File Coverage

blib/lib/Mojolicious/Plugin/AWS/SNS.pm

Criterion	Covered	Total	%
statement	127	134	94.7
branch			n/a
condition	1	8	12.5
subroutine	22	23	95.6
pod	1	1	100.0
total	151	166	90.9

package Mojolicious::Plugin::AWS::SNS;
use Mojo::Base 'Mojolicious::Plugin';
use Digest::SHA qw(hmac_sha256 hmac_sha256_hex sha256_hex);
use Mojo::Util qw(url_escape);
use Mojo::JSON 'encode_json';

our $VERSION = '0.03';

sub register {
    my ($self, $app) = @_;

    $app->helper(
        request_method => sub {
            uc pop;
        }
    );

    $app->helper(
        canonical_uri => sub {
            my $path = join '/' => map { url_escape $_ } split /\// => pop->path;
            $path .= '/';
            return $path;
        }
    );

    $app->helper(
        canonical_query_string => sub {
            my $url = pop;

            my @cqs   = ();
            my $names = $url->query->names;
            for my $name (@$names) {
                my $values = $url->query->every_param($name);

                ## FIXME: we assume a lexicographical sort. I don't know how
                ## FIXME: AWS prefers to sort numerical values and couldn't
                ## FIXME: find any guidance on that
                for my $val (sort { $a cmp $b } @$values) {
                    push @cqs, join '=', url_escape($name) => url_escape($val);
                }
            }

            return join '&' => @cqs;
        }
    );

    $app->helper(
        canonical_headers => sub {
            my $c       = shift;
            my $headers = Mojo::Headers->new->from_hash(shift // {});

            my @headers = ();
            my $names   = $headers->names;
            for my $name (sort { lc($a) cmp lc($b) } @$names) {
                my $values = $headers->every_header($name);

                my $value = join ',' => map { s/ +/ /g; $_ }
                  map { s/\s+$//; $_ } map { s/^\s*//; $_ } @$values;

                push @headers, lc($name) . ':' . $value;
            }

            my $response = join "\n" => @headers;
            return $response . "\n";
        }
    );

    $app->helper(
        signed_headers => sub {
            my $c = shift;
            ## FIXME: ensure 'host' (http/1.1) or ':authority' (http/2) header is present
            ## FIXME: ensure date or 'x-amz-date' is present and in iso 8601 format
            return join ';' => sort map { lc $_ } @{shift()};
        }
    );

    $app->helper(
        hashed_payload => sub {
            my $c       = shift;
            my $payload = shift;

            return lc sha256_hex($payload);
        }
    );

    $app->helper(
        canonical_request => sub {
            my $c    = shift;
            my %args = @_;
            my $url  = Mojo::URL->new($args{url});

            my $creq = join "\n" => $c->request_method($args{method}),
              $c->canonical_uri($url), $c->canonical_query_string($url),
              $c->canonical_headers($args{headers}), $c->signed_headers($args{signed_headers}),
              $c->hashed_payload($args{payload});

            return $creq;
        }
    );

    $app->helper(
        canonical_request_hash => sub {
            my $c       = shift;
            my $request = shift;

            return lc sha256_hex($request);
        }
    );

    ##

    $app->helper(
        aws_algorithm => sub {
            return 'AWS4-HMAC-SHA256';
        }
    );

    $app->helper(
        aws_datetime => sub {
            (my $date = Mojo::Date->new(pop)->to_datetime) =~ s/[^0-9TZ]//g;
            return $date;
        }
    );

    $app->helper(
        aws_date => sub {
            my $c = shift;
            (my $date = $c->aws_datetime(pop)) =~ s/^(\d+)T.*/$1/;
            return $date;
        }
    );

    $app->helper(
        aws_credentials => sub {
            my $c    = shift;
            my %args = @_;

            return join '/' => $c->aws_date($args{datetime}),
              $args{region}, $args{service}, 'aws4_request';
        }
    );

    $app->helper(
        string_to_sign => sub {
            my $c    = shift;
            my %args = @_;

            my $string = join "\n" => $c->aws_algorithm,
              $c->aws_datetime($args{datetime}),
              $c->aws_credentials(
                datetime => $args{datetime},
                region   => $args{region},
                service  => $args{service}
              ),
              $args{hash};

            return $string;
        }
    );

