mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
186f93a986
* fix(iam): persist policy tags and count attachments across all principal kinds CreatePolicy built its record with an empty tag list and never read input.Tags, and GetPolicy, ListPolicies and CreatePolicy's own response projected no Tags field at all. Both halves are fixed, matching the role path. buildAttachmentCounts scanned only the users bucket, so a policy attached to a role or group counted as unattached. That is not just a misleading number: DeletePolicy gates its conflict check on the same count, so an attached policy could be deleted, leaving the principal holding a dangling ARN. The count and the reverse lookup are the same traversal with the names kept or discarded, so both now derive from one buildPolicyAttachments over users, roles and groups. Nothing is stored, so no counter can drift from the attachments it counts. ListEntitiesForPolicy is implemented on that traversal, honouring EntityFilter and PathPrefix. Closes: mulga-fvhlc Closes: mulga-9i6uh Closes: mulga-ryu30 Closes: mulga-8ranb * test(iam): account for ListEntitiesForPolicy in the cross-tenant and policy-ARN gates The action resolves PolicyArn through the same branch as GetPolicy, so it belongs with that helper's siblings; it was in neither gate, which is what the accounting test exists to catch.