Fix test failures from auth scheme resolution refactoring: preserve interceptor signer properties and reorder SIGNING_METHOD resolution

Author: S-Saranya1

core/aws-core/src/main/java/software/amazon/awssdk/awscore/internal/AwsExecutionContextBuilder.java

@@ -161,6 +161,10 @@ private AwsExecutionContextBuilder() {
         ExecutionInterceptorChain executionInterceptorChain =
             new ExecutionInterceptorChain(clientConfig.option(SdkClientOption.EXECUTION_INTERCEPTORS));
 
+        // Snapshot the auth scheme before interceptors run so we can detect interceptor-modified signer properties later.
+        executionAttributes.putAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_BEFORE_INTERCEPTORS,
+                                         executionAttributes.getAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME));
+
         InterceptorContext interceptorContext = InterceptorContext.builder()
                                                                   .request(originalRequest)
                                                                   .asyncRequestBody(executionParams.getAsyncRequestBody())
@@ -184,6 +188,15 @@ private AwsExecutionContextBuilder() {
                                              signer, executionAttributes, executionAttributes.getOptionalAttribute(
                                                  AwsSignerExecutionAttribute.AWS_CREDENTIALS).orElse(null)));
 
+        // Set a callback to recompute SIGNING_METHOD after auth scheme resolution,
+        // when derived attributes like ENABLE_CHUNKED_ENCODING have correct values.
+        Signer resolvedSigner = signer;
+        executionAttributes.putAttribute(SdkInternalExecutionAttribute.SIGNING_METHOD_UPDATER, attrs ->
+            attrs.putAttribute(HttpChecksumConstant.SIGNING_METHOD,
+                               resolveSigningMethodUsed(
+                                   resolvedSigner, attrs, attrs.getOptionalAttribute(
+                                       AwsSignerExecutionAttribute.AWS_CREDENTIALS).orElse(null))));
+
         putStreamingInputOutputTypesMetadata(executionAttributes, executionParams);
 
         return ExecutionContext.builder()

core/sdk-core/src/main/java/software/amazon/awssdk/core/interceptor/SdkInternalExecutionAttribute.java

@@ -177,6 +177,15 @@ public final class SdkInternalExecutionAttribute extends SdkExecutionAttribute {
     public static final ExecutionAttribute<IdentityProviderUpdater> IDENTITY_PROVIDER_UPDATER =
         new ExecutionAttribute<>("IdentityProviderUpdater");
 
+    /**
+     * Callback to recompute {@code SIGNING_METHOD} after auth scheme resolution.
+     * Set by {@code AwsExecutionContextBuilder} so that the signing method can be updated
+     * once the resolved auth scheme provides correct values for derived attributes like
+     * {@code ENABLE_CHUNKED_ENCODING}.
+     */
+    public static final ExecutionAttribute<java.util.function.Consumer<ExecutionAttributes>> SIGNING_METHOD_UPDATER =
+        new ExecutionAttribute<>("SigningMethodUpdater");
+
     /**
      * Callback to resolve auth scheme options from the (possibly modified) request.
      * Called by AuthSchemeResolutionStage after interceptors have run.
@@ -204,6 +213,22 @@ public final class SdkInternalExecutionAttribute extends SdkExecutionAttribute {
     public static final ExecutionAttribute<SelectedAuthScheme<?>> SELECTED_AUTH_SCHEME =
         new ExecutionAttribute<>("SelectedAuthScheme");
 
+    /**
+     * Snapshot of {@link #SELECTED_AUTH_SCHEME} taken before execution interceptors run.
+     * Used by {@code AuthSchemeResolver#mergePreExistingAuthSchemeProperties} to detect which signer properties
+     * were explicitly modified by interceptors (and should therefore override the freshly-resolved values).
+     */
+    public static final ExecutionAttribute<SelectedAuthScheme<?>> AUTH_SCHEME_BEFORE_INTERCEPTORS =
+        new ExecutionAttribute<>("AuthSchemeBeforeInterceptors");
+
+    /**
+     * Snapshot of {@link #SELECTED_AUTH_SCHEME} taken after interceptors run but before auth scheme resolution.
+     * Together with {@link #AUTH_SCHEME_BEFORE_INTERCEPTORS}, this allows detecting which signer properties
+     * were explicitly modified by interceptors so they can be re-applied after endpoint resolution.
+     */
+    public static final ExecutionAttribute<SelectedAuthScheme<?>> AUTH_SCHEME_AFTER_INTERCEPTORS =
+        new ExecutionAttribute<>("AuthSchemeAfterInterceptors");
+
     /**
      * The supported compression algorithms for an operation, and whether the operation is streaming or not.
      */

