Function apply_sigv4_to_request

crates/openshell-supervisor-network/src/sigv4.rs:255–298

Apply AWS Signature Version 4 signing to a raw HTTP request buffer. Strips existing AWS auth headers, computes a new signature using the `aws-sigv4` crate, and returns the rewritten request bytes including body.

(
    raw: &[u8],
    host: &str,
    region: &str,
    service: &str,
    access_key: &str,
    secret_key: &str,
    session_token: Option<&str>,
)

/// Strips existing AWS auth headers, computes a new signature using the
/// `aws-sigv4` crate, and returns the rewritten request bytes including body.
pub fn apply_sigv4_to_request(
    raw: &[u8],
    host: &str,
    region: &str,
    service: &str,
    access_key: &str,
    secret_key: &str,
    session_token: Option<&str>,
) -> Result<Vec<u8>> {
    let header_end = raw
        .windows(4)
        .position(|w| w == b"\r\n\r\n")
        .map_or(raw.len(), |p| p + 4);

    let body = if header_end < raw.len() {
        &raw[header_end..]
    } else {
        &[]
    };

    let header_str = std::str::from_utf8(&raw[..header_end])
        .map_err(|e| miette!("SigV4 signing: request headers are not valid UTF-8: {e}"))?;
    let parts = parse_request_parts(header_str);
    let uri = format!("https://{host}{}", parts.path);
    let identity = build_identity(access_key, secret_key, session_token);
    let signing_params = build_signing_params(&identity, region, service)?;

    let signable_request = SignableRequest::new(
        parts.method,
        &uri,
        parts
            .headers_to_sign
            .iter()
            .map(|(k, v)| (k.as_str(), v.as_str())),
        SignableBody::Bytes(body),
    )
    .map_err(|e| miette!("SigV4 signable request: {e}"))?;

    let (instructions, _signature) = sign(signable_request, &signing_params)
        .map_err(|e| miette!("SigV4 signing failed: {e}"))?
        .into_parts();

    Ok(rebuild_request(&parts, &instructions, body))
}

/// Apply AWS `SigV4` signing to HTTP headers only, using UNSIGNED-PAYLOAD.
///