presign

import http from 'k6/http'
import { check } from 'k6'

import {
    AWSConfig,
    SignatureV4,
    AMZ_CONTENT_SHA256_HEADER,
    UNSIGNED_PAYLOAD,
} from 'https://jslib.k6.io/aws/0.11.0/kms.js'

const awsConfig = new AWSConfig({
    region: __ENV.AWS_REGION,
    accessKeyId: __ENV.AWS_ACCESS_KEY_ID,
    secretAccessKey: __ENV.AWS_SECRET_ACCESS_KEY,
    sessionToken: __ENV.AWS_SESSION_TOKEN,
})

export default function () {
    // In order to be able to produce pre-signed URLs,
    // we need to instantiate a SignatureV4 object.
    const signer = new SignatureV4({
        service: 's3',
        region: awsConfig.region,
        credentials: {
            accessKeyId: awsConfig.accessKeyId,
            secretAccessKey: awsConfig.secretAccessKey,
            sessionToken: awsConfig.sessionToken,
        },
        uriEscapePath: false,
        applyChecksum: false,
    })

    // We can now use the signer to produce a pre-signed URL.
    const signedRequest = signer.presign(
        /**
         * HTTP request description
         */
        {
            /**
             * The HTTP method we will use in the request.
             */
            method: 'GET',

            /**
             * The network protocol we will use to make the request.
             */
            protocol: 'https',

            /**
             * The hostname of the service we will be making the request to.
             */
            hostname: 'my-bucket.s3.us-east-1.amazonaws.com',

            /**
             * The path of the request.
             */
            path: '/my-file.txt',

            /**
             * The headers we will be sending in the request.
             *
             * Note that in the specific case of this example, requesting
             * an object from S3, we want to set the `x-amz-content-sha256`
             * header to `UNSIGNED_PAYLOAD`. That way, we bypass the payload
             * hash calculation, and communicate that value instead, as specified.
             */
            headers: { [AMZ_CONTENT_SHA256_HEADER]: 'UNSIGNED-PAYLOAD' },
        },

        /**
         * (optional) pre-sign operation options.
         */
        {
            /**
             * The number of seconds before the pre-signed URL expires
             */
            expiresIn: 86400,

            /**
             * A set of strings whose representing headers that should not be hoisted
             * to pre-signed request's query string. If not supplied, the pre-signer
             * moves all the AWS-specific headers (starting with `x-amz-`) to the request
             * query string. If supplied, these headers remain in the pre-signed request's
             * header.
             * All headers in the provided request will have their names converted to
             * lower case and then checked for existence in the unhoistableHeaders set.
             *
             * In the case of pre-signing S3 URLs, the body needs to be empty.
             * however, the AMZ_CONTENT_SHA256_HEADER needs to be set to
             * UNSIGNED_PAYLOAD. To do this, we need to set the header,
             * but declare it as unhoistable, and unsignable.
             */
            unhoistableHeaders: new Set([AMZ_CONTENT_SHA256_HEADER]),

            /**
             * A set of strings whose members represents headers that cannot be signed.
             * All headers in the provided request will have their names converted to
             * lower case and then checked for existence in the unsignableHeaders set.
             *
             * In the case of pre-signing S3 URLs, the body needs to be empty.
             * however, the AMZ_CONTENT_SHA256_HEADER needs to be set to
             * UNSIGNED_PAYLOAD. To do this, we need to set the header,
             * but declare it as unhoistable, and unsignable.
             */
            unsignableHeaders: new Set([AMZ_CONTENT_SHA256_HEADER]),

            /**
             * A set of strings whose members represents headers that should be signed.
             * Any values passed here will override those provided via unsignableHeaders,
             * allowing them to be signed.
             *
             * All headers in the provided request will have their names converted to
             * lower case before signing.
             */
            signableHeaders: new Set(),

            /**
             * The date and time to be used as signature metadata. This value should be
             * a Date object, a unix (epoch) timestamp, or a string that can be
             * understood by the JavaScript `Date` constructor.If not supplied, the
             * value returned by `new Date()` will be used.
             */
            signingDate: new Date(),

            /**
             * The service signing name. It will override the service name of the signer
             * in current invocation
             */
            signingService: 's3',

            /**
             * The signingRegion and signingService options let the user
             * specify a different region or service to pre-sign the request for.
             */
            signingRegion: 'us-east-1',
        }
    )

    console.log(`presigned URL: ${signedRequest.url}`)

    /**
     * Our URL is now ready to be used.
     */
    const res = http.get(signedRequest.url, {
        headers: signedRequest.headers,
    })

    check(res, { 'status is 200': (r) => r.status === 200 })
}