[alanshaw]

Stacked on #286, which maps hilt#101's ConflictingQuery refusal to S3's 400. Pins hilt to the merge of fil-forge/hilt#102 (cd26388, which includes hilt#101), replacing #286's pin, and libforge to its merge of fil-forge/libforge#86.

Hilt used to classify POST /b?delete (DeleteObjects) as CreateBucket. CreateBucket skips the bucket scope check, so a key holding s3:CreateBucket could batch-delete in any bucket of its tenant, permanently deleting named versions included. Ingot did no permission check per entry. hilt#101 authorizes DeleteObjects on s3:DeleteObject, as S3 does.

S3 also requires s3:DeleteObjectVersion for each entry that names a version. Those entries are in the body, where Hilt can't see them, so Ingot now checks them: the IAM service puts the key's action sets on the request (reqscope.ActionsKey, the same per-key cache the local fast path reads), and DeleteObjects fails each such entry with AccessDenied, leaving the version in place, unless the key holds the permission on the bucket. Entries without a version are unaffected. A request with no action set refuses version entries.

The pin bump also brings in hilt#101's and hilt#102's classification on the fast path (RequirementsFor), so bucket configuration, object tagging and attribute requests are checked against their own permissions.

Tests

• TestVersioning_DeleteObjectsNeedsVersionPermission: refused without the permission and with no action set; a mixed batch refuses the version entry and deletes the rest.

• TestForgeRoutePermissions (itest), through the real hilt:

  • a key holding only s3:CreateBucket is refused PutBucketVersioning and DeleteObjects on an existing bucket
  • a key without s3:DeleteObjectVersion gets AccessDenied for the version entry while the other entry is deleted, and a key with it deletes the version

  Each denial is asserted twice, so the fast path is covered.

• The itest key (hiltAllPermissions) carries the encryption and route permissions; the published hilt image knows them, so the INGOT_ITEST_ENCRYPTION_PERMS and INGOT_ITEST_ROUTE_PERMS guards are gone and both permission scenarios run in CI.

make test passes. Against the published hilt :main (cd26388), with no override, as CI runs, these pass: TestForgeVersity (the S3 conformance suite), TestForgeScenarios, TestForgeRoutePermissions and TestForgeBucketEncryptionPermissions.

Merge #286 first; this PR's pin replaces its pin.

🤖 Generated with Claude Code