developmentseed
diff --git a/‎.github/workflows/deploy.yml‎
Lines changed: 9 additions & 0 deletions b/‎.github/workflows/deploy.yml‎
Lines changed: 9 additions & 0 deletions
diff --git a/‎.github/workflows/preview.yml‎
Lines changed: 2 additions & 0 deletions b/‎.github/workflows/preview.yml‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎crates/core/src/aws_chunked.rs‎
Lines changed: 89 additions & 0 deletions b/‎crates/core/src/aws_chunked.rs‎
Lines changed: 89 additions & 0 deletions
diff --git a/‎crates/core/src/backend/request_signer.rs‎
Lines changed: 0 additions & 3 deletions b/‎crates/core/src/backend/request_signer.rs‎
Lines changed: 0 additions & 3 deletions
diff --git a/‎crates/core/src/lib.rs‎
Lines changed: 1 addition & 0 deletions b/‎crates/core/src/lib.rs‎
Lines changed: 1 addition & 0 deletions
@@ -20,6 +20,11 @@ on:
         required: false
         type: string
         default: ""
+      smoke_write_bucket:
+        description: "Virtual bucket for the multipart write smoke test; empty skips it"
+        required: false
+        type: string
+        default: ""
       set_secrets:
         description: "Whether to set worker secrets after deploy"
         required: false
@@ -112,6 +117,10 @@ jobs:
       # here on both preview (PR) and staging deploys, against the stable
       # staging OIDC issuer — see preview.yml / staging.yml.
       FEDERATION_TEST_KEY: ${{ vars.FEDERATION_TEST_KEY }}
+      # Virtual bucket the multipart write smoke test uploads to
+      # (TestMultipartUpload). Set per-caller via the `smoke_write_bucket` input
+      # (preview.yml passes `smoke-writable`); empty -> the test self-skips.
+      SMOKE_WRITE_BUCKET: ${{ inputs.smoke_write_bucket }}
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
 
@@ -21,6 +21,8 @@ jobs:
       worker_name: multistore-proxy-pr-${{ github.event.pull_request.number }}
       wrangler_config: wrangler.deploy.toml
       environment: preview
+      # Run the real-S3 multipart write smoke test on every preview.
+      smoke_write_bucket: smoke-writable
       # Mint tokens with the STABLE staging issuer rather than this PR's own URL.
       # All deployments share OIDC_PROVIDER_KEY, so a preview can sign assertions
       # whose `iss` is the staging URL; AWS then validates them against the
 
@@ -0,0 +1,89 @@
+//! Detection of AWS SigV4 streaming ("aws-chunked") uploads.
+//!
+//! Modern AWS clients (aws-cli ≥ 2.23, recent SDKs) send `PutObject`/`UploadPart`
+//! bodies as `Content-Encoding: aws-chunked` framing with an
+//! `x-amz-content-sha256: STREAMING-…` sentinel rather than a plain payload. S3
+//! only de-chunks that framing for a request signed with the matching streaming
+//! sentinel, so the proxy must re-sign the request seed (not presign) and stream
+//! the framing through untouched — see `ProxyGateway::build_streaming_forward`.
+
+use http::HeaderMap;
+
+/// How a streaming ("aws-chunked") upload's chunks are authenticated — which
+/// decides whether the proxy can forward the framing after re-signing.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum StreamingUpload {
+    /// `STREAMING-UNSIGNED-PAYLOAD[-TRAILER]` — chunks are framed but not
+    /// individually signed. The proxy can re-sign the request seed with the
+    /// backend credentials and stream the framing through for S3 to de-chunk.
+    Unsigned,
+    /// `STREAMING-AWS4-HMAC-SHA256-PAYLOAD[-TRAILER]` — each chunk carries a
+    /// signature chained from the client's signing key, which cannot survive the
+    /// proxy re-signing the request to the backend with different credentials.
+    /// The proxy cannot forward these.
+    Signed,
+}
+
+/// Classify a request body from its `x-amz-content-sha256`, returning the
+/// upload kind together with the sentinel value (so the caller can reuse it as
+/// the seed's payload hash without re-reading it). `None` for an ordinary
+/// (non-streaming) upload.
+pub(crate) fn streaming_upload(headers: &HeaderMap) -> Option<(StreamingUpload, &str)> {
+    let sentinel = headers.get("x-amz-content-sha256")?.to_str().ok()?;
+    let variant = sentinel.strip_prefix("STREAMING-")?;
+    let kind = if variant.contains("UNSIGNED") {
+        StreamingUpload::Unsigned
+    } else {
+        StreamingUpload::Signed
+    };
+    Some((kind, sentinel))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn headers(content_sha256: &str) -> HeaderMap {
+        let mut h = HeaderMap::new();
+        if !content_sha256.is_empty() {
+            h.insert("x-amz-content-sha256", content_sha256.parse().unwrap());
+        }
+        h
+    }
+
+    #[test]
+    fn unsigned_streaming_is_unsigned() {
+        // The aws-cli/SDK default (CRC64NVME trailer), and the no-trailer form.
+        // The sentinel is returned verbatim (the `-TRAILER` suffix matters).
+        assert_eq!(
+            streaming_upload(&headers("STREAMING-UNSIGNED-PAYLOAD-TRAILER")),
+            Some((
+                StreamingUpload::Unsigned,
+                "STREAMING-UNSIGNED-PAYLOAD-TRAILER"
+            ))
+        );
+        assert_eq!(
+            streaming_upload(&headers("STREAMING-UNSIGNED-PAYLOAD")),
+            Some((StreamingUpload::Unsigned, "STREAMING-UNSIGNED-PAYLOAD"))
+        );
+    }
+
+    #[test]
+    fn signed_streaming_is_signed() {
+        assert_eq!(
+            streaming_upload(&headers("STREAMING-AWS4-HMAC-SHA256-PAYLOAD")),
+            Some((
+                StreamingUpload::Signed,
+                "STREAMING-AWS4-HMAC-SHA256-PAYLOAD"
+            ))
+        );
+    }
+
+    #[test]
+    fn non_streaming_is_none() {
+        // Anything without the `STREAMING-` prefix (a plain hash, `UNSIGNED-PAYLOAD`,
+        // or a missing header) is not a streaming upload.
+        assert_eq!(streaming_upload(&headers("UNSIGNED-PAYLOAD")), None);
+        assert_eq!(streaming_upload(&headers("")), None);
+    }
+}
@@ -152,6 +152,3 @@ pub fn hash_payload(payload: &[u8]) -> String {
 
 /// The SigV4 sentinel for unsigned payloads (used with streaming uploads).
 pub const UNSIGNED_PAYLOAD: &str = "UNSIGNED-PAYLOAD";
-
-/// The SigV4 sentinel for streaming payloads.
-pub const STREAMING_PAYLOAD: &str = "STREAMING-AWS4-HMAC-SHA256-PAYLOAD";
@@ -23,6 +23,7 @@
 
 pub mod api;
 pub mod auth;
+pub(crate) mod aws_chunked;
 pub mod backend;
 pub mod error;
 pub mod maybe_send;