Chris LuandClaude Opus 5.5 21fc46692c s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287) ...

* s3vectors: authorize CreateVectorBucket as an s3vectors action

CreateVectorBucket went through the catalog's CreateTableBucket check, so
an identity granted s3vectors:* was denied the create while s3tables:*
was allowed it. Check s3vectors:CreateVectorBucket in the gateway, the
same way the catalog checks a bucket create, and create the record on
the internal manager under the caller's name so the caller stays the
owner.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3vectors: delete only the index record DeleteIndex checked

DeleteIndex read the record, checked it is a Lance index, then deleted
by name. A table that replaced the index in between was deleted too.
Send the checked record's version token, so a replaced record fails the
delete with a 409 ConflictException.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3tables: reject s3vectors rules in any letter case

validatePolicyDocument kept s3vectors actions and resources out of the
shared policy slot with case-sensitive checks, so "S3Vectors:GetIndex"
was stored as a rule that never takes effect. IAM service prefixes are
case-insensitive; fold case in both checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-31 15:07:23 -07:00

..

s3tablestest

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

filer_ops_race_test.go

s3, s3tables: create buckets and namespaces exclusively (#11872)

2026-10-20 19:01:08 -07:00

filer_ops_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

filer_ops.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

handler_bucket_create.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

handler_bucket_format_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_bucket_get_list_delete.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

handler_delete_create_race_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_delete_decouple_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_delete_replacement_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_existence_hiding_test.go

s3tables: judge an absent tag target by its canonical ARN (#11912)

2026-10-21 13:31:04 -07:00

handler_identity_test.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

handler_log_level_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_maintenance_test.go

s3tables: add the maintenance configuration APIs (#10773)

2026-08-16 10:36:59 -07:00

handler_maintenance.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler_name_charset_test.go

s3tables: allow hyphens in namespace and table names (#10093)

2026-06-24 16:24:45 -07:00

handler_namespace_keeps_data_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

handler_namespace_resolution_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_namespace.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

handler_no_trace_errorf_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_ownerless_test.go

s3tables: only the admin repairs a table bucket that has no owner metadata (#11873)

2026-10-20 18:58:54 -07:00

handler_policy_deny_test.go

s3tables: honor resource policy Deny on remaining operations (#11825)

2026-10-19 03:59:18 -07:00

handler_policy.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler_principal_test.go

s3vectors: keep bucket policies in vector form and evaluate them in the gateway (#12214)

2026-10-29 13:35:34 -07:00

handler_rename_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_renamed_source_test.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler_table_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

handler_table.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler_update_cas_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_update_conflict_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_view_rename_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_view_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

iam.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

iceberg_layout_test.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_layout.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_manifest_list_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest_list.go

iceberg: read manifest lists that omit the Avro format version (#10475)

2026-07-28 16:42:17 -07:00

iceberg_manifest_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

manager_test.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

manager.go

s3vectors: keep bucket policies in vector form and evaluate them in the gateway (#12214)

2026-10-29 13:35:34 -07:00

permissions_test.go

s3tables: keep the admin bypass off an identified caller's empty action list (#12217)

2026-10-29 13:41:26 -07:00

permissions.go

s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287)

2026-10-31 15:07:23 -07:00

policy_case_test.go

s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287)

2026-10-31 15:07:23 -07:00

table_data_dir_test.go

iceberg: make a table commit a compare-and-swap (#10775)

2026-08-16 12:55:42 -07:00

types.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

utils_location_test.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00

utils_namespace_test.go

iceberg: persist namespace properties for create/get (#8276)

2026-02-09 22:20:45 -08:00

utils.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00