RestoreTableToPointInTime is unimplemented and denies on a different action than the service #446

What ExtendDB does

handle_restore_table_to_point_in_time in crates/engine/src/backup.rs returns ValidationException with the message Point-in-time recovery restore is not yet supported without reading SourceTableArn. For a caller with no policy, ExtendDB denies on dynamodb:RestoreTableToPointInTime on the source table's base ARN.

What DynamoDB does

For a caller with no policy and an index SourceTableArn, DynamoDB denies on dynamodb:Scan on the target table, because it checks the target item actions first. For an authorized caller with an index source, DynamoDB returns ValidationException with the message Invalid Request: Table ARN is invalid.. Measured on 2026-10-22 for a caller with no policy and for an admin.

Effect

An authorized restore fails on ExtendDB because the feature is not implemented. For a no-policy caller the deny names dynamodb:RestoreTableToPointInTime on the source where the service names dynamodb:Scan on the target, so a policy calibrated to the service's deny sees a different action and resource. The error code matches the service for the no-policy case. The action, the resource, and the authorized-caller message do not.

Current state on main

#335 and #827 changed the answers above. On main, a caller with no permissions gets AccessDeniedException on dynamodb:Scan on the target table. A caller with permissions gets ValidationException Invalid Request: Table ARN is invalid. for an index source, TableNotFoundException for a missing source, and PointInTimeRecoveryUnavailableException Point in time recovery is not enabled for table '<name>' for a table. These answers are the same as the answers of DynamoDB.

Suggested fix

Point-in-time recovery is not in v1, so ExtendDB tells the caller that the operation is not available before it checks permissions:

• RestoreTableToPointInTime returns PointInTimeRecoveryUnavailableException, and an enable on UpdateContinuousBackups returns ContinuousBackupsUnavailableException. These are the exceptions that the service defines for each operation. Each message says that point-in-time recovery is not supported.
• The refusal comes after authentication and before authorization. All callers get the same refusal, with or without permissions.
• The refusal does not read the source table, so a caller cannot use it to find out whether a table exists.
• DescribeContinuousBackups and a disable on UpdateContinuousBackups continue to answer DISABLED.

This is different from DynamoDB, which checks permissions first. docs/differences-from-dynamodb.md records the difference. The authorization order from #827 stays in the code for the time when point-in-time recovery is implemented.