aws · lauzadis · Apr 29, 2024 · Mar 1, 2024 · Mar 1, 2024 · Mar 1, 2024
@@ -6,8 +6,7 @@
 package aws.sdk.kotlin.crt.auth.signing
 
 import aws.sdk.kotlin.crt.*
-import aws.sdk.kotlin.crt.auth.credentials.StaticCredentialsProvider
-import aws.sdk.kotlin.crt.auth.credentials.build
+import aws.sdk.kotlin.crt.auth.credentials.Credentials
 import aws.sdk.kotlin.crt.http.Headers
 import aws.sdk.kotlin.crt.http.HttpRequest
 import aws.sdk.kotlin.crt.http.HttpRequestBodyStream
@@ -55,182 +54,142 @@ class SigningTest : CrtTest() {
         headers.append("Authorization", "example.amazonaws.com")
     }
 
-    @Ignore // FIXME Enable when Kotlin/Native implementation is complete
     @Test
     fun testSigningSuccess() = runTest {
-        StaticCredentialsProvider.build {
-            accessKeyId = TEST_ACCESS_KEY_ID
-            secretAccessKey = TEST_SECRET_ACCESS_KEY
-        }.use { provider ->
-            val request = createSimpleRequest("https://www.example.com", "POST", "/derp", "<body>Hello</body>")
-            val signingConfig = AwsSigningConfig.build {
-                algorithm = AwsSigningAlgorithm.SIGV4
-                signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
-                region = "us-east-1"
-                service = "service"
-                date = Platform.epochMilliNow()
-                credentialsProvider = provider
-                shouldSignHeader = { it != "bad-param" }
-                useDoubleUriEncode = true
-                normalizeUriPath = true
-            }
-
-            val signedRequest = AwsSigner.signRequest(request, signingConfig)
-            assertTrue(signedRequest.headers.contains("X-Amz-Date"))
-            assertTrue(signedRequest.headers.contains("Authorization"))
+        val request = createSimpleRequest("https://www.example.com", "POST", "/derp", "<body>Hello</body>")
+        val signingConfig = AwsSigningConfig.build {
+            algorithm = AwsSigningAlgorithm.SIGV4
+            signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
+            region = "us-east-1"
+            service = "service"
+            date = Platform.epochMilliNow()
+            credentials = Credentials(TEST_ACCESS_KEY_ID, TEST_SECRET_ACCESS_KEY, null)
+            shouldSignHeader = { it != "bad-param" }
+            useDoubleUriEncode = true
+            normalizeUriPath = true
         }
+
+        val signedRequest = AwsSigner.signRequest(request, signingConfig)
+        assertTrue(signedRequest.headers.contains("X-Amz-Date"))
+        assertTrue(signedRequest.headers.contains("Authorization"))
     }
 
-    @Ignore // FIXME Enable when Kotlin/Native implementation is complete
     @Test
     fun testQuerySigningSuccess() = runTest {
-        StaticCredentialsProvider.build {
-            accessKeyId = TEST_ACCESS_KEY_ID
-            secretAccessKey = TEST_SECRET_ACCESS_KEY
-        }.use { provider ->
-            val request = createSigV4TestSuiteRequest()
-            val signingConfig = AwsSigningConfig.build {
-                algorithm = AwsSigningAlgorithm.SIGV4
-                signatureType = AwsSignatureType.HTTP_REQUEST_VIA_QUERY_PARAMS
-                region = "us-east-1"
-                service = "service"
-                date = TEST_DATE_EPOCH_MILLI
-                credentialsProvider = provider
-                useDoubleUriEncode = true
-                normalizeUriPath = true
-                signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
-                expirationInSeconds = 60
-            }
-
-            val signedRequest = AwsSigner.signRequest(request, signingConfig)
-
-            val path = signedRequest.encodedPath
-            assertTrue(path.contains("X-Amz-Signature="), "`$path` did not contain expected signature")
-            assertTrue(path.contains("X-Amz-SignedHeaders=host"), "`$path` did not contain expected host")
-            assertTrue(path.contains("X-Amz-Credential=AKIDEXAMPLE%2F20150830%2F"), "`$path` did not contain expected credentials")
-            assertTrue(path.contains("X-Amz-Algorithm=AWS4-HMAC-SHA256"), "`$path` did not contain expected algorithm")
-            assertTrue(path.contains("X-Amz-Expires=60"), "`$path` did not contain expected expiration")
+        val request = createSigV4TestSuiteRequest()
+        val signingConfig = AwsSigningConfig.build {
+            algorithm = AwsSigningAlgorithm.SIGV4
+            signatureType = AwsSignatureType.HTTP_REQUEST_VIA_QUERY_PARAMS
+            region = "us-east-1"
+            service = "service"
+            date = TEST_DATE_EPOCH_MILLI
+            credentials = Credentials(TEST_ACCESS_KEY_ID, TEST_SECRET_ACCESS_KEY, null)
+            useDoubleUriEncode = true
+            normalizeUriPath = true
+            signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
+            expirationInSeconds = 60
         }
+
+        val signedRequest = AwsSigner.signRequest(request, signingConfig)
+
+        val path = signedRequest.encodedPath
+        assertTrue(path.contains("X-Amz-Signature="), "`$path` did not contain expected signature")
+        assertTrue(path.contains("X-Amz-SignedHeaders=host"), "`$path` did not contain expected host")
+        assertTrue(path.contains("X-Amz-Credential=AKIDEXAMPLE%2F20150830%2F"), "`$path` did not contain expected credentials")
+        assertTrue(path.contains("X-Amz-Algorithm=AWS4-HMAC-SHA256"), "`$path` did not contain expected algorithm")
+        assertTrue(path.contains("X-Amz-Expires=60"), "`$path` did not contain expected expiration")
     }
 
