Function buildSignatureHeader

packages/cli/test/proxy.test.ts:28–55

* Builds the `x-zenstack-signature` header value for a request. * The payload is: * - GET / DELETE: the raw query string (URL-encoded, after `?`) * - other methods: `JSON.stringify(body)` (the raw request body)

(options: {
    privateKey: string;
    method: string;
    /** Path + optional query string, e.g. `/api/model/user/findMany?q=%7B%7D` */
    pathWithQuery: string;
    body?: unknown;
    authorizationToken?: string;
    /** Override timestamp (unix seconds as string). Defaults to `now`. */
    timestamp?: string;
})

 *   - other methods: `JSON.stringify(body)` (the raw request body)
 */
function buildSignatureHeader(options: {
    privateKey: string;
    method: string;
    /** Path + optional query string, e.g. `/api/model/user/findMany?q=%7B%7D` */
    pathWithQuery: string;
    body?: unknown;
    authorizationToken?: string;
    /** Override timestamp (unix seconds as string). Defaults to `now`. */
    timestamp?: string;
}): string {
    const timestamp = options.timestamp ?? String(Math.floor(Date.now() / 1000));

    const method = options.method.toUpperCase();
    let payload: string;
    if (method === 'GET' || method === 'DELETE') {
        const qMark = options.pathWithQuery.indexOf('?');
        payload = qMark >= 0 ? options.pathWithQuery.substring(qMark + 1) : '';
    } else {
        payload = options.body != null ? JSON.stringify(options.body) : '';
    }

    const message = options.authorizationToken
        ? `${payload}${timestamp}${options.authorizationToken}`
        : `${payload}${timestamp}`;

    const sig = sign(null, Buffer.from(message, 'utf8'), options.privateKey).toString('base64url');
    return `t=${timestamp},v1=${sig}`;
}

/** Encodes a UserClaim as a plain base64 bearer token. */
function makeUserToken(claim: { type: 'superUser' } | { type: 'user'; data: Record<string, unknown> }): string {