Batch A: blob storage layer, MCIAS auth, OCI token endpoint

Phase 2 — internal/storage/:
Content-addressed blob storage with atomic writes via rename.
BlobWriter stages data in uploads dir with running SHA-256 hash,
commits by verifying digest then renaming to layers/sha256/<prefix>/<hex>.
Reader provides Open, Stat, Delete, Exists with digest validation.

Phase 3 — internal/auth/ + internal/server/:
MCIAS client with Login and ValidateToken, 30s SHA-256-keyed cache
with lazy eviction and injectable clock for testing. TLS 1.3 minimum
with optional custom CA cert.
Chi router with RequireAuth middleware (Bearer token extraction,
WWW-Authenticate header, OCI error format), token endpoint (Basic
auth → bearer exchange via MCIAS), and /v2/ version check handler.

52 tests passing (14 storage + 9 auth + 9 server + 20 existing).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/storage/writer_test.go

@@ -0,0 +1,188 @@
+package storage
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"os"
+	"sync"
+	"testing"
+	"time"
+)
+
+func writeTestBlob(t *testing.T, s *Store, data []byte) string {
+	t.Helper()
+	uuid := "test-upload-" + fmt.Sprintf("%d", time.Now().UnixNano())
+	w, err := s.StartUpload(uuid)
+	if err != nil {
+		t.Fatalf("StartUpload: %v", err)
+	}
+	if _, err := w.Write(data); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+	h := sha256.Sum256(data)
+	digest := "sha256:" + hex.EncodeToString(h[:])
+	got, err := w.Commit(digest)
+	if err != nil {
+		t.Fatalf("Commit: %v", err)
+	}
+	if got != digest {
+		t.Fatalf("Commit returned %q, want %q", got, digest)
+	}
+	return digest
+}
+
+func TestWriteAndCommit(t *testing.T) {
+	s := newTestStore(t)
+	data := []byte("hello, blob storage")
+	digest := writeTestBlob(t, s, data)
+
+	// Verify file exists at expected path.
+	path := s.blobPath(digest)
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatalf("stat blob file: %v", err)
+	}
+	if info.Size() != int64(len(data)) {
+		t.Fatalf("blob size: got %d, want %d", info.Size(), len(data))
+	}
+
+	// Verify content.
+	content, err := os.ReadFile(path) //nolint:gosec // test file path from t.TempDir()
+	if err != nil {
+		t.Fatalf("read blob file: %v", err)
+	}
+	if string(content) != string(data) {
+		t.Fatalf("blob content: got %q, want %q", content, data)
+	}
+}
+
+func TestDigestMismatch(t *testing.T) {
+	s := newTestStore(t)
+	data := []byte("some data")
+
+	uuid := "mismatch-upload"
+	w, err := s.StartUpload(uuid)
+	if err != nil {
+		t.Fatalf("StartUpload: %v", err)
+	}
+	if _, err := w.Write(data); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+
+	wrongDigest := "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+	_, err = w.Commit(wrongDigest)
+	if !errors.Is(err, ErrDigestMismatch) {
+		t.Fatalf("Commit with wrong digest: got %v, want ErrDigestMismatch", err)
+	}
+
+	// Verify temp file was cleaned up.
+	tempPath := w.path
+	if _, err := os.Stat(tempPath); !os.IsNotExist(err) {
+		t.Fatalf("temp file should be removed after digest mismatch, stat err: %v", err)
+	}
+}
+
+func TestCancel(t *testing.T) {
+	s := newTestStore(t)
+
+	uuid := "cancel-upload"
+	w, err := s.StartUpload(uuid)
+	if err != nil {
+		t.Fatalf("StartUpload: %v", err)
+	}
+	if _, err := w.Write([]byte("partial data")); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+
+	tempPath := w.path
+	if err := w.Cancel(); err != nil {
+		t.Fatalf("Cancel: %v", err)
+	}
+
+	if _, err := os.Stat(tempPath); !os.IsNotExist(err) {
+		t.Fatalf("temp file should be removed after Cancel, stat err: %v", err)
+	}
+}
+
+func TestBytesWritten(t *testing.T) {
+	s := newTestStore(t)
+
+	uuid := "bytes-upload"
+	w, err := s.StartUpload(uuid)
+	if err != nil {
+		t.Fatalf("StartUpload: %v", err)
+	}
+	t.Cleanup(func() { _ = w.Cancel() })
+
+	if w.BytesWritten() != 0 {
+		t.Fatalf("BytesWritten before write: got %d, want 0", w.BytesWritten())
+	}
+
+	data1 := []byte("first chunk")
+	if _, err := w.Write(data1); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+	if w.BytesWritten() != int64(len(data1)) {
+		t.Fatalf("BytesWritten after first write: got %d, want %d", w.BytesWritten(), len(data1))
+	}
+
+	data2 := []byte("second chunk")
+	if _, err := w.Write(data2); err != nil {
+		t.Fatalf("Write: %v", err)
+	}
+	want := int64(len(data1) + len(data2))
+	if w.BytesWritten() != want {
+		t.Fatalf("BytesWritten after second write: got %d, want %d", w.BytesWritten(), want)
+	}
+}
+
+func TestConcurrentWrites(t *testing.T) {
+	s := newTestStore(t)
+
+	type result struct {
+		digest string
+		err    error
+	}
+
+	blobs := [][]byte{
+		[]byte("concurrent blob alpha"),
+		[]byte("concurrent blob beta"),
+	}
+
+	results := make([]result, len(blobs))
+	var wg sync.WaitGroup
+
+	for i, data := range blobs {
+		wg.Add(1)
+		go func(idx int, d []byte) {
+			defer wg.Done()
+			uuid := fmt.Sprintf("concurrent-%d-%d", idx, time.Now().UnixNano())
+			w, err := s.StartUpload(uuid)
+			if err != nil {
+				results[idx] = result{err: err}
+				return
+			}
+			if _, err := w.Write(d); err != nil {
+				results[idx] = result{err: err}
+				return
+			}
+			h := sha256.Sum256(d)
+			digest := "sha256:" + hex.EncodeToString(h[:])
+			got, err := w.Commit(digest)
+			results[idx] = result{digest: got, err: err}
+		}(i, data)
+	}
+
+	wg.Wait()
+
+	for i, r := range results {
+		if r.err != nil {
+			t.Fatalf("blob %d: %v", i, r.err)
+		}
+		if !s.Exists(r.digest) {
+			t.Fatalf("blob %d: digest %q not found after concurrent write", i, r.digest)
+		}
+	}
+}