use DateTime::Format;
use Digest::HMAC;
use Digest::SHA;
use Digest;
use MIME::Base64;
use OpenSSL::RSATools;
use HTTP::Request;

unit class HTTP::Signature;

has $.keyid is rw ;
has $.secret is rw ;
has $.algorithm is rw = 'hmac-sha256';
has @.headers is rw = <date>;

has $!signing-string;
has $!signature;
has $!authorization_string = 'Signature';

my grammar Signature::Grammar {
    token TOP {
        Signature \s+ <keyid> <algorithm> <headers>? <signature>
    }
    token keyid {
        \,? <space>* keyId \= \" $<value>=<-["]>+ \" <space>*
    }
    token algorithm {
        \, <space>* algorithm \= \" $<value>=<-["]>+ \" <space>*
    }
    token headers {
        \, <space>* headers \= \" <header>+ \" <space>*
    }
    token header {
        <space>* $<value>=[<-["]-:space>+]
    }

    token signature {
        \, <space>* signature \= \" $<value>=<-["]>+ \" <space>*
    }
}

method verify-request( HTTP::Request $request ) {
    $!signature = $request.field("Authorization").Str;
    my $match = Signature::Grammar.parse( $!signature );
    $!algorithm = ~$match<algorithm><value>;
    if $match<headers><header> {
        @!headers = $match<headers><header>.flat.map( {~$_<value>} );
    } else {
        @!headers = <date>;
    }
    $!signature = ~$match<signature><value>;
    self!generate_signing_string( $request );

    return self!verify();
}

method sign-request( HTTP::Request $request ) {
    #Add a date header if not present
    if !$request.field('date') {
        $request.header.field(:date(strftime( '%a, %d %b %Y %T GMT' ,DateTime.now.utc) ) );
    }

    self!generate_signing_string( $request );
    $!signature = MIME::Base64.encode( self!sign(), :oneline );
    $request.header.field( :Authorization( self!format_signature()) );

    return $request;
}

method !verify {
    given $.algorithm {
        when /hmac\-sha256/ { return True if MIME::Base64.decode($!signature) == hmac($.secret, $!signing-string, &sha256); }
        when /hmac\-sha1/ { return True if MIME::Base64.decode($!signature) == hmac($.secret, $!signing-string, &sha1); }
        when /hmac\-md5/ { return True if MIME::Base64.decode($!signature) == hmac($.secret, $!signing-string, &md5); }
        when /rsa\-sha256/ {
            my $rsa = OpenSSL::RSAKey.new(public-pem => $!secret);
            return $rsa.verify( ($!signing-string).encode,  MIME::Base64.decode($!signature), :sha256 );
        }
        when /rsa\-sha1/ {
            my $rsa = OpenSSL::RSAKey.new(public-pem => $!secret);
            return $rsa.verify( ($!signing-string).encode,  MIME::Base64.decode($!signature), :sha1 );
        }
        when /rsa\-md5/ {
            my $rsa = OpenSSL::RSAKey.new(public-pem => $!secret);
            return $rsa.verify( ($!signing-string).encode,  MIME::Base64.decode($!signature), :md5 );
        }
    }
    return False;
}
method !sign {
    my $signed;
    given $.algorithm {
        when /hmac\-sha256/ { $signed = hmac($.secret, $!signing-string, &sha256); }
        when /hmac\-sha1/ { $signed = hmac($.secret, $!signing-string, &sha1); }
        when /hmac\-md5/ { $signed = hmac($.secret, $!signing-string, &md5); }
        when /rsa\-sha256/ {
            my $rsa = OpenSSL::RSAKey.new(private-pem => $!secret);
            $signed = $rsa.sign( $!signing-string.encode, :sha256);
        }
        when /rsa\-sha1/ {
            my $rsa = OpenSSL::RSAKey.new(private-pem => $!secret);
            $signed = $rsa.sign( $!signing-string.encode, :sha1);
        }
        when /rsa\-md5/ {
            my $rsa = OpenSSL::RSAKey.new(private-pem => $!secret);
            $signed = $rsa.sign( $!signing-string.encode, :md5);
        }
    }
    return $signed;
}

method !format_signature {
      my $rv = sprintf(q (%s keyId="%s",algorithm="%s"),
                  $!authorization_string,
                  $.keyid,
                  $.algorithm
               );

      if @.headers.elems == 1 and @.headers[0].lc eq 'date' {
          # if there's only the default header, omit the headers param
      }
      else {
          $rv ~= ",headers=\"@.headers[]\"";
      }

