Chris LuandClaude Opus 5.5 8e577b8685 s3tables: match legacy subject patterns in table bucket policy principals ...

A policy written before issuer scoping can name role sessions by a pattern
over their bare OIDC subjects. Match such a pattern against the caller's
subject claim once that subject resolves to the session's scoped principal
under the single configured issuer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-13 04:17:13 -08:00

..

s3tablestest

fix(s3tables): let DeleteTableBucket remove empty leftover directories (#12307)

2026-11-01 13:43:15 -08:00

filer_ops_race_test.go

s3, s3tables: create buckets and namespaces exclusively (#11872)

2026-10-20 19:01:08 -07:00

filer_ops_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

filer_ops.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

handler_bind_authorized_test.go

fix(s3tables,s3vectors): bind DeleteNamespace and the vector bucket cleanup to the authorized records (#12331)

2026-11-02 09:55:09 -08:00

handler_bind_bucket_test.go

fix(s3tables,s3vectors): bind table and vector bucket writes to the bucket they were authorized against (#12329)

2026-11-02 03:00:30 -08:00

handler_bind_tags_test.go

s3vectors: support TagResource, UntagResource and ListTagsForResource (#12335)

2026-11-02 10:33:26 -08:00

handler_bucket_create.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

handler_bucket_format_test.go

s3vectors: encrypt the objects of a vector bucket declared AES256 (#12324)

2026-11-01 23:57:40 -08:00

handler_bucket_get_list_delete.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

handler_bucket_keeps_data_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handler_delete_create_race_test.go

fix(s3tables): bind table and view writes to the record they were authorized against (#12328)

2026-11-02 02:50:45 -08:00

handler_delete_decouple_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_delete_replacement_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_existence_hiding_test.go

s3tables, iceberg: one catalog record per table location (#12473)

2026-11-07 05:04:09 -08:00

handler_identity_test.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

handler_location_owner_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handler_log_level_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_maintenance_test.go

s3tables: add the maintenance configuration APIs (#10773)

2026-08-16 10:36:59 -07:00

handler_maintenance.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

handler_name_charset_test.go

s3tables: allow hyphens in namespace and table names (#10093)

2026-06-24 16:24:45 -07:00

handler_namespace_keeps_data_test.go

fix(s3tables): keep the data under a deleted namespace (#12276)

2026-10-31 05:27:58 -07:00

handler_namespace_resolution_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_namespace.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

handler_no_trace_errorf_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handler_ownerless_test.go

s3tables: only the admin repairs a table bucket that has no owner metadata (#11873)

2026-10-20 18:58:54 -07:00

handler_policy_condition_test.go

fix(s3tables): validate policy conditions and fail safe on unusable ones (#12389)

2026-11-04 08:13:05 -08:00

handler_policy_deny_test.go

s3tables: honor resource policy Deny on remaining operations (#11825)

2026-10-19 03:59:18 -07:00

handler_policy.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

handler_principal_test.go

s3vectors: resolve the caller like table buckets and honor bucket-scoped identity actions (#12319)

2026-11-01 23:50:19 -08:00

handler_rename_test.go

fix(s3tables): route REST RenameTable and refuse unrouted S3 Tables requests (#12446)

2026-11-06 09:32:13 -08:00

handler_renamed_source_test.go

fix(s3tables): answer 404 for a table name that was renamed away (#12258)

2026-10-30 19:53:57 -07:00

handler_sts_legacy_owner_test.go

s3tables: test a federated session on a bucket its legacy subject owns

2026-11-13 02:56:59 -08:00

handler_table_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

handler_table.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

handler_update_after_rename_test.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

handler_update_cas_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_update_conflict_test.go

fix(s3tables): bind table and view writes to the record they were authorized against (#12328)

2026-11-02 02:50:45 -08:00

handler_view_rename_test.go

fix(s3tables): refuse a create that a namespace delete can lose (#12239)

2026-10-30 03:18:52 -07:00

handler_view_test.go

Lance catalog, and a Rust plugin worker to maintain it (#10841)

2026-08-19 22:59:56 -07:00

handler_view.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

handler_warehouse_location_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handler.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

iam.go

s3tables: scope the anonymous identity's grant on the table catalogs (#12056)

2026-10-25 06:13:22 -07:00

iceberg_layout_test.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_layout.go

s3tables: accept Puffin statistics files in a table's metadata/ (#11892)

2026-10-21 12:19:53 -07:00

iceberg_manifest_list_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest_list.go

iceberg: read manifest lists that omit the Avro format version (#10475)

2026-07-28 16:42:17 -07:00

iceberg_manifest_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

iceberg_manifest.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

manager_test.go

s3vectors: accept and return encryptionConfiguration on vector buckets (#12203)

2026-10-29 11:29:00 -07:00

manager.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

permissions_test.go

fix(s3tables): validate policy conditions and fail safe on unusable ones (#12389)

2026-11-04 08:13:05 -08:00

permissions.go

s3tables: match legacy subject patterns in table bucket policy principals

2026-11-13 04:17:13 -08:00

policy_case_test.go

s3vectors: authorize CreateVectorBucket as a vector action, close DeleteIndex race, fold policy service case (#12287)

2026-10-31 15:07:23 -07:00

table_data_dir_test.go

fix(iceberg): keep a losing table create from deleting the winner's metadata (#12474)

2026-11-07 10:54:04 -08:00

types.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

utils_location_test.go

s3tables: confine caller-supplied metadataLocation to the table's namespace

2026-10-12 02:41:28 -07:00

utils_namespace_test.go

iceberg: persist namespace properties for create/get (#8276)

2026-02-09 22:20:45 -08:00

utils.go

fix(s3tables): let a table renamed across namespaces keep committing (#12515)

2026-11-10 21:15:48 -08:00

vector_namespace_test.go

s3tables: keep the vector-namespace fence on a declare of an existing index (#12293)

2026-10-31 16:07:31 -07:00

vector_namespace.go

s3tables: keep the vector-namespace fence on a declare of an existing index (#12293)

2026-10-31 16:07:31 -07:00