feat(io): expose FileIO configuration properties

src/iceberg/arrow/s3/arrow_s3_file_io.cc

@@ -213,6 +213,10 @@ class ArrowS3FileIO final : public FileIO, public SupportsStorageCredentials {
     return storage_credentials_;
   }
 
+  const std::unordered_map<std::string, std::string>& properties() const override {
+    return default_properties_;
+  }
+
   SupportsStorageCredentials* AsSupportsStorageCredentials() override { return this; }
 
  private:

src/iceberg/file_io.h

@@ -29,6 +29,7 @@
 #include <span>
 #include <string>
 #include <string_view>
+#include <unordered_map>
 #include <vector>
 
 #include "iceberg/iceberg_export.h"
@@ -180,6 +181,15 @@ class ICEBERG_EXPORT FileIO {
 
   /// \brief Return storage-credential support when implemented by this FileIO.
   virtual SupportsStorageCredentials* AsSupportsStorageCredentials() { return nullptr; }
+
+  /// \brief Return the configuration used to create this FileIO.
+  ///
+  /// The returned map may contain credentials. Callers must not log or expose it.
+  /// Implementations that do not expose their configuration return an empty map.
+  virtual const std::unordered_map<std::string, std::string>& properties() const {
+    static const std::unordered_map<std::string, std::string> kEmpty;
+    return kEmpty;
+  }
 };
 
 /// \brief Mix-in for FileIO implementations that route object paths to

src/iceberg/resolving_file_io.h

@@ -60,6 +60,10 @@ class ICEBERG_EXPORT ResolvingFileIO final : public FileIO,
 
   const std::vector<StorageCredential>& credentials() const override;
 
+  const std::unordered_map<std::string, std::string>& properties() const override {
+    return properties_;
+  }
+
   SupportsStorageCredentials* AsSupportsStorageCredentials() override { return this; }
 
  private:

src/iceberg/test/arrow_s3_file_io_test.cc

@@ -175,6 +175,18 @@ TEST_F(ArrowS3FileIOTest, StoresCredentials) {
   EXPECT_EQ(credentialed->credentials(), credentials);
 }
 
+TEST_F(ArrowS3FileIOTest, PropertiesExposeFileIOConfiguration) {
+  auto result = MakeS3FileIO({{std::string(S3Properties::kClientRegion), "us-east-1"},
+                              {std::string(S3Properties::kAccessKeyId), "key"},
+                              {std::string(S3Properties::kSecretAccessKey), "secret"}});
+  ASSERT_THAT(result, IsOk());
+
+  const auto& properties = result.value()->properties();
+  EXPECT_EQ(properties.at(std::string(S3Properties::kClientRegion)), "us-east-1");
+  EXPECT_EQ(properties.at(std::string(S3Properties::kAccessKeyId)), "key");
+  EXPECT_EQ(properties.at(std::string(S3Properties::kSecretAccessKey)), "secret");
+}
+
 TEST_F(ArrowS3FileIOTest, SkipsNonS3CredentialPrefix) {
   auto result = MakeS3FileIO({});
   ASSERT_THAT(result, IsOk());

src/iceberg/test/rest_file_io_test.cc

@@ -95,6 +95,18 @@ TEST(RestFileIOTest, DefaultResolverDelegatesThroughRegistry) {
   EXPECT_THAT(result.value()->DeleteFile("rest-test://file"), IsOk());
 }
 
+TEST(RestFileIOTest, DefaultResolverExposesMergedProperties) {
+  auto result = MakeTableFileIO({{"catalog-only", "catalog"}, {"shared", "catalog"}},
+                                {{"table-only", "table"}, {"shared", "table"}},
+                                /*storage_credentials=*/{});
+  ASSERT_THAT(result, IsOk());
+
+  EXPECT_THAT(result.value()->properties(),
+              ::testing::UnorderedElementsAre(::testing::Pair("catalog-only", "catalog"),
+                                              ::testing::Pair("table-only", "table"),
+                                              ::testing::Pair("shared", "table")));
+}
+
 TEST(RestFileIOTest, MakeCatalogFileIOPassesThroughCustomImpl) {
   const std::string custom_impl = "com.mycompany.CustomFileIO";
   FileIORegistry::Register(