@apteva/integrations 0.3.62 → 0.15.4

package/dist/aws-sigv4.d.ts

@@ -0,0 +1,32 @@
+export interface SignRequestOptions {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body?: string | Buffer | undefined;
+    service: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    /** Override the request timestamp; defaults to now. Mostly for tests. */
+    now?: Date;
+}
+/**
+ * AWS Signature Version 4 signer for HTTPS REST/JSON endpoints (SES v2,
+ * Lambda, DynamoDB, etc.).
+ *
+ * Returns the headers that must be merged into the outgoing request.
+ * The caller is responsible for actually setting them — this function
+ * does not mutate `headers` in place.
+ *
+ * Notes:
+ *  - The Host header is included in the canonical request via the URL's
+ *    hostname; we do not need to set it on the outgoing fetch (Node /
+ *    undici sets it from the URL automatically and that's what the AWS
+ *    server validates).
+ *  - For S3 the URI canonicalization is different (no double-encoding).
+ *    SES, Lambda, DynamoDB, etc. all use the standard form implemented
+ *    here; do not reuse this signer for S3.
+ */
+export declare function signAwsRequest(opts: SignRequestOptions): Record<string, string>;
+//# sourceMappingURL=aws-sigv4.d.ts.map

package/dist/aws-sigv4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sigv4.d.ts","sourceRoot":"","sources":["../src/aws-sigv4.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0E/E"}

package/dist/aws-sigv4.js

@@ -0,0 +1,126 @@
+import { createHash, createHmac } from "node:crypto";
+/**
+ * AWS Signature Version 4 signer for HTTPS REST/JSON endpoints (SES v2,
+ * Lambda, DynamoDB, etc.).
+ *
+ * Returns the headers that must be merged into the outgoing request.
+ * The caller is responsible for actually setting them — this function
+ * does not mutate `headers` in place.
+ *
+ * Notes:
+ *  - The Host header is included in the canonical request via the URL's
+ *    hostname; we do not need to set it on the outgoing fetch (Node /
+ *    undici sets it from the URL automatically and that's what the AWS
+ *    server validates).
+ *  - For S3 the URI canonicalization is different (no double-encoding).
+ *    SES, Lambda, DynamoDB, etc. all use the standard form implemented
+ *    here; do not reuse this signer for S3.
+ */
+export function signAwsRequest(opts) {
+    const url = new URL(opts.url);
+    const host = url.host;
+    const now = opts.now ?? new Date();
+    const amzDate = formatAmzDate(now); // YYYYMMDDTHHMMSSZ
+    const dateStamp = amzDate.slice(0, 8); // YYYYMMDD
+    const bodyBytes = opts.body == null
+        ? Buffer.alloc(0)
+        : typeof opts.body === "string"
+            ? Buffer.from(opts.body, "utf8")
+            : opts.body;
+    const payloadHash = sha256Hex(bodyBytes);
+    // Build canonical headers — host, x-amz-date, x-amz-content-sha256,
+    // and (if present) x-amz-security-token. We deliberately do not pull
+    // arbitrary headers from `opts.headers` into the signed set: keeping
+    // the signed-headers list minimal and known avoids drift between what
+    // we sign and what fetch actually sends (some headers like
+    // Content-Length are added by the runtime).
+    const headersToSign = {
+        host,
+        "x-amz-content-sha256": payloadHash,
+        "x-amz-date": amzDate,
+    };
+    if (opts.sessionToken) {
+        headersToSign["x-amz-security-token"] = opts.sessionToken;
+    }
+    const sortedHeaderNames = Object.keys(headersToSign).sort();
+    const canonicalHeaders = sortedHeaderNames
+        .map((n) => `${n}:${headersToSign[n].trim()}`)
+        .join("\n") + "\n";
+    const signedHeaders = sortedHeaderNames.join(";");
+    const canonicalQueryString = canonicalizeQuery(url.searchParams);
+    const canonicalUri = canonicalizePath(url.pathname);
+    const canonicalRequest = [
+        opts.method.toUpperCase(),
+        canonicalUri,
+        canonicalQueryString,
+        canonicalHeaders,
+        signedHeaders,
+        payloadHash,
+    ].join("\n");
+    const credentialScope = `${dateStamp}/${opts.region}/${opts.service}/aws4_request`;
+    const stringToSign = [
+        "AWS4-HMAC-SHA256",
+        amzDate,
+        credentialScope,
+        sha256Hex(Buffer.from(canonicalRequest, "utf8")),
+    ].join("\n");
+    const kDate = hmac(`AWS4${opts.secretAccessKey}`, dateStamp);
+    const kRegion = hmac(kDate, opts.region);
+    const kService = hmac(kRegion, opts.service);
+    const kSigning = hmac(kService, "aws4_request");
+    const signature = hmac(kSigning, stringToSign).toString("hex");
+    const authorization = `AWS4-HMAC-SHA256 Credential=${opts.accessKeyId}/${credentialScope}, ` +
+        `SignedHeaders=${signedHeaders}, Signature=${signature}`;
+    const out = {
+        "X-Amz-Date": amzDate,
+        "X-Amz-Content-Sha256": payloadHash,
+        Authorization: authorization,
+    };
+    if (opts.sessionToken)
+        out["X-Amz-Security-Token"] = opts.sessionToken;
+    return out;
+}
+function sha256Hex(buf) {
+    return createHash("sha256").update(buf).digest("hex");
+}
+function hmac(key, data) {
+    return createHmac("sha256", key).update(data, "utf8").digest();
+}
+function formatAmzDate(d) {
+    const pad = (n) => n.toString().padStart(2, "0");
+    return (d.getUTCFullYear().toString() +
+        pad(d.getUTCMonth() + 1) +
+        pad(d.getUTCDate()) +
+        "T" +
+        pad(d.getUTCHours()) +
+        pad(d.getUTCMinutes()) +
+        pad(d.getUTCSeconds()) +
+        "Z");
+}
+// SigV4 canonical URI: each segment URI-encoded (RFC 3986). For non-S3
+// services AWS expects double-encoding of any already-encoded chars,
+// but in practice if the path comes from a literal template and uses
+// only safe characters + `/`, single-encoding via encodeURIComponent
+// per segment is correct.
+function canonicalizePath(pathname) {
+    if (!pathname || pathname === "")
+        return "/";
+    return pathname
+        .split("/")
+        .map((seg) => (seg === "" ? "" : encodeRfc3986(seg)))
+        .join("/");
+}
+function canonicalizeQuery(sp) {
+    const pairs = [];
+    sp.forEach((v, k) => pairs.push([k, v]));
+    pairs.sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : a[1] < b[1] ? -1 : 1));
+    return pairs
+        .map(([k, v]) => `${encodeRfc3986(k)}=${encodeRfc3986(v)}`)
+        .join("&");
+}
+// encodeURIComponent leaves !'()* unencoded; AWS canonicalization
+// requires they be encoded. Patch them up.
+function encodeRfc3986(s) {
+    return encodeURIComponent(s).replace(/[!'()*]/g, (c) => "%" + c.charCodeAt(0).toString(16).toUpperCase());
+}
+//# sourceMappingURL=aws-sigv4.js.map

