Module signed_url 

Signed URL request authentication (DW-109).

This module provides short-lived signed URL verification: a request to a route with signed_url enabled must carry a cryptographic signature in its query string, computed as an HMAC-SHA256 over the canonical request (method, path, and an expiry timestamp). The signature proves the URL was minted by a trusted party that holds the secret, and the expiry bounds the URL’s validity window.

Replay hardening (SEC-07, #211)

Two optional mechanisms prevent replay within the validity window:

• One-time nonces: when require_nonce: true, each signed URL must carry a unique nonce query parameter. The verifier records each seen nonce in a bounded TTL cache; a replayed nonce is rejected with ReplayedNonce. The cache is per-verifier (per route), keyed by the nonce value, and entries expire at the URL’s expires timestamp (so the cache does not grow unboundedly).
• Client-IP binding: when bind_client_ip: true, the canonical request includes the client’s IP address, so a signed URL minted for one client cannot be replayed from a different IP. The IP is appended to the canonical string as a fourth line.

Both are opt-in (default off) for backward compatibility with existing signed-URL minters.

Structs

SignedUrlConfig

Signed URL configuration (DW-109, routes[].signed_url).

SignedUrlVerifier

A signed URL verifier (DW-109).

Enums

SignedUrlError

An error from signed URL verification (DW-109).

SignedUrlResult

The result of signed URL verification.