fix: use path-only hmac signatures

package.json

@@ -1,7 +1,7 @@
 {
     "name": "@kuestcom/builder-signing-sdk",
     "description": "Kuest SDK for creating builder headers",
-    "version": "2.0.1",
+    "version": "2.0.2",
     "repository": {
         "type": "git",
         "url": "git+https://github.com/kuestcom/builder-signing-sdk.git"

src/signing/hmac.ts

@@ -19,7 +19,8 @@ export const buildHmacSignature = (
     requestPath: string,
     body?: string,
 ): string => {
-    let message = timestamp + method + requestPath;
+    const signingPath = requestPath.split("?")[0];
+    let message = timestamp + method + signingPath;
     if (body !== undefined) {
         message += body;
     }

tests/hmac.test.ts

@@ -15,4 +15,23 @@ describe("hmac", () => {
         expect(signature.length).toBeGreaterThan(0);
         expect(signature).toBe("ZwAdJKvoYRlEKDkNMwd5BuwNNtg93kNaR_oU2HrfVvc=");
     });
+
+    it("excludes query parameters from the signing path", () => {
+        const pathSignature = buildHmacSignature(
+            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+            1000000,
+            "test-sign",
+            "/orders",
+            '{"hash": "0x123"}',
+        );
+        const querySignature = buildHmacSignature(
+            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+            1000000,
+            "test-sign",
+            "/orders?market=condition",
+            '{"hash": "0x123"}',
+        );
+
+        expect(querySignature).toBe(pathSignature);
+    });
 });