feat s3api: support aws signature v4

commit_hash:98e7054204568f698d3604a4120c01c320721350

Author: mishasychev

.mapping.json

@@ -3321,6 +3321,7 @@
   "libraries/s3api/CMakeLists.txt":"taxi/uservices/userver/libraries/s3api/CMakeLists.txt",
   "libraries/s3api/include/userver/s3api/authenticators/access_key.hpp":"taxi/uservices/userver/libraries/s3api/include/userver/s3api/authenticators/access_key.hpp",
   "libraries/s3api/include/userver/s3api/authenticators/interface.hpp":"taxi/uservices/userver/libraries/s3api/include/userver/s3api/authenticators/interface.hpp",
+  "libraries/s3api/include/userver/s3api/authenticators/signature_v4.hpp":"taxi/uservices/userver/libraries/s3api/include/userver/s3api/authenticators/signature_v4.hpp",
   "libraries/s3api/include/userver/s3api/authenticators/utils.hpp":"taxi/uservices/userver/libraries/s3api/include/userver/s3api/authenticators/utils.hpp",
   "libraries/s3api/include/userver/s3api/clients/fwd.hpp":"taxi/uservices/userver/libraries/s3api/include/userver/s3api/clients/fwd.hpp",
   "libraries/s3api/include/userver/s3api/clients/s3api.hpp":"taxi/uservices/userver/libraries/s3api/include/userver/s3api/clients/s3api.hpp",
@@ -3333,6 +3334,8 @@
   "libraries/s3api/include/userver/s3api/models/secret.hpp":"taxi/uservices/userver/libraries/s3api/include/userver/s3api/models/secret.hpp",
   "libraries/s3api/library.yaml":"taxi/uservices/userver/libraries/s3api/library.yaml",
   "libraries/s3api/src/s3api/authenticators/access_key.cpp":"taxi/uservices/userver/libraries/s3api/src/s3api/authenticators/access_key.cpp",
+  "libraries/s3api/src/s3api/authenticators/signature_v4.cpp":"taxi/uservices/userver/libraries/s3api/src/s3api/authenticators/signature_v4.cpp",
+  "libraries/s3api/src/s3api/authenticators/signature_v4_test.cpp":"taxi/uservices/userver/libraries/s3api/src/s3api/authenticators/signature_v4_test.cpp",
   "libraries/s3api/src/s3api/authenticators/utils.cpp":"taxi/uservices/userver/libraries/s3api/src/s3api/authenticators/utils.cpp",
   "libraries/s3api/src/s3api/authenticators/utils_test.cpp":"taxi/uservices/userver/libraries/s3api/src/s3api/authenticators/utils_test.cpp",
   "libraries/s3api/src/s3api/clients/client.cpp":"taxi/uservices/userver/libraries/s3api/src/s3api/clients/client.cpp",

libraries/s3api/include/userver/s3api/authenticators/access_key.hpp

@@ -20,7 +20,7 @@ class AccessKey : public Authenticator {
           secret_key_{std::move(secret_key)}
     {}
     std::unordered_map<std::string, std::string> Auth(const Request& request) const override;
-    std::unordered_map<std::string, std::string> Sign(const Request& request, time_t expires) const override;
+    std::unordered_map<std::string, std::string> Sign(const Request& request, std::time_t expires) const override;
 
 private:
     std::string access_key_;

libraries/s3api/include/userver/s3api/authenticators/interface.hpp

@@ -21,7 +21,7 @@ namespace authenticators {
 /// @brief Base class for all authenticators - classes that sign the request with auth data
 struct Authenticator {
     virtual std::unordered_map<std::string, std::string> Auth(const Request& request) const = 0;
-    virtual std::unordered_map<std::string, std::string> Sign(const Request& request, time_t expires) const = 0;
+    virtual std::unordered_map<std::string, std::string> Sign(const Request& request, std::time_t expires) const = 0;
     virtual ~Authenticator() = default;
 };
 

libraries/s3api/include/userver/s3api/authenticators/signature_v4.hpp

@@ -0,0 +1,51 @@
+#pragma once
+
+/// @file userver/s3api/authenticators/signature_v4.hpp
+/// @brief Authenticator implementing AWS Signature Version 4
+
+#include <string>
+#include <unordered_map>
+
+#include <userver/s3api/authenticators/interface.hpp>
+#include <userver/s3api/models/fwd.hpp>
+#include <userver/s3api/models/secret.hpp>
+
+USERVER_NAMESPACE_BEGIN
+
+namespace s3api::authenticators {
+
+/// @brief Authenticator implementing AWS Signature Version 4.
+///
+/// `Auth` signs a request with headers (`Authorization`, `X-Amz-Date`,
+/// `X-Amz-Content-Sha256`), `Sign` produces query parameters for a presigned
+/// URL (`X-Amz-Algorithm`, `X-Amz-Credential`, `X-Amz-Date`, `X-Amz-Expires`,
+/// `X-Amz-SignedHeaders`, `X-Amz-Signature`).
+///
+/// See https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html
+class SignatureV4 : public Authenticator {
+public:
+    SignatureV4(std::string access_key, Secret secret_key, std::string region, std::string service = "s3")
+        : access_key_{std::move(access_key)},
+          secret_key_{std::move(secret_key)},
+          region_{std::move(region)},
+          service_{std::move(service)}
+    {}
+
+    std::unordered_map<std::string, std::string> Auth(const Request& request) const override;
+
+    /// @note `expires` is an absolute unix timestamp of the moment the
+    /// presigned URL stops being valid, the same way as in
+    /// @ref AccessKey::Sign. It is converted to the `X-Amz-Expires` duration
+    /// relative to the current time.
+    std::unordered_map<std::string, std::string> Sign(const Request& request, std::time_t expires) const override;
+
+private:
+    std::string access_key_;
+    Secret secret_key_;
+    std::string region_;
+    std::string service_;
+};
+
+}  // namespace s3api::authenticators
+
+USERVER_NAMESPACE_END

libraries/s3api/src/s3api/authenticators/access_key.cpp

@@ -38,7 +38,7 @@ std::unordered_map<std::string, std::string> AccessKey::Auth(const Request& requ
     return auth_headers;
 }
 
-std::unordered_map<std::string, std::string> AccessKey::Sign(const Request& request, time_t expires) const {
+std::unordered_map<std::string, std::string> AccessKey::Sign(const Request& request, std::time_t expires) const {
     static const std::string kExpires{"Expires"};
     static const std::string kSignature{"Signature"};
     static const std::string kAWSAccessKeyId{"AWSAccessKeyId"};