Request signing

import hashlib
import hmac
import json
import os
import secrets
import time
import urllib.request

def vantage_request(method, path, payload=None, idempotency_key=None):
    key = os.environ["VANTAGE_API_KEY"]
    origin = os.environ["VANTAGE_API_ORIGIN"].rstrip("/")
    body = b"" if payload is None else json.dumps(
        payload, separators=(",", ":")
    ).encode()
    timestamp = str(int(time.time()))
    nonce = secrets.token_urlsafe(24)
    body_hash = hashlib.sha256(body).hexdigest()
    canonical = "\n".join([
        method.upper(), path, timestamp, nonce, body_hash
    ]).encode()
    signature = hmac.new(key.encode(), canonical, hashlib.sha256).hexdigest()
    headers = {
        "X-API-Key": key,
        "X-Timestamp": timestamp,
        "X-Nonce": nonce,
        "X-Signature": signature,
    }
    if payload is not None:
        headers["Content-Type"] = "application/json"
    if idempotency_key:
        headers["Idempotency-Key"] = idempotency_key
    request = urllib.request.Request(
        origin + path,
        data=body if payload is not None else None,
        method=method.upper(),
        headers=headers,
    )
    with urllib.request.urlopen(request, timeout=30) as response:
        return json.load(response)

import crypto from "node:crypto";

export async function vantageRequest<T = any>(
  method: string,
  path: string,
  payload?: unknown,
  idempotencyKey?: string,
): Promise<T> {
  const key = process.env.VANTAGE_API_KEY!;
  const origin = process.env.VANTAGE_API_ORIGIN!.replace(/\/$/, "");
  const body = payload === undefined ? "" : JSON.stringify(payload);
  const timestamp = Math.floor(Date.now() / 1000).toString();
  const nonce = crypto.randomBytes(18).toString("base64url");
  const bodyHash = crypto.createHash("sha256").update(body).digest("hex");
  const canonical = [method.toUpperCase(), path, timestamp, nonce, bodyHash].join("\n");
  const signature = crypto.createHmac("sha256", key).update(canonical).digest("hex");
  const headers: Record<string, string> = {
    "X-API-Key": key,
    "X-Timestamp": timestamp,
    "X-Nonce": nonce,
    "X-Signature": signature,
  };
  if (payload !== undefined) headers["Content-Type"] = "application/json";
  if (idempotencyKey) headers["Idempotency-Key"] = idempotencyKey;
  const response = await fetch(origin + path, {
    method: method.toUpperCase(),
    headers,
    body: payload === undefined ? undefined : body,
  });
  const result = await response.json();
  if (!response.ok) throw new Error(`${response.status}: ${JSON.stringify(result)}`);
  return result as T;
}

vantage_curl() {
  method="$1"
  path="$2"
  body="${3-}"
  idempotency_key="${4-}"
  timestamp="$(date +%s)"
  nonce="$(openssl rand -hex 18)"
  body_hash="$(printf '%s' "$body" | openssl dgst -sha256 -binary | xxd -p -c 256)"
  canonical="$(printf '%s\n%s\n%s\n%s\n%s' "$method" "$path" "$timestamp" "$nonce" "$body_hash")"
  signature="$(printf '%s' "$canonical" | openssl dgst -sha256 -hmac "$VANTAGE_API_KEY" -binary | xxd -p -c 256)"

  args=(
    --request "$method" "$VANTAGE_API_ORIGIN$path"
    --header "X-API-Key: $VANTAGE_API_KEY"
    --header "X-Timestamp: $timestamp"
    --header "X-Nonce: $nonce"
    --header "X-Signature: $signature"
  )
  if [ -n "$body" ]; then
    args+=(--header 'Content-Type: application/json' --data "$body")
  fi
  if [ -n "$idempotency_key" ]; then
    args+=(--header "Idempotency-Key: $idempotency_key")
  fi
  curl "${args[@]}"
}