adyen 2.0.0.pre2 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 65289d682bc415347ec65ea427c0d6e7943cb3d3
-  data.tar.gz: e3a11edb4ac752b412721f3bdf61a0a04b4bf85e
+  metadata.gz: 98769e9e8772583d0d35be23a09352f10654095b
+  data.tar.gz: 8e8fefa15a40bcd9f871ddf203acb415351df55d
 SHA512:
-  metadata.gz: fb6eb78b5a9748124fa432b7105f88d1b0d358ad7fe13817d36ae97036968ebb9514e7986aa8ee071a0210331d16782b67db5179ef90a04733c9d08835b07fcb
-  data.tar.gz: db40c3ff10543755bbe055f6f2ac677cbba179aea097ea175389d0c39b9958e6434118ff646deba9cb2ce2dd5096bca23ae869ae1ce45766a738e79f4c5ca4bb
+  metadata.gz: c3273f3cfb9c26b6e399254e92e068843dd7a75eedd66205166eee82b3cb2761848dc05fec7935d0e08d1d5b45ad00d4903f280c69c00a540dd1b52f35666d56
+  data.tar.gz: 629c089709b330bf3bfb9accd30f4ee7a4a8db5d687662eb6c7b2047b4b2d973ab676c9d8ebaa099cfe1790e6d9cec5f4793db9932dc038b1fd920b5a5607567

data/lib/adyen.rb

@@ -26,6 +26,7 @@ end
 require 'adyen/version'
 require 'adyen/configuration'
 require 'adyen/util'
+require 'adyen/hpp/signature'
 require 'adyen/form'
 require 'adyen/api'
 require 'adyen/rest'

data/lib/adyen/form.rb

@@ -120,10 +120,18 @@ module Adyen
         parameters[:billing_address_sig] = calculate_billing_address_signature(parameters, shared_secret)
       end
 
+      if parameters[:delivery_address]
+        parameters[:delivery_address_sig] = calculate_delivery_address_signature(parameters, shared_secret)
+      end
+
       if parameters[:shopper]
         parameters[:shopper_sig] = calculate_shopper_signature(parameters, shared_secret)
       end
 
+      if parameters[:openinvoicedata]
+        parameters[:openinvoicedata][:sig] = calculate_open_invoice_signature(parameters, shared_secret)
+      end
+
       return parameters
     end
 
@@ -225,14 +233,15 @@ module Adyen
     # @return [String] The string for which the siganture is calculated.
     def calculate_signature_string(parameters)
       merchant_sig_string = ""
-      merchant_sig_string << parameters[:payment_amount].to_s       << parameters[:currency_code].to_s        <<
-                             parameters[:ship_before_date].to_s     << parameters[:merchant_reference].to_s   <<
-                             parameters[:skin_code].to_s            << parameters[:merchant_account].to_s     <<
-                             parameters[:session_validity].to_s     << parameters[:shopper_email].to_s        <<
-                             parameters[:shopper_reference].to_s    << parameters[:recurring_contract].to_s   <<
-                             parameters[:allowed_methods].to_s      << parameters[:blocked_methods].to_s      <<
-                             parameters[:shopper_statement].to_s    << parameters[:merchant_return_data].to_s <<
-                             parameters[:billing_address_type].to_s << parameters[:offset].to_s
+      merchant_sig_string << parameters[:payment_amount].to_s       << parameters[:currency_code].to_s         <<
+                             parameters[:ship_before_date].to_s     << parameters[:merchant_reference].to_s    <<
+                             parameters[:skin_code].to_s            << parameters[:merchant_account].to_s      <<
+                             parameters[:session_validity].to_s     << parameters[:shopper_email].to_s         <<
+                             parameters[:shopper_reference].to_s    << parameters[:recurring_contract].to_s    <<
+                             parameters[:allowed_methods].to_s      << parameters[:blocked_methods].to_s       <<
+                             parameters[:shopper_statement].to_s    << parameters[:merchant_return_data].to_s  <<
+                             parameters[:billing_address_type].to_s << parameters[:delivery_address_type].to_s <<
+                             parameters[:shopper_type].to_s         << parameters[:offset].to_s
     end
 