-    @Ignore // FIXME Enable when Kotlin/Native implementation is complete
     @Test
     fun testSigningBasicSigV4() = runTest {
-        StaticCredentialsProvider.build {
-            accessKeyId = TEST_ACCESS_KEY_ID
-            secretAccessKey = TEST_SECRET_ACCESS_KEY
-        }.use { provider ->
-            val request = createSigV4TestSuiteRequest()
-            val signingConfig = AwsSigningConfig.build {
-                algorithm = AwsSigningAlgorithm.SIGV4
-                signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
-                region = "us-east-1"
-                service = "service"
-                date = TEST_DATE_EPOCH_MILLI
-                credentialsProvider = provider
-                useDoubleUriEncode = true
-                normalizeUriPath = true
-                signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
-                expirationInSeconds = 60
-            }
-
-            val signedRequest = AwsSigner.signRequest(request, signingConfig)
-            assertTrue(signedRequest.headers.contains("X-Amz-Date", "20150830T123600Z"), "${signedRequest.headers}")
-            assertTrue(
-                signedRequest.headers.contains(
-                    "Authorization",
-                    "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=28038455d6de14eafc1f9222cf5aa6f1a96197d7deb8263271d420d138af7f11",
-                ),
-                "sigv4 authorization not equal: " + signedRequest.headers["Authorization"],
-            )
+        val request = createSigV4TestSuiteRequest()
+        val signingConfig = AwsSigningConfig.build {
+            algorithm = AwsSigningAlgorithm.SIGV4
+            signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
+            region = "us-east-1"
+            service = "service"
+            date = TEST_DATE_EPOCH_MILLI
+            credentials = Credentials(TEST_ACCESS_KEY_ID, TEST_SECRET_ACCESS_KEY, null)
+            useDoubleUriEncode = true
+            normalizeUriPath = true
+            signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
+            expirationInSeconds = 60
         }
+
+        val signedRequest = AwsSigner.signRequest(request, signingConfig)
+        assertTrue(signedRequest.headers.contains("X-Amz-Date", "20150830T123600Z"), "${signedRequest.headers}")
+        assertTrue(
+            signedRequest.headers.contains(
+                "Authorization",
+                "AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20150830/us-east-1/service/aws4_request, SignedHeaders=host;x-amz-date, Signature=28038455d6de14eafc1f9222cf5aa6f1a96197d7deb8263271d420d138af7f11",
+            ),
+            "sigv4 authorization not equal: " + signedRequest.headers["Authorization"],
+        )
     }
 
