feat(iam) policy evaluation stack (WIP!)

[snazy]

No description provided.

[snazy]

@greptile-apps please review

[greptile-apps]

Greptile Summary

This PR introduces opt-in IAM allow-policy enforcement for supported GCS REST operations, including principal resolution, role and condition evaluation, bucket-policy bootstrapping, downscoped-token identity propagation, overwrite authorization, and UBLA configuration handling.

• Applies CAB checks before IAM evaluation for supported object operations.
• Adds bucket IAM enforcement and conditional-policy validation.
• Adds CEL-based IAM condition evaluation and policy normalization.
• Extends REST, gRPC, integration, and Java SDK compatibility coverage.
• Two UBLA validation inconsistencies need correction before merge.

Confidence Score: 3/5

The PR is not yet safe to merge because gRPC can invalidate a conditional bucket policy and valid partial REST IAM-configuration updates can be rejected.

Two concrete update paths mishandle the interaction between UBLA and conditional IAM policies: gRPC omits required transition validation, while REST validates the partial request rather than the merged configuration.

Files Needing Attention: src/main/java/io/floci/gcp/services/gcs/GcsGrpcController.java, src/main/java/io/floci/gcp/services/iam/IamBucketPolicyService.java

Important Files Changed

Filename	Overview
src/main/java/io/floci/gcp/services/gcs/GcsGrpcController.java	Adds gRPC IAM-configuration update support but bypasses the conditional-policy transition validation used by REST.
src/main/java/io/floci/gcp/services/iam/IamBucketPolicyService.java	Coordinates bucket policies and conditions, but incorrectly interprets unrelated partial IAM configuration patches as UBLA removal.
src/main/java/io/floci/gcp/services/iam/GcsIamAuthorizationService.java	Composes CAB and IAM permission checks and defers overwrite-delete authorization for atomic evaluation.
src/main/java/io/floci/gcp/services/gcs/GcsService.java	Adds atomic overwrite checks and server-managed UBLA lock normalization.
src/main/java/io/floci/gcp/services/iam/NessieIamConditionEvaluator.java	Implements a bounded, cached CEL environment for supported IAM conditions.
src/main/java/io/floci/gcp/services/credentials/CredentialTokenService.java	Preserves impersonated principals in downscoped tokens and rejects recursive downscoping.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  R[Incoming GCS request] --> P{Protocol}
  P -->|REST object or bucket| C[CAB and IAM authorization]
  C --> E[Resolve principal and bucket policy]
  E --> A{Permission granted?}
  A -->|No| D[Return permission denied]
  A -->|Yes| M[Execute GCS mutation or read]
  P -->|gRPC bucket update| F[Resolve FieldMask into IAM configuration]
  F --> U[Persist through GcsService]
  C --> V[REST UBLA and conditional-policy validation]
  V --> M
  F -. missing equivalent validation .-> U

Loading

_{Reviews (1): Last reviewed commit: "feat(iam): support IAM-aware downscoped ..." | Re-trigger Greptile}

[greptile-apps]

gRPC Bypasses Policy Validation

The gRPC UpdateBucket path writes the resolved IAM configuration without calling validateIamConfigurationUpdate, while both REST update paths perform that validation. A gRPC client can therefore disable uniform bucket-level access while conditional IAM bindings remain stored, leaving the bucket in an invalid state that REST rejects. Route the resolved gRPC patch through the same validation before persisting it. This also violates the repository directive to check compatibility across alternate gRPC and REST protocol paths.

Context Used: AGENTS.md (source)

[greptile-apps]

Partial Updates Disable UBLA

This check treats every partial iamConfiguration patch that does not explicitly contain uniformBucketLevelAccess.enabled=true as disabling UBLA. On a bucket with UBLA and conditional bindings, a valid patch that only changes publicAccessPrevention is rejected even though GcsService.updateBucket merges the patch and preserves the current UBLA setting. Check whether the patch actually removes or disables UBLA, or validate the merged configuration instead.