fix(auth): enforce trust-policy Deny and match IAM condition evaluation

crates/auth/src/cache_registry.rs

@@ -72,6 +72,12 @@ pub trait AuthzCacheInvalidator: Send + Sync {
         user_name: &'a str,
     ) -> BoxFuture<'a, ()>;
 
+    fn invalidate_user_created_at<'a>(
+        &'a self,
+        account_id: &'a str,
+        user_name: &'a str,
+    ) -> BoxFuture<'a, ()>;
+
     fn invalidate_role_policies<'a>(
         &'a self,
         account_id: &'a str,
@@ -90,6 +96,12 @@ pub trait AuthzCacheInvalidator: Send + Sync {
         role_name: &'a str,
     ) -> BoxFuture<'a, ()>;
 
+    fn invalidate_role_created_at<'a>(
+        &'a self,
+        account_id: &'a str,
+        role_name: &'a str,
+    ) -> BoxFuture<'a, ()>;
+
     fn invalidate_session<'a>(
         &'a self,
         account_id: &'a str,
@@ -228,6 +240,12 @@ impl AuthCacheRegistry {
         }
     }
 
+    pub async fn invalidate_user_created_at(&self, account_id: &str, user_name: &str) {
+        if let Some(c) = &self.authz {
+            c.invalidate_user_created_at(account_id, user_name).await;
+        }
+    }
+
     pub async fn invalidate_role_policies(&self, account_id: &str, role_name: &str) {
         if let Some(c) = &self.authz {
             c.invalidate_role_policies(account_id, role_name).await;
@@ -246,6 +264,12 @@ impl AuthCacheRegistry {
         }
     }
 
+    pub async fn invalidate_role_created_at(&self, account_id: &str, role_name: &str) {
+        if let Some(c) = &self.authz {
+            c.invalidate_role_created_at(account_id, role_name).await;
+        }
+    }
+
     pub async fn invalidate_session(&self, account_id: &str, role_name: &str, session_name: &str) {
         if let Some(c) = &self.authz {
             c.invalidate_session(account_id, role_name, session_name)