snapshot of https://github.com/mountain-loop/yaak.git (main, 2026-09-23; blobs > 131072B omitted)

plugins/auth-aws/README.md

@@ -0,0 +1,49 @@
+# AWS Signature Version 4 Auth
+
+A plugin for authenticating AWS-compatible requests using the
+[AWS Signature Version 4 signing process](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html).  
+This enables secure, signed requests to AWS services (or any S3-compatible APIs like
+Cloudflare R2).
+
+![Screenshot of AWS SigV4 UI](screenshot.png)
+
+## Overview
+
+This plugin provides AWS Signature authentication for API requests in Yaak. SigV4 is used
+by nearly all AWS APIs to verify the authenticity and integrity of requests using
+cryptographic signatures.
+
+With this plugin, you can securely sign requests to AWS services such as S3, STS, Lambda,
+API Gateway, DynamoDB, and more. You can also authenticate against S3-compatible services
+like **Cloudflare R2**, **MinIO**, or **Wasabi**.
+
+## How AWS Signature Version 4 Works
+
+SigV4 signs requests by creating a hash of key request components (method, URL, headers,
+and optionally the payload) using your AWS credentials. The resulting HMAC signature is
+added in the `Authorization` header along with credential scope metadata.
+
+Example header:
+
+```
+Authorization: AWS4-HMAC-SHA256 Credential=AKIA…/20251011/us-east-1/s3/aws4_request, SignedHeaders=host;x-amz-date, Signature=abcdef123456…
+```
+
+Each request must include a timestamp (`X-Amz-Date`) and may include a session token if
+using temporary credentials.
+
+## Configuration
+
+The plugin presents the following fields:
+
+- **Access Key ID** – Your AWS access key identifier
+- **Secret Access Key** – The secret associated with the access key
+- **Session Token** _(optional)_ – Used for temporary or assumed-role credentials (treated as secret)
+- **Region** – AWS region (e.g., `us-east-1`)
+- **Service** – AWS service identifier (e.g., `sts`, `s3`, `execute-api`)
+
+## Usage
+
+1. Configure a request, folder, or workspace to use **AWS SigV4 Authentication**
+2. Enter your AWS credentials and target service/region
+3. The plugin will automatically sign outgoing requests with valid SigV4 headers

plugins/auth-aws/package.json

@@ -0,0 +1,22 @@
+{
+  "name": "@yaak/auth-aws",
+  "displayName": "AWS SigV4",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Authenticate requests using AWS SigV4 signing",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mountain-loop/yaak.git",
+    "directory": "plugins/auth-aws"
+  },
+  "scripts": {
+    "build": "yaakcli build",
+    "dev": "yaakcli dev"
+  },
+  "dependencies": {
+    "aws4": "^1.13.2"
+  },
+  "devDependencies": {
+    "@types/aws4": "^1.11.6"
+  }
+}

plugins/auth-aws/src/index.ts

@@ -0,0 +1,89 @@
+import { URL } from "node:url";
+import type { PluginDefinition } from "@yaakapp/api";
+import type { CallHttpAuthenticationResponse } from "@yaakapp-internal/plugins";
+import type { Request } from "aws4";
+import aws4 from "aws4";
+
+export const plugin: PluginDefinition = {
+  authentication: {
+    name: "awsv4",
+    label: "AWS Signature",
+    shortLabel: "AWS v4",
+    args: [
+      { name: "accessKeyId", label: "Access Key ID", type: "text", password: true },
+      {
+        name: "secretAccessKey",
+        label: "Secret Access Key",
+        type: "text",
+        password: true,
+      },
+      {
+        name: "service",
+        label: "Service Name",
+        type: "text",
+        defaultValue: "sts",
+        placeholder: "sts",
+        description: "The service that is receiving the request (sts, s3, sqs, ...)",
+      },
+      {
+        name: "region",
+        label: "Region",
+        type: "text",
+        placeholder: "us-east-1",
+        description: "The region that is receiving the request (defaults to us-east-1)",
+        optional: true,
+      },
+      {
+        name: "sessionToken",
+        label: "Session Token",
+        type: "text",
+        password: true,
+        optional: true,
+        description: "Only required if you are using temporary credentials",
+      },
+    ],
+    onApply(_ctx, { values, ...args }): CallHttpAuthenticationResponse {
+      const accessKeyId = String(values.accessKeyId || "");
+      const secretAccessKey = String(values.secretAccessKey || "");
+      const sessionToken = String(values.sessionToken || "") || undefined;
+
+      const url = new URL(args.url);
+
+      const headers: NonNullable<Request["headers"]> = {};
+      for (const headerName of ["content-type", "host", "x-amz-date", "x-amz-security-token"]) {
+        const v = args.headers.find((h) => h.name.toLowerCase() === headerName);
+        if (v != null) {
+          headers[headerName] = v.value;
+        }
+      }
+
+      const signature = aws4.sign(
+        {
+          host: url.host,
+          method: args.method,
+          path: url.pathname + (url.search || ""),
+          service: String(values.service || "sts"),
+          region: values.region ? String(values.region) : undefined,
+          headers,
+          body: args.body ?? undefined,
+          doNotEncodePath: true,
+        },
+        {
+          accessKeyId,
+          secretAccessKey,
+          sessionToken,
+        },
+      );
+
+      if (signature.headers == null) {
+        return {};
+      }
+
+      return {
+        setHeaders: Object.entries(signature.headers)
+          .filter(([name]) => name !== "content-type") // Don't add this because we already have it
+          .map(([name, value]) => ({ name, value: String(value || "") })),
+      };
+    },
+  },
+};

plugins/auth-aws/tsconfig.json

@@ -0,0 +1,3 @@
+{
+  "extends": "../../tsconfig.json"
+}