Add s3 access grants feature

src/httpfs_extension.cpp

@@ -73,6 +73,10 @@ static void LoadInternal(ExtensionLoader &loader) {
 	config.AddExtensionOption("unsafe_disable_etag_checks", "Disable checks on ETag consistency", LogicalType::BOOLEAN,
 	                          Value(false));
 
+	// S3 Access Grants config
+	config.AddExtensionOption("s3_access_grants_enabled", "Enable S3 Access grants", LogicalType::BOOLEAN,
+	                          Value(false));
+
 	// HuggingFace options
 	config.AddExtensionOption("hf_max_per_page", "Debug option to limit number of items returned in list requests",
 	                          LogicalType::UBIGINT, Value::UBIGINT(0));

src/include/lru_cache.hpp

@@ -0,0 +1,62 @@
+#pragma once
+#include <list>
+#include <unordered_map>
+#include "duckdb/common/mutex.hpp"
+
+namespace duckdb {
+template <typename key_t, typename value_t>
+class LRUCache {
+public:
+	typedef typename std::pair<key_t, value_t> key_value_pair_t;
+	typedef typename std::list<key_value_pair_t>::iterator list_iterator_t;
+	LRUCache(size_t capacity) : _capacity(capacity) {
+	}
+	void Put(const key_t &key, const value_t &value) {
+		lock_guard<mutex> parallel_lock(lock);
+		auto it = _cache_items_map.find(key);
+		_cache_items_list.push_front(key_value_pair_t(key, value));
+		if (it != _cache_items_map.end()) {
+			_cache_items_list.erase(it->second);
+			_cache_items_map.erase(it);
+		}
+		_cache_items_map[key] = _cache_items_list.begin();
+
+		if (_cache_items_map.size() > _capacity) {
+			auto last = _cache_items_list.end();
+			last--;
+			_cache_items_map.erase(last->first);
+			_cache_items_list.pop_back();
+		}
+	}
+	bool Get(const key_t &key, value_t &value) {
+		lock_guard<mutex> parallel_lock(lock);
+		auto it = _cache_items_map.find(key);
+		if (it == _cache_items_map.end()) {
+			return false;
+		} else {
+			_cache_items_list.splice(_cache_items_list.begin(), _cache_items_list, it->second);
+			value = it->second->second;
+			return true;
+		}
+	}
+	void Delete(const key_t &key) {
+		lock_guard<mutex> parallel_lock(lock);
+		auto it = _cache_items_map.find(key);
+		if (it == _cache_items_map.end()) {
+			return; // another thread already cleaned up
+		}
+		_cache_items_list.erase(it->second);
+		_cache_items_map.erase(it);
+	}
+	size_t Size() const {
+		return _cache_items_map.size();
+	}
+
+private:
+	std::list<key_value_pair_t> _cache_items_list;
+	std::unordered_map<key_t, list_iterator_t> _cache_items_map;
+	size_t _capacity;
+	mutex lock;
+};
+
+} // namespace duckdb

src/include/s3fs.hpp

@@ -58,6 +58,7 @@ struct S3AuthParams {
 	bool use_ssl = true;
 	bool s3_url_compatibility_mode = false;
 	bool requester_pays = false;
+	bool s3_access_grants_enabled = false;
 	string oauth2_bearer_token; // OAuth2 bearer token for GCS
 
 	static S3AuthParams ReadFrom(optional_ptr<FileOpener> opener, FileOpenerInfo &info);
@@ -78,6 +79,7 @@ struct AWSEnvironmentCredentialsProvider {
 	static constexpr const char *DUCKDB_USE_SSL_ENV_VAR = "DUCKDB_S3_USE_SSL";
 	static constexpr const char *DUCKDB_KMS_KEY_ID_ENV_VAR = "DUCKDB_S3_KMS_KEY_ID";
 	static constexpr const char *DUCKDB_REQUESTER_PAYS_ENV_VAR = "DUCKDB_S3_REQUESTER_PAYS";
+	static constexpr const char *DUCKDB_S3_ACCESS_GRANTS_ENABLED_ENV_VAR = "DUCKDB_S3_ACCESS_GRANTS_ENABLED";
 
 	explicit AWSEnvironmentCredentialsProvider(DBConfig &config) : config(config) {};