     # Calculates the payment request signature for the given payment parameters.
@@ -265,6 +274,16 @@ module Adyen
       end.join
     end
 
+    # Generates the string that is used to calculate the request signature. This signature
+    # is used by Adyen to check whether the request is genuinely originating from you.
+    # @param [Hash] parameters The parameters that will be included in the delivery address request.
+    # @return [String] The string for which the siganture is calculated.
+    def calculate_delivery_address_signature_string(parameters)
+      %w(street house_number_or_name city postal_code state_or_province country).map do |key|
+        parameters[key.to_sym]
+      end.join
+    end
+
     # Calculates the billing address request signature for the given billing address parameters.
     #
     # This signature is used by Adyen to check whether the request is
@@ -285,6 +304,26 @@ module Adyen
       Adyen::Util.hmac_base64(shared_secret, calculate_billing_address_signature_string(parameters[:billing_address]))
     end
 
+    # Calculates the delivery address request signature for the given delivery address parameters.
+    #
+    # This signature is used by Adyen to check whether the request is
+    # genuinely originating from you. The resulting signature should be
+    # included in the delivery address request parameters as the +deliveryAddressSig+
+    # parameter; the shared secret should of course not be included.
+    #
+    # @param [Hash] parameters The delivery address parameters for which to calculate
+    #    the delivery address request signature.
+    # @param [String] shared_secret The shared secret to use for this signature.
+    #    It should correspond with the skin_code parameter. This parameter can be
+    #    left out if the shared_secret is included as key in the parameters.
+    # @return [String] The signature of the delivery address request
+    # @raise [ArgumentError] Thrown if shared_secret is empty
+    def calculate_delivery_address_signature(parameters, shared_secret = nil)
+      shared_secret ||= parameters.delete(:shared_secret)
+      raise ArgumentError, "Cannot calculate delivery address request signature with empty shared_secret" if shared_secret.to_s.empty?
+      Adyen::Util.hmac_base64(shared_secret, calculate_delivery_address_signature_string(parameters[:delivery_address]))
+    end
+
     # shopperSig: shopper.firstName + shopper.infix + shopper.lastName + shopper.gender + shopper.dateOfBirthDayOfMonth + shopper.dateOfBirthMonth + shopper.dateOfBirthYear + shopper.telephoneNumber
     # (Note that you can send only shopper.firstName and shopper.lastName if you like. Do NOT include shopperSocialSecurityNumber in the shopperSig!)
     def calculate_shopper_signature_string(parameters)
@@ -299,6 +338,19 @@ module Adyen
       Adyen::Util.hmac_base64(shared_secret, calculate_shopper_signature_string(parameters[:shopper]))
     end
 
+    def calculate_open_invoice_signature_string(merchant_sig, parameters)
+      flattened = Adyen::Util.flatten(:merchant_sig => merchant_sig, :openinvoicedata => parameters)
+      pairs = flattened.to_a.sort
+      pairs.transpose.map { |it| it.join(':') }.join('|')
+    end
+
+    def calculate_open_invoice_signature(parameters, shared_secret = nil)
+      shared_secret ||= parameters.delete(:shared_secret)
+      raise ArgumentError, "Cannot calculate open invoice request signature with empty shared_secret" if shared_secret.to_s.empty?
+      merchant_sig = calculate_signature(parameters, shared_secret)
+      Adyen::Util.hmac_base64(shared_secret, calculate_open_invoice_signature_string(merchant_sig, parameters[:openinvoicedata]))
+    end
+
     ######################################################
     # REDIRECT SIGNATURE CHECKING
     ######################################################

