From f9484738db8354e9f823c13af9b784e3215db88b Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 29 Jul 2026 08:54:10 +0700
Subject: [PATCH] debug: add SigV4 canonical request logging for
 troubleshooting

---
 src/utils/s3/auth.ts | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/utils/s3/auth.ts b/src/utils/s3/auth.ts
index 02a51e2..8abf547 100644
--- a/src/utils/s3/auth.ts
+++ b/src/utils/s3/auth.ts
@@ -1,4 +1,5 @@
 import { timingSafeEqual } from 'node:crypto';
+import logger from '../../shared/logger/index';
 
 /**
  * Timing-safe string comparison that prevents timing attacks.
@@ -299,8 +300,17 @@ export const verifySignature = async (
 
   const hashedCanonicalRequest = await sha256Hex(canonicalRequest);
 
+  // Debug canonical request for non-root GETs (bucket operations)
+  logger.info('SigV4 canonical request', {
+    method,
+    path: parsedUrl.pathname,
+    signedHeaders: parsed.signedHeaders,
+    hashedPayload: hashedPayload.slice(0, 20) + '...',
+    canReq: canonicalRequest.slice(0, 500),
+  });
+
   // M1: Fall back to Date header if x-amz-date is missing
-  const amzDate = headers['x-amz-date'] || headers.date || '';
+  const amzDate = headers['x-amz-date'] || headers['date'] || '';
 
   // H5: Validate request freshness (clock skew / replay protection)
   if (amzDate) {