|
| 1 | +/** |
| 2 | +* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 3 | + * SPDX-License-Identifier: Apache-2.0. |
| 4 | + */ |
| 5 | +#pragma once |
| 6 | + |
| 7 | +#include <smithy/identity/auth/AuthOption.h> |
| 8 | +#include <smithy/identity/identity/AwsIdentity.h> |
| 9 | +#include <smithy/identity/resolver/AwsIdentityResolverBase.h> |
| 10 | +#include <smithy/identity/signer/AwsSignerBase.h> |
| 11 | + |
| 12 | +#include <aws/core/utils/FutureOutcome.h> |
| 13 | +#include <aws/core/client/AWSError.h> |
| 14 | +#include <aws/core/http/HttpRequest.h> |
| 15 | + |
| 16 | +#include <aws/crt/Variant.h> |
| 17 | +#include <aws/crt/Optional.h> |
| 18 | +#include <aws/core/utils/memory/stl/AWSMap.h> |
| 19 | + |
| 20 | +#include <cassert> |
| 21 | + |
| 22 | + |
| 23 | +namespace smithy |
| 24 | +{ |
| 25 | + template <typename AuthSchemesVariantT> |
| 26 | + class AwsClientRequestSigning |
| 27 | + { |
| 28 | + public: |
| 29 | + using HttpRequest = Aws::Http::HttpRequest; |
| 30 | + using SigningError = Aws::Client::AWSError<Aws::Client::CoreErrors>; |
| 31 | + using SigningOutcome = Aws::Utils::FutureOutcome<Aws::Http::HttpRequest, SigningError>; |
| 32 | + |
| 33 | + static SigningOutcome SignRequest(const HttpRequest& HTTPRequest, const AuthOption& authOption, |
| 34 | + const Aws::UnorderedMap<Aws::String, AuthSchemesVariantT>& authSchemes) |
| 35 | + { |
| 36 | + auto authSchemeIt = authSchemes.find(authOption.schemeId); |
| 37 | + if (authSchemeIt == authSchemes.end()) |
| 38 | + { |
| 39 | + assert(!"Auth scheme has not been found for a given auth option!"); |
| 40 | + return (SigningError(Aws::Client::CoreErrors::CLIENT_SIGNING_FAILURE, |
| 41 | + "", |
| 42 | + "Requested AuthOption was not found within client Auth Schemes", |
| 43 | + false/*retryable*/)); |
| 44 | + } |
| 45 | + |
| 46 | + AuthSchemesVariantT authScheme = *authSchemeIt; |
| 47 | + |
| 48 | + return SignWithAuthScheme(HTTPRequest, authScheme, authOption); |
| 49 | + } |
| 50 | + |
| 51 | + protected: |
| 52 | + struct SignerVisitor |
| 53 | + { |
| 54 | + SignerVisitor(const HttpRequest& httpRequest, const AuthOption& targetAuthOption) |
| 55 | + : m_httpRequest(httpRequest), m_targetAuthOption(targetAuthOption) |
| 56 | + { |
| 57 | + } |
| 58 | + |
| 59 | + const HttpRequest& m_httpRequest; |
| 60 | + const AuthOption& m_targetAuthOption; |
| 61 | + |
| 62 | + Aws::Crt::Optional<SigningOutcome> result; |
| 63 | + |
| 64 | + template <typename AuthSchemeAlternativeT> |
| 65 | + void operator()(AuthSchemeAlternativeT& authScheme) |
| 66 | + { |
| 67 | + // Auth Scheme Variant alternative contains the requested auth option |
| 68 | + assert(strcmp(authScheme.schemeId, m_targetAuthOption.schemeId) == 0); |
| 69 | + |
| 70 | + using IdentityT = typename decltype(authScheme)::IdentityT; |
| 71 | + using IdentityResolver = IdentityResolverBase<IdentityT>; |
| 72 | + using Signer = AwsSignerBase<IdentityT>; |
| 73 | + |
| 74 | + std::shared_ptr<IdentityResolver> identityResolver = authScheme.identityResolver(); |
| 75 | + if (!identityResolver) |
| 76 | + { |
| 77 | + result.emplace(SigningError(Aws::Client::CoreErrors::CLIENT_SIGNING_FAILURE, |
| 78 | + "", |
| 79 | + "Auth scheme provided a nullptr identityResolver", |
| 80 | + false/*retryable*/)); |
| 81 | + return; |
| 82 | + } |
| 83 | + |
| 84 | + static_assert( |
| 85 | + std::is_same<IdentityResolverBase<IdentityT>, typename decltype(identityResolver |
| 86 | + )::IdentityT>::value); |
| 87 | + static_assert(std::is_base_of<IdentityResolverBase<IdentityT>, decltype(identityResolver)>::value); |
| 88 | + |
| 89 | + IdentityT identity = identityResolver->getIdentity(m_targetAuthOption.identityProperties); |
| 90 | + |
| 91 | + std::shared_ptr<Signer> signer = authScheme.signer(); |
| 92 | + if (!signer) |
| 93 | + { |
| 94 | + result.emplace(SigningError(Aws::Client::CoreErrors::CLIENT_SIGNING_FAILURE, |
| 95 | + "", |
| 96 | + "Auth scheme provided a nullptr signer", |
| 97 | + false/*retryable*/)); |
| 98 | + return; |
| 99 | + } |
| 100 | + |
| 101 | + |
| 102 | + static_assert(std::is_same<AwsSignerBase<IdentityT>, typename decltype(signer)::IdentityT>::value); |
| 103 | + static_assert(std::is_base_of<AwsSignerBase<IdentityT>, decltype(signer)>::value); |
| 104 | + |
| 105 | + result.emplace(signer->sign(m_httpRequest, identity, m_targetAuthOption.signerProperties)); |
| 106 | + } |
| 107 | + }; |
| 108 | + |
| 109 | + static |
| 110 | + SigningOutcome SignWithAuthScheme(const HttpRequest& HTTPRequest, const AuthSchemesVariantT& authSchemesVariant, |
| 111 | + const AuthOption& targetAuthOption) |
| 112 | + { |
| 113 | + SignerVisitor visitor(HTTPRequest, targetAuthOption); |
| 114 | + visitor.Visit(authSchemesVariant); |
| 115 | + |
| 116 | + if (!visitor.result) |
| 117 | + { |
| 118 | + return (SigningError(Aws::Client::CoreErrors::CLIENT_SIGNING_FAILURE, |
| 119 | + "", |
| 120 | + "Failed to sign with an unknown error", |
| 121 | + false/*retryable*/)); |
| 122 | + } |
| 123 | + return std::move(*visitor.result); |
| 124 | + } |
| 125 | + }; |
| 126 | +} |
0 commit comments