core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/AmazonAsyncHttpClient.java

@@ -199,9 +199,9 @@ public <OutputT> CompletableFuture<OutputT> execute(
                                 .then(MergeCustomQueryParamsStage::new)
                                 .then(QueryParametersToBodyStage::new)
                                 .then(() -> new CompressRequestStage(httpClientDependencies))
-                                .then(() -> new HttpChecksumStage(ClientType.ASYNC))
                                 .then(AuthSchemeResolutionStage::new)
                                 .then(EndpointResolutionStage::new)
+                                .then(() -> new HttpChecksumStage(ClientType.ASYNC))
                                 .then(ApplyUserAgentStage::new)
                                 .then(MakeRequestImmutableStage::new)
                                 .then(RequestPipelineBuilder

core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/AmazonSyncHttpClient.java

@@ -187,9 +187,9 @@ public <OutputT> OutputT execute(HttpResponseHandler<Response<OutputT>> response
                                .then(MergeCustomQueryParamsStage::new)
                                .then(QueryParametersToBodyStage::new)
                                .then(() -> new CompressRequestStage(httpClientDependencies))
-                               .then(() -> new HttpChecksumStage(ClientType.SYNC))
                                .then(AuthSchemeResolutionStage::new)
                                .then(EndpointResolutionStage::new)
+                               .then(() -> new HttpChecksumStage(ClientType.SYNC))
                                .then(ApplyUserAgentStage::new)
                                .then(MakeRequestImmutableStage::new)
                                // End of mutating request

core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/auth/AuthSchemeResolver.java

@@ -19,6 +19,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.concurrent.CompletableFuture;
 import java.util.function.Supplier;
 import java.util.stream.Collectors;
@@ -32,6 +33,7 @@
 import software.amazon.awssdk.http.auth.spi.scheme.AuthScheme;
 import software.amazon.awssdk.http.auth.spi.scheme.AuthSchemeOption;
 import software.amazon.awssdk.http.auth.spi.signer.HttpSigner;
+import software.amazon.awssdk.http.auth.spi.signer.SignerProperty;
 import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
 import software.amazon.awssdk.identity.spi.Identity;
 import software.amazon.awssdk.identity.spi.IdentityProvider;
@@ -94,6 +96,9 @@ public static SelectedAuthScheme<? extends Identity> selectAuthScheme(
 
     /**
      * Merge properties from any pre-existing auth scheme into the selected one.
+     * Properties explicitly modified by execution interceptors (detected by diffing against the pre-interceptor snapshot)
+     * are force-overwritten onto the newly resolved auth scheme. All other pre-existing properties are merged with
+     * {@code putIfAbsent} so that freshly resolved values take precedence.
      */
     public static <T extends Identity> SelectedAuthScheme<T> mergePreExistingAuthSchemeProperties(
             SelectedAuthScheme<T> selectedAuthScheme,
@@ -106,9 +111,23 @@ public static <T extends Identity> SelectedAuthScheme<T> mergePreExistingAuthSch
             return selectedAuthScheme;
         }
 