data/lib/adyen/hpp/signature.rb

@@ -0,0 +1,66 @@
+require 'openssl'
+require 'base64'
+
+module Adyen
+  module HPP
+    # The Signature module can sign and verify HMAC SHA-256 signatures for Hosted Payment Pages
+    module Signature
+      extend self
+
+      # Sign the parameters with the given shared secret
+      # @param [Hash] params The set of parameters to sign
+      # @param [String] shared_secret The shared secret for signing/verification. Can also be sent in the
+      #   params hash with the `sharedSecret` key.
+      # @return [Hash] params The params that were passed in plus a new `merchantSig` param
+      def sign(params, shared_secret = nil)
+        shared_secret ||= params.delete['sharedSecret']
+        raise ArgumentError, "Cannot verify a signature without a shared secret" unless shared_secret
+        sig = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), Array(shared_secret).pack("H*"), string_to_sign(params))
+        params.merge('merchantSig' => Base64.encode64(sig).strip)
+      end
+
+      # Verify the parameters with the given shared secret
+      # @param [Hash] params The set of parameters to verify. Must include a `merchantSig`
+      #   param that will be compared to the signature we calculate.
+      # @param [String] shared_secret The shared secret for signing/verification. Can also be sent in the
+      #   params hash with the `sharedSecret` key.
+      # @return [Boolean] true if the `merchantSig` in the params matches our calculated signature
+      def verify(params, shared_secret = nil)
+        their_sig = params.delete('merchantSig')
+        raise ArgumentError, "params must include 'merchantSig' for verification" if their_sig.empty?
+        our_sig = sign(params, shared_secret)['merchantSig']
+        secure_compare(their_sig, our_sig)
+      end
+
+      private
+
+      def string_to_sign(params)
+        (sorted_keys(params) + sorted_values(params)).map{ |el| escape_value(el) }.join(':')
+      end
+
+      def sorted_keys(hash)
+        hash.sort.map{ |el| el[0] }
+      end
+
+      def sorted_values(hash)
+        hash.sort.map{ |el| el[1] }
+      end
+
+      def escape_value(value)
+        value.gsub(':', '\\:').gsub('\\', '\\\\')
+      end
+
+      # Constant-time compare for two fixed-length strings
+      # Stolen from https://github.com/rails/rails/commit/c8c660002f4b0e9606de96325f20b95248b6ff2d
+      def secure_compare(a, b)
+        return false unless a.bytesize == b.bytesize
+
+        l = a.unpack "C#{a.bytesize}"
+
+        res = 0
+        b.each_byte { |byte| res |= byte ^ l.shift }
+        res == 0
+      end
+    end
+  end
+end

data/lib/adyen/templates/notification_model.rb

@@ -16,7 +16,6 @@
 #      @invoice.set_paid!
 #    end
 class AdyenNotification < ActiveRecord::Base
-
   # A notification should always include an event_code
   validates_presence_of :event_code
 
@@ -37,8 +36,6 @@ class AdyenNotification < ActiveRecord::Base
   # @raise This method will raise an exception if the notification cannot be stored.
   # @see Adyen::Notification::HttpPost.log
   def self.log(params)
-    converted_params = {}
-
     # Assign explicit each attribute from CamelCase notation to notification
     # For example, merchantReference will be converted to merchant_reference
     self.new.tap do |notification|
@@ -46,6 +43,7 @@ class AdyenNotification < ActiveRecord::Base
         setter = "#{key.to_s.underscore}="
         notification.send(setter, value) if notification.respond_to?(setter)
       end
+
       notification.save!
     end
   end

data/lib/adyen/version.rb

@@ -1,5 +1,5 @@
 module Adyen
   # Version constant for the Adyen plugin.
   # Set it & commit the change before running rake release.
-  VERSION = "2.0.0.pre2"
+  VERSION = "2.0.0"
 end

data/test/form_test.rb

@@ -29,11 +29,32 @@ class FormTest < Minitest::Test
         :state_or_province    => 'Berlin',
         :country              => 'Germany',
       },
+      :delivery_address => {
+        :street               => 'Pecunialaan',
+        :house_number_or_name => '316',
+        :city                 => 'Geldrop',
+        :state_or_province    => 'None',
+        :postal_code          => '1234 AB',
+        :country              => 'Netherlands',
+      },
       :shopper => {
         :telephone_number       => '1234512345',
         :first_name             => 'John',
         :last_name              => 'Doe',
         :social_security_number => '123-45-1234'
+      },
+      :openinvoicedata => {
+        :number_of_lines => 1,
+        :line1 => {
+          :number_of_items => 2,
+          :item_amount => 4000,
+          :currency_code => 'GBP',
+          :item_vat_amount => 1000,
+          :item_vat_percentage => 2500,
+          :item_vat_category => 'High',
+          :description => 'Product Awesome'
+        },
+        :refund_description => 'Refund for 12345'
       }
     }
 
