fix(s3): enforce presigned POST policy conditions with case-insensitive field lookup

src/main/java/io/github/hectorvent/floci/services/s3/S3Controller.java

@@ -1611,7 +1611,10 @@ private Response handlePresignedPost(String bucket, String contentType, byte[] b
         }
 
         // Validate policy conditions if present
-        String policy = fields.get("policy");
+        String policy = fields.get("Policy");
+        if (policy == null) {
+            policy = fields.get("policy");
+        }
         if (policy != null && !policy.isEmpty()) {
             validatePolicyConditions(policy, bucket, fields, fileData.length);
         }

src/test/java/io/github/hectorvent/floci/services/s3/S3PresignedPostIntegrationTest.java

@@ -376,6 +376,64 @@ void presignedPostRejectsStartsWithMismatch() {
                             + "[\"starts-with\", \"$key\", \"uploads/\"]")));
     }
 
+    @Test
+    @Order(95)
+    void presignedPostEnforcesPolicyWithCapitalPFieldName() {
+        // The AWS SDK sends the policy field as "Policy" (capital P).
+        // This test verifies that validation works regardless of casing.
+        String key = "uploads/capital-p-reject.png";
+        String fileContent = "not a real png";
+
+        String policy = buildPolicy(BUCKET, key, "image/png", 0, 10485760);
+        String policyBase64 = Base64.getEncoder().encodeToString(policy.getBytes(StandardCharsets.UTF_8));
+
+        // Send with capital-P "Policy" and mismatched Content-Type — should be rejected
+        given()
+            .multiPart("key", key)
+            .multiPart("Content-Type", "image/gif")
+            .multiPart("Policy", policyBase64)
+            .multiPart("x-amz-algorithm", "AWS4-HMAC-SHA256")
+            .multiPart("x-amz-credential", "AKIAIOSFODNN7EXAMPLE/20260330/us-east-1/s3/aws4_request")
+            .multiPart("x-amz-date", AMZ_DATE_FORMAT.format(Instant.now()))
+            .multiPart("x-amz-signature", "dummysignature")
+            .multiPart("file", "capital-p-reject.png", fileContent.getBytes(StandardCharsets.UTF_8), "image/gif")
+        .when()
+            .post("/" + BUCKET)
+        .then()
+            .statusCode(403)
+            .contentType("application/xml")
+            .body(hasXPath("/Error/Code", equalTo("AccessDenied")))
+            .body(hasXPath("/Error/Message", equalTo(
+                    "Invalid according to Policy: Policy Condition failed: "
+                            + "[\"eq\", \"$Content-Type\", \"image/png\"]")));
+    }
+
+    @Test
+    @Order(96)
+    void presignedPostSucceedsWithCapitalPFieldName() {
+        // Verify that a valid upload with capital-P "Policy" also succeeds
+        String key = "uploads/capital-p-ok.txt";
+        String fileContent = "capital P success";
+
+        String policy = buildPolicy(BUCKET, key, "text/plain", 0, 10485760);
+        String policyBase64 = Base64.getEncoder().encodeToString(policy.getBytes(StandardCharsets.UTF_8));
+
+        given()
+            .multiPart("key", key)
+            .multiPart("Content-Type", "text/plain")
+            .multiPart("Policy", policyBase64)
+            .multiPart("x-amz-algorithm", "AWS4-HMAC-SHA256")
+            .multiPart("x-amz-credential", "AKIAIOSFODNN7EXAMPLE/20260330/us-east-1/s3/aws4_request")
+            .multiPart("x-amz-date", AMZ_DATE_FORMAT.format(Instant.now()))
+            .multiPart("x-amz-signature", "dummysignature")
+            .multiPart("file", "capital-p-ok.txt", fileContent.getBytes(StandardCharsets.UTF_8), "text/plain")
+        .when()
+            .post("/" + BUCKET)
+        .then()
+            .statusCode(204)
+            .header("ETag", notNullValue());
+    }
+
     @Test
     @Order(100)
     void cleanupBucket() {
@@ -386,6 +444,7 @@ void cleanupBucket() {
         given().delete("/" + BUCKET + "/uploads/typed-file.json");
         given().delete("/" + BUCKET + "/uploads/within-range.txt");
         given().delete("/" + BUCKET + "/uploads/prefix-test.txt");
+        given().delete("/" + BUCKET + "/uploads/capital-p-ok.txt");
 
         given()
         .when()