// 临时校验程序：用 aws-sdk-go-v2 的 SigV4 signer 给同一请求签名，
// 与 dev/theme-builder/serve.py 手写的实现比对。验证完即删。
//
// 每行 stdin：method \t url \t region \t payloadHash \t amzDate
package main

import (
	"bufio"
	"context"
	"fmt"
	"net/http"
	"os"
	"strings"
	"time"

	v4 "github.com/aws/aws-sdk-go-v2/aws/signer/v4"
	"github.com/aws/aws-sdk-go-v2/credentials"
)

func main() {
	keyID := os.Getenv("AWS_KEY_ID")
	secret := os.Getenv("AWS_SECRET")
	s := bufio.NewScanner(os.Stdin)
	for s.Scan() {
		line := strings.TrimSpace(s.Text())
		if line == "" {
			continue
		}
		f := strings.Split(line, "\t")
		method, urlStr, region, payloadHash, ts := f[0], f[1], f[2], f[3], f[4]

		t, err := time.Parse("20060102T150405Z", ts)
		if err != nil {
			panic(err)
		}
		req, err := http.NewRequest(method, urlStr, nil)
		if err != nil {
			panic(err)
		}
		req.Header.Set("X-Amz-Content-Sha256", payloadHash)
		creds := credentials.NewStaticCredentialsProvider(keyID, secret, "")
		c, err := creds.Retrieve(context.Background())
		if err != nil {
			panic(err)
		}
		if err := v4.NewSigner().SignHTTP(context.Background(), c, req, payloadHash, "s3", region, t); err != nil {
			panic(err)
		}
		fmt.Println(req.Header.Get("Authorization"))
	}
}