feat(objectstore): Add AWS SSE-KMS encryption support for S3 storage

[cuppett]

Summary

Add support for Server-Side Encryption with AWS Key Management Service (SSE-KMS) for S3 object storage. This allows Nextcloud to encrypt data at rest in S3 using AWS-managed keys.

Key Features

• New configuration options: sse_kms_enabled and sse_kms_key_id
• Full SSE-KMS support: Both single-part and multipart uploads
• Backward compatible: Existing SSE-C (customer-provided keys) continues to work
• Priority handling: SSE-C takes precedence when both SSE-C and SSE-KMS are configured

Implementation Details

• Added getServerSideEncryptionParameters() method to centralize encryption parameter logic for both SSE-C and SSE-KMS
• Updated multipart uploads to use unified encryption parameters (fixes potential SSE-KMS multipart upload issues)
• Added comprehensive PHPUnit test suite (S3SSEKMSTest.php) for SSE-KMS scenarios
• Validated with real AWS KMS keys and S3 buckets

Configuration Example

'objectstore' => [
  'class' => 'OC\\Files\\ObjectStore\\S3',
  'arguments' => [
    'bucket' => 'my-bucket',
    'region' => 'us-east-1',
    'key' => 'ACCESS_KEY',
    'secret' => 'SECRET_KEY',
    // SSE-KMS Configuration
    'sse_kms_enabled' => true,
    'sse_kms_key_id' => 'arn:aws:kms:us-east-1:ACCOUNT:key/KEY-ID',
  ]
]

Testing

Manual Testing

Validated both SSE-KMS and SSE-C encryption with comprehensive file upload/download tests:

SSE-KMS Testing:

• ✅ Small files (1KB, 1MB, 10MB) - single-part uploads
• ✅ Large files (100MB, 500MB, 1GB) - multipart uploads
• ✅ Verified `x-amz-server-side-encryption: aws:kms` headers on S3 objects
• ✅ Verified `x-amz-server-side-encryption-aws-kms-key-id` contains correct KMS key ARN
• ✅ All file integrity checks passed (md5sum matches)

SSE-C Backward Compatibility Testing:

• ✅ Confirmed SSE-C still works after changes
• ✅ Verified `SSECustomerAlgorithm: AES256` headers on SSE-C objects
• ✅ Both single-part and multipart uploads work correctly
• ✅ All file operations validated with checksum verification

PHPUnit Tests

• ✅ All 16 existing S3 tests pass with SSE-C configuration
• ✅ New `S3SSEKMSTest` class added with comprehensive SSE-KMS test coverage
• ✅ Tests validate encryption parameter handling for both SSE-C and SSE-KMS

Files Changed

• `lib/private/Files/ObjectStore/S3.php` - Added SSE-KMS configuration options
• `lib/private/Files/ObjectStore/S3ConnectionTrait.php` - Implemented `getServerSideEncryptionParameters()`
• `lib/private/Files/ObjectStore/S3ObjectTrait.php` - Updated multipart uploads to use unified encryption parameters
• `apps/files_external/lib/Lib/Storage/AmazonS3.php` - Extended SSE-KMS support to external storage
• `tests/lib/Files/ObjectStore/S3SSEKMSTest.php` - New comprehensive test suite

🤖 Generated with Claude Code