S3QueryString

# builds an authenticated S3 query string without having
# to connect to the server first
class S3QueryString < String

  def initialize(path, bucket, options = {})
    super()

    @access_key_id = options[:access_key_id]
    @secret_access_key = options[:secret_access_key]
    @bucket = bucket
    @expires = (Time.now + Integer(options[:expires_in])).to_i
    @path = path

    self << "https://#{bucket}.s3.amazonaws.com/#{path}?#{query_string}"
  end

  private

  def query_string
    "AWSAccessKeyId=#{@access_key_id}&Expires=#{@expires}&Signature=#{encoded_canonical}"
  end

  def encoded_canonical
    digest = OpenSSL::Digest::Digest.new('sha1')
    b64_hmac = [OpenSSL::HMAC.digest(digest, @secret_access_key, canonical_string)].pack("m").strip
    CGI.escape( b64_hmac )
  end

  def canonical_string
    "GET\n\n\n#{@expires}\n/#{@bucket}/#{@path}"
  end
end