      $rv ~= ", signature=\"$!signature\"";

      return $rv;
  }

method !generate_signing_string( HTTP::Request $request ) {
    $!signing-string = (for @!headers -> $h {
        self!get_header($request,$h);
    }).join("\n");
}

method !get_header ( $req, $name ) {
    if $name eq '(request-target)' {
        return '(request-target): ' ~ $req.method.lc ~ ' ' ~ ( $req.uri.query ?? $req.uri.path ~ '?' ~ $req.uri.query !! $req.uri.path );
    } elsif $name eq 'request-line' {
        return 'request-line: ' ~ ( $req.uri.query ?? $req.uri.path ~ '?' ~ $req.uri.query !! $req.uri.path ) ~ ' ' ~ $req.protocol;
    } else {
        return sprintf "%s: %s", $name, $req.field($name).Str;
    }
}



NAME
HTTP::Signature - Implemetation of HTTP::Signature specification


head

use HTTP::Signature;
use HTTP::UserAgent;
use HTTP::Request;


my $req = HTTP::Request.new(
    :GET('http://www.example.com/path')
);


my $signer = HTTP::Signature.new(
    keyid       => 'Test',
    secret      => 'MySuperSecretKey',
    algorithm   => 'hmac-sha256',
);
my $signed-request = $signer->sign-request( $req );
my $ua = HTTP::UserAgent.new;
my $response = $ua.request( $signed-request );


my $signer = HTTP::Signature.new(
    secret      => 'MySuperSecretKey',
);
if $signer.verify-request( $req ) {
    ...
}


DESCRIPTION
     ALPHA Implementation of http signature as defined in IETFF draft version 3


root

README

React

=begin React :component<HeaderCol> :id<menu> 
=para L<Documentation|/doc/introduction>
=para L<Modules| /mods>
=para L<Examples| file:../examples/index.podlite>
=para L<Download |file:../download/index.podlite>
=para L<About|file:../about/index.podlite>
=para 🔍 K<⌘K>/K<ctrl-K>
=end React


=begin React :component<HeaderCol> :id<footer>  
=begin nested :!nested
=item1 B<Language>
    =item2 L<Get started|file:../getting-started/getting-started.podlite>
    =item2 L<Why Raku?|/doc/language/faq#Why-should-I-learn-Raku-What's-so-great-about-it>
    =item2 L<Try Raku|https://glot.io/new/raku>
    =item2 L<Raku cheat sheet|https://github.com/Raku/mu/blob/master/docs/Perl6/Cheatsheet/cheatsheet.txt>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<Raku on Exercism|https://exercism.org/tracks/raku>
    =item2 L<Wikipedia|https://en.wikipedia.org/wiki/Raku_(programming_language)>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>

=end nested
=begin nested :!nested

=item1 B<L<Documentation|/doc>>
    =item2 L<Getting started, Migration guides from other languages, & Tutorials | file:../doc/introduction.podlite>
    =item2 L<Language References|file:../doc/reference.podlite>
    =item2 L<Type Reference| file:../doc/types.podlite>
    =item2 L<Miscellaneous| file:../doc/miscellaneous.podlite>
    =item2 L<FAQs (Frequently Asked Questions)|/doc/language/faq>
    =item2 L<Community|/doc/language/community>
    =item2 L<The list of all documents|file:../doc/index.podlite>

=item1 B<Resources>
    =item2 L<The Raku Guide|https://raku.guide/>
    =item2 L<Books |https://perl6book.com/>
    =item2 L<Rosetta Code | https://www.raku.org/community/rosettacode>

=end nested
=begin nested :!nested

=item1 B<Resoures>
    =item2 L<Download | file:../download/index.podlite>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>

=item1 B<Learning>
    =item2 L<The Raku Guide|https://raku.guide/>
    =item2 L<Wikibook |https://en.wikibooks.org/wiki/Raku_Programming>
    =item2 L<Books |https://perl6book.com/>
    =item2 L<Rosetta Code | https://www.raku.org/community/rosettacode>
    =item2 L<Learn Raku in Y minutes|https://learnxinyminutes.com/docs/raku/>
    =item2 L<Golfing |https://github.com/AlexDaniel/raku-golf-cheatsheet>
=end nested
=begin nested :!nested

=item1 B<Explore>
    =item2 L<Raku Blog Aggregator|https://planet.raku.org/>
    =item2 L<Rakudo Weekly|https://rakudoweekly.blog/>
    =item2 L<The Weekly Challenge |https://perlweeklychallenge.org/>
    =item2 L<Raku Advent Calendar|https://raku-advent.blog/>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>
    =item2 L<empty|#>

=end nested
=end React


=begin React :component<CookieConsent> :id<CookieConsent> :buttonCaption("Got it!")
=para
This website uses cookies for analytics.
=end React


Signature

NAME HTTP::Signature - Implemetation of HTTP::Signature specification

SYNOPSIS

DESCRIPTION ALPHA Implementation of http signature as defined in IETFF draft version 3

METHODS