fix(s3api): strip aws-chunked only for streaming uploads

- Replace `StripAwsChunkedEncoding` with `ParseContentEncoding`, which drops
  the token only when `x-amz-content-sha256` names a streaming payload type,
  so a client that sends `aws-chunked` on a hex-payload request keeps it
- Revert the `CopyObject` and `CreateMultipartUpload` call sites: both routes
  are registered with `streamBody` false, so a streaming payload type is
  rejected before the controller and the token can only be a stored value
- Reject `aws-chunked` combined with `UNSIGNED-PAYLOAD` in the authentication
  middleware, beside the existing payload-type validation, with a new
  `InvalidArgAwsChunkedUnsignedPayload`
- Add REST tests for the three cases: stripped from a chunked upload, kept on
  a hex-payload request, and rejected with `UNSIGNED-PAYLOAD`
- Add `CONTENT_ENCODING` to the PutObject REST script and a
  `check_content_encoding` driver for HeadObject

s3api/controllers/object-post.go

@@ -147,7 +147,7 @@ func (c S3ApiController) CreateMultipartUpload(ctx fiber.Ctx) (*Response, error)
 	contentDisposition := ctx.Get("Content-Disposition")
 	contentLanguage := ctx.Get("Content-Language")
 	cacheControl := ctx.Get("Cache-Control")
-	contentEncoding := utils.StripAwsChunkedEncoding(ctx.Get("Content-Encoding"))
+	contentEncoding := ctx.Get("Content-Encoding")
 	tagging := ctx.Get("X-Amz-Tagging")
 	expires := ctx.Get("Expires")
 	websiteRedirectLocation := ctx.Get("X-Amz-Website-Redirect-Location")

s3api/controllers/object-post_test.go

@@ -328,28 +328,6 @@ func TestS3ApiController_CreateMultipartUpload(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "strips aws-chunked content encoding",
-			input: testInput{
-				locals: defaultLocals,
-				beRes:  s3response.InitiateMultipartUploadResult{},
-				headers: map[string]string{
-					"Content-Encoding": "aws-chunked,gzip",
-				},
-			},
-			output: testOutput{
-				response: &Response{
-					Data: s3response.InitiateMultipartUploadResult{},
-					Headers: map[string]*string{
-						"x-amz-checksum-algorithm": nil,
-						"x-amz-checksum-type":      nil,
-					},
-					MetaOpts: &MetaOptions{
-						BucketOwner: "root",
-					},
-				},
-			},
-		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -358,14 +336,6 @@ func TestS3ApiController_CreateMultipartUpload(t *testing.T) {
 					if tt.name == "successful response" && createMultipartUploadInput.StorageClass != types.StorageClassGlacier {
 						t.Fatalf("expected storage class %q, got %q", types.StorageClassGlacier, createMultipartUploadInput.StorageClass)
 					}
-					if tt.name == "strips aws-chunked content encoding" {
-						if createMultipartUploadInput.ContentEncoding == nil {
-							t.Fatal("expected content encoding to be set")
-						}
-						if *createMultipartUploadInput.ContentEncoding != "gzip" {
-							t.Fatalf("expected content encoding %q, got %q", "gzip", *createMultipartUploadInput.ContentEncoding)
-						}
-					}
 					return tt.input.beRes.(s3response.InitiateMultipartUploadResult), tt.input.beErr
 				},
 				GetBucketPolicyFunc: func(contextMoqParam context.Context, bucket string) ([]byte, error) {

s3api/controllers/object-put.go

@@ -516,7 +516,7 @@ func (c S3ApiController) CopyObject(ctx fiber.Ctx) (*Response, error) {
 	metaDirective := types.MetadataDirective(ctx.Get("X-Amz-Metadata-Directive", string(types.MetadataDirectiveCopy)))
 	taggingDirective := types.TaggingDirective(ctx.Get("X-Amz-Tagging-Directive", string(types.TaggingDirectiveCopy)))
 	contentType := ctx.Get("Content-Type", defaultContentType)
-	contentEncoding := utils.StripAwsChunkedEncoding(ctx.Get("Content-Encoding"))
+	contentEncoding := ctx.Get("Content-Encoding")
 	contentDisposition := ctx.Get("Content-Disposition")
 	contentLanguage := ctx.Get("Content-Language")
 	cacheControl := ctx.Get("Cache-Control")
@@ -698,7 +698,7 @@ func (c S3ApiController) PutObject(ctx fiber.Ctx) (*Response, error) {
 	bucket := ctx.Params("bucket")
 	key := strings.TrimPrefix(ctx.Path(), fmt.Sprintf("/%s/", bucket))
 	contentType := ctx.Get("Content-Type", defaultContentType)
-	contentEncoding := utils.StripAwsChunkedEncoding(ctx.Get("Content-Encoding"))
+	contentEncoding := utils.ParseContentEncoding(ctx)
 	contentDisposition := ctx.Get("Content-Disposition")
 	contentLanguage := ctx.Get("Content-Language")
 	cacheControl := ctx.Get("Cache-Control")

