Struct Signer 

pub struct Signer<K>
where
    K: SigningCredential,
{ /* private fields */ }

Available on crate feature reqsign only.

Loads credentials and atomically signs request heads.

The service-specific SignRequest runs against a private candidate. Only the candidate URI and headers are committed after successful signing.

Implementations

impl<K> Signer<K>

where K: SigningCredential,

pub fn new( ctx: Context, loader: impl ProvideCredential<Credential = K>, builder: impl SignRequest<Credential = K>, ) -> Signer<K>

Create a new signer.

pub fn with_context(self, ctx: Context) -> Signer<K>

Replace the context while keeping the credential provider, request signer, and shared credential cache.

pub fn with_credential_provider( self, provider: impl ProvideCredential<Credential = K>, ) -> Signer<K>

Replace the credential provider while keeping context and request signer, and create an isolated empty credential cache.

pub fn with_request_signer( self, signer: impl SignRequest<Credential = K>, ) -> Signer<K>

Replace the request signer while keeping context and credential provider.

pub async fn sign( &self, req: &mut Parts, expires_in: Option<Duration>, ) -> Result<(), Error>

Sign a wire-ready request head.

The request URI must satisfy the input contract of the configured SignRequest. Built-in signers require an authority and expect path and query data to be percent-encoded exactly once before this call. Signing does not perform general-purpose URI encoding for the caller.

If credential loading or request signing returns an error, req is unchanged. On success, only req.uri and req.headers may change; the method, version, and extensions retain their input values.

expires_in is a service-specific validity input and does not universally select query authentication. The configured service signer and credential type determine how it is interpreted.

Cached credentials must be fresh according to SigningCredential::is_valid and usable through SignRequest::required_valid_until. A refreshed credential only needs to satisfy the exact operation deadline. Credential refresh is serialized per shared cache. A failed refresh is not cached, so the next waiting or later caller can retry. Provider errors are returned without internal retry or fallback to the previous cached credential. Request signing runs after refresh coordination has completed and remains concurrent.

Trait Implementations

impl<K> Clone for Signer<K>

where K: Clone + SigningCredential,

fn clone(&self) -> Signer<K>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<K> Debug for Signer<K>

where K: SigningCredential,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.