[PR #5888] feat: add AWS profile credential mode for Signature auth #5395

New issue

Open

opened 2026-03-17 02:50:41 +03:00 by kerem · 0 comments

kerem commented

2026-03-17 02:50:41 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/hoppscotch/hoppscotch/pull/5888
Author: @mcdgavin
Created: 2/18/2026
Status: 🔄 Open

Base: main ← Head: feat/aws-profiles-clean

📝 Commits (2)

3cd3b9c feat(common,agent,data): add AWS profile credential mode for AWS Signature auth
d2d6879 fix(common,agent): improve AWS profile UX and correctness

📊 Changes

23 files changed (+1486 additions, -87 deletions)

View changed files

📝 packages/hoppscotch-agent/src-tauri/Cargo.lock (+559 -36)
📝 packages/hoppscotch-agent/src-tauri/Cargo.toml (+2 -0)
➕ packages/hoppscotch-agent/src-tauri/src/aws.rs (+170 -0)
📝 packages/hoppscotch-agent/src-tauri/src/error.rs (+6 -0)
📝 packages/hoppscotch-agent/src-tauri/src/lib.rs (+1 -0)
📝 packages/hoppscotch-agent/src-tauri/src/model.rs (+30 -0)
📝 packages/hoppscotch-agent/src-tauri/src/route.rs (+6 -1)
📝 packages/hoppscotch-common/locales/en.json (+5 -1)
📝 packages/hoppscotch-common/src/components/graphql/Authorization.vue (+2 -0)
📝 packages/hoppscotch-common/src/components/http/Authorization.vue (+6 -0)
📝 packages/hoppscotch-common/src/components/http/authorization/AWSSign.vue (+190 -33)
📝 packages/hoppscotch-common/src/helpers/auth/types/__tests__/aws-signature.spec.ts (+209 -0)
📝 packages/hoppscotch-common/src/helpers/auth/types/aws-signature.ts (+23 -6)
📝 packages/hoppscotch-common/src/platform/std/kernel-interceptors/agent/store.ts (+115 -0)
📝 packages/hoppscotch-common/src/services/persistence/__tests__/__mocks__/index.ts (+2 -2)
📝 packages/hoppscotch-common/src/services/test-runner/test-runner.service.ts (+2 -1)
📝 packages/hoppscotch-common/src/types/post-request.d.ts (+2 -0)
📝 packages/hoppscotch-common/src/types/pre-request.d.ts (+2 -0)
📝 packages/hoppscotch-data/src/collection/index.ts (+4 -2)
➕ packages/hoppscotch-data/src/collection/v/12.ts (+60 -0)

...and 3 more files

📄 Description

Summary

Adds a Profile credential mode to AWS Signature authentication, allowing users to select an AWS profile (from ~/.aws/credentials and ~/.aws/config) instead of manually entering access key and secret key
The Hoppscotch Agent resolves credentials using the full AWS credential provider chain (static, assume-role, SSO, credential_process) via the aws-config Rust crate
Manual credential mode remains unchanged and is the default for backward compatibility

Closes #5235

Changes

Agent (Rust)

New aws.rs module with two endpoints:
- GET /aws/profiles — lists profile names from ~/.aws/credentials and ~/.aws/config
- POST /aws/resolve-credentials — resolves a profile to temporary credentials via the AWS SDK credential provider chain
AwsCredentialsResponse uses a custom Debug impl that redacts sensitive fields
AWS SDK errors are logged server-side and return a generic message to the client

Data model

REST schema v17 → v18: extends HoppRESTAuthAWSSignature with credentialMode ("manual" | "profile") and profileName
Collection schema v11 → v12: migrates collection-level auth with recursive folder handling
Both use .catch() defaults for backward compatibility

