fix: authenticate cached multipart completion replays

[perfloop]

Multipart-completion replays are now bound to the access key that completed the upload. Transparent mode rechecks that caller's bucket grant after the completion-cache read, so a revocation completed while the read is pending cannot authorize the cached response.

TAG stores the access key with each fully captured successful completion. Signing mode validates the replay's SigV4 signature; transparent mode binds the identity learned from a successful upstream response or a validated request-start snapshot, then checks the current grant. The exported cache helpers cache.GetCompletion and cache.PutCompletion now carry that caller identity. The exact bucket, object key, and upload ID still define the tuple, and delimiter-containing components are encoded to avoid collisions. The five-second TTL is unchanged, and no S3 route or configuration option was added.

TestCompleteMultipartUploadReplayAuthorization covers transparent and signing modes, same-principal and presigned retries, unbound entries, anonymous or invalid callers, different principals and buckets, delimiter aliases, and misses. Its revocation case blocks the completion-cache read while a concurrent request receives upstream 403 and revokes the grant; after release, the replay follows the normal upstream denial path. The expiry case waits for upstream entry and releases after the signature-age cutoff instead of using fixed sleeps. A fast cold-auth identity-learning case remains. The upstream is controlled; these tests do not establish live Tigris behavior or a deployment exploit.

The README and S3 compatibility guide document the replay rule. The multipart operation table stays concise; its duplicate note was removed. The single-node integration-cache fixture binds memberlist to loopback as test setup.

The assertion was violated on comparison revision 36d0c890b3efa8c19beeb1d56154a7a4f42d813a and satisfied on the final source. The recorded check was invoked with go run ./.perfloop_claim/completion_replay_claim.go.

Recorded proof ran with retained support that is not included in this pull request.

The recorded repository checks passed: make test, make lint-ci, make test-race, make test-coverage, make test-integration, and make lint.

Target CI also runs:

• S3 Compatibility Tests / s3-compat-tests (default, tiered)
• S3 Compatibility Tests (Cluster) / s3-compat-tests-cluster (default)
• Lint PR Title / lint

---

Generated by Perfloop. Measurements and checks. Reproduce this comparison (tenant access required).

[greptile-apps]

Confidence Score: 5/5

[Critical risk] Adds authentication validation to cached multipart completion replays.

The PR appears safe to merge based on the changes since the previous review.

Summary

The PR binds cached multipart-completion responses to the completing access key and checks authorization before replay.

• The latest changes recheck transparent-mode bucket authorization after the cache read.
• Integration coverage now synchronizes a revocation during that read and waits for signature expiry without fixed sleeps.
• The redundant multipart table note was removed.

_{Reviews (2) · Last reviewed commit: "fix: recheck multipart completion grants..."}