-    @Ignore // FIXME Enable when Kotlin/Native implementation is complete
     @Test
     fun testSigningFailureBadRequest() = runTest {
-        StaticCredentialsProvider.build {
-            accessKeyId = TEST_ACCESS_KEY_ID
-            secretAccessKey = TEST_SECRET_ACCESS_KEY
-        }.use { provider ->
-            val request = createUnsignableRequest("POST", "/bad")
-            val signingConfig = AwsSigningConfig.build {
-                algorithm = AwsSigningAlgorithm.SIGV4
-                signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
-                region = "us-east-1"
-                service = "service"
-                date = Platform.epochMilliNow()
-                credentialsProvider = provider
-                useDoubleUriEncode = true
-                normalizeUriPath = true
-                signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
-            }
-
-            val ex = assertFailsWith<CrtRuntimeException> {
-                AwsSigner.signRequest(request, signingConfig)
-            }
-            assertEquals("AWS_AUTH_SIGNING_ILLEGAL_REQUEST_HEADER", ex.errorName)
+        val request = createUnsignableRequest("POST", "/bad")
+        val signingConfig = AwsSigningConfig.build {
+            algorithm = AwsSigningAlgorithm.SIGV4
+            signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
+            region = "us-east-1"
+            service = "service"
+            date = Platform.epochMilliNow()
+            credentials = Credentials(TEST_ACCESS_KEY_ID, TEST_SECRET_ACCESS_KEY, null)
+            useDoubleUriEncode = true
+            normalizeUriPath = true
+            signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
+        }
+
+        val ex = assertFailsWith<CrtRuntimeException> {
+            AwsSigner.signRequest(request, signingConfig)
         }
+        assertEquals("AWS_AUTH_SIGNING_ILLEGAL_REQUEST_HEADER", ex.errorName)
     }
 
-    @Ignore // FIXME Enable when Kotlin/Native implementation is complete
     @Test
     fun testSigningSigV4Asymmetric() = runTest {
-        StaticCredentialsProvider.build {
-            accessKeyId = TEST_ACCESS_KEY_ID
-            secretAccessKey = TEST_SECRET_ACCESS_KEY
-        }.use { provider ->
-            val request = createSigV4TestSuiteRequest()
-            val signingConfig = AwsSigningConfig.build {
-                algorithm = AwsSigningAlgorithm.SIGV4_ASYMMETRIC
-                signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
-                region = "us-east-1"
-                service = "service"
-                date = TEST_DATE_EPOCH_MILLI
-                credentialsProvider = provider
-                useDoubleUriEncode = true
-                normalizeUriPath = true
-                signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
-                expirationInSeconds = 60
-            }
-
-            val signedRequest = AwsSigner.signRequest(request, signingConfig)
-            assertTrue(signedRequest.headers.contains("X-Amz-Date", "20150830T123600Z"), "${signedRequest.headers}")
-            val prefix = "AWS4-ECDSA-P256-SHA256 Credential=AKIDEXAMPLE/20150830/service/aws4_request, SignedHeaders=host;x-amz-date;x-amz-region-set, Signature="
-            assertTrue(signedRequest.headers["Authorization"]!!.contains(prefix), signedRequest.headers["Authorization"])
+        val request = createSigV4TestSuiteRequest()
+        val signingConfig = AwsSigningConfig.build {
+            algorithm = AwsSigningAlgorithm.SIGV4_ASYMMETRIC
+            signatureType = AwsSignatureType.HTTP_REQUEST_VIA_HEADERS
+            region = "us-east-1"
+            service = "service"
+            date = TEST_DATE_EPOCH_MILLI
+            credentials = Credentials(TEST_ACCESS_KEY_ID, TEST_SECRET_ACCESS_KEY, null)
+            useDoubleUriEncode = true
+            normalizeUriPath = true
+            signedBodyValue = AwsSignedBodyValue.EMPTY_SHA256
+            expirationInSeconds = 60
         }
+
+        val signedRequest = AwsSigner.signRequest(request, signingConfig)
+        assertTrue(signedRequest.headers.contains("X-Amz-Date", "20150830T123600Z"), "${signedRequest.headers}")
+        val prefix = "AWS4-ECDSA-P256-SHA256 Credential=AKIDEXAMPLE/20150830/service/aws4_request, SignedHeaders=host;x-amz-date;x-amz-region-set, Signature="
+        assertTrue(signedRequest.headers["Authorization"]!!.contains(prefix), signedRequest.headers["Authorization"])
     }
 
