Skip to content

Pass through session token to signer #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpil merged 2 commits into from
Nov 24, 2025
Merged

Pass through session token to signer #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e36974f
Pass through session token to signer (#6)
devstopfix Nov 19, 2025
a4e869e
Session tokens are optional
devstopfix Nov 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions src/bucket.gleam
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ pub type Credentials {
region: String,
access_key_id: String,
secret_access_key: String,
session_token: Option(String),
)
}

Expand All @@ -43,6 +44,7 @@ pub fn credentials(
region: "eu-west-1",
port: option.None,
scheme: http.Https,
session_token: option.None,
)
}

Expand All @@ -61,6 +63,14 @@ pub fn with_scheme(creds: Credentials, scheme: http.Scheme) -> Credentials {
Credentials(..creds, scheme:)
}

/// Set the optional session token when given via a task or instance role
pub fn with_session_token(
Copy link
Contributor Author

@devstopfix devstopfix Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lpil I have suggestion for better API. I have to check the session token is present later in the call, and before I use this function (given I can run locally with key/pair or on ECS with token)

Perhaps this can be maybe_with_session_token(option.Option(token)) then it's less code in the caller.

Or just with_session_token(option.Option(...))

No preference with me I already wrote the calling code

Copy link
Owner

@lpil lpil Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Having it take an option sounds good to me. Let me know if you want me to merge this or wait for that

Copy link
Contributor Author

@devstopfix devstopfix Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok I change it this afternoon to take option! 👍

Copy link
Contributor Author

@devstopfix devstopfix Nov 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lpil ready for you. Thanks for quick turnaround
(I take any interface you prefer)

creds: Credentials,
session_token: option.Option(String),
) -> Credentials {
Credentials(..creds, session_token: session_token)
}

pub type Bucket {
Bucket(name: String, creation_date: String)
}
12 changes: 12 additions & 0 deletions src/bucket/internal.gleam
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ pub fn request(
creds.region,
"s3",
)
|> with_session_token(creds)
|> aws4_request.sign_bits(request)
}

Expand Down Expand Up @@ -86,3 +87,14 @@ pub fn s3_error(response: Response(BitArray)) -> Result(a, BucketError) {
Error(_) -> Error(bucket.UnexpectedResponseError(response))
}
}

fn with_session_token(
signer: aws4_request.Signer,
creds: Credentials,
) -> aws4_request.Signer {
case creds.session_token {
option.None -> signer
option.Some(session_token) ->
aws4_request.with_session_token(signer, session_token)
}
}
2 changes: 2 additions & 0 deletions test/helpers.gleam
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ pub const creds = bucket.Credentials(
region: "us-east-1",
access_key_id: "minioadmin",
secret_access_key: "miniopass",
session_token: option.None,
)

pub const bad_creds = bucket.Credentials(
Expand All @@ -28,6 +29,7 @@ pub const bad_creds = bucket.Credentials(
region: "us-east-1",
access_key_id: "unknown",
secret_access_key: "nope",
session_token: option.None,
)

pub fn create_bucket(name: String) -> Nil {
Expand Down