Function aws4Sign

src/cmap/auth/aws4.ts:93–207

(
  options: AwsSigv4Options,
  credentials: AWSCredentials
)

 * The signing logic is described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
 */
export async function aws4Sign(
  options: AwsSigv4Options,
  credentials: AWSCredentials
): Promise<SignedHeaders> {
  /**
   * From the spec: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html
   *
   * Summary of signing steps
   * 1. Create a canonical request
   *    Arrange the contents of your request (host, action, headers, etc.) into a standard canonical format. The canonical request is one of the inputs used to create the string to sign.
   * 2. Create a hash of the canonical request
   *    Hash the canonical request using the same algorithm that you used to create the hash of the payload. The hash of the canonical request is a string of lowercase hexadecimal characters.
   * 3. Create a string to sign
   *    Create a string to sign with the canonical request and extra information such as the algorithm, request date, credential scope, and the hash of the canonical request.
   * 4. Derive a signing key
   *    Use the secret access key to derive the key used to sign the request.
   * 5. Calculate the signature
   *    Perform a keyed hash operation on the string to sign using the derived signing key as the hash key.
   * 6. Add the signature to the request
   *    Add the calculated signature to an HTTP header or to the query string of the request.
   */

  // 1: Create a canonical request

  // Date – The date and time used to sign the request.
  const date = options.date;
  // RequestDateTime – The date and time used in the credential scope. This value is the current UTC time in ISO 8601 format (for example, 20130524T000000Z).
  const requestDateTime = date.toISOString().replace(/[:-]|\.\d{3}/g, '');
  // RequestDate – The date used in the credential scope. This value is the current UTC date in YYYYMMDD format (for example, 20130524).
  const requestDate = requestDateTime.substring(0, 8);
  // Method – The HTTP request method. For us, this is always 'POST'.
  const method = options.method;
  // CanonicalUri – The URI-encoded version of the absolute path component URI, starting with the / that follows the domain name and up to the end of the string
  // For our requests, this is always '/'
  const canonicalUri = options.path;
  // CanonicalQueryString – The URI-encoded query string parameters. For our requests, there are no query string parameters, so this is always an empty string.
  const canonicalQuerystring = '';

  // CanonicalHeaders – A list of request headers with their values. Individual header name and value pairs are separated by the newline character ("\n").
  // All of our known/expected headers are included here, there are no extra headers.
  const headers = new Headers({
    'content-length': convertHeaderValue(options.headers['Content-Length']),
    'content-type': convertHeaderValue(options.headers['Content-Type']),
    host: convertHeaderValue(options.host),
    'x-amz-date': convertHeaderValue(requestDateTime),
    'x-mongodb-gs2-cb-flag': convertHeaderValue(options.headers['X-MongoDB-GS2-CB-Flag']),
    'x-mongodb-server-nonce': convertHeaderValue(options.headers['X-MongoDB-Server-Nonce'])
  });
  // If session token is provided, include it in the headers
  if ('sessionToken' in credentials && credentials.sessionToken) {
    headers.append('x-amz-security-token', convertHeaderValue(credentials.sessionToken));
  }

  // Canonical headers are lowercased and sorted.
  const canonicalHeaders = Array.from(headers.entries())
    .map(([key, value]) => `${key.toLowerCase()}:${value}`)
    .sort()
    .join('\n');