+        SelectedAuthScheme<?> beforeInterceptors =
+            executionAttributes.getAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_BEFORE_INTERCEPTORS);
+
         AuthSchemeOption.Builder mergedOption = selectedAuthScheme.authSchemeOption().toBuilder();
+
+        existingAuthScheme.authSchemeOption().forEachSignerProperty(new AuthSchemeOption.SignerPropertyConsumer() {
+            @Override
+            public <S> void accept(SignerProperty<S> key, S value) {
+                if (wasModifiedByInterceptor(beforeInterceptors, key, value)) {
+                    mergedOption.putSignerProperty(key, value);
+                } else {
+                    mergedOption.putSignerPropertyIfAbsent(key, value);
+                }
+            }
+        });
+
         existingAuthScheme.authSchemeOption().forEachIdentityProperty(mergedOption::putIdentityPropertyIfAbsent);
-        existingAuthScheme.authSchemeOption().forEachSignerProperty(mergedOption::putSignerPropertyIfAbsent);
 
         return new SelectedAuthScheme<>(
             selectedAuthScheme.identity(),
@@ -117,6 +136,57 @@ public static <T extends Identity> SelectedAuthScheme<T> mergePreExistingAuthSch
         );
     }
 
+    private static <T> boolean wasModifiedByInterceptor(SelectedAuthScheme<?> beforeInterceptors,
+                                                         SignerProperty<T> key, T currentValue) {
+        if (beforeInterceptors == null) {
+            return true;
+        }
+        T originalValue = beforeInterceptors.authSchemeOption().signerProperty(key);
+        return !Objects.equals(originalValue, currentValue);
+    }
+
+    /**
+     * Re-applies interceptor-modified signer properties onto the current auth scheme.
+     * Called after endpoint resolution, which may have overwritten properties that interceptors set.
+     */
+    public static void applyInterceptorModifiedProperties(SelectedAuthScheme<?> currentScheme,
+                                                           SelectedAuthScheme<?> beforeInterceptors,
+                                                           SelectedAuthScheme<?> afterInterceptors,
+                                                           ExecutionAttributes attrs) {
+        if (afterInterceptors == null) {
+            return;
+        }
+        doApplyInterceptorModifiedProperties(currentScheme, beforeInterceptors, afterInterceptors, attrs);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static <T extends Identity> void doApplyInterceptorModifiedProperties(
+            SelectedAuthScheme<T> currentScheme,
+            SelectedAuthScheme<?> beforeInterceptors,
+            SelectedAuthScheme<?> afterInterceptors,
+            ExecutionAttributes attrs) {
+
+        AuthSchemeOption.Builder mergedOption = currentScheme.authSchemeOption().toBuilder();
+        boolean[] changed = {false};
+
+        afterInterceptors.authSchemeOption().forEachSignerProperty(new AuthSchemeOption.SignerPropertyConsumer() {
+            @Override
+            public <S> void accept(SignerProperty<S> key, S value) {
+                if (wasModifiedByInterceptor(beforeInterceptors, key, value)) {
+                    mergedOption.putSignerProperty(key, value);
+                    changed[0] = true;
+                }
+            }
+        });
+
+        if (changed[0]) {
+            attrs.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME,
+                               new SelectedAuthScheme<>(currentScheme.identity(),
+                                                        currentScheme.signer(),
+                                                        mergedOption.build()));
+        }
+    }
+
     private static <T extends Identity> SelectedAuthScheme<T> trySelectAuthScheme(
             AuthSchemeOption authOption,
             AuthScheme<T> authScheme,

core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/pipeline/stages/AuthSchemeResolutionStage.java

@@ -76,10 +76,22 @@ public SdkHttpFullRequest.Builder execute(SdkHttpFullRequest.Builder request, Re
         SelectedAuthScheme<? extends Identity> selectedAuthScheme =
             AuthSchemeResolver.selectAuthScheme(authOptions, authSchemes, identityProviders, metricCollector);
 
