Chris LuandClaude Opus 5.5 7298b4ed37 fix(s3tables,s3vectors): bind DeleteNamespace and the vector bucket cleanup to the authorized records (#12331) ...

* s3tables: bind DeleteNamespace to the authorized namespace

The delete claimed whatever finished namespace held the name at claim
time, so one deleted and created again by another owner after the
authorization read was removed under the first one's authorization.
The claim now requires the creation time that was authorized.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3vectors: bind DeleteVectorBucket's namespace cleanup to the authorized bucket

After the bound DeleteTableBucket reported the bucket not empty, the
index namespace cleanup ran unbound, so a bucket deleted and created
again in between lost its empty index namespace under the first
bucket's authorization. DeleteNamespace now honors the bucket binding,
checking the bucket after reading the namespace, and the cleanup
carries it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-02 09:55:09 -08:00

..

s3tablestest

fix(s3tables): let DeleteTableBucket remove empty leftover directories (#12307)

2026-11-01 13:43:15 -08:00

filer_ops_race_test.go

s3, s3tables: create buckets and namespaces exclusively (#11872)

2026-10-20 19:01:08 -07:00

filer_ops_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

filer_ops.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_bind_authorized_test.go

fix(s3tables,s3vectors): bind DeleteNamespace and the vector bucket cleanup to the authorized records (#12331)

2026-11-02 09:55:09 -08:00

handler_bind_bucket_test.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_bucket_create.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

handler_bucket_format_test.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

handler_bucket_get_list_delete.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_bucket_keeps_data_test.go

fix(s3tables): let DeleteTableBucket remove empty leftover directories (#12307)

2026-11-01 13:43:15 -08:00

handler_delete_create_race_test.go

fix(s3tables): bind table and view writes to the record they were authorized against (#12328)

2026-11-02 02:50:45 -08:00

handler_delete_decouple_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_delete_replacement_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_existence_hiding_test.go

s3tables: judge an absent tag target by its canonical ARN (#11912)

2026-10-21 13:31:04 -07:00

handler_identity_test.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

handler_log_level_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_maintenance_test.go

s3tables: add the maintenance configuration APIs (#10773)

2026-08-16 10:36:59 -07:00

handler_maintenance.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_name_charset_test.go

s3tables: allow hyphens in namespace and table names (#10093)

2026-06-24 16:24:45 -07:00

handler_namespace_keeps_data_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

handler_namespace_resolution_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_namespace.go

fix(s3tables,s3vectors): bind DeleteNamespace and the vector bucket cleanup to the authorized records (#12331)

2026-11-02 09:55:09 -08:00

handler_no_trace_errorf_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_ownerless_test.go

s3tables: only the admin repairs a table bucket that has no owner metadata (#11873)

2026-10-20 18:58:54 -07:00

handler_policy_deny_test.go

s3tables: honor resource policy Deny on remaining operations (#11825)

2026-10-19 03:59:18 -07:00

handler_policy.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_principal_test.go

s3vectors: resolve the caller like table buckets and honor bucket-scoped identity actions (#12319)

2026-11-01 23:50:19 -08:00

handler_rename_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_renamed_source_test.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler_table_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

handler_table.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_update_cas_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_update_conflict_test.go

fix(s3tables): bind table and view writes to the record they were authorized against (#12328)

2026-11-02 02:50:45 -08:00

handler_view_rename_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_view_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view.go

fix(s3tables): bind table and view writes to the record they were authorized against (#12328)

2026-11-02 02:50:45 -08:00

handler.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

iam.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

iceberg_layout_test.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_layout.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_manifest_list_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest_list.go

iceberg: read manifest lists that omit the Avro format version (#10475)

2026-07-28 16:42:17 -07:00

iceberg_manifest_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

manager_test.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

manager.go

fix(s3tables,s3vectors): bind DeleteNamespace and the vector bucket cleanup to the authorized records (#12331)

2026-11-02 09:55:09 -08:00

permissions_test.go

s3tables: keep the admin bypass off an identified caller's empty action list (#12217)

2026-10-29 13:41:26 -07:00

permissions.go

s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287)

2026-10-31 15:07:23 -07:00

policy_case_test.go

s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287)

2026-10-31 15:07:23 -07:00

table_data_dir_test.go

iceberg: make a table commit a compare-and-swap (#10775)

2026-08-16 12:55:42 -07:00

types.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

utils_location_test.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00

utils_namespace_test.go

iceberg: persist namespace properties for create/get (#8276)

2026-02-09 22:20:45 -08:00

utils.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

vector_namespace_test.go

s3tables: keep the vector-namespace fence on a declare of an existing index (#12293)

2026-10-31 16:07:31 -07:00

vector_namespace.go

s3tables: keep the vector-namespace fence on a declare of an existing index (#12293)

2026-10-31 16:07:31 -07:00