fix: localhost is not a Tigris endpoint for tiered flavor selection

[ovaistariq]

Fixes the three review threads on release PR #230.

• P1 — localhost bypassed the cleanup guard. IsTigrisEndpoint conflated the transparent-mode allowlist (Tigris domains or localhost for local testing) with a trust claim about the backend (headers understood, keys learnable, If-Match on DELETE enforced). Since it now selects tiered's forwarding flavor, a local MinIO on localhost took the transparent path and re-enabled the cleanup DELETE. Split: IsTigrisEndpoint is strict (Tigris domains only, case-normalized) and drives the flavor; new IsTransparentEndpoint (Tigris or localhost, any case) is what the transparent-mode validator uses. Tiered on localhost now forwards by signing with cleanup disabled; transparent mode keeps its localhost allowance.
• Low — mixed-case localhost. Lowercased before the compare in the allowlist; covered by TestIsTransparentEndpoint.
• P2 — docs overstated permissions. Delete permission is scoped to Tigris-backed tiered deployments; on the signing flavor the key never issues a DELETE (read-only suffices for the re-tier GET) and rejected cannot occur.

Tests updated (strict predicate, allowlist, flavor table incl. tiered/localhost → signing, transparent/localhost still valid); full suite, race, lint green.

🤖 Generated with Claude Code

https://claude.ai/code/session_01L5DLvDTo9dhD38YQXhHpU9

---

Note

Medium Risk
Changes tiered forwarding and cleanup safety gates keyed on upstream trust; behavior shift for tiered-on-localhost is intentional and reduces data-loss risk from unverified If-Match backends.

Overview
Tiered mode no longer treats localhost as a trusted Tigris backend. IsTigrisEndpoint now matches only *.tigris.dev / *.storage.dev (case-normalized) and drives tiered forwarding flavor via ForwardsTransparently, so a local MinIO on localhost uses signing and cross-tier cleanup DELETE stays disabled instead of taking the transparent path that could re-enable unsafe cleanup.

Transparent proxy validation keeps localhost for local testing via a new IsTransparentEndpoint (Tigris domains or localhost, any case); validateUpstreamEndpoint uses that allowlist instead of overloading IsTigrisEndpoint.

Docs clarify that delete permission applies to Tigris-backed tiered deployments; on the signing flavor cleanup is never issued and background work is read-oriented, while forwarded client ops still need whatever permissions those calls require.

Tests cover the strict predicate, the transparent allowlist, tiered/localhost → signing, and transparent mode still accepting localhost.

^{Reviewed by Cursor Bugbot for commit a77b700. Bugbot is set up for automated code reviews on this repo. Configure here.}

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the endpoint trust split is consistently implemented and the previously incomplete credential guidance is now fully corrected.

Summary

This PR separates trusted Tigris endpoint detection from the transparent-mode localhost allowlist.

• Tiered mode now selects transparent forwarding only for case-normalized Tigris domains, preventing cleanup DELETEs against unverified localhost backends.
• Transparent mode retains localhost support for local testing, including mixed-case hostnames.
• Tests cover endpoint classification and forwarding-flavor selection.
• Tiered-mode documentation now scopes read-only guidance to background operations and explains the signing credential’s overall permission requirements.

_{Reviews (2) · Last reviewed commit: "docs: scope the read-only note to tiered..."}

[ovaistariq]

@greptile review — a77b700: read-only note scoped to background operations; the key's overall requirement on the signing flavor stated explicitly.

[tigrisdata-argocd-bot]

🎉 This PR is included in version 1.22.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