+        // Snapshot the interceptor-modified auth scheme before overwriting, so EndpointResolutionStage
+        // can re-apply interceptor-modified properties after the endpoint resolver callback runs.
+        executionAttributes.putAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_AFTER_INTERCEPTORS,
+                                         executionAttributes.getAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME));
+
         selectedAuthScheme = AuthSchemeResolver.mergePreExistingAuthSchemeProperties(selectedAuthScheme, executionAttributes);
 
         executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
 
+        // Recompute SIGNING_METHOD now that SELECTED_AUTH_SCHEME has correct values for derived attributes
+        java.util.function.Consumer<ExecutionAttributes> signingMethodUpdater =
+            executionAttributes.getAttribute(SdkInternalExecutionAttribute.SIGNING_METHOD_UPDATER);
+        if (signingMethodUpdater != null) {
+            signingMethodUpdater.accept(executionAttributes);
+        }
+
         recordBusinessMetrics(selectedAuthScheme, sdkRequest, executionAttributes);
 
         return request;

core/sdk-core/src/main/java/software/amazon/awssdk/core/internal/http/pipeline/stages/EndpointResolutionStage.java

@@ -22,12 +22,14 @@
 import software.amazon.awssdk.annotations.SdkInternalApi;
 import software.amazon.awssdk.core.ClientEndpointProvider;
 import software.amazon.awssdk.core.SdkRequest;
+import software.amazon.awssdk.core.SelectedAuthScheme;
 import software.amazon.awssdk.core.interceptor.ExecutionAttributes;
 import software.amazon.awssdk.core.interceptor.SdkExecutionAttribute;
 import software.amazon.awssdk.core.interceptor.SdkInternalExecutionAttribute;
 import software.amazon.awssdk.core.internal.endpoint.EndpointResolver;
 import software.amazon.awssdk.core.internal.http.HttpClientDependencies;
 import software.amazon.awssdk.core.internal.http.RequestExecutionContext;
+import software.amazon.awssdk.core.internal.http.auth.AuthSchemeResolver;
 import software.amazon.awssdk.core.internal.http.pipeline.MutableRequestToRequestPipeline;
 import software.amazon.awssdk.core.metrics.CoreMetric;
 import software.amazon.awssdk.endpoints.Endpoint;
@@ -70,6 +72,10 @@ public SdkHttpFullRequest.Builder execute(SdkHttpFullRequest.Builder request, Re
         Endpoint endpoint = resolver.resolve(sdkRequest, attrs);
         Duration resolveEndpointDuration = Duration.ofNanos(System.nanoTime() - resolveEndpointStart);
 
+        // The endpoint resolver callback (generated per-service) may overwrite SELECTED_AUTH_SCHEME with
+        // endpoint-resolved signer properties. Re-apply any interceptor-modified properties so they take precedence.
+        reapplyInterceptorModifiedAuthProperties(attrs);
+
         MetricCollector metricCollector = attrs.getAttribute(SdkExecutionAttribute.API_CALL_METRIC_COLLECTOR);
         if (metricCollector != null) {
             metricCollector.reportMetric(CoreMetric.ENDPOINT_RESOLVE_DURATION, resolveEndpointDuration);
@@ -140,4 +146,26 @@ private static String combinePath(String clientEndpointPath, String requestPath,
         String requestPathWithClientPathRemoved = StringUtils.replaceOnce(requestPath, clientEndpointPath, "");
         return SdkHttpUtils.appendUri(resolvedUriPath, requestPathWithClientPathRemoved);
     }
+
+    /**
+     * Re-applies interceptor-modified signer properties after the endpoint resolver callback may have overwritten them.
+     * Compares the pre-interceptor snapshot with the post-interceptor (pre-resolution) state to find what interceptors
+     * changed, then force-overwrites those properties onto the current auth scheme.
+     */
+    private static void reapplyInterceptorModifiedAuthProperties(ExecutionAttributes attrs) {
+        SelectedAuthScheme<?> currentScheme = attrs.getAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME);
+        if (currentScheme == null) {
+            return;
+        }
+        SelectedAuthScheme<?> beforeInterceptors =
+            attrs.getAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_BEFORE_INTERCEPTORS);
+
+        SelectedAuthScheme<?> afterInterceptors =
+            attrs.getAttribute(SdkInternalExecutionAttribute.AUTH_SCHEME_AFTER_INTERCEPTORS);
+        if (afterInterceptors == null) {
+            return;
+        }
+
+        AuthSchemeResolver.applyInterceptorModifiedProperties(currentScheme, beforeInterceptors, afterInterceptors, attrs);
+    }
 }