binoculars/aws-sigv4

import {hash, hmac, normalize} from 'deps';

/** @function
 * Computes the hash
 *
 * @name hash
 * @param {!string} data - The data to hash
 * @returns {Promise<string>} - The hashed output
 */
export {hash};

const algorithm = 'AWS4-HMAC-SHA256';
const emptyHash = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855';

/**
 * Formats a Date object to an AWS date string
 *
 * @param {!Date} date - The date
 * @returns {string} - The formatted date string
 */
export function formatDateTime(date) {
    return date
        .toISOString()
        .replace(/-|:|(\.\d+)/g, '');
}

/**
 * Creates the canonical request
 * https://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html
 *
 * @param {!string} httpRequestMethod - The HTTP request method (e.g. `GET` or `POST`)
 * @param {!string} canonicalURI - The canonical URI
 * @param {!string} canonicalQueryString - The canonical query string
 * @param {!string} canonicalHeaders - The canonical headers
 * @param {!string} signedHeaders - The signed headers
 * @param {!string} requestPayload - The payload of the request
 * @returns {Promise<string>} - The canonical request
 */
export async function buildCanonicalRequest(httpRequestMethod, canonicalURI, canonicalQueryString, canonicalHeaders,
                                            signedHeaders, requestPayload='') {
    return [
        httpRequestMethod,
        canonicalURI,
        canonicalQueryString,
        canonicalHeaders,
        '',
        signedHeaders,
        await (requestPayload ? hash(requestPayload) : emptyHash)
    ].join('\n');
}

/**
 * Creates the string to sign
 * https://docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html
 *
 * @param {!string} requestDate - The request date (`YYYMMDDThhmmssZ`)
 * @param {!string} credentialScope - the credential scope (formatted as `YYYYMMDD/region/service/aws4_request`)
 * @param {!string} hashedCanonicalRequest
 * @returns {string} - The string to sign
 */
export function buildStringToSign(requestDate, credentialScope, hashedCanonicalRequest) {
    return [
        algorithm,
        requestDate,
        credentialScope,
        hashedCanonicalRequest
    ].join('\n');
}

/**
 * Pre-calculates the signing key
 * https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
 *
 * @param {!string} secretAccessKey - The secret access key for the AWS account
 * @param {!string} date - The date in YYYYMMDD format
 * @param {!string} region - The AWS region (e.g. `us-east-1`)
 * @param {!string} service - The AWS service (e.g. `iam`)
 * @returns {Promise<string>} - The pre-calculated signing key
 */
export async function preCalculateSigningKey(secretAccessKey, date, region, service) {
    return [
        date,
        region,
        service,
        'aws4_request'
    ].reduce(
        async (acc, val) => hmac(await acc, val),
        `AWS4${secretAccessKey}`
    );
}

/**
 * Pre-calculates the signature
 * https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
 *
 * @param {!string} signingKey - The pre-calculated signing key
 * @param {!string} stringToSign - The string to sign
 * @returns {Promise<string>} - The pre-calculated signature
 */
export function preCalculatedSign(signingKey, stringToSign) {
    return hmac(signingKey, stringToSign, 'hex');
}

/**
 * Calculates the signature
 * https://docs.aws.amazon.com/general/latest/gr/sigv4-calculate-signature.html
 *
 * @param {!string} secretAccessKey - The secret access key for the AWS account
 * @param {!string} date - The date in YYYYMMDD format
 * @param {!string} region - The AWS region (e.g. `us-east-1`)
 * @param {!string} service - The AWS service (e.g. `iam`)
 * @param {!string} stringToSign - The string to sign
 * @returns {Promise<string>} - The signature
 */
export async function sign(secretAccessKey, date, region, service, stringToSign) {
    const signingKey = await preCalculateSigningKey(secretAccessKey, date, region, service);

    return preCalculatedSign(signingKey, stringToSign);
}

/**
 * Creates the authorization string
 * https://docs.aws.amazon.com/general/latest/gr/sigv4-add-signature-to-request.html
 *
 * @param {!string} accessKeyId
 * @param {!string} credentialScope
 * @param {!string} signedHeaders
 * @param {!string} signature
 * @returns {string}
 */
export function buildAuthorization(accessKeyId, credentialScope, signedHeaders, signature) {
    return algorithm + ' ' + [
        ['Credential', `${accessKeyId}/${credentialScope}`],
        ['SignedHeaders', signedHeaders],
        ['Signature', signature]
    ]
        .map(item => item.join('='))
        .join(', ');
}