HMAC signer

# Signed-request auth, driven by the `loadr-plugin-hmac-signer` native SERVICE
# plugin.
#
# Like `redis-loader`, this is a service plugin (start/stop lifecycle rather than
# a per-URL protocol handler): loadr calls `start(config)` once before the run
# and `stop()` once after. On start the plugin parses the signer config (shared
# secret, algorithm, canonical `template`, header, encoding, prefix), binds a
# tiny local line endpoint and returns its address, e.g.:
#
#   → hmac-signer at 127.0.0.1:52193
#
# For every request line a VU sends — either a JSON object of request fields
# (`{"method":…,"path":…,"url":…,"body":…}`) rendered through the template, or an
# already-rendered canonical string signed verbatim — the endpoint replies with
# one JSON line carrying the header name and the HMAC signature to stamp:
#
#   {"header":"x-signature","value":"sha256=9f86d081…"}
#
# The signing is pure Rust (`hmac` + `sha2`): no OpenSSL, no C dependency and no
# build toolchain.
#
# Keep the secret OUT of the plan — pass it from the environment:
#   PARTNER_SECRET=… loadr run examples/plugins/hmac-signer.yaml
#
# Build + install the plugin, then run:
#   cargo build -p loadr-plugin-hmac-signer --release
#   mkdir -p dist && cp plugins/loadr-plugin-hmac-signer/plugin.toml dist/ \
#     && cp target/release/libloadr_plugin_hmac_signer.so dist/
#   loadr plugin install dist
#   loadr run examples/plugins/hmac-signer.yaml
#
# Or point the plan's `plugins:` entry at the built artifact directly (below).
name: hmac-signer
description: HMAC-SHA256 request signer serving signatures over a local endpoint

plugins:
  # Resolve `hmac-signer` by name from the plugins dir (after
  # `loadr plugin install`). To run straight from a build tree instead, set:
  #   path: target/release/libloadr_plugin_hmac_signer.so
  - name: hmac-signer
    config:
      # Shared secret keying the HMAC. Pulled from the environment, not the
      # committed plan; a missing/empty secret fails the run at start.
      secret: ${PARTNER_SECRET}
      # HMAC hash: `sha256` (default) or `sha512`.
      algo: sha256
      # Header the signature is written to.
      header: x-signature
      # The canonical string the HMAC is taken over. `{method}`, `{path}`,
      # `{url}`, `{body}` and `{timestamp}` are substituted per request; literal
      # text is signed verbatim.
      template: "{method}{path}{body}"
      # Signature encoding in the header value: `hex` (default) or `base64`.
      encoding: hex
      # Literal text prepended to the encoded signature — e.g. `sha256=` for a
      # GitHub-style `x-hub-signature-256` header.
      prefix: ""
      # Local address the signer endpoint binds to. Port 0 = ephemeral; the
      # bound address is printed when the run starts.
      bind: 127.0.0.1:0

scenarios:
  # A steady signed-request flow: every VU asks the signer endpoint for the
  # header/value to stamp on its outgoing partner-API request.
  partner_api:
    executor: constant-vus
    vus: 20
    duration: 30s
    flow:
      # Ask the signer for the signature for this request. Send one JSON request
      # line; the endpoint answers with `{"header":…,"value":…}` + a newline.
      # See the address printed at run start.
      - request:
          name: sign request
          url: tcp://127.0.0.1:0   # replace with the printed signer address
          socket:
            send_text: '{"method":"POST","path":"/v1/orders","body":"{\"sku\":\"abc\",\"qty\":2}"}\n'
            read_bytes: 512
            read_timeout: 2s
          checks:
            - { type: duration, name: signer is fast, max: 25ms }

thresholds:
  checks: [ "rate>0.99" ]