    ##

    $app->helper(
        signing_key => sub {
            my $c    = shift;
            my %args = @_;

            my $date     = $c->aws_date($args{datetime});
            my $kDate    = hmac_sha256($date, 'AWS4' . $args{secret});
            my $kRegion  = hmac_sha256($args{region}, $kDate);
            my $kService = hmac_sha256($args{service}, $kRegion);
            my $kSigning = hmac_sha256('aws4_request', $kService);

            return $kSigning;
        }
    );

    $app->helper(
        signature => sub {
            my $c    = shift;
            my %args = @_;

            my $digest = hmac_sha256_hex($args{string_to_sign}, $args{signing_key});

            return $digest;
        }
    );

    $app->helper(
        authorization_header => sub {
            my $c    = shift;
            my %args = @_;

            my $algorithm      = $c->aws_algorithm;
            my $access_key     = $args{access_key};
            my $credential     = $args{credential_scope};
            my $signed_headers = join ';' => map {lc} @{$args{signed_headers}};
            my $signature      = $args{signature};
            my $headers
              = Mojo::Headers->new->authorization(
                "$algorithm Credential=$access_key/$credential, SignedHeaders=$signed_headers, Signature=$signature"
              );

            return $headers;
        }
    );

    $app->helper(
        signed_request => sub {
            my $c    = shift;
            my %args = @_;

            ## build a normal transaction
            my $headers = Mojo::Headers->new->from_hash(
                {
                    'X-Amz-Date'   => $args{datetime},
                    'Host'         => $args{url}->host,
                    'Content-Type' => 'application/x-www-form-urlencoded; charset=utf-8',
                    'Accept'       => 'application/json',
                }
            );

            ## build the authorization header
            my $signed_headers  = [qw/content-type host x-amz-date accept/];
            my $aws_credentials = $c->aws_credentials(
                datetime => $args{datetime},
                region   => $args{region},
                service  => $args{service}
            );
            my $aws_signing_key = $c->signing_key(
                secret   => $args{secret_key},
                datetime => $args{datetime},
                region   => $args{region},
                service  => $args{service}
            );
            ## FIXME (disposable build_tx): is there a better way to build a request body?
            my $canonical_request = $c->canonical_request(
                url            => $args{url},
                method         => 'POST',
                headers        => $headers->to_hash,
                signed_headers => $signed_headers,
                payload =>
                  $c->ua->build_tx(POST => $args{url}, $headers->to_hash, form => $args{form})
                  ->req->body
            );
            my $canonical_request_hash = $c->canonical_request_hash($canonical_request);
            my $string_to_sign         = $c->string_to_sign(
                datetime => $args{datetime},
                region   => $args{region},
                service  => $args{service},
                hash     => $canonical_request_hash,
            );
            my $signature = $c->signature(
                signing_key    => $aws_signing_key,
                string_to_sign => $string_to_sign,
            );

            my $auth_header = $c->authorization_header(
                access_key       => $args{access_key},
                credential_scope => $aws_credentials,
                signed_headers   => $signed_headers,
                signature        => $signature,
            );

            $headers->add(Authorization => $auth_header->authorization);
            my $tx
              = $c->ua->build_tx(POST => $args{url}, $headers->to_hash, form => $args{form});

            return $tx;
        }
    );

    $app->helper(
        sns_publish => sub {
            my $c    = shift;
            my %args = @_;

            my $region = $args{region};

            $args{datetime} ||= Mojo::Date->new(time)->to_datetime;
            $args{url}      ||= Mojo::URL->new("https://sns.$region.amazonaws.com");

            my $tx = $c->signed_request(
                datetime   => $args{datetime},
                url        => $args{url},
                service    => 'sns',
                region     => $region,
                access_key => $args{access_key},
                secret_key => $args{secret_key},
                form       => {
                    Action           => 'Publish',
                    TopicArn         => $args{topic},
                    Subject          => $args{subject},
                    MessageStructure => 'json',
                    Message          => encode_json($args{message}),
                    Version          => '2010-03-31',
                }
            );

            $c->ua->start_p($tx);
        }
    );
}

1;
__END__