Chris LuandDevin 4bdbfbaaa8 s3tables: judge an absent tag target by its canonical ARN (#11912) ...

* s3tables: judge an absent tag target by its canonical ARN

authorizeAbsentTarget matched the bucket policy's Deny statements
against the request's raw resource ARN. The ARN parsers accept any
account and region but resolve the target by name, so a caller with an
identity grant could reformat the ARN, miss the Deny match, and learn
whether a denied name exists — the oracle the absent-target check was
meant to close. Rebuild the ARN from the resolved names and the real
bucket owner and evaluate the Deny against that, matching what the
existing-target path checks.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* s3tables: cover a foreign-account ARN on an absent denied table

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

* s3tables: keep the absent-target deny check behind a supplied ARN

Callers that pass no resource ARN (ListTables, ListViews,
CreateNamespace) must reach CheckTableOrBucketPermission's admin
shortcut unchanged; running the bucket-policy Deny match first would
deny the admin lists those callers take.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

---------

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-10-21 13:31:04 -07:00

..

s3tablestest

avro: field time.Time <> iceberg.date (#11091)

2026-09-02 17:24:23 -07:00

filer_ops_race_test.go

s3, s3tables: create buckets and namespaces exclusively (#11872)

2026-10-20 19:01:08 -07:00

filer_ops_test.go

Report a delete the filer rejected instead of answering success (#11003)

2026-08-27 22:29:48 -07:00

filer_ops.go

s3, s3tables: create buckets and namespaces exclusively (#11872)

2026-10-20 19:01:08 -07:00

handler_bucket_create.go

s3, s3tables: create buckets and namespaces exclusively (#11872)

2026-10-20 19:01:08 -07:00

handler_bucket_format_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_bucket_get_list_delete.go

s3tables: keep absent-target answers identical to denied ones (#11905)

2026-10-21 13:07:47 -07:00

handler_delete_decouple_test.go

s3tables: check data-path ancestors for catalog markers on DeleteTable

2026-10-12 02:41:28 -07:00

handler_existence_hiding_test.go

s3tables: judge an absent tag target by its canonical ARN (#11912)

2026-10-21 13:31:04 -07:00

handler_identity_test.go

s3tables: scope OIDC-derived account IDs to the token issuer (#11774)

2026-10-16 19:48:32 -07:00

handler_maintenance_test.go

s3tables: add the maintenance configuration APIs (#10773)

2026-08-16 10:36:59 -07:00

handler_maintenance.go

s3tables: honor resource policy Deny on remaining operations (#11825)

2026-10-19 03:59:18 -07:00

handler_name_charset_test.go

s3tables: allow hyphens in namespace and table names (#10093)

2026-06-24 16:24:45 -07:00

handler_namespace_resolution_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_namespace.go

s3tables: keep absent-target answers identical to denied ones (#11905)

2026-10-21 13:07:47 -07:00

handler_ownerless_test.go

s3tables: only the admin repairs a table bucket that has no owner metadata (#11873)

2026-10-20 18:58:54 -07:00

handler_policy_deny_test.go

s3tables: honor resource policy Deny on remaining operations (#11825)

2026-10-19 03:59:18 -07:00

handler_policy.go

s3tables: keep absent-target answers identical to denied ones (#11905)

2026-10-21 13:07:47 -07:00

handler_principal_test.go

s3api: unify auth error handling across s3tables, iceberg and lance (#11381)

2026-09-18 01:01:04 -07:00

handler_rename_test.go

s3tables: hide inaccessible catalog resources (#11365)

2026-09-17 11:43:52 -07:00

handler_table_test.go

iceberg: support table register (#10067)

2026-06-23 14:07:13 -07:00

handler_table.go

s3tables: keep absent-target answers identical to denied ones (#11905)

2026-10-21 13:07:47 -07:00

handler_update_cas_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view_rename_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view.go

s3tables: keep absent-target answers identical to denied ones (#11905)

2026-10-21 13:07:47 -07:00

handler.go

s3tables: judge an absent tag target by its canonical ARN (#11912)

2026-10-21 13:31:04 -07:00

iam.go

s3api: tolerate session tokens on statically configured credentials (#11694)

2026-10-10 10:11:24 +08:00

iceberg_layout_test.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_layout.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_manifest_list_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest_list.go

iceberg: read manifest lists that omit the Avro format version (#10475)

2026-07-28 16:42:17 -07:00

iceberg_manifest_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

manager_test.go

s3tables: scope management authorization to the caller's identity (#9961)

2026-06-14 13:55:36 -07:00

manager.go

iceberg, lance: vend read-only credentials to callers that may only read (#11859)

2026-10-20 07:16:27 -07:00

permissions_test.go

s3tables: tighten legacy OIDC subject re-anchoring (#11808)

2026-10-18 02:43:03 -07:00

permissions.go

s3tables: honor resource policy Deny on remaining operations (#11825)

2026-10-19 03:59:18 -07:00

table_data_dir_test.go

iceberg: make a table commit a compare-and-swap (#10775)

2026-08-16 12:55:42 -07:00

types.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

utils_location_test.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00

utils_namespace_test.go

iceberg: persist namespace properties for create/get (#8276)

2026-02-09 22:20:45 -08:00

utils.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00