[alanshaw]

Companion to fil-forge/hilt#106 and fil-forge/libforge#87, both merged; pins Hilt and libforge main.

Hilt now decides a DeleteObjects on its body: an entry naming a version needs s3:DeleteObjectVersion beside s3:DeleteObject. Until now Ingot removed the named versions with no such check, so a key holding the delete permission alone could remove any version it could name.

What changes

The request forwarded to Hilt carries its body only for the operations Hilt's classifier names as deciding on one, which today is DeleteObjects. Every other request goes without, so PutObject and UploadPart never have their body read here. Hilt binds the body to the signature before reading it, and the fast path decides on the same classification: a version entry is refused locally when the key's cached set lacks the version permission, and a body the signature does not bind is left to Hilt, which refuses it as InvalidBody. That name joins UnsignedHeader in the error mapping as AccessDenied.

Behaviour changes to know about

• A DeleteObjects naming a version by a key or principal without s3:DeleteObjectVersion is refused as a whole, where S3 would refuse only those entries. Plain batches are unaffected.
• A DeleteObjects whose body is not covered by the signature, as the payload hash or a signed checksum header, is refused. The SDKs and CLI sign the payload for this operation.

The IAM itest scenario for this lives in Hilt and was not run.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Unbounded pre-authentication body buffering and forgeable checksum-based body binding leave unresolved security risks.

2 open issues

• Use collision-resistant digest for signed DeleteObjects body · New
• Bound streamed body reads before cloning or authorization · New

What changed in this PR

This PR adds body-aware DeleteObjects authorization to Ingot’s Hilt integration, so batches naming versions require version-delete permission.

Changes:

• Forward bodies only for operations Hilt classifies as body-dependent, and map UnboundBody to AccessDenied.
• Add tests for cached permissions and tampered bodies.
• Update Hilt/libforge dependencies and authorization documentation.

File	Description
iam/​service.go	Forward authorization-relevant bodies and map unbound-body errors.
iam/​service_internal_test.go	Test version-delete permissions, body binding, and error mapping.
go.sum	Update dependency checksums.
go.mod	Pin Hilt and libforge revisions supporting body-aware authorization.
docs/​diagrams.md	Document body-dependent authorization and fallback behavior.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

The mixed DeleteObjects integration expectations must be updated, and end-to-end body forwarding and restoration coverage should be added.

2 open issues

• Update mixed DeleteObjects integration test for whole-request denial · New
• Add streamed request body forwarding and restoration coverage · New

2 resolved since last review

• Bound streamed body reads before cloning or authorization
• Use collision-resistant digest for signed DeleteObjects body

_{Review effort: Lite}

[Copilot]

🟡 Changes recommended

The integration subtest should prime or assert the cached fast path so regressions in the local body and permission check cannot pass.

1 open issue

• Prime deleter cache to verify the cached fast path · New

2 resolved since last review

• Update mixed DeleteObjects integration test for whole-request denial
• Add streamed request body forwarding and restoration coverage

_{Review effort: Lite}

[Copilot]

🔵 Needs a closer look

An unresolved documentation-contract inconsistency remains, and the review assessments are mixed.

No open issues 🎉

1 resolved since last review

• Prime deleter cache to verify the cached fast path

_{Review effort: Lite}