Add httpYac sample with HMAC auth config

Author: pwelter34

samples/Sample.HttpYac/Authenticated/GetAddresses.http

@@ -0,0 +1,10 @@
+GET /addresses
+Authorization: HMAC client:{{tokenId}} secret:{{tokenSecret}}
+Content-Type: application/json
+
+HTTP/1.1 200  - OK
+connection: close
+content-type: application/json; charset=utf-8
+date: Mon, 13 Apr 2026 21:28:24 GMT
+server: Kestrel
+transfer-encoding: chunked

samples/Sample.HttpYac/Authenticated/GetUsers.http

@@ -0,0 +1,10 @@
+GET /users
+Authorization: HMAC client:{{tokenId}} secret:{{tokenSecret}}
+Content-Type: application/json
+
+HTTP/1.1 200  - OK
+connection: close
+content-type: application/json; charset=utf-8
+date: Mon, 13 Apr 2026 21:29:36 GMT
+server: Kestrel
+transfer-encoding: chunked

samples/Sample.HttpYac/Authenticated/PostAddress.http

@@ -0,0 +1,18 @@
+POST /addresses
+Authorization: HMAC client:{{tokenId}} secret:{{tokenSecret}}
+Content-Type: application/json
+
+{
+    "line1": "{{$randomInt 100 200}} Main St",
+    "line2": "Apt {{$randomInt 1 50}}",
+    "city": "New York",
+    "state": "NY",
+    "zipCode": "10001"    
+}
+
+HTTP/1.1 200  - OK
+connection: close
+content-type: application/json; charset=utf-8
+date: Mon, 13 Apr 2026 21:32:44 GMT
+server: Kestrel
+transfer-encoding: chunked

samples/Sample.HttpYac/Authenticated/PostUser.http

@@ -0,0 +1,16 @@
+POST /users
+Authorization: HMAC client:{{tokenId}} secret:{{tokenSecret}}
+Content-Type: application/json
+
+{
+    "first": "John",
+    "last": "Doe",
+    "email": "John.Doe@example.com"
+}
+
+HTTP/1.1 200  - OK
+connection: close
+content-type: application/json; charset=utf-8
+date: Mon, 13 Apr 2026 21:35:29 GMT
+server: Kestrel
+transfer-encoding: chunked

samples/Sample.HttpYac/Public/GetWeather.http

@@ -0,0 +1,9 @@
+GET /weather
+Content-Type: application/json
+
+HTTP/1.1 200  - OK
+connection: close
+content-type: application/json; charset=utf-8
+date: Mon, 13 Apr 2026 21:36:50 GMT
+server: Kestrel
+transfer-encoding: chunked

samples/Sample.HttpYac/Public/HelloWorld.http

@@ -0,0 +1,9 @@
+GET /
+Content-Type: application/json
+
+HTTP/1.1 200  - OK
+connection: close
+content-type: text/plain; charset=utf-8
+date: Mon, 13 Apr 2026 21:37:25 GMT
+server: Kestrel
+transfer-encoding: chunked

samples/Sample.HttpYac/Public/PostWeather.http

@@ -0,0 +1,15 @@
+POST /weather
+Content-Type: application/json
+
+{
+    "date": "2025-08-05",
+    "temperatureC": 25,
+    "summary": "Sunny"
+  }
+
+HTTP/1.1 200  - OK
+connection: close
+content-type: application/json; charset=utf-8
+date: Mon, 13 Apr 2026 21:38:22 GMT
+server: Kestrel
+transfer-encoding: chunked

