feat(io): expose FileIO configuration properties

Add FileIO::properties(), returning the FileIO's configuration by const
reference. The default returns an empty map; ArrowS3FileIO returns the
properties it was configured with.

This lets an engine that performs its own I/O read the resolved configuration
of a table's FileIO, matching the property surface other Iceberg
implementations expose (Java FileIO.properties(), Rust config().props(),
Python table.io.properties; Trino reads baseTable.io().properties()). Vended
credentials returned in a table's config are part of that configuration and
are surfaced here; structured storage-credentials remain on the separate
SupportsStorageCredentials channel, as in Java.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Sreesh Maheshwar

src/iceberg/arrow/s3/arrow_s3_file_io.cc

@@ -215,6 +215,10 @@ class ArrowS3FileIO final : public FileIO, public SupportsStorageCredentials {
     return storage_credentials_;
   }
 
+  const std::unordered_map<std::string, std::string>& properties() const override {
+    return default_properties_;
+  }
+
   SupportsStorageCredentials* AsSupportsStorageCredentials() override { return this; }
 
  private:

src/iceberg/file_io.h

@@ -26,6 +26,7 @@
 #include <span>
 #include <string>
 #include <string_view>
+#include <unordered_map>
 #include <vector>
 
 #include "iceberg/iceberg_export.h"
@@ -177,6 +178,15 @@ class ICEBERG_EXPORT FileIO {
 
   /// \brief Return storage-credential support when implemented by this FileIO.
   virtual SupportsStorageCredentials* AsSupportsStorageCredentials() { return nullptr; }
+
+  /// \brief Return this FileIO's configuration properties.
+  ///
+  /// Engines that access storage through their own I/O stack can read these to
+  /// configure that access. The default returns an empty map.
+  virtual const std::unordered_map<std::string, std::string>& properties() const {
+    static const std::unordered_map<std::string, std::string> kEmpty;
+    return kEmpty;
+  }
 };
 
 /// \brief Mix-in for FileIO implementations that route object paths to

src/iceberg/test/arrow_s3_file_io_test.cc

@@ -156,6 +156,21 @@ TEST_F(ArrowS3FileIOTest, StoresCredentials) {
   EXPECT_EQ(credentialed->credentials(), credentials);
 }
 
+TEST_F(ArrowS3FileIOTest, PropertiesExposeFileIOConfiguration) {
+  // REST servers typically return vended credentials in a table's config, which
+  // becomes the FileIO's configuration; properties() exposes it to engines.
+  auto result = MakeS3FileIO({{std::string(S3Properties::kClientRegion), "us-east-1"},
+                              {std::string(S3Properties::kAccessKeyId), "key"},
+                              {std::string(S3Properties::kSecretAccessKey), "secret"}});
+  ASSERT_THAT(result, IsOk());
+
+  // No downcast needed: properties() is a FileIO method.
+  const auto& properties = result.value()->properties();
+  EXPECT_EQ(properties.at(std::string(S3Properties::kClientRegion)), "us-east-1");
+  EXPECT_EQ(properties.at(std::string(S3Properties::kAccessKeyId)), "key");
+  EXPECT_EQ(properties.at(std::string(S3Properties::kSecretAccessKey)), "secret");
+}
+
 TEST_F(ArrowS3FileIOTest, RejectsCredentialPrefix) {
   auto result = MakeS3FileIO({});
   ASSERT_THAT(result, IsOk());