@@ -122,6 +143,12 @@ class FormTest < Minitest::Test
 
     signature_string = Adyen::Form.calculate_signature_string(@recurring_payment_attributes)
     assert_equal "10000GBP2007-10-20Internet Order 12345sk1nC0deOtherMerchant2007-10-11T11:00:00Zgras.shopper@somewhere.orggrasshopper52DEFAULT", signature_string
+
+    signature_string = Adyen::Form.calculate_signature_string(@payment_attributes.merge(:billing_address_type => '1', :delivery_address_type => '2'))
+    assert_equal "10000GBP2007-10-20Internet Order 123454aD37dJATestMerchant2007-10-11T11:00:00Z12", signature_string
+
+    signature_string = Adyen::Form.calculate_signature_string(@payment_attributes.merge(:delivery_address_type => '2', :shopper_type => '1'))
+    assert_equal "10000GBP2007-10-20Internet Order 123454aD37dJATestMerchant2007-10-11T11:00:00Z21", signature_string
   end
 
   def test_redirect_signature
@@ -150,10 +177,58 @@ class FormTest < Minitest::Test
     assert_raises(ArgumentError) { Adyen::Form.calculate_billing_address_signature(@payment_attributes) } 
   end
 
-  def test_billing_address_and_shopper_signature_in_redirect_url
+  def test_delivery_address_signature
+    signature_string = Adyen::Form.calculate_delivery_address_signature_string(@payment_attributes[:delivery_address])
+    assert_equal "Pecunialaan316Geldrop1234 ABNoneNetherlands", signature_string
+    assert_equal 'g8wPEWYrDPatkGXzuQbN1++JVbE=', Adyen::Form.calculate_delivery_address_signature(@payment_attributes)
+
+    @payment_attributes.delete(:shared_secret)
+    assert_raises(ArgumentError) { Adyen::Form.calculate_delivery_address_signature(@payment_attributes) }
+  end
+
+  def test_open_invoice_signature
+    merchant_sig = Adyen::Form.calculate_signature(@payment_attributes, @payment_attributes[:shared_secret])
+    signature_string = Adyen::Form.calculate_open_invoice_signature_string(merchant_sig, @payment_attributes[:openinvoicedata])
+    expected_string =
+      [
+        'merchantSig',
+        'openinvoicedata.line1.currencyCode',
+        'openinvoicedata.line1.description',
+        'openinvoicedata.line1.itemAmount',
+        'openinvoicedata.line1.itemVatAmount',
+        'openinvoicedata.line1.itemVatCategory',
+        'openinvoicedata.line1.itemVatPercentage',
+        'openinvoicedata.line1.numberOfItems',
+        'openinvoicedata.numberOfLines',
+        'openinvoicedata.refundDescription'
+      ].join(':') +
+      '|' +
+      [
+        merchant_sig,
+        'GBP',
+        'Product Awesome',
+        4000,
+        1000,
+        'High',
+        2500,
+        2,
+        1,
+        'Refund for 12345'
+      ].join(':')
+
+    assert_equal expected_string, signature_string
+    assert_equal 'OI71VGB7G3vKBRrtE6Ibv+RWvYY=', Adyen::Form.calculate_open_invoice_signature(@payment_attributes)
+
+    @payment_attributes.delete(:shared_secret)
+    assert_raises(ArgumentError) { Adyen::Form.calculate_open_invoice_signature(@payment_attributes) }
+  end
+
+  def test_billing_signatures_in_redirect_url
     get_params = CGI.parse(URI(Adyen::Form.redirect_url(@payment_attributes)).query)
     assert_equal '5KQb7VJq4cz75cqp11JDajntCY4=', get_params['billingAddressSig'].first
+    assert_equal 'g8wPEWYrDPatkGXzuQbN1++JVbE=', get_params['deliveryAddressSig'].first
     assert_equal 'rb2GEs1kGKuLh255a3QRPBYXmsQ=', get_params['shopperSig'].first
+    assert_equal 'OI71VGB7G3vKBRrtE6Ibv+RWvYY=', get_params['openinvoicedata.sig'].first
   end  
 
