Chris LuandClaude Opus 5.5 813ac74d79 s3tables: keep legacy-subject owners and policy principals for federated STS sessions (#12615) ...

* s3tables: re-anchor legacy owners for federated STS sessions

A web-identity role session was keyed on its bare OIDC subject until
owners became issuer-scoped. Its sessions now carry the scoped aws:userid
but no asserted issuers, so the legacy subject check never applied and the
session lost the table buckets and namespaces it had created. Read the
configured issuer set for such sessions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3api: keep token claims from asserting trusted issuers on STS sessions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* iceberg: give the catalog's table handler the local accounts and issuer set

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3tables: test a federated session on a bucket its legacy subject owns

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* sts: drop a token-supplied aws:userid when a session has no parent user

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3api: take a session's aws:userid from its signed parent user

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3api: test that session claims keep only the server-asserted aws:userid

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3tables: match legacy subject patterns in table bucket policy principals

A policy written before issuer scoping can name role sessions by a pattern
over their bare OIDC subjects. Match such a pattern against the caller's
subject claim once that subject resolves to the session's scoped principal
under the single configured issuer.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* s3tables: test a federated session against a legacy subject pattern principal

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-11-13 12:43:52 -08:00

..

testdata

iceberg: repair non-compliant manifests at commit (#10641)

2026-08-08 21:24:37 -07:00

commit_helpers.go

fix(iceberg): keep a losing table create from deleting the winner's metadata (#12474)

2026-11-07 10:54:04 -08:00

commit_updates.go

Iceberg: implement stage-create finalize flow (phase 1) (#8279)

2026-02-10 09:46:09 -08:00

handlers_commit.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handlers_metrics_test.go

iceberg: add view rename, scan-report and snapshots=refs to the catalog (#10776)

2026-08-16 12:56:45 -07:00

handlers_metrics.go

iceberg: add view rename, scan-report and snapshots=refs to the catalog (#10776)

2026-08-16 12:56:45 -07:00

handlers_namespace.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

handlers_oauth_test.go

iceberg: fix OAuth token expiry handling (401 + token-exchange + configurable TTL) (#11242)

2026-09-09 10:54:39 -07:00

handlers_oauth.go

s3: end a catalog-vended session with the access key it was vended for (#11945)

2026-10-23 03:58:06 -07:00

handlers_table.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handlers_transaction.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

handlers_view_update.go

iceberg: authorize a commit before staging its metadata file (#11891)

2026-10-21 19:13:02 -07:00

handlers_view.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

iceberg_access_delegation_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

iceberg_commit_authorize_test.go

iceberg: authorize a commit before staging its metadata file (#11891)

2026-10-21 19:13:02 -07:00

iceberg_commit_location_test.go

iceberg/s3tables: confine stored metadataLocation to the authorized table bucket (#11292)

2026-09-13 13:48:13 -07:00

iceberg_commit_updates_test.go

Authorize an Iceberg table create before it writes (#10991)

2026-08-27 16:23:51 -07:00

iceberg_create_table_conflict_test.go

s3tables, iceberg: create missing directories exclusively so a concurrent create keeps its record (#12600)

2026-11-13 12:10:18 -08:00

iceberg_create_table_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

iceberg_create_view_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

iceberg_credential_vending_test.go

iceberg, lance: vend read-only credentials to callers that may only read (#11859)

2026-10-20 07:16:27 -07:00

iceberg_drop_location_test.go

s3tables, iceberg: one catalog record per table location (#12473)

2026-11-07 05:04:09 -08:00

iceberg_invalid_name_test.go

catalog: refused writes answer 403 to callers that can read the entry (#11650)

2026-10-09 09:59:32 +08:00

iceberg_issue_9103_test.go

iceberg, lance: vend read-only credentials to callers that may only read (#11859)

2026-10-20 07:16:27 -07:00

iceberg_location_owner_test.go

s3tables, iceberg: one catalog record per table location (#12473)

2026-11-07 05:04:09 -08:00

iceberg_namespace_properties_test.go

iceberg: persist namespace properties for create/get (#8276)

