RestoreTableToPointInTime is unimplemented and denies on a different action than the service #446

What ExtendDB does

handle_restore_table_to_point_in_time in crates/engine/src/backup.rs returns ValidationException with the message Point-in-time recovery restore is not yet supported without reading SourceTableArn. For a caller with no policy, ExtendDB denies on dynamodb:RestoreTableToPointInTime on the source table's base ARN.

What DynamoDB does

For a caller with no policy and an index SourceTableArn, DynamoDB denies on dynamodb:Scan on the target table, because it checks the target item actions first. For an authorized caller with an index source, DynamoDB returns ValidationException with the message Invalid Request: Table ARN is invalid.. Measured on 2026-10-22 for a caller with no policy and for an admin.

Effect

An authorized restore fails on ExtendDB because the feature is not implemented. For a no-policy caller the deny names dynamodb:RestoreTableToPointInTime on the source where the service names dynamodb:Scan on the target, so a policy calibrated to the service's deny sees a different action and resource. The error code matches the service for the no-policy case. The action, the resource, and the authorized-caller message do not.

Suggested fix

Implement point-in-time restore. Until then, authorize the target table's item actions before the restore action, so the deny names the same action and resource the service names, and return Invalid Request: Table ARN is invalid. after authorization for a source ARN that is not a table.