@ func NewServer(filerClient FilerClient, authenticator S3Authenticator) *Server {
 	if authenticator != nil {
 		manager.SetDefaultAllow(authenticator.DefaultAllow())
 	}
+	if checker, ok := authenticator.(interface{ IsConfiguredAccountID(string) bool }); ok {
+		manager.SetLocalAccountChecker(checker.IsConfiguredAccountID)
+	}
+	if source, ok := authenticator.(interface {
+		TrustedOIDCIssuers(context.Context) []string
+	}); ok {
+		manager.SetTrustedIssuerSource(source.TrustedOIDCIssuers)
+	}
 	return &Server{
 		filerClient:   filerClient,
 		tablesManager: manager,
diff --git a/weed/s3api/s3api_server.go b/weed/s3api/s3api_server.go
index 8d120ed4d2..91a0da8e80 100644
--- a/weed/s3api/s3api_server.go
+++ b/weed/s3api/s3api_server.go
@@ -1528,6 +1528,22 @@ func (s3a *S3ApiServer) DefaultAllow() bool {
 	return s3a.iam.iamIntegration.DefaultAllow()
 }
 
+// IsConfiguredAccountID reports whether id is the account of a configured identity.
+func (s3a *S3ApiServer) IsConfiguredAccountID(id string) bool {
+	return s3a.iam != nil && s3a.iam.isConfiguredAccountID(id)
+}
+
+// TrustedOIDCIssuers returns the configured OIDC issuer set.
+func (s3a *S3ApiServer) TrustedOIDCIssuers(ctx context.Context) []string {
+	if s3a.iam == nil {
+		return nil
+	}
+	if s3iam, ok := s3a.iam.iamIntegration.(*S3IAMIntegration); ok {
+		return s3iam.trustedOIDCIssuers(ctx)
+	}
+	return nil
+}
+
 // ValidateS3Credential validates an S3 access key / secret key pair.
 // Returns the identity name and identity object on success.
 func (s3a *S3ApiServer) ValidateS3Credential(accessKey, secretKey string) (string, interface{}, error) {