[misc] Add upload URL signing and rate limiting (#7502)

upload-server/server/local.go

@@ -8,9 +8,12 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"time"
 
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/management/server/http/middleware"
+
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
@@ -20,11 +23,12 @@ const (
 )
 
 type local struct {
-	url string
-	dir string
+	url    string
+	dir    string
+	signer *signer
 }
 
-func configureLocalHandlers(mux *http.ServeMux) error {
+func configureLocalHandlers(mux *http.ServeMux, limiter *middleware.APIRateLimiter) error {
 	envURL, ok := os.LookupEnv("SERVER_URL")
 	if !ok {
 		return fmt.Errorf("SERVER_URL environment variable is required")
@@ -44,11 +48,17 @@ func configureLocalHandlers(mux *http.ServeMux) error {
 		dir = envDir
 	}
 
-	l := &local{
-		url: envURL,
-		dir: dir,
+	uploadSigner, err := newSigner()
+	if err != nil {
+		return err
 	}
-	mux.HandleFunc(types.GetURLPath, l.handlerGetUploadURL)
+
+	l := &local{
+		url:    envURL,
+		dir:    dir,
+		signer: uploadSigner,
+	}
+	mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(l.handlerGetUploadURL)))
 	mux.HandleFunc(putURLPath+putHandler, l.handlePutRequest)
 
 	return nil
@@ -80,10 +90,11 @@ func (l *local) getUploadURL(objectKey string) (string, error) {
 		return "", fmt.Errorf("failed to parse upload URL: %w", err)
 	}
 	newURL := parsedUploadURL.JoinPath(parsedUploadURL.Path, putURLPath, objectKey)
+	newURL.RawQuery = l.signer.sign(objectKey, time.Now()).Encode()
 	return newURL.String(), nil
 }
 
-const maxUploadSize = 150 << 20
+const maxUploadSize = 50 << 20
 
 func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPut {
@@ -91,13 +102,6 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize)
-	body, err := io.ReadAll(r.Body)
-	if err != nil {
-		http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge)
-		return
-	}
-
 	uploadDir := r.PathValue("dir")
 	if uploadDir == "" {
 		http.Error(w, "missing dir path", http.StatusBadRequest)
@@ -109,6 +113,19 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err := l.signer.verify(uploadDir+"/"+uploadFile, r.URL.Query(), time.Now()); err != nil {
+		http.Error(w, "unauthorized", http.StatusUnauthorized)
+		log.Warnf("Rejected upload of %s/%s: %v", uploadDir, uploadFile, err)
+		return
+	}
+
+	r.Body = http.MaxBytesReader(w, r.Body, maxUploadSize)
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		http.Error(w, "request body too large or failed to read", http.StatusRequestEntityTooLarge)
+		return
+	}
+
 	cleanBase := filepath.Clean(l.dir) + string(filepath.Separator)
 
 	dirPath := filepath.Clean(filepath.Join(l.dir, uploadDir))
@@ -125,14 +142,14 @@ func (l *local) handlePutRequest(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = os.MkdirAll(dirPath, 0750); err != nil {
+	if err = os.MkdirAll(dirPath, 0o750); err != nil {
 		http.Error(w, "failed to create upload dir", http.StatusInternalServerError)
 		log.Errorf("Failed to create upload dir: %v", err)
 		return
 	}
 
 	flags := os.O_WRONLY | os.O_CREATE | os.O_EXCL
-	f, err := os.OpenFile(filePath, flags, 0600)
+	f, err := os.OpenFile(filePath, flags, 0o600)
 	if err != nil {
 		if os.IsExist(err) {
 			http.Error(w, "file already exists", http.StatusConflict)

upload-server/server/local_test.go

@@ -8,19 +8,28 @@ import (
 	"os"
 	"path/filepath"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/require"
 