Frontend

AWSSign.vue: credential mode toggle (Manual/Profile) with profile dropdown populated from the agent
Agent service: listAwsProfiles() and resolveAwsCredentials() methods using shared encryptPayload() helper
Signing logic: resolves profile credentials from the agent before signing when in profile mode
i18n: new localization strings for profile mode UI

Test plan

Verify 20 unit tests pass: cd packages/hoppscotch-common && pnpm test -- src/helpers/auth/types/__tests__/aws-signature.spec.ts
Verify full test suite passes: cd packages/hoppscotch-common && pnpm test
Verify typecheck passes: pnpm typecheck
Manual: configure ~/.aws/credentials with a test profile, start agent, switch to Profile mode, verify dropdown lists profiles
Manual: select a profile and send a request to an AWS service, verify signing works
Manual: switch to Manual mode, verify existing access key/secret key flow is unchanged
Manual: verify backward compatibility — old saved requests load without errors

Summary by cubic

Adds an AWS Profile credential mode for AWS Signature auth, letting users pick a profile and resolve credentials via the Hoppscotch Agent using the AWS SDK. Manual key entry remains the default and fully supported.

Bug Fixes
- Profiles now respect AWS_SHARED_CREDENTIALS_FILE and AWS_CONFIG_FILE and load when switching modes or when the Agent connects.
- Agent connection check includes sharedSecretB16 to reflect actual usability in profile mode.
- Region fallback uses "us-east-1" when empty or unset.
- Initialized serviceToken in auth selectors to avoid undefined flowing through v-model.
Migration
- REST schema v18 and Collection schema v12 add credentialMode ("manual" | "profile") and profileName; existing data defaults to manual and stays compatible.
- To use profiles, run and connect the Hoppscotch Agent; manual mode needs no changes.

