happyskills 1.4.0 → 1.4.1

package/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [1.4.1] - 2026-06-03
+
+### Fixed
+- Send the `x-amz-content-sha256` payload-hash header on bodyless POST/DELETE requests so CloudFront OAC SigV4 signing accepts them. It was previously set only when a request had a body, so bodyless authenticated mutations (`star`, `unstar`, `delete`, `people remove`, `groups delete`, `access revoke`) were rejected by the Lambda Function URL with a 403 signature mismatch.
+
 ## [1.4.0] - 2026-06-03
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "happyskills",
-	"version": "1.4.0",
+	"version": "1.4.1",
 	"description": "Package manager for AI agent skills",
 	"license": "SEE LICENSE IN LICENSE",
 	"author": "Nicolas Dao <nic@cloudlesslabs.com> (https://cloudlesslabs.com)",

package/src/api/client.js

@@ -40,8 +40,15 @@ const request = (method, path, options = {}) => catch_errors(`API ${method} ${pa
 		headers['Content-Type'] = 'application/json'
 	}
 
-	if (body_str) {
-		headers['x-amz-content-sha256'] = createHash('sha256').update(body_str).digest('hex')
+	// CloudFront OAC signs requests to the Lambda Function URL with SigV4, which
+	// covers the payload hash via x-amz-content-sha256. GET/HEAD carry no body and
+	// OAC uses the empty-string hash deterministically, so they work without it.
+	// But body-carrying methods (POST/PUT/PATCH/DELETE) MUST send the header or the
+	// Function URL rejects the signature with a 403 — and that applies even when the
+	// specific request has no body (e.g. `star`/`unstar`, `delete`, `people remove`).
+	// The correct hash for an empty body is sha256(''). See docs/gotchas/deployment.md § 2.1.
+	if (method !== 'GET' && method !== 'HEAD') {
+		headers['x-amz-content-sha256'] = createHash('sha256').update(body_str || '').digest('hex')
 	}
 
 	let res

package/src/api/client.test.js

@@ -0,0 +1,53 @@
+// Run with: node --test src/api/client.test.js
+//
+// Pins the x-amz-content-sha256 payload-hash header that CloudFront OAC requires
+// to SigV4-sign requests to the Lambda Function URL. The original bug: the header
+// was set only when a body existed, so bodyless authed mutations (star/unstar,
+// delete, people remove, ...) reached the Function URL without it and were
+// rejected with a 403 signature mismatch. GET/HEAD are exempt — OAC uses the
+// deterministic empty-string hash for them. See docs/gotchas/deployment.md § 2.1.
+
+const { describe, it } = require('node:test')
+const assert = require('node:assert/strict')
+const crypto = require('node:crypto')
+const client = require('./client')
+
+const EMPTY_SHA = crypto.createHash('sha256').update('').digest('hex')
+
+// Run a client call with global.fetch stubbed to capture the outgoing request.
+const capture_request = async (fn) => {
+	const orig = global.fetch
+	const captured = {}
+	global.fetch = async (url, opts) => {
+		captured.url = url
+		captured.method = opts.method
+		captured.headers = opts.headers
+		captured.body = opts.body
+		return { ok: true, status: 200, headers: { get: () => null }, json: async () => ({ data: {} }) }
+	}
+	try { await fn() } finally { global.fetch = orig }
+	return captured
+}
+
+describe('api client — x-amz-content-sha256 (CloudFront OAC SigV4 payload hash)', () => {
+	it('bodyless POST sends the empty-string payload hash (regression: star → 403)', async () => {
+		const c = await capture_request(() => client.post('/repos/acme/deploy-aws/star', undefined, { auth: false }))
+		assert.equal(c.headers['x-amz-content-sha256'], EMPTY_SHA)
+	})
+
+	it('bodyless DELETE sends the empty-string payload hash (regression: unstar/delete → 403)', async () => {
+		const c = await capture_request(() => client.del('/repos/acme/deploy-aws/star', { auth: false }))
+		assert.equal(c.headers['x-amz-content-sha256'], EMPTY_SHA)
+	})
+
+	it('POST with a body sends the body hash (unchanged)', async () => {
+		const c = await capture_request(() => client.post('/repos:search', { q: 'x' }, { auth: false }))
+		const expected = crypto.createHash('sha256').update(JSON.stringify({ q: 'x' })).digest('hex')
+		assert.equal(c.headers['x-amz-content-sha256'], expected)
+	})
+
+	it('GET does not send the header (OAC uses the deterministic empty hash)', async () => {
+		const c = await capture_request(() => client.get('/repos/acme/deploy-aws', { auth: false }))
+		assert.equal(c.headers['x-amz-content-sha256'], undefined)
+	})
+})