libeufin

azure.rs (7653B)

---

 /*
 * This file is part of LibEuFin.
 * Copyright (C) 2026 Taler Systems S.A.
 
 * LibEuFin is free software; you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation; either version 3, or
 * (at your option) any later version.
 
 * LibEuFin is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
 * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU Affero General
 * Public License for more details.
 
 * You should have received a copy of the GNU Affero General Public
 * License along with LibEuFin; see the file COPYING.  If not, see
 * <http://www.gnu.org/licenses/>
 */
 
 use std::str::FromStr;
 
 use aws_lc_rs::hmac::{self, HMAC_SHA256};
 use axum::{
     body::Bytes,
     http::{HeaderName, HeaderValue},
 };
 use compact_str::{CompactString, ToCompactString};
 use http_client::{ApiErr, Client, ClientErr, builder::Req};
 use jiff::{Timestamp, Zoned, tz::TimeZone};
 use reqwest::{
     Method, StatusCode, Url,
     header::{
         AUTHORIZATION, CONTENT_ENCODING, CONTENT_LANGUAGE, CONTENT_TYPE, IF_MATCH,
         IF_MODIFIED_SINCE, IF_NONE_MATCH, IF_RANGE, IF_UNMODIFIED_SINCE,
     },
 };
 use taler_common::encoding::base64;
 use thiserror::Error;
 
 const API_VERSION: &str = "2025-11-05";
 
 #[derive(Debug, Error)]
 
 pub enum AzureErr {
     #[error("{status} {code}")]
     Api {
         status: StatusCode,
         code: CompactString,
     },
     #[error(transparent)]
     Client(#[from] ClientErr),
 }
 
 pub type AzureResult = Result<(), ApiErr<AzureErr>>;
 
 pub struct AzureBlobStorage<'a> {
     base_url: Url,
     account: &'a str,
     key: hmac::Key,
     client: &'a Client,
 }
 
 impl<'a> AzureBlobStorage<'a> {
     pub fn new(
         base_url: &'a str,
         account: &'a str,
         key: &str,
         client: &'a Client,
     ) -> anyhow::Result<Self> {
         let decoded = base64::decode(key)?;
         Ok(Self {
             base_url: Url::from_str(base_url)?,
             account,
             key: hmac::Key::new(HMAC_SHA256, &decoded),
             client,
         })
     }
 
     async fn req(&self, req: Req) -> AzureResult {
         // Set required headers (x-ms-date and x-ms-version)
         // Azure uses x-ms-date instead of the standard Date header for signing
         let date = Zoned::new(Timestamp::now(), TimeZone::UTC)
             .strftime("%a, %d %b %Y %H:%M:%S GMT")
             .to_string();
         let req = req
             .header("x-ms-date", date)
             .header("x-ms-version", API_VERSION);
 
         // Calculate the HMAC-SHA256 signature
         let signature = {
             let mut ctx = aws_lc_rs::hmac::Context::with_key(&self.key);
 
             let add_str = |sign: &mut aws_lc_rs::hmac::Context, value: &str| {
                 sign.update(value.as_bytes());
                 sign.update(b"\n");
             };
             let add_header = |sign: &mut aws_lc_rs::hmac::Context, name: &HeaderName| {
                 sign.update(
                     req.headers()
                         .get(name)
                         .map(|it| it.as_bytes())
                         .unwrap_or_default(),
                 );
                 sign.update(b"\n");
             };
             // 1. VERB
             add_str(&mut ctx, req.method().as_str());
             // 2. Content-Encoding
             add_header(&mut ctx, &CONTENT_ENCODING);
             // 3. Content-Language
             add_header(&mut ctx, &CONTENT_LANGUAGE);
             // 4. Content-Length (empty string if zero for modern versions)
             let len = req.body().len();
             if len != 0 {
                 add_str(&mut ctx, &len.to_compact_string());
             } else {
                 add_str(&mut ctx, "");
             }
             // 5. Content-MD5
             add_header(&mut ctx, &HeaderName::from_static("content-md5"));
             // 6. Content-Type
             add_header(&mut ctx, &CONTENT_TYPE);
             // 7. Date
             add_str(&mut ctx, ""); // Must be empty as x-ms-date is used)
             // 8. If-Modified-Since
             add_header(&mut ctx, &IF_MODIFIED_SINCE);
             // 9. If-Match
             add_header(&mut ctx, &IF_MATCH);
             // 10. If-None-Match
             add_header(&mut ctx, &IF_NONE_MATCH);
             // 11. If-Unmodified-Since
             add_header(&mut ctx, &IF_UNMODIFIED_SINCE);
             // 12. Range
             add_header(&mut ctx, &IF_RANGE);
             // 13. CanonicalizedHeaders
             // This includes all x-ms- headers, converted to lowercase, sorted, and concatenated.
             let mut headers: Vec<_> = req
                 .headers()
                 .iter()
                 .filter(|(n, _)| n.as_str().starts_with("x-ms-"))
                 .collect();
             headers.sort_unstable_by_key(|(n, _)| n.as_str());
             // TODO should we group them ?
             for (n, v) in headers {
                 ctx.update(n.as_str().as_bytes());
                 ctx.update(b":");
                 ctx.update(v.as_bytes()); // TODO replace linear whitesoace ?
                 ctx.update(b"\n");
             }
 
             // 14. CanonicalizedResource
             // This includes the account name, the path, and canonicalized query parameters.
             ctx.update(b"/");
             ctx.update(self.account.as_bytes());
             ctx.update(req.url().path().trim_end_matches('/').as_bytes());
             let mut params: Vec<_> = req.url().query_pairs().collect();
             params.sort_unstable();
             for (key, value) in params {
                 ctx.update(b"\n");
                 ctx.update(key.as_bytes());
                 ctx.update(b":");
                 ctx.update(value.as_bytes());
             }
             ctx.sign()
         };
 
         // Add the Authorization header
         let req = req.header(
             AUTHORIZATION,
             format!("SharedKey {}:{}", self.account, base64::fmt(signature)),
         );
 
         // Send it and handle error
         let (ctx, res) = req.send().await.map_err(|(ctx, e)| ctx.wrap(e.into()))?;
         if !res.status().is_success() {
             Err(ctx.wrap(AzureErr::Api {
                 status: res.status(),
                 code: res
                     .headers()
                     .get(HeaderName::from_static("x-ms-error-code"))
                     .and_then(|it| it.to_str().ok())
                     .unwrap_or_default()
                     .into(),
             }))
         } else {
             Ok(())
         }
     }
 
     pub async fn create_container(&self, name: &str) -> AzureResult {
         self.req(
             Req::new(self.client, Method::PUT, &self.base_url, name.to_owned())
                 .query("restype", "container"),
         )
         .await
     }
 
     pub async fn container_metadata(&self, name: &str) -> AzureResult {
         self.req(
             Req::new(self.client, Method::GET, &self.base_url, name.to_owned())
                 .query("restype", "container")
                 .query("comp", "metadata"),
         )
         .await
     }
 
     pub async fn put_blob(
         &self,
         container: &str,
         name: &str,
         content: Bytes,
         ty: HeaderValue,
     ) -> AzureResult {
         self.req(
             Req::new(
                 self.client,
                 Method::PUT,
                 &self.base_url,
                 format!("{container}/{name}"),
             )
             .content(content, ty)
             .header(
                 HeaderName::from_static("x-ms-blob-type"),
                 HeaderValue::from_static("BlockBlob"),
             ),
         )
         .await
     }
 }