Quickstart

import hashlib, hmac, os, secrets, urllib.parse
from datetime import datetime, timezone

import requests

ACCESS_KEY = os.environ["BASALTIC_ACCESS_KEY_ID"]
SECRET_KEY = os.environ["BASALTIC_SECRET_ACCESS_KEY"]
REGION     = "sa-saopaulo-1"
HOST       = f"compute.{REGION}.basaltic.sh"


def _hmac(key: bytes, msg: str) -> bytes:
    return hmac.new(key, msg.encode(), hashlib.sha256).digest()


def signed_headers(method, path, query="", body=b""):
    now = datetime.now(timezone.utc)
    x_date = now.strftime("%Y%m%dT%H%M%SZ")
    date = x_date[:8]
    nonce = secrets.token_hex(16)

    body_hash = hashlib.sha256(body).hexdigest() if body else "UNSIGNED-PAYLOAD"

    # Exactly these three headers are signed (plus x-amz-security-token when
    # you are using temporary STS credentials).
    headers = {"host": HOST, "x-date": x_date, "x-nonce": nonce}
    names = sorted(headers)

    pairs = sorted(urllib.parse.parse_qsl(query, keep_blank_values=True))
    canonical_query = "&".join(
        f"{urllib.parse.quote(k, safe='-_.~')}={urllib.parse.quote(v, safe='-_.~')}"
        for k, v in pairs
    )

    canonical_request = "\n".join([
        method,
        path,
        canonical_query,
        "".join(f"{n}:{headers[n].strip()}\n" for n in names),
        ";".join(names),
        body_hash,
    ])

    # The timestamp line is the credential date at MIDNIGHT, not x-date.
    string_to_sign = "\n".join([
        "BASALTIC-HMAC-SHA256",
        f"{date}T000000Z",
        f"{date}/{REGION}/basaltic/basaltic_request",
        hashlib.sha256(canonical_request.encode()).hexdigest(),
    ])

    key = _hmac(("BASALTIC" + SECRET_KEY).encode(), date)
    for part in (REGION, "basaltic", "basaltic_request"):
        key = _hmac(key, part)
    signature = hmac.new(key, string_to_sign.encode(), hashlib.sha256).hexdigest()

    out = {
        "Host": HOST,
        "X-Date": x_date,
        "X-Nonce": nonce,
        "Authorization": (
            f"BASALTIC-HMAC-SHA256 Credential={ACCESS_KEY}/{date}/{REGION}"
            f"/basaltic/basaltic_request, "
            f"SignedHeaders={';'.join(names)}, Signature={signature}"
        ),
    }
    if body:
        out["X-Content-Sha256"] = body_hash
    return out


if __name__ == "__main__":
    path = "/v1/instances"
    r = requests.get(
        f"https://{HOST}{path}",
        headers=signed_headers("GET", path),
        timeout=30,
    )
    print(r.status_code, r.text)