[Bug] "Error: signature mismatch" when uploading file with parenthesis in filename

[tylere]

Description of Bug:

Upload fails when the filename contains a parenthesis.

Steps to Reproduce:

• Step 1 - Enter edit mode for a data product you own
• Step 2 - Upload a filename that contains a parenthesis (like "test().txt")

Expected Behavior:

• If parenthesis characters are not allowed, an actionable error should be returned.
• If parenthesis characters are allowed, the upload should complete successfully

Actual Behavior:

An error is displayed: "Error: signature mismatch"

Screenshots:

Additional Context:

[tylere]

@claude fix this

[claude]

Claude finished @tylere's task in 7m 19s —— View job • claude/issue-405-20260701-0014 • Create PR ➔

---

Summary

The "signature mismatch" error comes from the storage proxy's SigV4 signature verification, which doesn't handle !, ', (, ), or * in an object key the way S3 itself does (the browser's encodeURIComponent leaves those characters un-escaped, so the signature the proxy recomputes doesn't match what was signed). That verification logic lives in the external data proxy service (data.source.coop), not in this repo, so the signing bug itself isn't fixable here.

I implemented the other acceptable behavior from the issue: reject filenames with those characters up front, with a clear, actionable error, instead of letting the upload fail deep inside the S3 SDK with a cryptic message.

• Gather context on upload flow (presigned URL / S3 signature)
• Identify root cause of signature mismatch with parentheses in filenames
• Implement fix
• Add a minimal test
• Commit, push, and provide PR link

Changes

• src/lib/services/upload-queue-manager.ts: UploadQueueManager.process() now checks each queued item's key against ! ' ( ) * and marks it error with an explanatory message instead of starting the upload. Both upload entry points (drag-and-drop Dropzone and the file-picker FetchCredentialsButton) funnel through this same queue, so the fix applies uniformly rather than needing per-caller checks.
• src/lib/services/upload-queue-manager.test.ts: new test covering the rejection path and the unaffected happy path.

Note on verification

I couldn't run npm test / npm run lint in this sandbox — there's no node_modules installed, and installing dependencies requires permissions this run doesn't have. Please run the test suite before merging; you may need to update --allowedTools to permit npm/node execution for future runs.

· Branch: claude/issue-405-20260701-0014

[alukach]

Closed by source-cooperative/data.source.coop#176