fix: use path-only hmac signatures

py_builder_signing_sdk/signing/hmac.py

@@ -10,7 +10,8 @@ def build_hmac_signature(
     Creates an HMAC signature by signing a payload with the secret
     """
     base64_secret = base64.urlsafe_b64decode(secret)
-    message = str(timestamp) + str(method) + str(requestPath)
+    signing_path = str(requestPath).split("?", 1)[0]
+    message = str(timestamp) + str(method) + signing_path
     if body:
         # NOTE: Necessary to replace single quotes with double quotes
         # to generate the same hmac message as go and typescript

setup.py

@@ -5,7 +5,7 @@
 
 setuptools.setup(
     name="kuest-py-builder-signing-sdk",
-    version="2.0.1",
+    version="2.0.2",
     author="Kuest Engineering",
     author_email="engineering@kuest.com",
     maintainer="Kuest Engineering",

tests/signing/test_hmac.py

@@ -17,3 +17,21 @@ def test_build_hmac_signature(self):
             signature,
             "ZwAdJKvoYRlEKDkNMwd5BuwNNtg93kNaR_oU2HrfVvc=",
         )
+
+    def test_query_parameters_are_excluded_from_signature(self):
+        path_signature = build_hmac_signature(
+            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+            "1000000",
+            "test-sign",
+            "/orders",
+            '{"hash": "0x123"}',
+        )
+        query_signature = build_hmac_signature(
+            "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
+            "1000000",
+            "test-sign",
+            "/orders?market=condition",
+            '{"hash": "0x123"}',
+        )
+
+        self.assertEqual(query_signature, path_signature)