s3api/controllers/object-put_test.go

@@ -1331,7 +1331,7 @@ func TestS3ApiController_PutObject(t *testing.T) {
 		})
 	})
 
-	t.Run("strips aws-chunked content encoding", func(t *testing.T) {
+	t.Run("strips aws-chunked from a streaming upload", func(t *testing.T) {
 		be := &BackendMock{
 			PutObjectFunc: func(_ context.Context, input s3response.PutObjectInput) (s3response.PutObjectOutput, error) {
 				if input.ContentEncoding == nil {
@@ -1381,7 +1381,64 @@ func TestS3ApiController_PutObject(t *testing.T) {
 		}, nil, ctxInputs{
 			locals: defaultLocals,
 			headers: map[string]string{
-				"Content-Encoding": "aws-chunked,gzip",
+				"Content-Encoding":     "aws-chunked,gzip",
+				"X-Amz-Content-Sha256": "STREAMING-UNSIGNED-PAYLOAD-TRAILER",
+			},
+		})
+	})
+
+	t.Run("keeps aws-chunked when the payload is not streamed", func(t *testing.T) {
+		be := &BackendMock{
+			PutObjectFunc: func(_ context.Context, input s3response.PutObjectInput) (s3response.PutObjectOutput, error) {
+				if input.ContentEncoding == nil {
+					t.Fatal("expected content encoding to be set")
+				}
+				if *input.ContentEncoding != "aws-chunked" {
+					t.Fatalf("expected content encoding %q, got %q", "aws-chunked", *input.ContentEncoding)
+				}
+				return s3response.PutObjectOutput{ETag: "etag", VersionID: "version-id"}, nil
+			},
+			GetBucketPolicyFunc: func(_ context.Context, _ string) ([]byte, error) {
+				return nil, s3err.GetAPIError(s3err.ErrAccessDenied)
+			},
+			GetObjectLockConfigurationFunc: func(_ context.Context, _ string) ([]byte, error) {
+				return nil, s3err.GetAPIError(s3err.ErrObjectLockConfigurationNotFound)
+			},
+			GetBucketVersioningFunc: func(_ context.Context, _ string) (s3response.GetBucketVersioningOutput, error) {
+				return s3response.GetBucketVersioningOutput{}, s3err.GetAPIError(s3err.ErrNotImplemented)
+			},
+		}
+
+		ctrl := S3ApiController{be: be}
+		testController(t, ctrl.PutObject, &Response{
+			Headers: map[string]*string{
+				"ETag":                     utils.GetStringPtr("etag"),
+				"x-amz-checksum-crc32":     nil,
+				"x-amz-checksum-crc32c":    nil,
+				"x-amz-checksum-crc64nvme": nil,
+				"x-amz-checksum-sha1":      nil,
+				"x-amz-checksum-sha256":    nil,
+				"x-amz-checksum-sha512":    nil,
+				"x-amz-checksum-md5":       nil,
+				"x-amz-checksum-xxhash64":  nil,
+				"x-amz-checksum-xxhash3":   nil,
+				"x-amz-checksum-xxhash128": nil,
+				"x-amz-checksum-type":      nil,
+				"x-amz-version-id":         utils.GetStringPtr("version-id"),
+				"x-amz-object-size":        nil,
+			},
+			MetaOpts: &MetaOptions{
+				BucketOwner:   "root",
+				ObjectETag:    utils.GetStringPtr("etag"),
+				ContentLength: 0,
+				ObjectSize:    0,
+				EventName:     s3event.EventObjectCreatedPut,
+			},
+		}, nil, ctxInputs{
+			locals: defaultLocals,
+			headers: map[string]string{
+				"Content-Encoding":     "aws-chunked",
+				"X-Amz-Content-Sha256": "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08",
 			},
 		})
 	})