herolib_crypt/httpsig/

parser.rs

//! RFC 9421 Signature-Input and Signature header parsing.

use crate::httpsig::error::HttpSigError;
use base64::Engine;

/// Signature parameters extracted from Signature-Input header.
#[derive(Debug, Clone)]
pub struct SignatureParams {
    pub label: String,
    pub components: Vec<String>,
    pub keyid: String,
    pub alg: String,
    pub created: u64,
}

/// Extract the key ID from a Signature-Input header value.
///
/// # Example
///
/// ```
/// use herolib_crypt::httpsig::extract_key_id;
///
/// let header = r#"sig1=("@method" "@path");keyid="user-123";alg="ed25519";created=1234567890"#;
/// let key_id = extract_key_id(header).unwrap();
/// assert_eq!(key_id, "user-123");
/// ```
pub fn extract_key_id(signature_input: &str) -> Result<String, HttpSigError> {
    let params = parse_signature_input(signature_input)?;
    Ok(params.keyid)
}

/// Parse a Signature-Input header value.
///
/// Expected format:
/// ```text
/// sig1=("@method" "@path" "content-digest");keyid="user-123";alg="ed25519";created=1234567890
/// ```
pub fn parse_signature_input(header: &str) -> Result<SignatureParams, HttpSigError> {
    // Split into label and rest
    let parts: Vec<&str> = header.splitn(2, '=').collect();
    if parts.len() != 2 {
        return Err(HttpSigError::ParseError(
            "Invalid Signature-Input format".to_string(),
        ));
    }

    let label = parts[0].trim().to_string();
    let rest = parts[1].trim();

    // Extract components list (between parentheses)
    let components = parse_components_list(rest)?;

    // Extract parameters after the closing parenthesis
    let params_start = rest.find(");").ok_or_else(|| {
        HttpSigError::ParseError("Missing closing parenthesis in component list".to_string())
    })? + 2;

    let params_str = &rest[params_start..];

    // Parse parameters
    let keyid = extract_param(params_str, "keyid")?;
    let alg = extract_param(params_str, "alg")?;
    let created_str = extract_param(params_str, "created")?;
    let created = created_str.parse::<u64>().map_err(|_| {
        HttpSigError::ParseError(format!("Invalid created timestamp: {}", created_str))
    })?;

    Ok(SignatureParams {
        label,
        components,
        keyid,
        alg,
        created,
    })
}

/// Parse the component list from a Signature-Input header.
///
/// Extracts components from: `("@method" "@path" "content-digest")`
fn parse_components_list(input: &str) -> Result<Vec<String>, HttpSigError> {
    let start = input.find('(').ok_or_else(|| {
        HttpSigError::ParseError("Missing opening parenthesis in component list".to_string())
    })?;

    let end = input.find(')').ok_or_else(|| {
        HttpSigError::ParseError("Missing closing parenthesis in component list".to_string())
    })?;

    let list_str = &input[start + 1..end];

    let components: Vec<String> = list_str
        .split_whitespace()
        .map(|s| s.trim_matches('"').to_string())
        .filter(|s| !s.is_empty())
        .collect();

    if components.is_empty() {
        return Err(HttpSigError::ParseError(
            "Empty component list".to_string(),
        ));
    }

    Ok(components)
}

/// Extract a parameter value from the parameter string.
///
/// Handles both quoted and unquoted values.
fn extract_param(params: &str, name: &str) -> Result<String, HttpSigError> {
    let pattern = format!("{}=", name);
    let start = params
        .find(&pattern)
        .ok_or_else(|| HttpSigError::ParseError(format!("Missing parameter: {}", name)))?
        + pattern.len();

    let rest = &params[start..];

    // Check if value is quoted
    if rest.starts_with('"') {
        let end = rest[1..]
            .find('"')
            .ok_or_else(|| HttpSigError::ParseError(format!("Unclosed quote for {}", name)))?
            + 1;
        Ok(rest[1..end].to_string())
    } else {
        // Unquoted value - read until semicolon or end
        let end = rest.find(';').unwrap_or(rest.len());
        Ok(rest[..end].trim().to_string())
    }
}

/// Parse a Signature header value and extract the signature bytes for a given label.
///
/// Expected format: `sig1=:base64_signature:`
pub fn parse_signature(header: &str, label: &str) -> Result<Vec<u8>, HttpSigError> {
    let pattern = format!("{}=:", label);
    let start = header.find(&pattern).ok_or_else(|| {
        HttpSigError::InvalidSignature(format!("Signature label '{}' not found", label))
    })? + pattern.len();

    let rest = &header[start..];
    let end = rest
        .find(':')
        .ok_or_else(|| HttpSigError::InvalidSignature("Missing closing colon".to_string()))?;

    let b64_sig = &rest[..end];

    base64::engine::general_purpose::STANDARD
        .decode(b64_sig)
        .map_err(|e| HttpSigError::InvalidSignature(format!("Invalid base64: {}", e)))
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_parse_signature_input() {
        let header = r#"sig1=("@method" "@path" "content-digest");keyid="user-123";alg="ed25519";created=1234567890"#;
        let params = parse_signature_input(header).unwrap();

        assert_eq!(params.label, "sig1");
        assert_eq!(params.components.len(), 3);
        assert_eq!(params.components[0], "@method");
        assert_eq!(params.components[1], "@path");
        assert_eq!(params.components[2], "content-digest");
        assert_eq!(params.keyid, "user-123");
        assert_eq!(params.alg, "ed25519");
        assert_eq!(params.created, 1234567890);
    }

    #[test]
    fn test_extract_key_id() {
        let header = r#"sig1=("@method");keyid="test-key";alg="ed25519";created=123"#;
        let key_id = extract_key_id(header).unwrap();
        assert_eq!(key_id, "test-key");
    }

    #[test]
    fn test_parse_components_list() {
        let input = r#"("@method" "@path" "content-digest");keyid="x""#;
        let components = parse_components_list(input).unwrap();

        assert_eq!(components.len(), 3);
        assert_eq!(components[0], "@method");
        assert_eq!(components[1], "@path");
        assert_eq!(components[2], "content-digest");
    }

    #[test]
    fn test_extract_param_quoted() {
        let params = r#"keyid="user-123";alg="ed25519""#;
        assert_eq!(extract_param(params, "keyid").unwrap(), "user-123");
        assert_eq!(extract_param(params, "alg").unwrap(), "ed25519");
    }

    #[test]
    fn test_extract_param_unquoted() {
        let params = "created=1234567890;other=value";
        assert_eq!(extract_param(params, "created").unwrap(), "1234567890");
    }

    #[test]
    fn test_parse_signature() {
        let header = "sig1=:YWJjZGVm:";
        let sig_bytes = parse_signature(header, "sig1").unwrap();
        assert_eq!(sig_bytes, b"abcdef");
    }

    #[test]
    fn test_parse_signature_invalid_label() {
        let header = "sig1=:YWJjZGVm:";
        let result = parse_signature(header, "sig2");
        assert!(matches!(result, Err(HttpSigError::InvalidSignature(_))));
    }
}