fix(s3,dynamodb,athena,route53,cloudwatch,ses,firehose): correct output/filter/pagination divergences (bug-hunt)

[vieiralucas]

Summary

Eight confirmed correctness fixes to existing modeled operations, one per divergence found in a bug-hunt. Each is an independent small fix; grouped into one PR.

1. S3 GetObjectAttributes ETag over-quoted (fakecloud-s3): the <ETag> element wrapped the value in " quotes. AWS returns the GetObjectAttributes ETag WITHOUT surrounding quotes (unlike GetObject/HeadObject) for both single-part (md5) and multipart (md5-N) objects. Now emitted unquoted.
2. DynamoDB Query on a sparse GSI/LSI returned phantom rows (fakecloud-dynamodb): query() filtered table.items by the key condition only, so items missing an index key attribute (absent from the index on AWS) were still returned, inflating Items/Count/ScannedCount. Now skips items lacking any of the index's key attributes, mirroring the existing scan() guard.
3. Athena GetQueryResults truncated with no pagination (fakecloud-athena): input NextToken was ignored and no output NextToken was emitted, so result sets larger than MaxResults were unreachable past page 1. Now honors MaxResults + NextToken (offset cursor), emits a NextToken when more rows remain, and only emits the column-header row on the first invocation. Header emission is keyed on token-absence (not offset == 0) so MaxResults=1 terminates instead of looping.
4. Route53 ListResourceRecordSets wrong sort order (fakecloud-route53): sorted by plain forward ASCII name; AWS sorts by reversed-label DNS name (com.example.www) then type. Now uses the existing reverse_dns_key() for both the sort and the NextRecordName/NextRecordType cursor.
5. CloudWatch ListMetrics dropped a name-only DimensionFilter (fakecloud-cloudwatch): a filter with a Name but no Value (Value is optional in the model) yielded an empty filter and returned every metric in the namespace. Added parse_dimension_filters (value-optional); a name-only filter matches any metric carrying that dimension name, Name+Value stays exact-match.
6. SES v2 SendEmail wrong error for unverified sender (fakecloud-ses): returned MailFromDomainNotVerifiedException where AWS returns MessageRejected ("Email address is not verified. The following identities failed the check..."). MailFromDomainNotVerifiedException is reserved for an unverified custom MAIL FROM domain. Now matches the v1 path. Updated the three tests that baked in the wrong class.
7. SES ListContacts ignored Filter (fakecloud-ses): returned every contact. Now applies FilteredStatus (OPT_IN/OPT_OUT via the contact's overall status) and TopicFilter (per-topic subscription status, with default fallback when UseDefaultIfPreferenceUnavailable).
8. Firehose ListTagsForDeliveryStream ignored Limit/ExclusiveStartTagKey, hardcoded HasMoreTags:false (fakecloud-firehose): now honors Limit (1-50) + ExclusiveStartTagKey, returns one page, and sets HasMoreTags:true when more remain, mirroring ListDeliveryStreams.

Test plan

• One regression test per fix: unquoted ETag (single-part + multipart), sparse-index query excludes the phantom row, Athena paginates a >MaxResults result set (plus a MaxResults=1 termination case), Route53 reversed-label order, CloudWatch name-only filter narrows results, SES v2 unverified sender -> MessageRejected (existing test updated), ListContacts FilteredStatus + TopicFilter narrow results, Firehose tag pagination.
• cargo test -p fakecloud-s3 -p fakecloud-dynamodb -p fakecloud-athena -p fakecloud-route53 -p fakecloud-cloudwatch -p fakecloud-ses -p fakecloud-firehose — all green.
• cargo clippy --all-targets -- -D warnings for each touched crate — clean.
• cargo fmt — clean.

Surface sync

Correctness fixes to existing modeled operations only — no new API surface, operation, or field, and no SDK change. No SDK/docs/metadata sync needed.

---

Summary by cubic

Fixes eight AWS compatibility bugs across S3, DynamoDB, Athena, Route53, CloudWatch, SES, and Firehose. Aligns outputs, filtering, and pagination with AWS to prevent wrong results and unreachable pages.

• Bug Fixes
  • fakecloud-s3: GetObjectAttributes now returns an unquoted ETag (single-part and multipart).
  • fakecloud-dynamodb: Query on GSIs/LSIs skips items missing index keys to avoid phantom rows/counts.
  • fakecloud-athena: GetQueryResults honors MaxResults/NextToken, emits header only on the first page, and paginates correctly (incl. MaxResults=1).
  • fakecloud-route53: ListResourceRecordSets sorts by reversed-label DNS name then type; cursors use the same key.
  • fakecloud-cloudwatch: ListMetrics applies DimensionFilter when only Name is set (matches any value).
  • fakecloud-ses: SendEmail and SendCustomVerificationEmail return MessageRejected for unverified senders; MailFromDomainNotVerifiedException is no longer used here.
  • fakecloud-ses: ListContacts applies Filter.FilteredStatus and TopicFilter (with UseDefaultIfPreferenceUnavailable).
  • fakecloud-firehose: ListTagsForDeliveryStream supports Limit and ExclusiveStartTagKey and sets HasMoreTags when more tags exist.

^{Written for commit b014e90. Summary will update on new commits.}

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.