2026-02-09 22:20:45 -08:00

iceberg_pagination_test.go

iceberg: wire pagination for list namespaces/tables REST APIs (#8275)

2026-02-09 21:46:55 -08:00

iceberg_register_table_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

iceberg_rename_table_test.go

iceberg: support table rename (#10068)

2026-06-23 20:18:11 -07:00

iceberg_snapshots_param_test.go

iceberg: add view rename, scan-report and snapshots=refs to the catalog (#10776)

2026-08-16 12:56:45 -07:00

iceberg_table_location_test.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

iceberg_transaction_test.go

fix(iceberg): serve a registered table's metadata on load and commit (#12159)

2026-10-28 08:15:42 -07:00

iceberg_update_namespace_properties_test.go

iceberg: support namespace property updates (#10052)

2026-06-23 00:41:47 -07:00

iceberg_view_test.go

iceberg: support views (#10069)

2026-06-23 15:22:31 -07:00

iceberg_warehouse_test.go

iceberg: let clients select their table bucket as the catalog warehouse (#10549)

2026-08-03 13:25:37 -07:00

iceberg.go

Iceberg: implement stage-create finalize flow (phase 1) (#8279)

2026-02-10 09:46:09 -08:00

log_manager_error_test.go

s3tables, iceberg: log client refusals at V(1), not ERROR (#11896)

2026-10-21 14:00:33 -07:00

manifest_repair_test.go

iceberg: repair non-compliant manifests at commit (#10641)

2026-08-08 21:24:37 -07:00

manifest_repair.go

fix(iceberg): keep a losing table create from deleting the winner's metadata (#12474)

2026-11-07 10:54:04 -08:00

metadata_compliance_test.go

fix(s3tables/iceberg): make metadata spec-compliant and accept real-world manifest names (#9703)

2026-05-27 13:05:41 -07:00

metadata_compliance.go

fix(s3tables/iceberg): make metadata spec-compliant and accept real-world manifest names (#9703)

2026-05-27 13:05:41 -07:00

metadata_files_test.go

iceberg: make a table commit a compare-and-swap (#10775)

2026-08-16 12:55:42 -07:00

metadata_files.go

s3tables, iceberg: create missing directories exclusively so a concurrent create keeps its record (#12600)

2026-11-13 12:10:18 -08:00

name_mapping_test.go

iceberg: repair non-compliant manifests at commit (#10641)

2026-08-08 21:24:37 -07:00

name_mapping.go

iceberg: repair non-compliant manifests at commit (#10641)

2026-08-08 21:24:37 -07:00

path_validation_test.go

iceberg/s3tables: confine stored metadataLocation to the authorized table bucket (#11292)

2026-09-13 13:48:13 -07:00

path_validation.go

iceberg/s3tables: confine stored metadataLocation to the authorized table bucket (#11292)

2026-09-13 13:48:13 -07:00

requirements_test.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

requirements.go

build(deps): bump github.com/twmb/avro from 1.7.2 to 1.8.0 (#11210)

2026-09-07 15:58:24 -07:00

server_access_key_test.go

s3, iceberg: record the access key a request was signed with (#11901)

2026-10-21 20:33:08 -07:00

server_auth_test.go

iceberg: fix OAuth token expiry handling (401 + token-exchange + configurable TTL) (#11242)

2026-09-09 10:54:39 -07:00

server_routes_test.go

iceberg: collapse doubled /v1 prefix in catalog requests (#11767)

2026-10-16 23:01:57 -07:00

server.go

s3tables: keep legacy-subject owners and policy principals for federated STS sessions (#12615)

2026-11-13 12:43:52 -08:00

stage_create.go

s3tables, iceberg: create missing directories exclusively so a concurrent create keeps its record (#12600)

2026-11-13 12:10:18 -08:00

types.go

iceberg: fix CREATE TABLE rejecting a partition on the first column (#12072)

2026-10-26 07:54:10 -07:00

utils.go

s3tables, iceberg: give tables created without a location their own directory (#12475)

2026-11-07 16:37:31 -08:00

vector_namespace_test.go

s3vectors: vend write credentials to index data only to the vector engine and Lance worker (#12316)

2026-11-01 18:49:01 -08:00