media-cloud-sync / includes / sdk / s3 / Aws / Signature / S3SignatureV4.php

S3SignatureV4.php in Media Cloud Sync trunk, at includes/sdk/s3/Aws/Signature/S3SignatureV4.php

89 lines 3.7 KB

Raw Download Zip

1	<?php
2
3	namespace Dudlewebs\WPMCS\s3\Aws\Signature;
4
5	use Dudlewebs\WPMCS\s3\Aws\Credentials\CredentialsInterface;
6	use Dudlewebs\WPMCS\s3\AWS\CRT\Auth\SignatureType;
7	use Dudlewebs\WPMCS\s3\AWS\CRT\Auth\SigningAlgorithm;
8	use Dudlewebs\WPMCS\s3\AWS\CRT\Auth\SigningConfigAWS;
9	use Dudlewebs\WPMCS\s3\Psr\Http\Message\RequestInterface;
10	/**
11	* Amazon S3 signature version 4 support.
12	*/
13	class S3SignatureV4 extends SignatureV4
14	{
15	/**
16	* S3-specific signing logic
17	*
18	* {@inheritdoc}
19	*/
20	use SignatureTrait;
21	public function signRequest(RequestInterface $request, CredentialsInterface $credentials, $signingService = null)
22	{
23	// Always add a x-amz-content-sha-256 for data integrity
24	if (!$request->hasHeader('x-amz-content-sha256')) {
25	$request = $request->withHeader('x-amz-content-sha256', $this->getPayload($request));
26	}
27	$useCrt = \strpos($request->getUri()->getHost(), "accesspoint.s3-global") !== \false;
28	if (!$useCrt) {
29	if (\strpos($request->getUri()->getHost(), "s3-object-lambda")) {
30	return parent::signRequest($request, $credentials, "s3-object-lambda");
31	}
32	return parent::signRequest($request, $credentials);
33	}
34	$signingService = $signingService ?: 's3';
35	return $this->signWithV4a($credentials, $request, $signingService);
36	}
37	/**
38	* @param CredentialsInterface $credentials
39	* @param RequestInterface $request
40	* @param $signingService
41	* @param SigningConfigAWS\|null $signingConfig
42	* @return RequestInterface
43	*
44	* Instantiates a separate sigv4a signing config. All services except S3
45	* use double encoding. All services except S3 require path normalization.
46	*/
47	protected function signWithV4a(CredentialsInterface $credentials, RequestInterface $request, $signingService, ?SigningConfigAWS $signingConfig = null)
48	{
49	$this->verifyCRTLoaded();
50	$credentials_provider = $this->createCRTStaticCredentialsProvider($credentials);
51	$signingConfig = new SigningConfigAWS(['algorithm' => SigningAlgorithm::SIGv4_ASYMMETRIC, 'signature_type' => SignatureType::HTTP_REQUEST_HEADERS, 'credentials_provider' => $credentials_provider, 'signed_body_value' => $this->getPayload($request), 'region' => $this->region, 'should_normalize_uri_path' => \false, 'use_double_uri_encode' => \false, 'service' => $signingService, 'date' => \time()]);
52	return parent::signWithV4a($credentials, $request, $signingService, $signingConfig);
53	}
54	/**
55	* Always add a x-amz-content-sha-256 for data integrity.
56	*
57	* {@inheritdoc}
58	*/
59	public function presign(RequestInterface $request, CredentialsInterface $credentials, $expires, array $options = [])
60	{
61	if (!$request->hasHeader('x-amz-content-sha256')) {
62	$request = $request->withHeader('X-Amz-Content-Sha256', $this->getPresignedPayload($request));
63	}
64	if (\strpos($request->getUri()->getHost(), "accesspoint.s3-global")) {
65	$request = $request->withHeader("x-amz-region-set", "*");
66	}
67	return parent::presign($request, $credentials, $expires, $options);
68	}
69	/**
70	* Override used to allow pre-signed URLs to be created for an
71	* in-determinate request payload.
72	*/
73	protected function getPresignedPayload(RequestInterface $request)
74	{
75	return SignatureV4::UNSIGNED_PAYLOAD;
76	}
77	/**
78	* Amazon S3 does not double-encode the path component in the canonical request
79	*/
80	protected function createCanonicalizedPath($path)
81	{
82	// Only remove one slash in case of keys that have a preceding slash
83	if (\substr($path, 0, 1) === '/') {
84	$path = \substr($path, 1);
85	}
86	return '/' . $path;
87	}
88	}
89