|
|
"use strict";
|
|
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
const crypto = require("crypto");
|
|
|
const utils_1 = require("./utils");
|
|
|
const utils_lang_1 = require("./utils.lang");
|
|
|
const keyvalue_1 = require("./keyvalue");
|
|
|
const url_1 = require("url");
|
|
|
const debug = require('util').debuglog('@cloudbase/signature');
|
|
|
const isStream = require('is-stream');
|
|
|
exports.signedParamsSeparator = ';';
|
|
|
const HOST_KEY = 'host';
|
|
|
const CONTENT_TYPE_KEY = 'content-type';
|
|
|
var MIME;
|
|
|
(function (MIME) {
|
|
|
MIME["MULTIPART_FORM_DATA"] = "multipart/form-data";
|
|
|
MIME["APPLICATION_JSON"] = "application/json";
|
|
|
})(MIME || (MIME = {}));
|
|
|
class Signer {
|
|
|
constructor(credential, service, options = {}) {
|
|
|
this.credential = credential;
|
|
|
this.service = service;
|
|
|
this.algorithm = 'TC3-HMAC-SHA256';
|
|
|
this.options = options;
|
|
|
}
|
|
|
static camSafeUrlEncode(str) {
|
|
|
return encodeURIComponent(str)
|
|
|
.replace(/!/g, '%21')
|
|
|
.replace(/'/g, '%27')
|
|
|
.replace(/\(/g, '%28')
|
|
|
.replace(/\)/g, '%29')
|
|
|
.replace(/\*/g, '%2A');
|
|
|
}
|
|
|
/**
|
|
|
* 将一个对象处理成 KeyValue 形式，嵌套的对象将会被处理成字符串，Key转换成小写字母
|
|
|
* @param {Object} obj - 待处理的对象
|
|
|
* @param {Object} options
|
|
|
* @param {Boolean} options.enableBuffer
|
|
|
*/
|
|
|
static formatKeyAndValue(obj, options = {}) {
|
|
|
if (!utils_lang_1.isPlainObject(obj)) {
|
|
|
return obj;
|
|
|
}
|
|
|
// enableValueToLowerCase：头部字段，要求小写，其他数据不需要小写，所以这里避免转小写
|
|
|
const { multipart, enableValueToLowerCase = false, selectedKeys, filter } = options;
|
|
|
const kv = {};
|
|
|
Object.keys(obj || {}).forEach(key => {
|
|
|
// NOTE: 客户端类型在服务端可能会丢失
|
|
|
const lowercaseKey = Signer.camSafeUrlEncode(key.toLowerCase().trim());
|
|
|
// 过滤 Key，服务端接收到的数据，可能含有未签名的 Key，通常是签名的时候被过滤掉的流，数据量可能会比较大
|
|
|
// 所以这里提供一个过滤的判断，避免不必要的计算
|
|
|
// istanbul ignore next
|
|
|
if (Array.isArray(selectedKeys) && !selectedKeys.includes(lowercaseKey)) {
|
|
|
return;
|
|
|
}
|
|
|
// istanbul ignore next
|
|
|
if (typeof filter === 'function') {
|
|
|
if (filter(key, obj[key], options)) {
|
|
|
return;
|
|
|
}
|
|
|
}
|
|
|
// istanbul ignore else
|
|
|
if (key && obj[key] !== undefined) {
|
|
|
if (lowercaseKey === CONTENT_TYPE_KEY) {
|
|
|
// multipart/form-data; boundary=???
|
|
|
if (obj[key].startsWith(MIME.MULTIPART_FORM_DATA)) {
|
|
|
kv[lowercaseKey] = MIME.MULTIPART_FORM_DATA;
|
|
|
}
|
|
|
else {
|
|
|
kv[lowercaseKey] = obj[key];
|
|
|
}
|
|
|
return;
|
|
|
}
|
|
|
if (isStream(obj[key])) {
|
|
|
// 这里如果是个文件流，在发送的时候可以识别
|
|
|
// 服务端接收到数据之后传到这里判断不出来的
|
|
|
// 所以会进入后边的逻辑
|
|
|
return;
|
|
|
}
|
|
|
else if (utils_1.isNodeEnv() && Buffer.isBuffer(obj[key])) {
|
|
|
if (multipart) {
|
|
|
kv[lowercaseKey] = obj[key];
|
|
|
}
|
|
|
else {
|
|
|
kv[lowercaseKey] = enableValueToLowerCase
|
|
|
? utils_1.stringify(obj[key]).trim().toLowerCase()
|
|
|
: utils_1.stringify(obj[key]).trim();
|
|
|
}
|
|
|
}
|
|
|
else {
|
|
|
kv[lowercaseKey] = enableValueToLowerCase
|
|
|
? utils_1.stringify(obj[key]).trim().toLowerCase()
|
|
|
: utils_1.stringify(obj[key]).trim();
|
|
|
}
|
|
|
}
|
|
|
});
|
|
|
return kv;
|
|
|
}
|
|
|
static calcParamsHash(params, keys = null, options = {}) {
|
|
|
debug(params, 'calcParamsHash');
|
|
|
if (utils_lang_1.isString(params)) {
|
|
|
return utils_1.sha256hash(params);
|
|
|
}
|
|
|
// 只关心业务参数，不关心以什么类型的 Content-Type 传递的
|
|
|
// 所以 application/json multipart/form-data 计算方式是相同的
|
|
|
keys = keys || keyvalue_1.SortedKeyValue.kv(params).keys();
|
|
|
const hash = crypto.createHash('sha256');
|
|
|
for (const key of keys) {
|
|
|
// istanbul ignore next
|
|
|
if (!params[key]) {
|
|
|