package/dist/aws-sigv4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-sigv4.js","sourceRoot":"","sources":["../src/aws-sigv4.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAgBrD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;IAElD,MAAM,SAAS,GACb,IAAI,CAAC,IAAI,IAAI,IAAI;QACf,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IAClB,MAAM,WAAW,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAEzC,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,sEAAsE;IACtE,2DAA2D;IAC3D,4CAA4C;IAC5C,MAAM,aAAa,GAA2B;QAC5C,IAAI;QACJ,sBAAsB,EAAE,WAAW;QACnC,YAAY,EAAE,OAAO;KACtB,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,aAAa,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IAC5D,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,MAAM,gBAAgB,GACpB,iBAAiB;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;SAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,MAAM,aAAa,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAElD,MAAM,oBAAoB,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAEpD,MAAM,gBAAgB,GAAG;QACvB,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;QACzB,YAAY;QACZ,oBAAoB;QACpB,gBAAgB;QAChB,aAAa;QACb,WAAW;KACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,eAAe,GAAG,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,eAAe,CAAC;IACnF,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,OAAO;QACP,eAAe;QACf,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;KACjD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE/D,MAAM,aAAa,GACjB,+BAA+B,IAAI,CAAC,WAAW,IAAI,eAAe,IAAI;QACtE,iBAAiB,aAAa,eAAe,SAAS,EAAE,CAAC;IAE3D,MAAM,GAAG,GAA2B;QAClC,YAAY,EAAE,OAAO;QACrB,sBAAsB,EAAE,WAAW;QACnC,aAAa,EAAE,aAAa;KAC7B,CAAC;IACF,IAAI,IAAI,CAAC,YAAY;QAAE,GAAG,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;IACvE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,IAAI,CAAC,GAAoB,EAAE,IAAY;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,aAAa,CAAC,CAAO;IAC5B,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,CACL,CAAC,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE;QAC7B,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACxB,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QACnB,GAAG;QACH,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACpB,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtB,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACtB,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,0BAA0B;AAC1B,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,EAAE;QAAE,OAAO,GAAG,CAAC;IAC7C,OAAO,QAAQ;SACZ,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;SACpD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAmB;IAC5C,MAAM,KAAK,GAAuB,EAAE,CAAC;IACrC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,OAAO,KAAK;SACT,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,kEAAkE;AAClE,2CAA2C;AAC3C,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAClC,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CACxD,CAAC;AACJ,CAAC"}