fix(runtime): preserve SigV4 behind private Space auth

Author: BlueSkyXN

hfs/nginx.conf

@@ -122,6 +122,9 @@ http {
             proxy_http_version 1.1;
 
             proxy_set_header Host $proxy_host_header;
+            # The HF private-Space gateway consumes this header. Do not pass it
+            # to MinIO, where an unsigned X-* header invalidates SigV4.
+            proxy_set_header X-HF-Authorization "";
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $forwarded_proto;

scripts/smoke-s3-curl.sh

@@ -70,6 +70,11 @@ for required_curl_flag in '--aws-sigv4' '--fail-with-body'; do
   fi
 done
 
+hf_gateway_args=()
+if [[ -n "${HF_GATEWAY_TOKEN:-}" ]]; then
+  hf_gateway_args=(-H "X-HF-Authorization: Bearer ${HF_GATEWAY_TOKEN}")
+fi
+
 tmp_dir="$(mktemp -d)"
 payload_file="$tmp_dir/payload.txt"
 signed_download="$tmp_dir/signed-download.txt"
@@ -83,13 +88,15 @@ policy_applied=0
 
 signed_curl() {
   curl --silent --show-error --fail-with-body \
+    "${hf_gateway_args[@]}" \
     --aws-sigv4 "aws:amz:${REGION}:s3" \
     --user "${ACCESS_KEY}:${SECRET_KEY}" \
     "$@"
 }
 
 signed_status() {
   curl --silent --show-error \
+    "${hf_gateway_args[@]}" \
     --aws-sigv4 "aws:amz:${REGION}:s3" \
     --user "${ACCESS_KEY}:${SECRET_KEY}" \
     -o "$status_body" \
@@ -156,7 +163,7 @@ if ! cmp -s "$payload_file" "$signed_download"; then
 fi
 
 echo "==> anonymous read is denied before policy"
-private_status="$(curl --silent --show-error -o "$private_body" -w '%{http_code}' "$ENDPOINT/$BUCKET/$OBJECT" || true)"
+private_status="$(curl --silent --show-error "${hf_gateway_args[@]}" -o "$private_body" -w '%{http_code}' "$ENDPOINT/$BUCKET/$OBJECT" || true)"
 if [[ "$private_status" != "403" ]]; then
   echo "Expected anonymous read HTTP 403 before policy, got $private_status" >&2
   exit 1
@@ -167,7 +174,7 @@ signed_curl -X PUT -H 'Content-Type: application/json' --data-binary @"$policy_f
 policy_applied=1
 
 echo "==> anonymous read succeeds after policy"
-curl --silent --show-error --fail-with-body "$ENDPOINT/$BUCKET/$OBJECT" -o "$public_download"
+curl --silent --show-error --fail-with-body "${hf_gateway_args[@]}" "$ENDPOINT/$BUCKET/$OBJECT" -o "$public_download"
 if ! cmp -s "$payload_file" "$public_download"; then
   echo "Public download content does not match uploaded payload." >&2
   exit 1

scripts/validate-contract.sh

@@ -199,6 +199,7 @@ PY
 '
 
 check "S3 smoke script contract" require_pattern scripts/smoke-s3-curl.sh '--aws-sigv4' 'S3 smoke test must use curl SigV4 support'
+require_pattern scripts/smoke-s3-curl.sh 'X-HF-Authorization: Bearer' 'private candidate S3 smoke must support separate HF gateway auth'
 require_pattern scripts/smoke-s3-curl.sh 'Refusing to use bucket' 'S3 smoke test must refuse existing buckets'
 
 check "storage sampler script contract" test -f scripts/sample-hf-bucket-storage.sh
@@ -214,6 +215,7 @@ require_pattern hfs/nginx.conf 'location = /_admin' 'Nginx must normalize /_admi
 require_pattern hfs/nginx.conf 'proxy_pass http://127\.0\.0\.1:8082/;' 'Nginx must proxy admin service'
 require_pattern hfs/nginx.conf 'proxy_pass http://127\.0\.0\.1:9001/;' 'Console proxy_pass must strip /console/ prefix'
 require_pattern hfs/nginx.conf 'proxy_pass http://127\.0\.0\.1:9000;' 'S3 API must stay at the root path'
+require_pattern hfs/nginx.conf 'proxy_set_header X-HF-Authorization "";' 'S3 proxy must strip the private Space gateway header before SigV4 verification'
 require_pattern hfs/nginx.conf 'proxy_hide_header X-Frame-Options;' 'Console proxy must hide upstream X-Frame-Options'
 
 check "ops/admin service contract" require_pattern hfs/ops_service.py 'SECRET_KEYS' 'ops service must summarize secret presence only'