Zig Requires Chilkat v11.0.0+

Ibanity HTTP Signature for XS2A, Isabel Connect, Ponto Connect

See more Ibanity Examples

Demonstrates how to add a Signature header for Ibanity HTTP requests. Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // In order to sign your HTTP requests, you have to add 2 headers to the HTTP request: Digest: the digest of the request payload and Signature: the actual signature of the request.

    // POST /xs2a/customer-access-tokens HTTP/1.1
    // Host: api.ibanity.com
    // Content-Type: application/json
    // Digest: SHA-512=z4PhNX7vuL3xVChQ1m2AB9Yg5AULVxXcg/SpIdNs6c5H0NE8XYXysP+DGNKHfuwvY7kxvUdBeoGlODJ6+SfaPg==
    // Ibanity-Idempotency-Key: 61f02718-eeee-46e1-b5eb-e8fd6e799c2d
    // Signature: keyId="62f02718-eeee-46e1-b5eb-e8fd6e799c2e",created=1599659223,algorithm="hs2019",headers="(request-target) host digest (created) ibanity-idempotency-key",signature="SjWJWbWN7i0...zsbM="
    //
    // {"data":{"type":"customerAccessToken", "attributes":{"applicationCustomerReference":"15874569"}}}

    // The payload (body) of the above HTTP request is the JSON.
    // Build the JSON above.
    // Use this online tool to generate code from sample JSON:
    // Generate Code to Create JSON
    const json = try chilkat.JsonObject.init();
    defer json.deinit();
    json.updateString("data.type", "customerAccessToken") catch {};
    json.updateString("data.attributes.applicationCustomerReference", "15874569") catch {};

    const payload = try json.emit(alloc);
    std.debug.print("payload = {s}\n", .{payload});

    // Step 1: Build the (created) virtual header

    const dt_now = try chilkat.DateTime.init();
    defer dt_now.deinit();
    dt_now.setFromCurrentSystemTime() catch {};
    const created = try dt_now.getAsUnixTimeStr(alloc, false);
    std.debug.print("created = {s}\n", .{created});

    // Step 2: Build the Digest header
    const crypt = try chilkat.Crypt2.init();
    defer crypt.deinit();
    crypt.setHashAlgorithm("sha512");
    crypt.setEncodingMode("base64");
    crypt.setCharset("utf-8");

    const sb_digest_hdr_value = try chilkat.StringBuilder.init();
    defer sb_digest_hdr_value.deinit();
    sb_digest_hdr_value.append("SHA-512=") catch {};
    sb_digest_hdr_value.append(try crypt.hashStringENC(alloc, try json.emit(alloc))) catch {};

    std.debug.print("{s}\n", .{try sb_digest_hdr_value.getAsString(alloc)});

    // Step 3: Build the (request target) virtual header

    // In order to build the signature you will need a virtual header named (request-target) (the parentheses are important).
    // The (request-target) is the string concatenation of the HTTP method (in lowercase) with the path and query parameters.
    const request_target = "post /xs2a/customer-access-tokens";

    // Step 4: Build the signing string

    // The signing string is the concatenation of the signed header names (in lowercase) and values separated by a LF.

    // You must always sign the following headers: (request-target), host, (created), digest.
    // If used, you must also sign the authorization header and any ibanity-* headers, such as ibanity-idempotency-key.

    const sb_signing_string = try chilkat.StringBuilder.init();
    defer sb_signing_string.deinit();
    sb_signing_string.append("(request-target): ") catch {};
    sb_signing_string.appendLine(request_target, false) catch {};
    sb_signing_string.append("host: ") catch {};
    sb_signing_string.appendLine("api.ibanity.com", false) catch {};
    sb_signing_string.append("digest: ") catch {};
    sb_signing_string.appendLine(try sb_digest_hdr_value.getAsString(alloc), false) catch {};
    sb_signing_string.append("(created): ") catch {};
    sb_signing_string.appendLine(created, false) catch {};
    sb_signing_string.append("ibanity-idempotency-key: ") catch {};
    const idempotency_key = try crypt.generateUuid(alloc);
    sb_signing_string.append(idempotency_key) catch {};

    // Step 5: Build the signed headers list

    // To allow Ibanity to check the signed headers, you must provide a list of the header names. They should be lowercase and in the same order used to create the signing string.
    const signed_headers_list = "(request-target) host digest (created) ibanity-idempotency-key";

    // Step 6: Build the Signature header

    // This is where the real signing happens. The signature header is a combination of several sub-headers -
    //
    //     keyId: the identifier for the application's signature certificate, obtained from the Developer Portal
    //     algorithm: the digital signature algorithm used to generate the signature (must be hs2019)
    //     headers: The list of HTTP headers created in step 5
    //     signature: the Base64-encoded digital signature of the signing string created in step 4.

    const priv_key = try chilkat.PrivateKey.init();
    defer priv_key.deinit();
    priv_key.loadEncryptedPemFile("my_ibanity_signature_private_key.pem", "pem_password") catch {
        std.debug.print("{s}\n", .{try priv_key.getLastErrorText(alloc)});
        return;
    };

    const rsa = try chilkat.Rsa.init();
    defer rsa.deinit();
    rsa.setPssSaltLen(32);
    rsa.setEncodingMode("base64");
    // Use the RSASSA-PSS signature algorithm
    rsa.setPkcsPadding(false);

    rsa.usePrivateKey(priv_key) catch {
        std.debug.print("{s}\n", .{try rsa.getLastErrorText(alloc)});
        return;
    };

    // Sign the signing string.
    const sig_base64 = rsa.signStringENC(alloc, try sb_signing_string.getAsString(alloc), "sha-256") catch {
        std.debug.print("{s}\n", .{try rsa.getLastErrorText(alloc)});
        return;
    };

    // Build the signature header value.
    const sb_sig_header_value = try chilkat.StringBuilder.init();
    defer sb_sig_header_value.deinit();
    sb_sig_header_value.append("keyId=\"") catch {};
    // Use your identifier for the application's signature certificate, obtained from the Developer Portal
    sb_sig_header_value.append("62f02718-eeee-46e1-b5eb-e8fd6e799c2e") catch {};
    sb_sig_header_value.append("\",created=") catch {};
    sb_sig_header_value.append(created) catch {};
    sb_sig_header_value.append(",algorithm=\"hs2019\",headers=\"") catch {};
    sb_sig_header_value.append(signed_headers_list) catch {};
    sb_sig_header_value.append("\",signature=\"") catch {};
    sb_sig_header_value.append(sig_base64) catch {};
    sb_sig_header_value.append("\"") catch {};

    std.debug.print("{s}\n", .{try sb_sig_header_value.getAsString(alloc)});
}