s3: document s3:ExistingObjectTag support and feature status

Update policy engine documentation:

- Add s3:ExistingObjectTag/<tag-key> to supported condition keys
- Add 'Object Tag-Based Access Control' section with examples
- Add 'Feature Status' section with implemented and planned features

Planned features for future implementation:
- s3:RequestObjectTag/<key>
- s3:RequestObjectTagKeys
- s3:x-amz-server-side-encryption
- Cross-account access

1 files changed, 4 insertions, 3 deletions

diff --git a/weed/s3api/policy_engine/engine_test.go b/weed/s3api/policy_engine/engine_test.go
index 2b9565738..7ad2ca35b 100644
--- a/weed/s3api/policy_engine/engine_test.go
+++ b/weed/s3api/policy_engine/engine_test.go
@@ -5,6 +5,7 @@ import (
 	"net/url"
 	"testing"
 
+	"github.com/seaweedfs/seaweedfs/weed/s3api/s3_constants"
 	"github.com/seaweedfs/seaweedfs/weed/s3api/s3err"
 )
 
@@ -749,7 +750,7 @@ func TestExistingObjectTagCondition(t *testing.T) {
 		}
 		entry := make(map[string][]byte)
 		for k, v := range tags {
-			entry["X-Amz-Tagging-"+k] = []byte(v)
+			entry[s3_constants.AmzObjectTaggingPrefix+k] = []byte(v)
 		}
 		return entry
 	}
@@ -840,7 +841,7 @@ func TestExistingObjectTagConditionMultipleTags(t *testing.T) {
 	tagsToEntry := func(tags map[string]string) map[string][]byte {
 		entry := make(map[string][]byte)
 		for k, v := range tags {
-			entry["X-Amz-Tagging-"+k] = []byte(v)
+			entry[s3_constants.AmzObjectTaggingPrefix+k] = []byte(v)
 		}
 		return entry
 	}
@@ -934,7 +935,7 @@ func TestExistingObjectTagDenyPolicy(t *testing.T) {
 		}
 		entry := make(map[string][]byte)
 		for k, v := range tags {
-			entry["X-Amz-Tagging-"+k] = []byte(v)
+			entry[s3_constants.AmzObjectTaggingPrefix+k] = []byte(v)
 		}
 		return entry
 	}