add admin policy check for user operation

iam/src/store/object.rs

@@ -675,11 +675,11 @@ impl Store for ObjectStore {
     async fn load_all(&self, cache: &Cache) -> Result<()> {
         let listed_config_items = self.list_all_iamconfig_items().await?;
 
+        let mut policy_docs_cache = CacheEntity::new(get_default_policyes());
+
         if let Some(policies_list) = listed_config_items.get(POLICIES_LIST_KEY) {
             let mut policies_list = policies_list.clone();
 
-            let mut policy_docs_cache = CacheEntity::new(get_default_policyes());
-
             loop {
                 if policies_list.len() < 32 {
                     let policy_docs = self.load_policy_doc_concurrent(&policies_list).await?;
@@ -712,10 +712,10 @@ impl Store for ObjectStore {
 
                 policies_list = policies_list.split_off(32);
             }
-
-            cache.policy_docs.store(Arc::new(policy_docs_cache.update_load_time()));
         }
 
+        cache.policy_docs.store(Arc::new(policy_docs_cache.update_load_time()));
+
         let mut user_items_cache = CacheEntity::default();
 
         // users

iam/src/sys.rs

@@ -121,6 +121,18 @@ impl<T: Store> IamSys<T> {
         // TODO: notification
     }
 
+    pub async fn get_role_policy(&self, arn_str: &str) -> Result<(ARN, String)> {
+        let Some(arn) = ARN::parse(arn_str).ok() else {
+            return Err(Error::msg("Invalid ARN"));
+        };
+
+        let Some(policy) = self.roles_map.get(&arn) else {
+            return Err(Error::msg("No such role"));
+        };
+
+        Ok((arn, policy.clone()))
+    }
+
     pub async fn delete_user(&self, name: &str, _notify: bool) -> Result<()> {
         self.store.delete_user(name, UserType::Reg).await
         // TODO: notification