Method sign_request

crates/opencode-provider/src/bedrock.rs:205–265

(
        &self,
        method: &str,
        path: &str,
        body: &[u8],
    )

    }

    async fn sign_request(
        &self,
        method: &str,
        path: &str,
        body: &[u8],
    ) -> Result<reqwest::header::HeaderMap, ProviderError> {
        let mut headers = reqwest::header::HeaderMap::new();

        let now = chrono::Utc::now();
        let amz_date = now.format("%Y%m%dT%H%M%SZ").to_string();
        let date_stamp = now.format("%Y%m%d").to_string();

        let service = "bedrock";
        let region = &self.config.region;

        let body_hash = hex::encode(sha256(body));

        headers.insert("Content-Type", "application/json".parse().unwrap());
        headers.insert("X-Amz-Date", amz_date.parse().unwrap());
        headers.insert(
            "Host",
            format!("bedrock-runtime.{}.amazonaws.com", region)
                .parse()
                .unwrap(),
        );

        if let Some(ref token) = self.config.session_token {
            headers.insert("X-Amz-Security-Token", token.parse().unwrap());
        }

        let canonical_request =
            format!(
            "{}\n{}\n\nhost:bedrock-runtime.{}.amazonaws.com\nx-amz-date:{}\n\nhost;x-amz-date\n{}",
            method, path, region,
            headers.get("X-Amz-Date").unwrap().to_str().unwrap(),
            body_hash
        );

        let credential_scope = format!("{}/{}/{}/aws4_request", date_stamp, region, service);

        let string_to_sign = format!(
            "AWS4-HMAC-SHA256\n{}\n{}\n{}",
            headers.get("X-Amz-Date").unwrap().to_str().unwrap(),
            credential_scope,
            hex::encode(sha256(canonical_request.as_bytes()))
        );

        let signing_key =
            Self::get_signature_key(&self.config.secret_access_key, &date_stamp, region, service);

        let signature = hex::encode(Self::hmac_sha256(&signing_key, string_to_sign.as_bytes()));

        let authorization = format!(
            "AWS4-HMAC-SHA256 Credential={}/{}, SignedHeaders=host;x-amz-date, Signature={}",
            self.config.access_key_id, credential_scope, signature
        );

        headers.insert("Authorization", authorization.parse().unwrap());