-    @Ignore // FIXME Enable when Kotlin/Native implementation is complete
     @Test
     fun testSigningChunkTrailingHeaders() = runTest {
-        StaticCredentialsProvider.build {
-            accessKeyId = "AKID"
-            secretAccessKey = "SECRET"
-        }.use { provider ->
-
-            val creds = provider.getCredentials()
-
-            val signingConfig = AwsSigningConfig.build {
-                algorithm = AwsSigningAlgorithm.SIGV4
-                signatureType = AwsSignatureType.HTTP_REQUEST_TRAILING_HEADERS
-                region = "foo"
-                service = "bar"
-                date = 1651022625000
-                credentialsProvider = provider
-                credentials = creds
-            }
-
-            val trailingHeaders = Headers.build {
-                append("x-amz-checksum-crc32", "AAAAAA==")
-                append("x-amz-arbitrary-header-with-value", "test")
-            }
-
-            val previousSignature = "106d0654706e3e8dde144d69ca9882ea38d4d72576056c724ba763f8ed3074f3".encodeToByteArray()
-
-            val signature = AwsSigner.signChunkTrailer(trailingHeaders, previousSignature, signingConfig).signature.decodeToString()
-            val expectedSignature = "24f8ed01c7add645b75e65d2382fae5233b97526fdd1a2c4094933b93f6a08bf" // validated using DefaultAwsSigner
-            assertEquals(expectedSignature, signature)
+        val signingConfig = AwsSigningConfig.build {
+            algorithm = AwsSigningAlgorithm.SIGV4
+            signatureType = AwsSignatureType.HTTP_REQUEST_TRAILING_HEADERS
+            region = "foo"
+            service = "bar"
+            date = 1651022625000
+            credentials = Credentials(TEST_ACCESS_KEY_ID, TEST_SECRET_ACCESS_KEY, null)
+        }
+
+        val trailingHeaders = Headers.build {
+            append("x-amz-checksum-crc32", "AAAAAA==")
+            append("x-amz-arbitrary-header-with-value", "test")
         }
+
+        val previousSignature = "106d0654706e3e8dde144d69ca9882ea38d4d72576056c724ba763f8ed3074f3".encodeToByteArray()
+
+        val signature = AwsSigner.signChunkTrailer(trailingHeaders, previousSignature, signingConfig).signature.decodeToString()
+        val expectedSignature = "8b578658fa1705d62bf26aa73e764ac4b705e6d9efd223a2d9e156580f085de4" // validated using DefaultAwsSigner
+        assertEquals(expectedSignature, signature)
     }
-}
+}
@@ -20,9 +20,16 @@ headers = aws/common/allocator.h \
         aws/http/request_response.h \
         aws/http/proxy.h \
         aws/compression/compression.h \
+        aws/auth/credentials.h \
+        aws/auth/signing.h \
+        aws/auth/signing_config.h \
+        aws/auth/signable.h \
+        aws/auth/signing_result.h \
+        aws/compression/compression.h \
         aws/cal/hash.h \
+        aws/cal/cal.h \
         aws/checksums/crc.h
-headerFilter = aws/common/* aws/io/* aws/http/* aws/compression/* aws/cal/* aws/checksums/*
+headerFilter = aws/common/* aws/io/* aws/http/* aws/compression/* aws/auth/* aws/checksums/* aws/cal/*
 
 linkerOpts.osx = -framework Security
 linkerOpts.ios = -framework Security

@@ -34,6 +34,8 @@ public actual object CRT {
             aws_compression_library_init(Allocator.Default)
             aws_io_library_init(Allocator.Default)
             aws_http_library_init(Allocator.Default)
+            aws_auth_library_init(Allocator.Default)
+            aws_cal_library_init(Allocator.Default)
 
             Logging.initialize(config)
             aws_register_log_subject_info_list(s_crt_log_subject_list.ptr)
@@ -110,6 +112,7 @@ private fun cleanup() {
     aws_compression_library_clean_up()
     aws_io_library_clean_up()
     aws_common_library_clean_up()
+    aws_auth_library_clean_up()
 
     s_crt_kotlin_clean_up()
 }
@@ -8,19 +8,10 @@ package aws.sdk.kotlin.crt.auth.credentials
 /**
  * A credentials provider for a fixed set of credentials
  */
-public actual class StaticCredentialsProvider internal actual constructor(builder: StaticCredentialsProviderBuilder) :
-    CredentialsProvider {
+public actual class StaticCredentialsProvider internal actual constructor(private val builder: StaticCredentialsProviderBuilder) : CredentialsProvider {
     public actual companion object {}
-
-    override suspend fun getCredentials(): Credentials {
-        TODO("Not yet implemented")
-    }
-
-    override fun close() {
-        TODO("Not yet implemented")
-    }
-
-    override suspend fun waitForShutdown() {
-        TODO("Not yet implemented")
-    }
+    override suspend fun getCredentials(): Credentials =
+        Credentials(builder.accessKeyId!!, builder.secretAccessKey!!, builder.sessionToken)
+    override fun close() { }
+    override suspend fun waitForShutdown() { }
 }