Support for Iceberg SQL UDF

[rraulinio]

Required changes for Iceberg SQL UDF.

Summary by CodeRabbit

• New Features

  • Added support for S3 Tables function actions, including create, update, rename, delete, get, list, and register.
  • Added a new condition key for function names so policies can target function-specific access.
  • Updated default read/write and read-only policies to include the new function permissions.

• Bug Fixes

  • Improved validation so the new function-related action and condition key values are recognized as valid.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds a new S3TablesFunctionName condition key and seven new S3 Tables TableAction constants for SQL UDF function operations (create, delete, get, rename, update, list, register). These are wired into condition-key mappings, added to default canned policies (tablesReadWrite, tablesReadOnly), and covered by new unit tests.

Changes

S3 Tables function actions and condition keys

Layer / File(s)	Summary
Condition key definition policy/condition/keyname.go, policy/condition/key_test.go	Adds S3TablesFunctionName constant, includes it in AllSupportedKeys, and extends validity test coverage.
Function action constants policy/table-action.go	Adds seven new TableAction constants (Create/Delete/Get/Rename/Update/List/Register Function) and registers them in SupportedTableActions.
Condition key mapping wiring policy/table-action.go	Adds a derived function-name key, a withFunctionCommon helper combining warehouse/namespace/function keys, updates the wildcard AllS3TablesActions key set, and maps each function action to its condition keys.
Default canned policy updates policy/constants.go	tablesReadWrite gains full function CRUD/list/register permissions; tablesReadOnly gains function get/list permissions.
Tests policy/table-action_test.go	Adds TestTableActionIsValid and TestTableActionConditionKeys covering validity and condition-key behavior for the new function actions.

Estimated code review effort: 2 (Simple) | ~12 minutes

Suggested reviewers: harshavardhana

Poem

A rabbit hopped through policy code,
Adding functions down the road,
Keys for names, actions anew,
Read and write, permissions too,
Thump thump — tests all pass in view! 🐇✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the primary change: adding support for Iceberg SQL UDF functionality and related policy actions.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Adds policy-layer support for Iceberg SQL UDFs in the S3 Tables extension surface by introducing new table actions, a new condition key for function name scoping, and wiring these into default policies and validation tests.

Changes:

• Introduce new s3tables:*Function actions (CRUD + register/list) and include them in the supported table actions map.
• Add the s3tables:functionName condition key and allow it for the relevant actions (and the s3tables:* wildcard action).
• Extend default “tablesReadWrite” and “tablesReadOnly” policies and add unit tests covering action validity and condition-key mappings.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
policy/table-action.go	Defines new function-related table actions and maps them to supported condition keys.
policy/table-action_test.go	Adds tests for function action validity and condition key set expectations.
policy/constants.go	Grants new function actions in default tables policies (read/write + read-only).
policy/condition/keyname.go	Introduces S3TablesFunctionName and registers it as a supported condition key.
policy/condition/key_test.go	Updates key validation tests to include the new function-name key.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shtripat]

lgtm