Revert codegen changes and add specs for the plugin

gems/aws-sdk-s3/aws-sdk-s3.gemspec

@@ -28,7 +28,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency('aws-sdk-kms', '~> 1')
   spec.add_dependency('aws-sdk-s3control', '~> 1.73')
   spec.add_dependency('aws-sigv4', '~> 1.8')
-  spec.add_dependency('aws-sdk-core', '~> 3', '>= 3.191.0')
+  spec.add_dependency('aws-sdk-core', '~> 3', '>= 3.192.0')
 
   spec.required_ruby_version = '>= 2.5'
 end

gems/aws-sdk-s3/lib/aws-sdk-s3/client.rb

@@ -34,7 +34,6 @@
 require 'aws-sdk-core/plugins/sign.rb'
 require 'aws-sdk-core/plugins/protocols/rest_xml.rb'
 require 'aws-sdk-s3/plugins/accelerate.rb'
-require 'aws-sdk-s3/plugins/access_grants.rb'
 require 'aws-sdk-s3/plugins/arn.rb'
 require 'aws-sdk-s3/plugins/bucket_dns.rb'
 require 'aws-sdk-s3/plugins/bucket_name_restrictions.rb'
@@ -105,7 +104,6 @@ class Client < Seahorse::Client::Base
     add_plugin(Aws::Plugins::Sign)
     add_plugin(Aws::Plugins::Protocols::RestXml)
     add_plugin(Aws::S3::Plugins::Accelerate)
-    add_plugin(Aws::S3::Plugins::AccessGrants)
     add_plugin(Aws::S3::Plugins::ARN)
     add_plugin(Aws::S3::Plugins::BucketDns)
     add_plugin(Aws::S3::Plugins::BucketNameRestrictions)
@@ -368,12 +366,6 @@ class Client < Seahorse::Client::Base
     #       in the future.
     #
     #
-    #   @option options [Boolean] :s3_access_grants (false)
-    #     TODO
-    #
-    #   @option options [Aws::S3::AccessGrantsCredentialsProvider] :s3_access_grants_credentials_provider
-    #     TODO
-    #
     #   @option options [Boolean] :s3_disable_multiregion_access_points (false)
     #     When set to `false` this will option will raise errors when multi-region
     #     access point ARNs are used.  Multi-region access points can potentially

gems/aws-sdk-s3/lib/aws-sdk-s3/plugins/access_grants.rb

@@ -6,7 +6,7 @@ module Plugins
       # @api private
       class AccessGrants < Seahorse::Client::Plugin
         option(
-          :s3_access_grants,
+          :access_grants,
           default: false,
           doc_type: 'Boolean',
           docstring: <<-DOCS)
@@ -19,7 +19,7 @@ class AccessGrants < Seahorse::Client::Plugin
           doc_type: 'Aws::S3::AccessGrantsCredentialsProvider',
           rbs_type: 'untyped',
           docstring: <<-DOCS) do |_cfg|
-When `s3_access_grants` is `true`, this option can be used to provide
+When `access_grants` is `true`, this option can be used to provide
 additional options to the credentials provider, including a privilege
 setting, caching, and fallback behavior.
           DOCS
@@ -72,13 +72,12 @@ def access_grants_operation?(context)
           end
 
           def s3_express_endpoint?(context)
-            props = context[:endpoint_properties]
-            props['backend'] == 'S3Express'
+            context[:endpoint_properties]['backend'] == 'S3Express'
           end
         end
 
         def add_handlers(handlers,config)
-          handlers.add(Handler) if config.s3_access_grants
+          handlers.add(Handler) if config.access_grants
         end
 
         def after_initialize(client)

gems/aws-sdk-s3/spec/plugins/access_grants_spec.rb

@@ -0,0 +1,81 @@
+require_relative '../spec_helper'
+
+module Aws
+  module S3
+    describe Client do
+      describe 'access_grants' do
+        it 'is disabled by default' do
+          client = Aws::S3::Client.new(
+            stub_responses: true,
+            region: 'us-west-2'
+          )
+          expect(client.config.access_grants).to be false
+        end
+      end
+
+      describe 'access_grants_credentials_provider' do
+        it 'is configured to use the default provider by default' do
+          client = Aws::S3::Client.new(
+            stub_responses: true,
+            region: 'us-west-2'
+          )
+          expect(client.config.access_grants_credentials_provider)
+            .to be_a(Aws::S3::AccessGrantsCredentialsProvider)
+        end
+
+        it 'can use a configured provider' do
+          provider = Aws::S3::AccessGrantsCredentialsProvider.new
+          client = Aws::S3::Client.new(
+            stub_responses: true,
+            region: 'us-west-2',
+            access_grants_credentials_provider: provider
+          )
+          expect(client.config.access_grants_credentials_provider)
+            .to be(provider)
+        end
+      end
+
+      it 'sets the s3_client as the client to get data access' do
+        client = Aws::S3::Client.new(
+          stub_responses: true,
+          region: 'us-west-2'
+        )
+        provider = client.config.access_grants_credentials_provider
+        expect(provider.s3_client).to eq(client)
+      end
+
+      let(:client) do
+        Aws::S3::Client.new(
+          stub_responses: true,
+          access_grants: true,
+          region: 'us-east-1'
+        )
+      end
+
+      it 'is skipped for s3 express endpoints' do
+        expect_any_instance_of(Aws::S3::AccessGrantsCredentialsProvider)
+          .not_to receive(:access_grants_credentials_for)
+        client.head_object(bucket: 'bucket--use1-az2--x-s3', key: 'key')
+      end
+
+      it 'is skipped for non-bucket operations' do
+        expect_any_instance_of(Aws::S3::AccessGrantsCredentialsProvider)
+          .not_to receive(:access_grants_credentials_for)
+        client.list_buckets
+      end
+
+      it 'is skipped for non-permissioned operations' do
+        expect_any_instance_of(Aws::S3::AccessGrantsCredentialsProvider)
+          .not_to receive(:access_grants_credentials_for)
+        client.list_objects(bucket: 'bucket')
+      end
+
+      it 'is called for permissioned bucket operations' do
+        expect_any_instance_of(Aws::S3::AccessGrantsCredentialsProvider)
+          .to receive(:access_grants_credentials_for)
+          .with(bucket: 'bucket', key: 'key', permission: 'READ', prefix: nil)
+        client.head_object(bucket: 'bucket', key: 'key')
+      end
+    end
+  end
+end

gems/aws-sdk-s3/spec/plugins/express_session_auth_spec.rb

@@ -54,6 +54,17 @@ module S3
           expect(client.config.express_credentials_provider)
             .to be_a(Aws::S3::ExpressCredentialsProvider)
         end
+
+        it 'can use a configured provider' do
+          provider = Aws::S3::ExpressCredentialsProvider.new
+          client = Aws::S3::Client.new(
+            stub_responses: true,
+            region: 'us-west-2',
+            express_credentials_provider: provider
+          )
+          expect(client.config.express_credentials_provider)
+            .to be(provider)
+        end
       end
 
       it 'sets the client as the client to create sessions' do