pub struct Signer<K: SigningCredential> { /* private fields */ }Expand description
Loads credentials and atomically signs request heads.
The service-specific SignRequest runs against a private candidate. Only the
candidate URI and headers are committed after successful signing.
Implementations§
Source§impl<K: SigningCredential> Signer<K>
impl<K: SigningCredential> Signer<K>
Sourcepub fn new(
ctx: Context,
loader: impl ProvideCredential<Credential = K>,
builder: impl SignRequest<Credential = K>,
) -> Self
pub fn new( ctx: Context, loader: impl ProvideCredential<Credential = K>, builder: impl SignRequest<Credential = K>, ) -> Self
Create a new signer.
Sourcepub fn with_context(self, ctx: Context) -> Self
pub fn with_context(self, ctx: Context) -> Self
Replace the context while keeping credential provider and request signer.
Sourcepub fn with_credential_provider(
self,
provider: impl ProvideCredential<Credential = K>,
) -> Self
pub fn with_credential_provider( self, provider: impl ProvideCredential<Credential = K>, ) -> Self
Replace the credential provider while keeping context and request signer.
Sourcepub fn with_request_signer(
self,
signer: impl SignRequest<Credential = K>,
) -> Self
pub fn with_request_signer( self, signer: impl SignRequest<Credential = K>, ) -> Self
Replace the request signer while keeping context and credential provider.
Sourcepub async fn sign(
&self,
req: &mut Parts,
expires_in: Option<Duration>,
) -> Result<()>
pub async fn sign( &self, req: &mut Parts, expires_in: Option<Duration>, ) -> Result<()>
Sign a wire-ready request head.
The request URI must satisfy the input contract of the configured
SignRequest. Built-in signers require an authority and expect path and query
data to be percent-encoded exactly once before this call. Signing does not
perform general-purpose URI encoding for the caller.
If credential loading or request signing returns an error, req is unchanged.
On success, only req.uri and req.headers may change; the method, version, and
extensions retain their input values.
expires_in is a service-specific validity input and does not universally
select query authentication. The configured service signer and credential type
determine how it is interpreted.
Cached credentials must be fresh according to SigningCredential::is_valid
and usable through SignRequest::required_valid_until. A refreshed credential
only needs to satisfy the exact operation deadline. Provider errors are returned
without internal retry or fallback to the previous cached credential.