Function buildSignedHeaders

apps/sim/connectors/s3/s3.ts:282–319

* Builds SigV4 request headers for an S3 REST call. * * `canonicalQueryString` must be the already-sorted, percent-encoded query * string (empty for GetObject) — the caller builds the request URL from this * exact same string so the signed query and the wire query are byte-identical * (the clas

(
  ctx: S3Context,
  method: 'GET',
  encodedPath: string,
  canonicalQueryString: string
)

 * RequestTimeTooSkewed.
 */
function buildSignedHeaders(
  ctx: S3Context,
  method: 'GET',
  encodedPath: string,
  canonicalQueryString: string
): Record<string, string> {
  const date = new Date()
  const amzDate = date.toISOString().replace(/[:-]|\.\d{3}/g, '')
  const dateStamp = amzDate.slice(0, 8)

  const host = resolveHost(ctx)
  const payloadHash = crypto.createHash('sha256').update('').digest('hex')

  const canonicalHeaders =
    `host:${host}\n` + `x-amz-content-sha256:${payloadHash}\n` + `x-amz-date:${amzDate}\n`
  const signedHeaders = 'host;x-amz-content-sha256;x-amz-date'

  const canonicalRequest = `${method}\n${encodedPath}\n${canonicalQueryString}\n${canonicalHeaders}\n${signedHeaders}\n${payloadHash}`

  const algorithm = 'AWS4-HMAC-SHA256'
  const credentialScope = `${dateStamp}/${ctx.region}/s3/aws4_request`
  const stringToSign = `${algorithm}\n${amzDate}\n${credentialScope}\n${crypto
    .createHash('sha256')
    .update(canonicalRequest)
    .digest('hex')}`

  const signingKey = getSignatureKey(ctx.secretAccessKey, dateStamp, ctx.region, 's3')
  const signature = crypto.createHmac('sha256', signingKey).update(stringToSign).digest('hex')

  const authorizationHeader = `${algorithm} Credential=${ctx.accessKeyId}/${credentialScope}, SignedHeaders=${signedHeaders}, Signature=${signature}`

  return {
    Host: host,
    'X-Amz-Content-Sha256': payloadHash,
    'X-Amz-Date': amzDate,
    Authorization: authorizationHeader,
  }
}

/**
 * Percent-encodes a query parameter name or value per AWS SigV4 canonical rules