feat(auth): verify inbound SigV4 presigned URLs

[alukach]

What I'm changing

resolve_identity only authenticated requests whose SigV4 material was in the Authorization header. Presigned URLs carry everything in the query string, so they fell through to ResolvedIdentity::Anonymous and STS-signed links were treated as anonymous. Browsers can't set an Authorization header on <img>/<a>/fetch, so presigned URLs are the only way to hand a browser data-viewer a directly-fetchable, time-limited link. This unblocks presigned-URL support in the Source Cooperative data proxy (source-cooperative/data.source.coop#136).

Closes #53, closes #39.

How I did it

• crates/core/src/auth/sigv4.rs — refactor to share machinery between the two request shapes, then add the presigned path:
  • build_sigv4_auth — extracted the AKID/date/region/service/aws4_request credential-scope split so both parsers reuse it.
  • verify_signed — extracted the canonical-request reconstruction + signing-key derivation + constant-time compare. Callers pass the already-canonicalized query, payload hash, and string-to-sign date, so the header-vs-presigned differences live entirely in the thin wrappers. verify_sigv4_signature keeps its public signature.
  • parse_sigv4_presigned — pulls the X-Amz-* params; percent-decodes values for parsing (e.g. X-Amz-Credential arrives as AKID%2F.../aws4_request) while the raw encoded query is what gets canonicalized during verification.
  • verify_sigv4_presigned — strips X-Amz-Signature from the canonical query, uses UNSIGNED-PAYLOAD, and takes the date from the X-Amz-Date query param.
  • is_presigned — detects X-Amz-Algorithm=AWS4-HMAC-SHA256.
• crates/core/src/auth/identity.rs — parse the header or the presigned query into a unified SigMode, then run one shared resolve → verify → Authenticated tail (temporary-credential and long-lived branches unchanged). check_presigned_expiry rejects once X-Amz-Date + X-Amz-Expires elapses, with 5s clock-skew tolerance, via the existing ExpiredCredentials error. The session token (X-Amz-Security-Token) resolves through the same TemporaryCredentialResolver, keeping the access-key match check.
• crates/core/src/auth/mod.rs — export is_presigned, parse_sigv4_presigned, verify_sigv4_presigned, PresignedSig.
• docs/auth/ — note presigned-URL client auth in index.md and proxy-auth.md.

Everything downstream of identity resolution (authorize → presign-backend → stream) is unchanged.

Test plan

New tests in crates/core/src/auth/tests.rs (self-checking sign_presigned helper):

• presigned GET → Authenticated (long-lived cred)
• presigned GET with X-Amz-Security-Token via a stub resolver → Authenticated
• injected/unsigned query param → SignatureDoesNotMatch
• X-Amz-Date + X-Amz-Expires in the past → ExpiredCredentials
• credential access key ≠ resolved-token key → AccessDenied
• non-SigV4 query with no auth header → Anonymous (regression)

Verification run:

• cargo test -p multistore auth:: — 30 passed
• cargo fmt, cargo clippy -p multistore — clean
• cargo check
• cargo check -p multistore-cf-workers --target wasm32-unknown-unknown

Release

Lands as feat(auth): → release-please cuts a minor. Downstream proxy is on 0.4.0 and can bump once released.

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 4m 12s —— View job

---

Claude's review

• Gather context (diff, changed files)
• Review sigv4.rs changes
• Review identity.rs changes
• Review mod.rs, tests, docs
• Apply ponytail over-engineering pass
• Post final review

---

❌ Changes requested — see findings below.

• crates/core/src/auth/sigv4.rs:299-306 — canonicalize_query_string lost two behaviors it had before this refactor: appending a trailing = to value-less flag params (?uploads, ?delete), and filtering out empty segments from a stray &. The removed code even carried a comment calling this out as "the bug that broke multipart and batch delete" — this PR reintroduces that exact bug. This function is shared by inbound verification (verify_signed) and outbound signing to the real backend (crates/core/src/backend/request_signer.rs:84, whose own comment at lines 80-82 still documents the now-broken contract). Any multipart-upload-initiate (?uploads) or batch-delete (?delete) request — inbound or outbound — will now produce a canonical query that doesn't match what AWS-compliant clients/backends compute, causing SignatureDoesNotMatch. The unit tests that pinned this behavior (value_less_flag_gets_trailing_equals, mixed_flag_and_valued_params, stray_empty_segments_are_dropped) were deleted along with the fix, so nothing in this PR's test suite catches the regression.

  pub(crate) fn canonicalize_query_string(query: &str) -> String {
      if query.is_empty() {
          return String::new();
      }
      let mut parts: Vec<std::borrow::Cow<str>> = query
          .split('&')
          .filter(|p| !p.is_empty())
          .map(|p| {
              if p.contains('=') {
                  std::borrow::Cow::Borrowed(p)
              } else {
                  std::borrow::Cow::Owned(format!("{p}="))
              }
          })
          .collect();
      parts.sort_unstable();
      parts.join("&")
  }

  Restore the old logic (and the deleted unit tests) — the presigned-URL path doesn't change any of this, so there's no reason the refactor needed to touch it.

Simplify (ponytail)

• crates/core/src/auth/tests.rs:851-855 — sign_presigned manually sorts/joins params for its canonical query; call the already-exported sigv4::canonicalize_query_string(&params.join("&")) instead of reimplementing the sort.
• crates/core/src/auth/tests.rs:813-883 — sign_presigned duplicates ~35 lines of canonical-request-hash + signing-key derivation already in sign_request (tests.rs:60-116); factor a shared derive_signature(canonical_request, secret, date_stamp, region, amz_date) helper both can call.
  ·

---

💰 Estimated review cost: $1.28 · 4m12s · 33 turns

[github-actions]

📖 Docs preview deployed to https://multistore-docs-pr-125.development-seed.workers.dev

• Date: 2026-07-22T05:53:55Z
• Commit: ea21439