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
+const testSigningKey = "test-signing-key-with-enough-length"
+
+func signedQuery(t *testing.T, objectKey string) string {
+	t.Helper()
+	s := &signer{key: []byte(testSigningKey)}
+	return s.sign(objectKey, time.Now()).Encode()
+}
+
 func Test_LocalHandlerGetUploadURL(t *testing.T) {
 	mockURL := "http://localhost:8080"
 	t.Setenv("SERVER_URL", mockURL)
 	t.Setenv("STORE_DIR", t.TempDir())
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
@@ -37,7 +46,6 @@ func Test_LocalHandlerGetUploadURL(t *testing.T) {
 	require.Contains(t, response.URL, "test-file/")
 	require.NotEmpty(t, response.Key)
 	require.Contains(t, response.Key, "test-file/")
-
 }
 
 func Test_LocalHandlePutRequest(t *testing.T) {
@@ -45,13 +53,15 @@ func Test_LocalHandlePutRequest(t *testing.T) {
 	mockURL := "http://localhost:8080"
 	t.Setenv("SERVER_URL", mockURL)
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	fileContent := []byte("test file content")
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/test.txt", bytes.NewReader(fileContent))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/uploads/test.txt?"+signedQuery(t, "uploads/test.txt"), bytes.NewReader(fileContent))
 
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
@@ -69,13 +79,16 @@ func Test_LocalHandlePutRequest_PathTraversal(t *testing.T) {
 	mockURL := "http://localhost:8080"
 	t.Setenv("SERVER_URL", mockURL)
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	fileContent := []byte("malicious content")
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd", bytes.NewReader(fileContent))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd?"+signedQuery(t, "uploads/../../etc/passwd"),
+		bytes.NewReader(fileContent))
 
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
@@ -90,11 +103,13 @@ func Test_LocalHandlePutRequest_DirTraversal(t *testing.T) {
 	mockDir := t.TempDir()
 	t.Setenv("SERVER_URL", "http://localhost:8080")
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
-	l := &local{url: "http://localhost:8080", dir: mockDir}
+	l := &local{url: "http://localhost:8080", dir: mockDir, signer: &signer{key: []byte(testSigningKey)}}
 
 	body := bytes.NewReader([]byte("bad"))
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/x/evil.txt", body)
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/x/evil.txt?"+signedQuery(t, "../../../tmp/evil.txt"), body)
 	req.SetPathValue("dir", "../../../tmp")
 	req.SetPathValue("file", "evil.txt")
 
@@ -111,17 +126,20 @@ func Test_LocalHandlePutRequest_DuplicateFile(t *testing.T) {
 	mockDir := t.TempDir()
 	t.Setenv("SERVER_URL", "http://localhost:8080")
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("first")))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("first")))
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
 	require.Equal(t, http.StatusOK, rec.Code)
 
-	req = httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("second")))
+	req = httptest.NewRequest(http.MethodPut,
+		putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("second")))
 	rec = httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
 	require.Equal(t, http.StatusConflict, rec.Code)
@@ -135,13 +153,15 @@ func Test_LocalHandlePutRequest_BodyTooLarge(t *testing.T) {
 	mockDir := t.TempDir()
 	t.Setenv("SERVER_URL", "http://localhost:8080")
 	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
 
 	mux := http.NewServeMux()
-	err := configureLocalHandlers(mux)
+	err := configureLocalHandlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	largeBody := make([]byte, maxUploadSize+1)
-	req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/big.txt", bytes.NewReader(largeBody))
+	req := httptest.NewRequest(http.MethodPut,
+		putURLPath+"/dir/big.txt?"+signedQuery(t, "dir/big.txt"), bytes.NewReader(largeBody))
 	rec := httptest.NewRecorder()
 	mux.ServeHTTP(rec, req)
 

upload-server/server/ratelimit.go

@@ -0,0 +1,31 @@
+package server
+
+import (
+	"os"
+
+	log "github.com/sirupsen/logrus"
+
+	"github.com/netbirdio/netbird/management/server/http/middleware"
+)
+
+const defaultUploadBurst = 100
+
+func newRateLimiter() *middleware.APIRateLimiter {
+	cfg, enabled := middleware.RateLimiterConfigFromEnv()
+	if os.Getenv(middleware.RateLimitingBurstEnv) == "" {
+		cfg.Burst = defaultUploadBurst
+	}
+
+	// Rate limiting is enabled by default unless explicitly disabled
+	if os.Getenv(middleware.RateLimitingEnabledEnv) == "" {
+		enabled = true
+	}
+
+	limiter := middleware.NewAPIRateLimiter(cfg)
+	limiter.SetEnabled(enabled)
+
+	log.Infof("Upload URL rate limiting: enabled=%t rate=%.0f/min burst=%d trusted_proxies=%q",
+		limiter.Enabled(), cfg.RequestsPerMinute, cfg.Burst, os.Getenv(middleware.RateLimitingTrustedProxiesEnv))
+
+	return limiter
+}

