Add s3 access grants feature

src/httpfs_extension.cpp

@@ -91,6 +91,9 @@ static void LoadInternal(ExtensionLoader &loader) {
 	                          Value(50));
 	config.AddExtensionOption("unsafe_disable_etag_checks", "Disable checks on ETag consistency", LogicalType::BOOLEAN,
 	                          Value(false));
+
+	// S3 Access Grants config
+	config.AddExtensionOption("s3_access_grants_enabled", "Enable S3 Access grants", LogicalType::BOOLEAN, Value(false));
 
 	// HuggingFace options
 	config.AddExtensionOption("hf_max_per_page", "Debug option to limit number of items returned in list requests",

src/include/lru_cache.hpp

@@ -0,0 +1,62 @@
+#pragma once
+#include <list>
+#include <unordered_map>
+#include "duckdb/common/mutex.hpp"
+
+namespace duckdb {
+    template<typename key_t, typename value_t>
+    class LRUCache
+    {
+    public:
+        typedef typename std::pair<key_t, value_t> key_value_pair_t;
+        typedef typename std::list<key_value_pair_t>::iterator list_iterator_t;
+        LRUCache (size_t capacity): _capacity(capacity) {}
+        void Put(const key_t& key, const value_t& value) {
+            lock_guard<mutex> parallel_lock(lock);
+            auto it = _cache_items_map.find(key);
+            _cache_items_list.push_front(key_value_pair_t(key, value));
+            if (it != _cache_items_map.end()) {
+                _cache_items_list.erase(it->second);
+                _cache_items_map.erase(it);
+            }
+            _cache_items_map[key] = _cache_items_list.begin();
+
+            if (_cache_items_map.size() > _capacity) {
+                auto last = _cache_items_list.end();
+                last--;
+                _cache_items_map.erase(last->first);
+                _cache_items_list.pop_back();
+            }
+        }
+        bool Get(const key_t& key, value_t& value) {
+            lock_guard<mutex> parallel_lock(lock);
+            auto it = _cache_items_map.find(key);
+            if (it == _cache_items_map.end()) {
+                return false;
+            } else {
+                _cache_items_list.splice(_cache_items_list.begin(), _cache_items_list, it->second);
+                value = it->second->second;
+                return true;
+            }
+        }
+        void Delete(const key_t& key) {
+            lock_guard<mutex> parallel_lock(lock);
+            auto it = _cache_items_map.find(key);
+            if (it == _cache_items_map.end()) {
+                return; //another thread already cleaned up
+            }
+            _cache_items_list.erase(it->second);
+            _cache_items_map.erase(it);
+        }
+        size_t Size() const {
+            return _cache_items_map.size();
+        }
+
+    private:
+        std::list<key_value_pair_t> _cache_items_list;
+        std::unordered_map<key_t, list_iterator_t> _cache_items_map;
+        size_t _capacity;
+        mutex lock;
+    };
+
+}

src/include/s3fs.hpp

@@ -31,6 +31,7 @@ struct S3AuthParams {
 	bool use_ssl = true;
 	bool s3_url_compatibility_mode = false;
 	bool requester_pays = false;
+	bool s3_access_grants_enabled = false;
 	string oauth2_bearer_token; // OAuth2 bearer token for GCS
 
 	static S3AuthParams ReadFrom(optional_ptr<FileOpener> opener, FileOpenerInfo &info);
@@ -46,6 +47,7 @@ struct AWSEnvironmentCredentialsProvider {
 	static constexpr const char *DUCKDB_USE_SSL_ENV_VAR = "DUCKDB_S3_USE_SSL";
 	static constexpr const char *DUCKDB_KMS_KEY_ID_ENV_VAR = "DUCKDB_S3_KMS_KEY_ID";
 	static constexpr const char *DUCKDB_REQUESTER_PAYS_ENV_VAR = "DUCKDB_S3_REQUESTER_PAYS";
+	static constexpr const char *DUCKDB_S3_ACCESS_GRANTS_ENABLED_ENV_VAR = "DUCKDB_S3_ACCESS_GRANTS_ENABLED";
 
 	explicit AWSEnvironmentCredentialsProvider(DBConfig &config) : config(config) {};