Sigv4Signing.h

Go to the documentation of this file.

#pragma once
 
#include <aws/crt/Exports.h>
 
#include <aws/crt/DateTime.h>
#include <aws/crt/Types.h>
#include <aws/crt/auth/Signing.h>
 
struct aws_signing_config_aws;
 
namespace Aws
{
    namespace Crt
    {
        namespace Auth
        {
            class Credentials;
            class ICredentialsProvider;

            enum class SigningAlgorithm
            {
                SigV4 = AWS_SIGNING_ALGORITHM_V4,

                SigV4A = AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC,
            };

            enum class SignatureType
            {
                HttpRequestViaHeaders = AWS_ST_HTTP_REQUEST_HEADERS,

                HttpRequestViaQueryParams = AWS_ST_HTTP_REQUEST_QUERY_PARAMS,

                HttpRequestChunk = AWS_ST_HTTP_REQUEST_CHUNK,

                HttpRequestEvent = AWS_ST_HTTP_REQUEST_EVENT,
            };

            namespace SignedBodyValue
            {
                AWS_CRT_CPP_API const char *EmptySha256Str();

                AWS_CRT_CPP_API const char *UnsignedPayloadStr();

                AWS_CRT_CPP_API const char *StreamingAws4HmacSha256PayloadStr();
                AWS_CRT_CPP_API const char *StreamingAws4HmacSha256EventsStr();

                AWS_CRT_CPP_API extern const char *UnsignedPayload;
                AWS_CRT_CPP_API extern const char *EmptySha256;
                AWS_CRT_CPP_API extern const char *StreamingAws4HmacSha256Payload;
                AWS_CRT_CPP_API extern const char *StreamingAws4HmacSha256Events;
            } // namespace SignedBodyValue

            enum class SignedBodyHeaderType
            {
                None = AWS_SBHT_NONE,

                XAmzContentSha256 = AWS_SBHT_X_AMZ_CONTENT_SHA256,
            };
 
            using ShouldSignHeaderCb = bool (*)(const Crt::ByteCursor *, void *);

            class AWS_CRT_CPP_API AwsSigningConfig : public ISigningConfig
            {
              public:
                AwsSigningConfig(Allocator *allocator = ApiAllocator());
                virtual ~AwsSigningConfig();
 
                virtual SigningConfigType GetType() const noexcept override { return SigningConfigType::Aws; }

                SigningAlgorithm GetSigningAlgorithm() const noexcept;

                void SetSigningAlgorithm(SigningAlgorithm algorithm) noexcept;

                SignatureType GetSignatureType() const noexcept;

                void SetSignatureType(SignatureType signatureType) noexcept;

                const Crt::String &GetRegion() const noexcept;

                void SetRegion(const Crt::String &region) noexcept;

                const Crt::String &GetService() const noexcept;

                void SetService(const Crt::String &service) noexcept;

                DateTime GetSigningTimepoint() const noexcept;

                void SetSigningTimepoint(const DateTime &date) noexcept;
 
                /*
                 * We assume the uri will be encoded once in preparation for transmission.  Certain services
                 * do not decode before checking signature, requiring us to actually double-encode the uri in the
                 * canonical request in order to pass a signature check.
                 */

                bool GetUseDoubleUriEncode() const noexcept;

                void SetUseDoubleUriEncode(bool useDoubleUriEncode) noexcept;

                bool GetShouldNormalizeUriPath() const noexcept;

                void SetShouldNormalizeUriPath(bool shouldNormalizeUriPath) noexcept;

                bool GetOmitSessionToken() const noexcept;

                void SetOmitSessionToken(bool omitSessionToken) noexcept;

                ShouldSignHeaderCb GetShouldSignHeaderCallback() const noexcept;

                void SetShouldSignHeaderCallback(ShouldSignHeaderCb shouldSignHeaderCb) noexcept;

                void *GetShouldSignHeaderUserData() const noexcept;

                void SetShouldSignHeaderUserData(void *userData) noexcept;

                const Crt::String &GetSignedBodyValue() const noexcept;

                void SetSignedBodyValue(const Crt::String &signedBodyValue) noexcept;

                SignedBodyHeaderType GetSignedBodyHeader() const noexcept;

                void SetSignedBodyHeader(SignedBodyHeaderType signedBodyHeader) noexcept;

                uint64_t GetExpirationInSeconds() const noexcept;

                void SetExpirationInSeconds(uint64_t expirationInSeconds) noexcept;
 
                /*
                 * For Sigv4 signing, either the credentials provider or the credentials must be set.
                 * Credentials, if set, takes precedence over the provider.
                 */

                const std::shared_ptr<ICredentialsProvider> &GetCredentialsProvider() const noexcept;

                void SetCredentialsProvider(const std::shared_ptr<ICredentialsProvider> &credsProvider) noexcept;

                const std::shared_ptr<Credentials> &GetCredentials() const noexcept;

                void SetCredentials(const std::shared_ptr<Credentials> &credentials) noexcept;

                const struct aws_signing_config_aws *GetUnderlyingHandle() const noexcept;
 
              private:
                Allocator *m_allocator;
                std::shared_ptr<ICredentialsProvider> m_credentialsProvider;
                std::shared_ptr<Credentials> m_credentials;
                struct aws_signing_config_aws m_config;
                Crt::String m_signingRegion;
                Crt::String m_serviceName;
                Crt::String m_signedBodyValue;
            };

            class AWS_CRT_CPP_API Sigv4HttpRequestSigner : public IHttpRequestSigner
            {
              public:
                Sigv4HttpRequestSigner(Allocator *allocator = ApiAllocator());
                virtual ~Sigv4HttpRequestSigner() = default;
 
                bool IsValid() const override { return true; }

                virtual bool SignRequest(
                    const std::shared_ptr<Aws::Crt::Http::HttpRequest> &request,
                    const ISigningConfig &config,
                    const OnHttpRequestSigningComplete &completionCallback) override;
 
              private:
                Allocator *m_allocator;
            };
        } // namespace Auth
    } // namespace Crt
} // namespace Aws