   def test_redirect_signature_check

data/test/hpp/signature_test.rb

@@ -0,0 +1,36 @@
+require 'test_helper'
+
+class SignatureTest < Minitest::Test
+  def setup
+    # values from https://docs.adyen.com/pages/viewpage.action?pageId=5376964
+    @shared_secret = "4468D9782DEF54FCD706C9100C71EC43932B1EBC2ACF6BA0560C05AAA7550C48"
+
+    @expected_sig = 'GJ1asjR5VmkvihDJxCd8yE2DGYOKwWwJCBiV3R51NFg='
+
+    @raw_params = {
+      'merchantAccount' => 'TestMerchant',
+      'currencyCode' => 'EUR',
+      'paymentAmount' => '199',
+      'sessionValidity' => '2015-06-25T10:31:06Z',
+      'shipBeforeDate' => '2015-07-01',
+      'shopperLocale' => 'en_GB',
+      'merchantReference' => 'SKINTEST-1435226439255',
+      'skinCode' => 'X7hsNDWp',
+    }
+  end
+
+  def test_sign
+    signed_params = Adyen::HPP::Signature.sign(@raw_params, @shared_secret)
+    assert_equal @expected_sig, signed_params['merchantSig']
+  end
+
+  def test_verify_succeeds_with_same_secret
+    signed_params = @raw_params.merge('merchantSig' => @expected_sig)
+    assert_equal true, Adyen::HPP::Signature.verify(signed_params, @shared_secret)
+  end
+
+  def test_verification_fails_with_different_secret
+    signed_params = @raw_params.merge('merchantSig' => @expected_sig)
+    assert_equal false, Adyen::HPP::Signature.verify(signed_params, '12345')
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: adyen
 version: !ruby/object:Gem::Version
-  version: 2.0.0.pre2
+  version: 2.0.0
 platform: ruby
 authors:
 - Willem van Bergen
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-03-06 00:00:00.000000000 Z
+date: 2016-05-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -165,6 +165,7 @@ files:
 - lib/adyen/api/xml_querier.rb
 - lib/adyen/configuration.rb
 - lib/adyen/form.rb
+- lib/adyen/hpp/signature.rb
 - lib/adyen/matchers.rb
 - lib/adyen/notification_generator.rb
 - lib/adyen/railtie.rb
@@ -204,6 +205,7 @@ files:
 - test/helpers/views/index.erb
 - test/helpers/views/pay.erb
 - test/helpers/views/redirect_shopper.erb
+- test/hpp/signature_test.rb
 - test/integration/hpp_integration_test.rb
 - test/integration/payment_using_3d_secure_integration_test.rb
 - test/integration/payment_with_client_side_encryption_integration_test.rb
@@ -234,13 +236,13 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 1.9.3
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - '>'
+  - - '>='
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements:
 - Having Nokogiri installed will speed up XML handling when using the SOAP API.
 rubyforge_project: 
-rubygems_version: 2.0.14
+rubygems_version: 2.0.14.1
 signing_key: 
 specification_version: 4
 summary: Integrate Adyen payment services in your Ruby on Rails application.
@@ -269,6 +271,7 @@ test_files:
 - test/helpers/views/index.erb
 - test/helpers/views/pay.erb
 - test/helpers/views/redirect_shopper.erb
+- test/hpp/signature_test.rb
 - test/integration/hpp_integration_test.rb
 - test/integration/payment_using_3d_secure_integration_test.rb
 - test/integration/payment_with_client_side_encryption_integration_test.rb