flagon-io/g1t

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Docs know what code they describe; a project's docs folder in Docs; Docs events; files on any S3 store1d ago		1	/**
		2	* AWS Signature Version 4, by hand with WebCrypto: how a self-hosted g1t
		3	* signs requests to an S3-compatible store (MinIO, Ceph, Garage, AWS S3,
		4	* R2's S3 API) without an SDK. Checked against AWS's published test
		5	* vectors (sigv4.test.ts). Reference:
		6	* https://docs.aws.amazon.com/IAM/latest/UserGuide/create-signed-request.html
		7	*/
		8
		9	export type Credentials = { access_key_id: string; secret_access_key: string };
		10
		11	export type SignInput = {
		12	method: string;
		13	url: string;
		14	/** Headers to sign besides `host` and `x-amz-date` (which are added). */
		15	headers?: Record<string, string>;
		16	/** The payload's SHA-256 in hex, or `UNSIGNED-PAYLOAD`. */
		17	payload_hash: string;
		18	region: string;
		19	service: string;
		20	credentials: Credentials;
		21	/** When it is signed; now by default. */
		22	date?: Date;
		23	/**
		24	* Whether path segments are encoded a second time, as every AWS service
		25	* but S3 expects. S3 signs the path as sent.
		26	*/
		27	double_encode_path?: boolean;
		28	};
		29
		30	export type Signed = {
		31	/** Every header to send, `authorization` included (lowercase names). */
		32	headers: Record<string, string>;
		33	canonical_request: string;
		34	string_to_sign: string;
		35	signature: string;
		36	};
		37
		38	const encoder = new TextEncoder();
		39
		40	function hex(bytes: ArrayBuffer): string {
		41	return [...new Uint8Array(bytes)].map((b) => b.toString(16).padStart(2, "0")).join("");
		42	}
		43
		44	export async function sha256Hex(data: string | ArrayBuffer | Uint8Array): Promise<string> {
		45	const bytes = typeof data === "string" ? encoder.encode(data) : data;
		46	return hex(await crypto.subtle.digest("SHA-256", bytes as BufferSource));
		47	}
		48
		49	async function hmac(key: ArrayBuffer | Uint8Array, data: string): Promise<ArrayBuffer> {
		50	const k = await crypto.subtle.importKey("raw", key as BufferSource, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
		51	return crypto.subtle.sign("HMAC", k, encoder.encode(data));
		52	}
		53
		54	/** RFC 3986 encoding, as SigV4 wants it: unreserved characters stay, everything else is %XX in upper case. */
		55	export function uriEncode(value: string): string {
		56	return encodeURIComponent(value).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
		57	}
		58
		59	/** `20150830T123600Z`. */
		60	export function amzDate(date: Date): string {
		61	return date.toISOString().replace(/[-:]/g, "").replace(/\.\d{3}/, "");
		62	}
		63
		64	function canonicalPath(pathname: string, double: boolean): string {
		65	if (!pathname || pathname === "/") return "/";
		66	return pathname
		67	.split("/")
		68	.map((segment) => {
		69	let raw: string;
		70	try {
		71	raw = decodeURIComponent(segment);
		72	} catch {
		73	raw = segment;
		74	}
		75	const once = uriEncode(raw);
		76	return double ? uriEncode(once) : once;
		77	})
		78	.join("/");
		79	}
		80
		81	function canonicalQuery(search: URLSearchParams): string {
		82	return [...search.entries()]
		83	.map(([k, v]) => [uriEncode(k), uriEncode(v)] as const)
		84	.sort(([ak, av], [bk, bv]) => (ak < bk ? -1 : ak > bk ? 1 : av < bv ? -1 : av > bv ? 1 : 0))
		85	.map(([k, v]) => `${k}=${v}`)
		86	.join("&");
		87	}
		88
		89	/** Signs a request: the headers to send with it, and what was signed (for tests and debugging). */
		90	export async function sign(input: SignInput): Promise<Signed> {
		91	const url = new URL(input.url);
		92	const when = amzDate(input.date ?? new Date());
		93	const day = when.slice(0, 8);
		94	const headers: Record<string, string> = {};
		95	for (const [k, v] of Object.entries(input.headers ?? {})) headers[k.toLowerCase()] = String(v).trim().replace(/\s+/g, " ");
		96	headers.host = url.host;
		97	headers["x-amz-date"] = when;
		98	const names = Object.keys(headers).sort();
		99	const signedHeaders = names.join(";");
		100	const canonicalRequest = [
		101	input.method.toUpperCase(),
		102	canonicalPath(url.pathname, input.double_encode_path ?? input.service !== "s3"),
		103	canonicalQuery(url.searchParams),
		104	names.map((n) => `${n}:${headers[n]}\n`).join(""),
		105	signedHeaders,
		106	input.payload_hash,
		107	].join("\n");
		108	const scope = `${day}/${input.region}/${input.service}/aws4_request`;
		109	const stringToSign = ["AWS4-HMAC-SHA256", when, scope, await sha256Hex(canonicalRequest)].join("\n");
		110	const kDate = await hmac(encoder.encode(`AWS4${input.credentials.secret_access_key}`), day);
		111	const kRegion = await hmac(kDate, input.region);
		112	const kService = await hmac(kRegion, input.service);
		113	const kSigning = await hmac(kService, "aws4_request");
		114	const signature = hex(await hmac(kSigning, stringToSign));
		115	return {
		116	headers: {
		117	...headers,
		118	authorization: `AWS4-HMAC-SHA256 Credential=${input.credentials.access_key_id}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
		119	},
		120	canonical_request: canonicalRequest,
		121	string_to_sign: stringToSign,
		122	signature,
		123	};
		124	}