fix(sigv4): use encoded request path for inbound signature verification

src/lib.rs

@@ -278,14 +278,26 @@ async fn fetch(req: web_sys::Request, env: Env, ctx: Context) -> Result<web_sys:
         tracing::info_span!("request", %request_id, method = %parts.method, path = %parts.path);
     let _guard = span.enter();
 
+    // SigV4's canonical URI is the percent-encoded path the client signed over.
+    // `RequestParts` decodes the path for bucket/key routing, so recover the raw
+    // encoded path from the request URL for signature verification — otherwise a
+    // key with an escaped character (e.g. a space → `%20`) fails with
+    // SignatureDoesNotMatch. `Uri::path()` returns the path un-decoded; fall back
+    // to the decoded signing path if the URL somehow won't parse.
+    let signing_path = req
+        .url()
+        .parse::<http::Uri>()
+        .map(|u| u.path().to_string())
+        .unwrap_or_else(|_| rewrite.signing_path.clone());
+
     let request_info = RequestInfo::new(
         &parts.method,
         &rewrite.path,
         rewrite.query.as_deref(),
         &parts.headers,
         None,
     )
-    .with_signing_path(&rewrite.signing_path)
+    .with_signing_path(&signing_path)
     .with_signing_query(rewrite.signing_query.as_deref());
 
     let start_ms = js_sys::Date::now();

tests/routing.rs

@@ -135,3 +135,17 @@ fn url_encoded_prefix() {
         Some("list-type=2&prefix=admin%20boundaries/subdir/".to_string())
     );
 }
+
+// ── Signing-path encoding (http::Uri) ───────────────────────────────
+// The proxy recovers the raw, percent-encoded request path from the URL for
+// SigV4 signature verification: `RequestParts` decodes the path for routing,
+// but the client signs the *encoded* path, so a decoded key with a space breaks
+// the signature (SignatureDoesNotMatch). This pins the `http` crate behavior the
+// fix relies on — `Uri::path()` must return the path WITHOUT decoding `%20`.
+#[test]
+fn uri_path_preserves_percent_encoding() {
+    let uri: http::Uri = "https://data.staging.source.coop/acct/prod/foo%20bar?x-id=PutObject"
+        .parse()
+        .unwrap();
+    assert_eq!(uri.path(), "/acct/prod/foo%20bar");
+}