samples/Sample.HttpYac/README.md

@@ -0,0 +1,55 @@
+# HashGate HttpYac Sample
+
+[httpYac](https://httpyac.github.io/) collection demonstrating HMAC authentication with HashGate. Includes public and authenticated endpoint examples.
+
+## Prerequisites
+
+- [httpYac CLI](https://httpyac.github.io/guide/installation_cli) or the [VS Code extension](https://marketplace.visualstudio.com/items?itemName=anweber.vscode-httpyac)
+- Node.js (used by the config script to compute HMAC signatures)
+- A running HashGate sample server:
+
+```bash
+dotnet run --project ../Sample.MinimalApi
+```
+
+## Structure
+
+| Folder           | Description                                  |
+| ---------------- | -------------------------------------------- |
+| `Public/`        | Endpoints that do not require authentication |
+| `Authenticated/` | Endpoints secured with HMAC authentication   |
+
+## How It Works
+
+The `httpyac.config.js` file registers a `replaceVariable` hook that intercepts `Authorization` headers matching the pattern:
+
+```
+Authorization: HMAC client:{{tokenId}} secret:{{tokenSecret}}
+```
+
+The hook automatically computes the HMAC-SHA256 signature and sets the required headers (`host`, `x-timestamp`, `x-content-sha256`, `x-nonce`) on each request.
+
+## Usage
+
+### VS Code Extension
+
+1. Install the **httpYac** VS Code extension
+2. Open any `.http` file in this folder
+3. Click **Send** above the request
+
+### CLI
+
+```bash
+cd samples/Sample.HttpYac
+npx httpyac Authenticated/GetUsers.http --env local
+```
+
+## Environment Variables
+
+Defined in `httpyac.config.js` under the `local` environment:
+
+| Variable      | Description                          |
+| ------------- | ------------------------------------ |
+| `host`        | Base URL of the sample API           |
+| `tokenId`     | HMAC client identifier               |
+| `tokenSecret` | HMAC secret key for signing requests |

samples/Sample.HttpYac/httpyac.config.js

@@ -0,0 +1,89 @@
+const crypto = require('crypto');
+const { URL } = require('url');
+
+module.exports = {
+  log: {
+    level: 'trace',
+    supportAnsiColors: true,
+    prettyPrint: true,
+  },
+  request: {
+    https: {
+      rejectUnauthorized: false
+    }
+  },
+  environments: {
+    local: {
+      host: "https://localhost:7134",
+      tokenId: "SampleClient",
+      tokenSecret: "ci3JaJZRDQGq6juXVvfp89TnAzS43ASaK/uB38R6ndzr7NN/Wlbstvg+2ZaI2qUVHkvvD3+hPvvzL58Z/bPq6A==",
+    }
+  },
+  configureHooks: function (api) {
+    api.hooks.replaceVariable.addHook('replaceHmacHeader', replaceHmacHeader);
+  }
+}
+
+function replaceHmacHeader(text, type, context) {
+  if (type.toLowerCase() !== 'authorization')
+    return text;
+
+  if (!text.startsWith('HMAC'))
+    return text;
+
+  const { request } = context;
+  if (!request)
+    return text;
+
+  // format: HMAC client:myclient secret:mysecret
+  const hmacRegex = /^hmac\s*client\s*[:=]\s*(?<client>\S+)[\s&]+secret\s*[:=]\s*(?<secret>\S+)\s*$/i;
+  const match = hmacRegex.exec(text);
+  if (!match || !match.groups)
+    return text;
+
+  const client = match.groups.client;
+  const secretKey = match.groups.secret;
+
+  const timestamp = Math.floor(Date.now() / 1000);
+
+  const url = new URL(request.url);
+  const host = url.hostname;
+  const pathAndQuery = url.pathname + url.search;
+
+  const method = request.method.toUpperCase();
+  const body = request.body ? request.body.toString() : '';
+
+  // Create content hash
+  const contentHash = crypto
+    .createHash('sha256')
+    .update(body, 'utf8')
+    .digest('base64');
+
+  // Generate unique nonce
+  const nonce = crypto.randomUUID();
+
+  // Create signed headers and string to sign
+  const headerValues = `${host};${timestamp};${contentHash};${nonce}`;
+  const stringToSign = `${method}\n${pathAndQuery}\n${headerValues}`;
+
+  // Generate signature
+  const signature = crypto
+    .createHmac('sha256', secretKey)
+    .update(stringToSign, 'utf8')
+    .digest('base64');
+
+  // Construct Authorization header
+  const signedHeader = 'host;x-timestamp;x-content-sha256;x-nonce';
+  const authorization = `HMAC Client=${client}&SignedHeaders=${signedHeader}&Signature=${signature}`;
+
+  // Set required headers
+  request.headers['host'] = host;
+  request.headers['x-timestamp'] = timestamp.toString();
+  request.headers['x-content-sha256'] = contentHash;
+  request.headers['x-nonce'] = nonce;
+
+  console.info('Generated HMAC Authorization Header:', authorization);
+  // Return the new Authorization header
+  return authorization;
+
+}