upload-server/server/ratelimit_test.go

@@ -0,0 +1,60 @@
+package server
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/management/server/http/middleware"
+	"github.com/netbirdio/netbird/upload-server/types"
+)
+
+func newTestRateLimiter(t *testing.T) *middleware.APIRateLimiter {
+	t.Helper()
+
+	limiter := newRateLimiter()
+	t.Cleanup(limiter.Stop)
+
+	return limiter
+}
+
+func getUploadURL(t *testing.T, mux *http.ServeMux) int {
+	t.Helper()
+
+	req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
+	req.Header.Set(types.ClientHeader, types.ClientHeaderValue)
+	rec := httptest.NewRecorder()
+	mux.ServeHTTP(rec, req)
+
+	return rec.Code
+}
+
+func Test_GetUploadURLIsRateLimited(t *testing.T) {
+	t.Setenv(middleware.RateLimitingBurstEnv, "2")
+	t.Setenv(middleware.RateLimitingRPMEnv, "1")
+	mux, _ := newLocalMux(t)
+
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux))
+}
+
+func Test_RateLimitingIsOnByDefault(t *testing.T) {
+	t.Setenv(middleware.RateLimitingEnabledEnv, "")
+	t.Setenv(middleware.RateLimitingBurstEnv, "1")
+	mux, _ := newLocalMux(t)
+
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusTooManyRequests, getUploadURL(t, mux))
+}
+
+func Test_RateLimitingCanBeDisabled(t *testing.T) {
+	t.Setenv(middleware.RateLimitingEnabledEnv, "false")
+	t.Setenv(middleware.RateLimitingBurstEnv, "1")
+	mux, _ := newLocalMux(t)
+
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+	require.Equal(t, http.StatusOK, getUploadURL(t, mux))
+}

upload-server/server/s3.go

@@ -12,6 +12,8 @@ import (
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/management/server/http/middleware"
+
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
@@ -21,7 +23,7 @@ type sThree struct {
 	presignClient *s3.PresignClient
 }
 
-func configureS3Handlers(mux *http.ServeMux) error {
+func configureS3Handlers(mux *http.ServeMux, limiter *middleware.APIRateLimiter) error {
 	bucket := os.Getenv(bucketVar)
 	region, ok := os.LookupEnv("AWS_REGION")
 	if !ok {
@@ -40,7 +42,7 @@ func configureS3Handlers(mux *http.ServeMux) error {
 		bucket:        bucket,
 		presignClient: s3.NewPresignClient(client),
 	}
-	mux.HandleFunc(types.GetURLPath, handler.handlerGetUploadURL)
+	mux.Handle(types.GetURLPath, limiter.Middleware(http.HandlerFunc(handler.handlerGetUploadURL)))
 	return nil
 }
 

upload-server/server/s3_test.go

@@ -90,7 +90,7 @@ func Test_S3HandlerGetUploadURL(t *testing.T) {
 	t.Setenv(bucketVar, bucketName)
 
 	mux := http.NewServeMux()
-	err = configureS3Handlers(mux)
+	err = configureS3Handlers(mux, newTestRateLimiter(t))
 	require.NoError(t, err)
 
 	req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)

upload-server/server/server.go

@@ -10,6 +10,7 @@ import (
 	"github.com/google/uuid"
 	log "github.com/sirupsen/logrus"
 
+	"github.com/netbirdio/netbird/management/server/http/middleware"
 	"github.com/netbirdio/netbird/upload-server/types"
 )
 
@@ -19,7 +20,8 @@ const (
 )
 
 type Server struct {
-	srv *http.Server
+	srv     *http.Server
+	limiter *middleware.APIRateLimiter
 }
 
 func NewServer() *Server {
@@ -29,7 +31,7 @@ func NewServer() *Server {
 		address = "0.0.0.0:8080"
 	}
 	mux := http.NewServeMux()
-	err := configureMux(mux)
+	limiter, err := configureMux(mux)
 	if err != nil {
 		log.Fatalf("Failed to configure server: %v", err)
 	}
@@ -38,7 +40,8 @@ func NewServer() *Server {
 	})
 
 	return &Server{
-		srv: &http.Server{Addr: address, Handler: mux},
+		srv:     &http.Server{Addr: address, Handler: mux},
+		limiter: limiter,
 	}
 }
 
