signed-request

// A signed request: the API wants each request signed with a secret key, by HMAC-SHA-256, over what the
// request says. The collector reads the number of messages waiting in a queue.
need('protocol:http');

$base = variable('example:signed:url', 'text', array(
    'label' => 'Address of the API',
    'help'  => 'For example https://queue.example.',
));
$key_id = variable('example:signed:key-id', 'text', array(
    'label' => 'Key id',
    'help'  => 'The id of the key, sent with each request.',
));
$key = variable('example:signed:key', 'text', array(
    'label'  => 'Signing key',
    'help'   => 'The secret key that signs the requests.',
    'secret' => true,
));

output('waiting', 'number', array('label' => 'Messages waiting'));

watch.above('backlog', 'Queue backlog', 'waiting', array('warning' => 1000, 'critical' => 10000));

$path = '/v1/queues/main';
// time.now counts to the millisecond; the API wants whole seconds.
$query = url.query(array('timestamp' => number.round(time.now())));
// What is signed, one item per line: the method, the path, the query, and the SHA-256 of the body,
// empty for a GET.
$signed = "GET\n" . $path . "\n" . $query . "\n" . hash.sha256('');
// The signature, made with the secret key, is itself a secret: it only goes into the request.
$signature = hash.hmac_sha256($signed, $key);

$answer = http.get($base . $path . '?' . $query, headers=array('X-Key-Id' => $key_id, 'X-Signature' => $signature));
if ($answer['status'] != 200) {
    fail('misconfigured', 'Request refused, code ' . $answer['status']);
}
// {"waiting": 12, ...}
$queue = json.read($answer['body']);
value('waiting', $queue['waiting']);