feat(iam): implements policy operations

[designcode]

Note

Medium Risk
Introduces new IAM policy write operations and touches shared HTTP path configuration, so incorrect endpoint mappings or error handling could break IAM admin workflows.

Overview
Adds policy management support to @tigrisdata/iam, exposing new addPolicy, editPolicy, deletePolicy, getPolicy, and listPolicies APIs (with new Policy/PolicyDocument types) from the package entrypoint.

Refactors IAM request path handling by introducing IAM_ENDPOINTS in http-client.ts and updating existing access-key and organization operations to use these constants instead of inline paths. Also adds a shared handleError utility (exported from shared) to normalize certain IAM/storage error codes into friendlier messages, and uses it in the new policy calls.

^{Written by Cursor Bugbot for commit 44620fc. This will update automatically on new commits. Configure here.}

[greptile-apps]

Greptile Summary

This PR implements complete IAM policy operations (add, edit, delete, get, list) and refactors all IAM endpoint paths to use a centralized IAM_ENDPOINTS constant in http-client.ts.

Key changes:

• Adds five new policy operation modules following consistent patterns with proper error handling and type safety
• Introduces handleError utility in shared package for consistent error message mapping
• Centralizes all IAM endpoint definitions in IAM_ENDPOINTS object, improving maintainability
• Policy document parsing handles both single statement and array of statements (in get.ts)
• Follows existing patterns from access-key operations

Issue found:

• shared/utils.ts has a logic bug where consecutive if statements could overwrite error messages

Confidence Score: 4/5

• Safe to merge after fixing the error handling logic bug in shared/utils.ts
• The implementation follows established patterns and is well-structured, but the consecutive if statements in error handling could cause unexpected behavior
• shared/utils.ts needs the error handling logic fix before merge

Important Files Changed

Filename	Overview
packages/iam/src/lib/policy/add.ts	Implements policy creation with proper error handling and type mapping from API response
packages/iam/src/lib/policy/delete.ts	Implements policy deletion using ForceDeletePolicy endpoint, straightforward implementation
packages/iam/src/lib/policy/edit.ts	Updates existing policies with new descriptions and documents, follows add.ts pattern
packages/iam/src/lib/policy/get.ts	Retrieves policy details including document parsing with single/array statement handling
packages/iam/src/lib/policy/list.ts	Lists policies with pagination support, returns empty array for no results (follows rule 20cb7814)
shared/utils.ts	Adds handleError utility with error code mapping, has logic issue with consecutive if statements
packages/iam/src/lib/http-client.ts	Centralizes IAM endpoint definitions, adds policy endpoints alongside existing ones

_{Last reviewed commit: 44620fc}

[greptile-apps]

_{18 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Duplicate Action parameter in removeAccessKey after refactoring

High Severity

The removeAccessKey function now sends Action=DeleteAccessKey in both the URL query string (via IAM_ENDPOINTS.removeAccessKey = '/?Action=DeleteAccessKey') and the POST body (via formData.append('Action', 'DeleteAccessKey')). Before this refactoring, the path was an empty string so Action was only in the body. All other access-key operations that use ?Action=... in the path do not also append Action to formData. This duplication is inconsistent and could cause unexpected server behavior for a destructive operation.

Additional Locations (1)

• packages/iam/src/lib/http-client.ts#L13-L14

 

[designcode]

Good catch but this works fine and doesn't have a side effect

[github-actions]

🎉 This PR is included in version 1.2.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 2.14.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