@@ -48,6 +51,9 @@ func (s *Server) Start() error {
 }
 
 func (s *Server) Stop() error {
+	if s.limiter != nil {
+		s.limiter.Stop()
+	}
 	if s.srv != nil {
 		log.Infof("Stopping upload server on %s", s.srv.Addr)
 		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
@@ -57,13 +63,14 @@ func (s *Server) Stop() error {
 	return nil
 }
 
-func configureMux(mux *http.ServeMux) error {
+func configureMux(mux *http.ServeMux) (*middleware.APIRateLimiter, error) {
+	limiter := newRateLimiter()
+
 	_, ok := os.LookupEnv(bucketVar)
 	if ok {
-		return configureS3Handlers(mux)
-	} else {
-		return configureLocalHandlers(mux)
+		return limiter, configureS3Handlers(mux, limiter)
 	}
+	return limiter, configureLocalHandlers(mux, limiter)
 }
 
 func getObjectKey(w http.ResponseWriter, r *http.Request) string {

upload-server/server/signing.go

@@ -0,0 +1,90 @@
+package server
+
+import (
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net/url"
+	"os"
+	"strconv"
+	"time"
+
+	log "github.com/sirupsen/logrus"
+)
+
+const (
+	signingKeyVar = "NB_UPLOAD_SIGNING_KEY"
+
+	// signatureTTL matches the expiry the S3 backend puts on its presigned URLs.
+	signatureTTL = 15 * time.Minute
+
+	expiryParam    = "exp"
+	signatureParam = "sig"
+
+	minSigningKeyLen = 32
+)
+
+type signer struct {
+	key []byte
+}
+
+func newSigner() (*signer, error) {
+	if env, ok := os.LookupEnv(signingKeyVar); ok {
+		if env == "" {
+			return nil, fmt.Errorf("%s is set but empty", signingKeyVar)
+		}
+		if len(env) < minSigningKeyLen {
+			return nil, fmt.Errorf("%s must be at least %d bytes", signingKeyVar, minSigningKeyLen)
+		}
+		return &signer{key: []byte(env)}, nil
+	}
+
+	key := make([]byte, 32)
+	if _, err := rand.Read(key); err != nil {
+		return nil, fmt.Errorf("generate signing key: %w", err)
+	}
+	log.Infof("%s not set, generated an ephemeral upload signing key", signingKeyVar)
+
+	return &signer{key: key}, nil
+}
+
+// sign returns the query parameters that authorize an upload of objectKey.
+func (s *signer) sign(objectKey string, now time.Time) url.Values {
+	exp := now.Add(signatureTTL).Unix()
+
+	v := url.Values{}
+	v.Set(expiryParam, strconv.FormatInt(exp, 10))
+	v.Set(signatureParam, hex.EncodeToString(s.signature(objectKey, exp)))
+
+	return v
+}
+
+// verify reports whether query carries a still-valid signature over objectKey.
+func (s *signer) verify(objectKey string, query url.Values, now time.Time) error {
+	exp, err := strconv.ParseInt(query.Get(expiryParam), 10, 64)
+	if err != nil {
+		return fmt.Errorf("malformed %s parameter", expiryParam)
+	}
+
+	got, err := hex.DecodeString(query.Get(signatureParam))
+	if err != nil {
+		return fmt.Errorf("malformed %s parameter", signatureParam)
+	}
+
+	if !hmac.Equal(got, s.signature(objectKey, exp)) {
+		return fmt.Errorf("signature mismatch")
+	}
+	if now.Unix() >= exp {
+		return fmt.Errorf("upload URL expired")
+	}
+
+	return nil
+}
+
+func (s *signer) signature(objectKey string, exp int64) []byte {
+	mac := hmac.New(sha256.New, s.key)
+	fmt.Fprintf(mac, "%s\n%d", objectKey, exp)
+	return mac.Sum(nil)
+}

