Reject unsupported aws-chunked uploads

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

api/aws_chunked_test.go

@@ -1,10 +1,14 @@
 package api
 
 import (
+	"errors"
 	"io"
 	"net/http"
+	"net/http/httptest"
 	"strings"
 	"testing"
+
+	"fs/service"
 )
 
 func TestShouldDecodeAWSChunkedPayloadUnsignedTrailerMode(t *testing.T) {
@@ -20,6 +24,45 @@ func TestShouldDecodeAWSChunkedPayloadUnsignedTrailerMode(t *testing.T) {
 	}
 }
 
+func TestUnsupportedAWSChunkedContentEncodingWithoutStreamingMode(t *testing.T) {
+	t.Parallel()
+
+	req, err := http.NewRequest(http.MethodPut, "http://example.com/b/k", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Content-Encoding", "aws-chunked")
+	req.Header.Set("x-amz-content-sha256", "UNSIGNED-PAYLOAD")
+
+	if !hasUnsupportedAWSChunkedPayload(req) {
+		t.Fatalf("expected aws-chunked content encoding without streaming mode to be unsupported")
+	}
+	if shouldDecodeAWSChunkedPayload(req) {
+		t.Fatalf("non-streaming aws-chunked content encoding must not trigger decoding")
+	}
+}
+
+func TestPutObjectRejectsUnsignedAWSChunkedContentEncoding(t *testing.T) {
+	handler, svc := newUploadLimitHandler(t, 1024)
+	if err := svc.CreateBucket("test-bucket"); err != nil {
+		t.Fatalf("CreateBucket: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodPut, "/test-bucket/object.txt", strings.NewReader("4\r\nWiki\r\n0\r\n\r\n"))
+	req.Header.Set("Content-Encoding", "aws-chunked")
+	req.Header.Set("x-amz-content-sha256", "UNSIGNED-PAYLOAD")
+	rec := httptest.NewRecorder()
+
+	handler.router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want %d body=%s", rec.Code, http.StatusBadRequest, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "InvalidArgument") {
+		t.Fatalf("expected InvalidArgument response, body=%s", rec.Body.String())
+	}
+}
+
 func TestAWSChunkedReaderPassThroughForPlainPayload(t *testing.T) {
 	t.Parallel()
 
@@ -43,7 +86,6 @@ func TestAWSChunkedReaderDecodesChunkedPayload(t *testing.T) {
 		"4\r\nWiki\r\n" +
 		"5\r\npedia\r\n" +
 		"0\r\n" +
-		"\r\n" +
 		"x-amz-checksum-crc32:xxxx\r\n" +
 		"\r\n"
 
@@ -58,3 +100,16 @@ func TestAWSChunkedReaderDecodesChunkedPayload(t *testing.T) {
 		t.Fatalf("decoded payload mismatch: got %q want %q", string(out), "Wikipedia")
 	}
 }
+
+func TestAWSChunkedReaderRejectsOversizedChunkHeader(t *testing.T) {
+	t.Parallel()
+
+	encoded := strings.Repeat("f", maxAWSChunkedLineBytes+1) + "\n"
+	reader := newAWSChunkedDecodingReader(strings.NewReader(encoded))
+	defer reader.Close()
+
+	_, err := io.ReadAll(reader)
+	if !errors.Is(err, service.ErrEntityTooLarge) {
+		t.Fatalf("read error = %v, want ErrEntityTooLarge", err)
+	}
+}