s3-wire 0.1.1

An async, streaming S3-compatible client for Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68

use time::OffsetDateTime;

use super::super::{Header, canonical_headers};
use super::common::{
    ALGORITHM, build_canonical_request, calculate_signature, credential_scope, format_timestamp,
    validate_common, validate_payload_hash,
};
use super::types::{
    HeaderSigningOutput, HeaderSigningRequest, SigningCredentials, SigningError, SigningScope,
};

/// Sign an HTTP request, returning the headers owned by the signing layer.
pub(crate) fn sign_headers(
    credentials: &SigningCredentials<'_>,
    scope: SigningScope<'_>,
    request: &HeaderSigningRequest<'_>,
    timestamp: OffsetDateTime,
) -> Result<HeaderSigningOutput, SigningError> {
    validate_common(credentials, scope, request.method)?;
    validate_payload_hash(request.payload_hash)?;
    reject_reserved_headers(request.headers)?;

    let (amz_date, date) = format_timestamp(timestamp)?;
    let mut headers = request.headers.to_vec();
    headers.push(Header::new("x-amz-date", &amz_date));
    if let Some(token) = credentials.session_token {
        headers.push(Header::new("x-amz-security-token", token));
    }
    let canonical_headers = canonical_headers(&headers)?;
    let canonical_request = build_canonical_request(
        request.method,
        request.uri_path,
        request.query,
        &canonical_headers,
        request.payload_hash,
    )?;
    let credential_scope = credential_scope(&date, scope);
    let signature = calculate_signature(
        credentials,
        scope,
        &date,
        &amz_date,
        &credential_scope,
        &canonical_request,
    )?;
    let authorization = format!(
        "{ALGORITHM} Credential={}/{credential_scope}, SignedHeaders={}, Signature={signature}",
        credentials.access_key_id,
        canonical_headers.signed()
    );

    Ok(HeaderSigningOutput {
        authorization,
        amz_date,
        security_token: credentials.session_token.map(str::to_owned),
    })
}

fn reject_reserved_headers(headers: &[Header<'_>]) -> Result<(), SigningError> {
    if headers.iter().any(|header| {
        header.name.eq_ignore_ascii_case("authorization")
            || header.name.eq_ignore_ascii_case("x-amz-date")
            || header.name.eq_ignore_ascii_case("x-amz-security-token")
    }) {
        return Err(SigningError::ReservedHeader);
    }
    Ok(())
}