rustack_auth/lib.rs
1//! AWS Signature Version 2 and 4 request authentication for Rustack.
2//!
3//! This crate provides SigV4 and SigV2 signature verification for incoming HTTP
4//! requests to AWS-compatible services. It supports header-based authentication
5//! (via the `Authorization` header), presigned URL authentication (via query
6//! parameters), and legacy SigV2 authentication (HMAC-SHA1).
7//!
8//! # Overview
9//!
10//! AWS Signature Version 4 is the standard authentication mechanism for AWS API
11//! requests. This crate implements the verification side: given an incoming HTTP
12//! request and a credential store, it verifies that the request was signed by a
13//! known access key with the correct secret key.
14//!
15//! # Usage
16//!
17//! ```rust
18//! use rustack_auth::credentials::{CredentialProvider, StaticCredentialProvider};
19//! use rustack_auth::sigv4::{hash_payload, verify_sigv4};
20//!
21//! // Set up credentials
22//! let provider = StaticCredentialProvider::new(vec![
23//! ("AKIAIOSFODNN7EXAMPLE".to_owned(), "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY".to_owned()),
24//! ]);
25//!
26//! // For header-based auth, call verify_sigv4 with the request parts and body hash.
27//! // For presigned URLs, call verify_presigned with the request parts.
28//! ```
29//!
30//! # Modules
31//!
32//! - [`canonical`] - Canonical request construction per the SigV4 specification
33//! - [`credentials`] - Credential provider trait and in-memory implementation
34//! - [`error`] - Authentication error types
35//! - [`presigned`] - Presigned URL verification
36//! - [`sigv2`] - Legacy SigV2 signature verification (HMAC-SHA1)
37//! - [`sigv4`] - Main SigV4 signature verification logic
38
39pub mod canonical;
40pub mod credentials;
41pub mod error;
42pub mod presigned;
43pub mod sigv2;
44pub mod sigv4;
45
46pub use credentials::{CredentialProvider, StaticCredentialProvider};
47pub use error::AuthError;
48pub use presigned::verify_presigned;
49pub use sigv2::{is_sigv2, verify_sigv2};
50pub use sigv4::{AuthResult, hash_payload, verify_sigv4};