test(objectstore): verify S3 encryption headers on the wire and probe provider support

Add an offline test that drives S3 against an AWS SDK MockHandler and
asserts the server-side encryption headers each request actually sends,
for every sse mode. The SDK only serializes members an operation
defines, so this checks serialized requests rather than parameter arrays.

Add a capability probe for the live tests. It checks whether the
provider accepts and echoes each ServerSideEncryption value, so
providers without SSE-S3, SSE-KMS or DSSE-KMS (e.g. MinIO, Ceph) skip
with the provider's error instead of failing.

Tighten existing assertions to exact warning counts and exception
messages, add coverage for the new sensitive config keys and for edge
cases in sse parsing, remove duplicate tests, and make S3SSEKMSTest
resolve legacy key precedence the same way production does.

Assisted-by: ClaudeCode:claude-opus-5-5
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Stephen Cuppett <steve@cuppett.com>

Author: cuppett

apps/settings/tests/SetupChecks/S3SseCEncryptionTest.php

@@ -43,7 +43,6 @@ public static function dataRun(): array {
 			'non-S3 objectstore class' => [['class' => 'OC\\Files\\ObjectStore\\Swift', 'arguments' => ['sse_c_key' => 'x']], null, SetupResult::SUCCESS],
 			'S3 with no sse* arguments' => [$s3([]), null, SetupResult::SUCCESS],
 			'S3 with sse-kms' => [$s3(['sse' => 'sse-kms']), null, SetupResult::SUCCESS],
-			'S3 with sse-kms-dsse' => [$s3(['sse' => 'sse-kms-dsse']), null, SetupResult::SUCCESS],
 			'S3 with legacy sse_c_key only' => [$s3(['sse_c_key' => 'x']), null, SetupResult::WARNING],
 			'S3 with explicit sse => sse-c' => [$s3(['sse' => 'sse-c', 'sse_c_key' => 'x']), null, SetupResult::WARNING],
 			'S3 with both legacy keys set (sse_c_key wins by precedence)' => [$s3(['sse_c_key' => 'x', 'sse_kms_enabled' => true]), null, SetupResult::WARNING],
@@ -61,7 +60,9 @@ public static function dataRun(): array {
 
 	#[\PHPUnit\Framework\Attributes\DataProvider('dataRun')]
 	public function testRun(?array $objectStore, ?array $objectStoreMultibucket, string $expected): void {
-		$this->urlGenerator->method('linkToDocs')->willReturn('admin-s3-sse-c');
+		$this->urlGenerator->method('linkToDocs')
+			->with('admin-s3-sse-c')
+			->willReturn('https://docs.example.com/admin-s3-sse-c');
 
 		$this->config->method('getSystemValue')
 			->willReturnCallback(function (string $key, $default = null) use ($objectStore, $objectStoreMultibucket) {
@@ -76,5 +77,11 @@ public function testRun(?array $objectStore, ?array $objectStoreMultibucket, str
 
 		$result = $check->run();
 		$this->assertEquals($expected, $result->getSeverity());
+		if ($expected === SetupResult::WARNING) {
+			$this->assertSame('https://docs.example.com/admin-s3-sse-c', $result->getLinkToDoc());
+			$this->assertStringContainsString('Migrate to SSE-KMS', $result->getDescription());
+		} else {
+			$this->assertNull($result->getLinkToDoc());
+		}
 	}
 }

tests/lib/Files/ObjectStore/S3EncryptionCapabilityTrait.php

@@ -0,0 +1,79 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace Test\Files\ObjectStore;
+
+use Aws\S3\Exception\S3Exception;
+use OC\Files\ObjectStore\S3;
+
+/**
+ * Detects which `ServerSideEncryption` values the configured S3 provider actually supports,
+ * so live tests skip on providers without them (e.g. MinIO without KES, or anything other
+ * than AWS for DSSE-KMS) instead of failing.
+ *
+ * Support is probed with a real PutObject + HeadObject rather than inferred from the
+ * endpoint: the value counts as supported only if the provider accepts it and echoes it
+ * back. Results are cached per test class.
+ */
+trait S3EncryptionCapabilityTrait {
+	/** @var array<string, ?string> ServerSideEncryption value => null if supported, otherwise the reason it is not */
+	private static array $encryptionSupport = [];
+
+	/**
+	 * @param S3 $s3 instance for the bucket under test; its own `sse*` configuration is not used
+	 * @param string $serverSideEncryption 'AES256', 'aws:kms' or 'aws:kms:dsse'
+	 * @param ?string $kmsKeyId KMS key for the 'aws:kms*' values, or null for the bucket default
+	 * @return ?string null if supported, otherwise why not
+	 */
+	protected static function getEncryptionUnsupportedReason(S3 $s3, string $serverSideEncryption, ?string $kmsKeyId = null): ?string {
+		if (array_key_exists($serverSideEncryption, self::$encryptionSupport)) {
+			return self::$encryptionSupport[$serverSideEncryption];
+		}
+
+		$connection = $s3->getConnection();
+		$urn = 'sse-capability-probe-' . bin2hex(random_bytes(8));
+		$params = ['Bucket' => $s3->getBucket(), 'Key' => $urn, 'Body' => 'probe', 'ServerSideEncryption' => $serverSideEncryption];
+		if ($kmsKeyId !== null && str_starts_with($serverSideEncryption, 'aws:kms')) {
+			$params['SSEKMSKeyId'] = $kmsKeyId;
+		}
+
+		try {
+			$connection->putObject($params);
+			$echoed = $connection->headObject(['Bucket' => $s3->getBucket(), 'Key' => $urn])->get('ServerSideEncryption');
+			$reason = $echoed === $serverSideEncryption
+				? null
+				: "the provider accepted ServerSideEncryption '$serverSideEncryption' but reports '" . ($echoed ?? 'none') . "'";
+		} catch (S3Exception $e) {
+			// 501 is how MinIO reports SSE without a configured KMS; any other 5xx is an outage
+			$status = (int)$e->getStatusCode();
+			if ($status >= 500 && $status !== 501) {
+				throw $e;
+			}
+			$reason = "the provider rejected ServerSideEncryption '$serverSideEncryption' (HTTP $status " . $e->getAwsErrorCode() . ': ' . $e->getAwsErrorMessage() . ')';
+		} finally {
+			try {
+				$connection->deleteObject(['Bucket' => $s3->getBucket(), 'Key' => $urn]);
+			} catch (S3Exception) {
+				// never written
+			}
+		}
+
+		return self::$encryptionSupport[$serverSideEncryption] = $reason;
+	}
+
+	/**
+	 * Skip the current test unless the provider supports $serverSideEncryption.
+	 */
+	protected static function requireEncryptionSupport(S3 $s3, string $serverSideEncryption, ?string $kmsKeyId = null): void {
+		$reason = self::getEncryptionUnsupportedReason($s3, $serverSideEncryption, $kmsKeyId);
+		if ($reason !== null) {
+			self::markTestSkipped("S3 provider does not support '$serverSideEncryption': $reason");
+		}
+	}
+}