fix(uploads): omit hoisted S3 metadata headers

Author: TheodoreSpeaks

apps/sim/lib/uploads/providers/s3/client.test.ts

@@ -247,7 +247,7 @@ describe('S3 Client', () => {
   })
 
   describe('staged upload primitives', () => {
-    it('signs a fixed-size PUT with canonical object metadata', async () => {
+    it('signs metadata without returning duplicate x-amz-meta headers', async () => {
       mockGetSignedUrl.mockResolvedValueOnce('https://example.com/signed-put')
 
       const result = await getS3PresignedUploadUrl({
@@ -270,8 +270,6 @@ describe('S3 Client', () => {
         url: 'https://example.com/signed-put',
         headers: {
           'Content-Type': 'application/octet-stream',
-          'x-amz-meta-uploadid': 'upload-1',
-          'x-amz-meta-purpose': 'workspace_file',
         },
       })
     })

apps/sim/lib/uploads/providers/s3/client.ts

@@ -170,7 +170,9 @@ export async function getPresignedUrlWithConfig(
 
 /**
  * Generates a signed single-object PUT for a caller-selected staging key.
- * Every returned header covered by the signature must be sent verbatim by the client.
+ * The AWS presigner hoists `x-amz-meta-*` values into the signed query string,
+ * so only ordinary transfer headers are returned. Repeating that metadata as
+ * request headers makes S3 reject the otherwise-valid signature.
  */
 export async function getS3PresignedUploadUrl(params: {
   key: string
@@ -193,9 +195,6 @@ export async function getS3PresignedUploadUrl(params: {
     url,
     headers: {
       'Content-Type': params.contentType,
-      ...Object.fromEntries(
-        Object.entries(metadata).map(([key, value]) => [`x-amz-meta-${key.toLowerCase()}`, value])
-      ),
     },
   }
 }