fix(security): B17-P0 wrap /storage/:token/presign with middleware + audit

[mastermanas805]

B17-P0 — /storage/:token/presign had zero middleware

A leaked storage token UUID was a fully-cleartext bearer for read/write on the prefix. No per-token rate limit, no audit trail, no cross-team session guard, no operation allow-list, silent path-traversal stripping that masked exploit probes.

Changes

New per-token sliding-window rate limit

internal/middleware/presign_token_rate_limit.go — Redis ZSET, 10/min/token. Complements the existing global per-IP RateLimit so a leaked token distributed across a botnet of distinct IPs throttles on THIS counter. Fail-open on Redis errors (CLAUDE.md convention 1) with FailOpenEvents metric.

Hardened presign handler (internal/handlers/storage_presign.go)

• Operation allow-list: GET / PUT / HEAD only. DELETE, POST, PATCH, and unknown verbs reject 400 invalid_operation. HEAD is signed as a presigned GET (S3 V4 signatures cover both verbs on the same key).
• Path-traversal HARD-REJECT (was: silent strip). Any .., ., leading-slash, or empty segment returns 400 path_unsafe so probes surface in NR logs.
• Session/team cross-check. When OptionalAuth populated a session JWT, its team_id MUST match the resource's team_id — blocks the 'leaked token + legit but different-team session' impersonation path.
• Audit-log emit on every successful presign via safego.Go. Kind: storage.presign_minted. Metadata: masked token, op, masked path, team_id, expires_at.
• TTL cap WARN-logged when caller requests >1h.

Route wiring

internal/router/router.go + internal/testhelpers/testhelpers.go now wire:

OptionalAuth -> PresignTokenRateLimit -> Idempotency("storage.presign") -> PresignStorage

Testhelpers mirrors production so handler tests see the same chain.

Tests

Registry-style coverage per CLAUDE.md rule 18 — TestPresign_RegistryHasMiddleware walks router.go source text and asserts the literal wiring shape. Fails red if a future agent strips the middleware.

Test	Asserts
TestPresign_RegistryHasMiddleware	router.go wires OptionalAuth + PresignTokenRateLimit + Idempotency + handler
TestPresign_TestHelpersMirrorMiddleware	testhelpers mirrors production wiring
TestPresign_OperationAllowlist_TableDriven	GET/PUT/HEAD pass; DELETE/POST/PATCH/empty/unknown -> 400
TestPresign_PathTraversal_Rejected	../, ./, leading slash, empty segments -> 400 path_unsafe
TestPresign_CrossTeamSession_Rejected	team-B JWT against team-A resource -> 403 cross_team_session
TestPresign_PerTokenRateLimit_Fires	11th request -> 429
TestPresign_RateLimit_RetryAfterHeader	429 carries Retry-After + retry_after_seconds
TestPresign_TTLCap_Bounded	24h request capped at 1h
TestPresign_HandlerEnforcesValidation	source-text invariants (allow-list map, audit emit, no DELETE case)
TestIsSafePresignKey	boolean gate unit test

Coverage block (CLAUDE.md rule 17)

Symptom:        /storage/:token/presign had zero middleware.
Enumeration:    rg -F '/storage/:token/presign' .
Sites found:    2 (router.go production wiring + testhelpers mirror)
Sites touched:  2 (both wrap full chain identically)
Coverage test:  TestPresign_RegistryHasMiddleware
                (walks router.go source; fails red if any of
                OptionalAuth / PresignTokenRateLimit / Idempotency
                is removed in future)
Live verified:  (post-merge curl ledger will be appended once the auto-
                deploy lands master and the new build SHA is in /healthz)

Gate

make gate exercises every package against the test DB. The presign-specific lane (go test -run 'TestPresign_|TestIsSafePresignKey|TestSanitisePresignKey') is green. Storage-dependent sub-cases skip cleanly on runners without MinIO; CI provides MinIO so they exercise full HTTP flows.

🤖 Generated with Claude Code

[mastermanas805]

Superseded by wave-1 PR #123 which cherry-picked commit 5436158 (presign middleware) onto master. The B17-P0 fix is live at master commit 12a3da9. Closing as duplicate.