^{Written for commit d2d6879c27. Summary will update on new commits.}

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/hoppscotch/hoppscotch/pull/5888 **Author:** [@mcdgavin](https://github.com/mcdgavin) **Created:** 2/18/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/aws-profiles-clean` --- ### 📝 Commits (2) - [`3cd3b9c`](https://github.com/hoppscotch/hoppscotch/commit/3cd3b9c34fb146e1589559cc87373b4c57d75f48) feat(common,agent,data): add AWS profile credential mode for AWS Signature auth - [`d2d6879`](https://github.com/hoppscotch/hoppscotch/commit/d2d6879c27396722f22df0a83c0cceef778ab756) fix(common,agent): improve AWS profile UX and correctness ### 📊 Changes **23 files changed** (+1486 additions, -87 deletions) <details> <summary>View changed files</summary> 📝 `packages/hoppscotch-agent/src-tauri/Cargo.lock` (+559 -36) 📝 `packages/hoppscotch-agent/src-tauri/Cargo.toml` (+2 -0) ➕ `packages/hoppscotch-agent/src-tauri/src/aws.rs` (+170 -0) 📝 `packages/hoppscotch-agent/src-tauri/src/error.rs` (+6 -0) 📝 `packages/hoppscotch-agent/src-tauri/src/lib.rs` (+1 -0) 📝 `packages/hoppscotch-agent/src-tauri/src/model.rs` (+30 -0) 📝 `packages/hoppscotch-agent/src-tauri/src/route.rs` (+6 -1) 📝 `packages/hoppscotch-common/locales/en.json` (+5 -1) 📝 `packages/hoppscotch-common/src/components/graphql/Authorization.vue` (+2 -0) 📝 `packages/hoppscotch-common/src/components/http/Authorization.vue` (+6 -0) 📝 `packages/hoppscotch-common/src/components/http/authorization/AWSSign.vue` (+190 -33) 📝 `packages/hoppscotch-common/src/helpers/auth/types/__tests__/aws-signature.spec.ts` (+209 -0) 📝 `packages/hoppscotch-common/src/helpers/auth/types/aws-signature.ts` (+23 -6) 📝 `packages/hoppscotch-common/src/platform/std/kernel-interceptors/agent/store.ts` (+115 -0) 📝 `packages/hoppscotch-common/src/services/persistence/__tests__/__mocks__/index.ts` (+2 -2) 📝 `packages/hoppscotch-common/src/services/test-runner/test-runner.service.ts` (+2 -1) 📝 `packages/hoppscotch-common/src/types/post-request.d.ts` (+2 -0) 📝 `packages/hoppscotch-common/src/types/pre-request.d.ts` (+2 -0) 📝 `packages/hoppscotch-data/src/collection/index.ts` (+4 -2) ➕ `packages/hoppscotch-data/src/collection/v/12.ts` (+60 -0) _...and 3 more files_ </details> ### 📄 Description ## Summary - Adds a **Profile** credential mode to AWS Signature authentication, allowing users to select an AWS profile (from `~/.aws/credentials` and `~/.aws/config`) instead of manually entering access key and secret key - The Hoppscotch Agent resolves credentials using the full AWS credential provider chain (static, assume-role, SSO, `credential_process`) via the `aws-config` Rust crate - Manual credential mode remains unchanged and is the default for backward compatibility Closes #5235 ## Changes ### Agent (Rust) - **New `aws.rs` module** with two endpoints: - `GET /aws/profiles` — lists profile names from `~/.aws/credentials` and `~/.aws/config` - `POST /aws/resolve-credentials` — resolves a profile to temporary credentials via the AWS SDK credential provider chain - `AwsCredentialsResponse` uses a custom `Debug` impl that redacts sensitive fields - AWS SDK errors are logged server-side and return a generic message to the client ### Data model - **REST schema v17 → v18**: extends `HoppRESTAuthAWSSignature` with `credentialMode` (`"manual"` | `"profile"`) and `profileName` - **Collection schema v11 → v12**: migrates collection-level auth with recursive folder handling - Both use `.catch()` defaults for backward compatibility ### Frontend - **AWSSign.vue**: credential mode toggle (Manual/Profile) with profile dropdown populated from the agent - **Agent service**: `listAwsProfiles()` and `resolveAwsCredentials()` methods using shared `encryptPayload()` helper - **Signing logic**: resolves profile credentials from the agent before signing when in profile mode - **i18n**: new localization strings for profile mode UI ## Test plan - [ ] Verify 20 unit tests pass: `cd packages/hoppscotch-common && pnpm test -- src/helpers/auth/types/__tests__/aws-signature.spec.ts` - [ ] Verify full test suite passes: `cd packages/hoppscotch-common && pnpm test` - [ ] Verify typecheck passes: `pnpm typecheck` - [ ] Manual: configure `~/.aws/credentials` with a test profile, start agent, switch to Profile mode, verify dropdown lists profiles - [ ] Manual: select a profile and send a request to an AWS service, verify signing works - [ ] Manual: switch to Manual mode, verify existing access key/secret key flow is unchanged - [ ] Manual: verify backward compatibility — old saved requests load without errors  --- ## Summary by cubic Adds an AWS Profile credential mode for AWS Signature auth, letting users pick a profile and resolve credentials via the Hoppscotch Agent using the AWS SDK. Manual key entry remains the default and fully supported. - **Bug Fixes** - Profiles now respect AWS_SHARED_CREDENTIALS_FILE and AWS_CONFIG_FILE and load when switching modes or when the Agent connects. - Agent connection check includes sharedSecretB16 to reflect actual usability in profile mode. - Region fallback uses "us-east-1" when empty or unset. - Initialized serviceToken in auth selectors to avoid undefined flowing through v-model. - **Migration** - REST schema v18 and Collection schema v12 add credentialMode ("manual" | "profile") and profileName; existing data defaults to manual and stays compatible. - To use profiles, run and connect the Hoppscotch Agent; manual mode needs no changes. <sup>Written for commit d2d6879c27396722f22df0a83c0cceef778ab756. Summary will update on new commits.</sup>  --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>