Module: Everywhere::S3::Signer

Defined in:
lib/everywhere/s3.rb

Overview

Pure SigV4 header computation, separated for direct testing against the published AWS test vectors.

Class Method Summary collapse

Class Method Details

.canonical_query(query) ⇒ Object

Canonical form: every param as key=value (empty value keeps the "="), sorted. Callers pass unencoded simple queries; we never need decoding.



213
214
215
216
217
218
219
220
 
# File 'lib/everywhere/s3.rb', line 213

def canonical_query(query)
  return "" if query.nil? || query.empty?

  query.split("&").map { |pair|
    k, v = pair.split("=", 2)
    "#{uri_encode(k)}=#{uri_encode(v || "")}"
  }.sort.join("&")
end

.headers(method:, uri:, headers:, payload_sha256:, access_key_id:, secret_access_key:, session_token: nil, region:, time: Time.now.utc) ⇒ Object 



169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
 
# File 'lib/everywhere/s3.rb', line 169

def headers(method:, uri:, headers:, payload_sha256:, access_key_id:, secret_access_key:,
            session_token: nil, region:, time: Time.now.utc)
  amz_date = time.strftime("%Y%m%dT%H%M%SZ")
  date = time.strftime("%Y%m%d")

  signed = {
    "host" => host_header(uri),
    "x-amz-content-sha256" => payload_sha256,
    "x-amz-date" => amz_date
  }
  signed["x-amz-security-token"] = session_token if session_token
  # Sign every x-amz-* header we send (S3 requires it) plus the core set.
  canonical_headers = headers.select { |k, _| k.downcase.start_with?("x-amz-") || %w[range content-type content-md5 cache-control date expires].include?(k.downcase) }
                             .transform_keys(&:downcase).merge(signed)

  sorted = canonical_headers.sort.to_h
  header_list = sorted.keys.join(";")
  canonical_request = [
    method.to_s.upcase,
    uri.path.empty? ? "/" : uri.path,
    canonical_query(uri.query),
    sorted.map { |k, v| "#{k}:#{v.to_s.strip}\n" }.join,
    header_list,
    payload_sha256
  ].join("\n")

  scope = "#{date}/#{region}/s3/aws4_request"
  string_to_sign = [
    ALGORITHM, amz_date, scope,
    OpenSSL::Digest::SHA256.hexdigest(canonical_request)
  ].join("\n")

  k = %W[AWS4#{secret_access_key} #{date} #{region} s3 aws4_request]
      .reduce { |key, data| OpenSSL::HMAC.digest("SHA256", key, data) }
  signature = OpenSSL::HMAC.hexdigest("SHA256", k, string_to_sign)

  signed.merge(
    "authorization" => "#{ALGORITHM} Credential=#{access_key_id}/#{scope}, " \
                       "SignedHeaders=#{header_list}, Signature=#{signature}"
  )
end

.host_header(uri) ⇒ Object 



222
223
224
225
 
# File 'lib/everywhere/s3.rb', line 222

def host_header(uri)
  default_port = uri.scheme == "https" ? 443 : 80
  uri.port == default_port ? uri.host : "#{uri.host}:#{uri.port}"
end

.uri_encode(str) ⇒ Object

RFC 3986 unreserved-only encoding (AWS canonical form).



228
229
230
 
# File 'lib/everywhere/s3.rb', line 228

def uri_encode(str)
  str.to_s.gsub(/[^A-Za-z0-9\-._~]/) { |c| c.bytes.map { |b| format("%%%02X", b) }.join }
end