Server端Swift：Vapor连接CloudKit Web Services遇401认证失败求助

我正尝试用Vapor连接CloudKit Web Services，但一直收到401（认证失败）错误。反复查阅官方文档仍未解决，以下是我的代码：

let body = [
    "records":
        [
            ["recordName": "email@gmail.com"]
        ]
]
let bodyData = try? JSONSerialization.data(withJSONObject: body)

let requestBody = bodyData!
let body64 = requestBody.base64EncodedString()

let calendar = Calendar(identifier: .gregorian)
let dateFormatter = DateFormatter()
dateFormatter.dateFormat = "yyyy-MM-dd'T'HH:mm:ss'Z'"
dateFormatter.timeZone = calendar.timeZone
let date = dateFormatter.string(from: Date())

let webServiceURLPath = "/database/1/MYCONTAINERID/development/public/records/lookup"
let message = date + ":" + "\(body64)" + ":" + webServiceURLPath

let privateKeyPem = 
    """
    -----BEGIN EC PRIVATE KEY-----
    MY PRIVATE HIDDEN PRIVATE KEY
    -----END EC PRIVATE KEY-----
    """

let privateKey = try? P256.Signing.PrivateKey(pemRepresentation: privateKeyPem)
let sign = try? privateKey?.signature(for: SHA256.hash(data: message.data(using: .utf8)!))
let signatureBase64 = sign!.derRepresentation.base64EncodedString()

let keyID = "MYKEYID"

let url = URI(string: "https://api.apple-cloudkit.com/database/1/MYCONTAINERID/development/public/records/lookup")

let headers = HTTPHeaders([
    ("X-Apple-CloudKit-Request-KeyID", keyID),
    ("X-Apple-CloudKit-Request-ISO8601Date", date),
    ("X-Apple-CloudKit-Request-SignatureV1", signatureBase64)
])

let response = try app.client.post(url, headers: headers) { request in
    try request.content.encode(body)
}
response.flatMapThrowing({ response in
    print(response)
})

排查方向 #

• 时间同步问题：CloudKit对请求时间校验严格，服务器时间需与UTC时间同步（误差控制在5分钟内）。修改代码强制使用UTC时区：

  dateFormatter.timeZone = TimeZone(identifier: "UTC")
  

• 签名逻辑一致性：
  1. 确认message拼接顺序完全符合规则：ISO8601时间:Base64编码请求体:URL路径，URL路径需和实际请求路径完全匹配
  2. 替换代码中try?和强制解包，用do-catch捕获私钥加载、签名生成的具体错误，避免隐藏问题：

     do {
         let privateKey = try P256.Signing.PrivateKey(pemRepresentation: privateKeyPem)
         guard let messageData = message.data(using: .utf8) else {
             throw NSError(domain: "SignError", code: -1, userInfo: [NSLocalizedDescriptionKey: "消息转UTF8失败"])
         }
         let hash = SHA256.hash(data: messageData)
         let sign = try privateKey.signature(for: hash)
         let signatureBase64 = sign.derRepresentation.base64EncodedString()
         // 后续请求逻辑
     } catch {
         print("签名错误: \(error)")
     }
     

• 请求体编码统一：签名用JSONSerialization生成的Base64，而请求发送用Vapor的content.encode，两者JSON格式可能存在差异（如空格、键顺序）。统一编码方式：

  let encoder = JSONEncoder()
  let bodyData = try encoder.encode(body)
  let body64 = bodyData.base64EncodedString()
  // 发送请求时复用同一bodyData
  try request.content.encode(bodyData, as: .json)
  

• 密钥与容器关联验证：确认私钥是在Apple开发者后台生成，且对应的KeyID已正确关联到目标CloudKit容器

内容的提问来源于stack exchange，提问作者Cryv