continue;
|
|
|
}
|
|
|
// istanbul ignore next
|
|
|
if (isStream(params[key])) {
|
|
|
continue;
|
|
|
}
|
|
|
// string && buffer
|
|
|
hash.update(`&${key}=`);
|
|
|
hash.update(params[key]);
|
|
|
hash.update('\r\n');
|
|
|
}
|
|
|
return hash.digest(options.encoding || 'hex');
|
|
|
}
|
|
|
/**
|
|
|
* 计算签名信息
|
|
|
* @param {string} method - Http Verb：GET/get POST/post 区分大小写
|
|
|
* @param {string} url - 地址：http://abc.org/api/v1?a=1&b=2
|
|
|
* @param {Object} headers - 需要签名的头部字段
|
|
|
* @param {string} params - 请求参数
|
|
|
* @param {number} [timestamp] - 签名时间戳
|
|
|
* @param {object} [options] - 可选参数
|
|
|
*/
|
|
|
tc3sign(method, url, headers, params, timestamp, options = {}) {
|
|
|
timestamp = timestamp || utils_1.second();
|
|
|
const urlInfo = url_1.parse(url);
|
|
|
const formatedHeaders = Signer.formatKeyAndValue(headers, {
|
|
|
enableValueToLowerCase: true
|
|
|
});
|
|
|
const headerKV = keyvalue_1.SortedKeyValue.kv(formatedHeaders);
|
|
|
const signedHeaders = headerKV.keys();
|
|
|
const canonicalHeaders = headerKV.toString(':', '\n') + '\n';
|
|
|
const { enableHostCheck = true, enableContentTypeCheck = true } = options;
|
|
|
if (enableHostCheck && headerKV.get(HOST_KEY) !== urlInfo.host) {
|
|
|
throw new TypeError(`host:${urlInfo.host} in url must be equals to host:${headerKV.get('host')} in headers`);
|
|
|
}
|
|
|
if (enableContentTypeCheck && !headerKV.get(CONTENT_TYPE_KEY)) {
|
|
|
throw new TypeError(`${CONTENT_TYPE_KEY} field must in headers`);
|
|
|
}
|
|
|
const multipart = headerKV.get(CONTENT_TYPE_KEY).startsWith(MIME.MULTIPART_FORM_DATA);
|
|
|
const formatedParams = method.toUpperCase() === 'GET' ? '' : Signer.formatKeyAndValue(params, {
|
|
|
multipart
|
|
|
});
|
|
|
const paramKV = keyvalue_1.SortedKeyValue.kv(formatedParams);
|
|
|
const signedParams = paramKV.keys();
|
|
|
const hashedPayload = Signer.calcParamsHash(formatedParams, null);
|
|
|
const signedUrl = url.replace(/^https?:/, '').split('?')[0];
|
|
|
const canonicalRequest = `${method}\n${signedUrl}\n${urlInfo.query || ''}\n${canonicalHeaders}\n${signedHeaders.join(';')}\n${hashedPayload}`;
|
|
|
debug(canonicalRequest, 'canonicalRequest\n\n');
|
|
|
const date = utils_1.formateDate(timestamp);
|
|
|
const service = this.service;
|
|
|
const algorithm = this.algorithm;
|
|
|
const credentialScope = `${date}/${service}/tc3_request`;
|
|
|
const stringToSign = `${algorithm}\n${timestamp}\n${credentialScope}\n${utils_1.sha256hash(canonicalRequest)}`;
|
|
|
debug(stringToSign, 'stringToSign\n\n');
|
|
|
const secretDate = utils_1.sha256hmac(date, `TC3${this.credential.secretKey}`);
|
|
|
const secretService = utils_1.sha256hmac(service, secretDate);
|
|
|
const secretSigning = utils_1.sha256hmac('tc3_request', secretService);
|
|
|
const signature = utils_1.sha256hmac(stringToSign, secretSigning, 'hex');
|
|
|
debug(secretDate.toString('hex'), 'secretDate');
|
|
|
debug(secretService.toString('hex'), 'secretService');
|
|
|
debug(secretSigning.toString('hex'), 'secretSigning');
|
|
|
debug(signature, 'signature');
|
|
|
const { withSignedParams = false } = options;
|
|
|
return {
|
|
|
// 需注意该字段长度
|
|
|
// https://stackoverflow.com/questions/686217/maximum-on-http-header-values
|
|
|
// https://www.tutorialspoint.com/What-is-the-maximum-size-of-HTTP-header-values
|
|
|
authorization: `${algorithm} Credential=${this.credential.secretId}/${credentialScope},${withSignedParams ? ` SignedParams=${signedParams.join(';')},` : ''} SignedHeaders=${signedHeaders.join(';')}, Signature=${signature}`,
|
|
|
signedParams,
|
|
|
signedHeaders,
|
|
|
signature,
|
|
|
timestamp,
|
|
|
multipart
|
|
|
};
|
|
|
}
|
|
|
}
|
|
|
exports.Signer = Signer;
|
