Postman collection

// Signs every request with the workspace secret key (see API authentication).
// Canonical request: METHOD + path + ("?" + query, if any) + raw body.
const rfc3986 = (value) =>
  encodeURIComponent(value).replace(/[!'()*]/g, (c) => '%' + c.charCodeAt(0).toString(16).toUpperCase());

const apiKey = pm.variables.get('apiKey');
const secretKey = pm.variables.get('secretKey');
if (!apiKey || !secretKey) {
  throw new Error('Set the apiKey and secretKey variables of the ProofAge collection first.');
}
pm.request.headers.upsert({ key: 'X-API-Key', value: apiKey });

const body = pm.request.body;
if (body && body.mode === 'formdata') {
  // A media upload is signed over its fields and the SHA-256 of each file, which a
  // pre-request script cannot read: upload media with a server SDK instead.
  console.warn('ProofAge: media uploads cannot be signed from Postman.');
} else {
  // The sandbox has no URL class: take the path of baseUrl (for example /v1) by hand.
  const basePath = pm.variables.replaceIn('{{baseUrl}}').replace(/^[a-z]+:\/\/[^/]+/i, '').replace(/\/$/, '');
  const path = basePath + pm.variables.replaceIn(pm.request.url.getPath());
  const query = pm.request.url.query
    .filter((param) => !param.disabled)
    .map((param) => [pm.variables.replaceIn(param.key), pm.variables.replaceIn(param.value ?? '')])
    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
    .map(([key, value]) => rfc3986(key) + '=' + rfc3986(value))
    .join('&');
  const raw = body && body.mode === 'raw' ? pm.variables.replaceIn(body.raw) : '';

  const canonical = pm.request.method + path + (query ? '?' + query : '') + raw;
  const signature = CryptoJS.HmacSHA256(canonical, secretKey).toString(CryptoJS.enc.Hex);

  pm.request.headers.upsert({ key: 'X-HMAC-Signature', value: signature });
}