Method signRequest

packages/filesystem/s3/client.ts:201–260

AWS Signature V4 签名

(
    method: string,
    bucket: string,
    key: string | undefined,
    queryParams: Record<string, string>,
    headers: Record<string, string>,
    payloadHash: string
  )

  /** AWS Signature V4 签名 */
  private async signRequest(
    method: string,
    bucket: string,
    key: string | undefined,
    queryParams: Record<string, string>,
    headers: Record<string, string>,
    payloadHash: string
  ): Promise<void> {
    const now = new Date();
    // ISO 8601 基本格式: 20210101T000000Z
    const amzDate = now
      .toISOString()
      .replace(/[-:]/g, "")
      .replace(/\.\d{3}/, "");
    const dateStamp = amzDate.substring(0, 8);

    headers["host"] = this.getHost(bucket);
    headers["x-amz-date"] = amzDate;
    headers["x-amz-content-sha256"] = payloadHash;

    // 构建 Canonical Request
    const canonicalUri = this.getCanonicalUri(bucket, key);
    const canonicalQueryString = Object.entries(queryParams)
      .sort(([a], [b]) => a.localeCompare(b))
      .map(([k, v]) => `${awsUriEncode(k)}=${awsUriEncode(v)}`)
      .join("&");

    const signedHeaderKeys = Object.keys(headers)
      .map((k) => k.toLowerCase())
      .sort();
    const canonicalHeaders = signedHeaderKeys.map((k) => `${k}:${(headers[k] ?? "").trim()}\n`).join("");
    const signedHeaders = signedHeaderKeys.join(";");

    const canonicalRequest = [
      method,
      canonicalUri,
      canonicalQueryString,
      canonicalHeaders,
      signedHeaders,
      payloadHash,
    ].join("\n");

    // 构建 String to Sign
    const credentialScope = `${dateStamp}/${this.config.region}/s3/aws4_request`;
    const canonicalRequestHash = await sha256Hex(canonicalRequest);
    const stringToSign = ["AWS4-HMAC-SHA256", amzDate, credentialScope, canonicalRequestHash].join("\n");

    // 计算签名
    const signingKey = await deriveSigningKey(
      this.config.credentials.secretAccessKey,
      dateStamp,
      this.config.region,
      "s3"
    );
    const signature = toHex(await hmacSha256(signingKey, stringToSign));

    // 添加 Authorization 头
    headers["authorization"] =