upload-server/server/signing_test.go

@@ -0,0 +1,148 @@
+package server
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/netbirdio/netbird/upload-server/types"
+)
+
+func newLocalMux(t *testing.T) (*http.ServeMux, string) {
+	t.Helper()
+
+	mockDir := t.TempDir()
+	t.Setenv("SERVER_URL", "http://localhost:8080")
+	t.Setenv("STORE_DIR", mockDir)
+	t.Setenv(signingKeyVar, testSigningKey)
+
+	mux := http.NewServeMux()
+	require.NoError(t, configureLocalHandlers(mux, newTestRateLimiter(t)))
+
+	return mux, mockDir
+}
+
+func Test_LocalUploadURLRoundTrip(t *testing.T) {
+	mux, mockDir := newLocalMux(t)
+
+	getReq := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
+	getReq.Header.Set(types.ClientHeader, types.ClientHeaderValue)
+	getRec := httptest.NewRecorder()
+	mux.ServeHTTP(getRec, getReq)
+	require.Equal(t, http.StatusOK, getRec.Code)
+
+	var response types.GetURLResponse
+	require.NoError(t, json.Unmarshal(getRec.Body.Bytes(), &response))
+
+	minted, err := url.Parse(response.URL)
+	require.NoError(t, err)
+	require.NotEmpty(t, minted.Query().Get(signatureParam))
+
+	content := []byte("bundle")
+	putRec := httptest.NewRecorder()
+	mux.ServeHTTP(putRec, httptest.NewRequest(http.MethodPut, minted.RequestURI(), bytes.NewReader(content)))
+	require.Equal(t, http.StatusOK, putRec.Code)
+
+	written, err := os.ReadFile(filepath.Join(mockDir, response.Key))
+	require.NoError(t, err)
+	require.Equal(t, content, written)
+}
+
+func Test_LocalHandlePutRequest_RejectsUnauthorized(t *testing.T) {
+	expired := &signer{key: []byte(testSigningKey)}
+
+	tests := []struct {
+		name  string
+		query string
+	}{
+		{
+			name:  "no signature",
+			query: "",
+		},
+		{
+			name:  "tampered signature",
+			query: "exp=99999999999&sig=deadbeef",
+		},
+		{
+			name:  "malformed signature",
+			query: "exp=99999999999&sig=not-hex",
+		},
+		{
+			// A signature is only good for the key it was minted for, so a URL
+			// handed out for one bundle cannot be replayed against another.
+			name:  "signature for a different object",
+			query: signedQuery(t, "dir/other.txt"),
+		},
+		{
+			name:  "signature expiring this second",
+			query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL)).Encode(),
+		},
+		{
+			name:  "expired signature",
+			query: expired.sign("dir/file.txt", time.Now().Add(-signatureTTL-time.Minute)).Encode(),
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			mux, mockDir := newLocalMux(t)
+
+			target := putURLPath + "/dir/file.txt"
+			if tc.query != "" {
+				target += "?" + tc.query
+			}
+
+			rec := httptest.NewRecorder()
+			mux.ServeHTTP(rec, httptest.NewRequest(http.MethodPut, target, bytes.NewReader([]byte("payload"))))
+
+			require.Equal(t, http.StatusUnauthorized, rec.Code)
+
+			_, err := os.Stat(filepath.Join(mockDir, "dir", "file.txt"))
+			require.True(t, os.IsNotExist(err), "unauthorized upload should not be written")
+		})
+	}
+}
+
+func Test_SignerRejectsForeignKey(t *testing.T) {
+	minted := (&signer{key: []byte("one key")}).sign("dir/file.txt", time.Now())
+
+	err := (&signer{key: []byte("another key")}).verify("dir/file.txt", minted, time.Now())
+	require.Error(t, err)
+}
+
+func Test_NewSignerGeneratesEphemeralKey(t *testing.T) {
+	// Registers the restore hook, then clears the value for this test only.
+	t.Setenv(signingKeyVar, "")
+	os.Unsetenv(signingKeyVar)
+
+	first, err := newSigner()
+	require.NoError(t, err)
+	second, err := newSigner()
+	require.NoError(t, err)
+
+	require.NotEqual(t, first.key, second.key)
+	require.Len(t, first.key, 32)
+}
+
+func Test_NewSignerRejectsEmptyKey(t *testing.T) {
+	t.Setenv(signingKeyVar, "")
+
+	_, err := newSigner()
+	require.Error(t, err)
+}
+
+func Test_NewSignerRejectsShortKey(t *testing.T) {
+	t.Setenv(signingKeyVar, strings.Repeat("a", minSigningKeyLen-1))
+
+	_, err := newSigner()
+	require.Error(t, err)
+}