api-auth 2.1.0 → 2.2.0

data/lib/api_auth/helpers.rb

@@ -1,20 +1,11 @@
 module ApiAuth
   module Helpers # :nodoc:
     def b64_encode(string)
-      if Base64.respond_to?(:strict_encode64)
-        Base64.strict_encode64(string)
-      else
-        # Fall back to stripping out newlines on Ruby 1.8.
-        Base64.encode64(string).delete("\n")
-      end
+      Base64.strict_encode64(string)
     end
 
     def md5_base64digest(string)
-      if Digest::MD5.respond_to?(:base64digest)
-        Digest::MD5.base64digest(string)
-      else
-        b64_encode(Digest::MD5.digest(string))
-      end
+      Digest::MD5.base64digest(string)
     end
 
     # Capitalizes the keys of a hash

data/lib/api_auth/railtie.rb

@@ -18,22 +18,14 @@ module ApiAuth
       end
     end # ControllerMethods
 
-    module ActiveResourceExtension  # :nodoc:
+    module ActiveResourceExtension # :nodoc:
       module ActiveResourceApiAuth # :nodoc:
         def self.included(base)
           base.extend(ClassMethods)
-
-          if base.respond_to?('class_attribute')
-            base.class_attribute :hmac_access_id
-            base.class_attribute :hmac_secret_key
-            base.class_attribute :use_hmac
-            base.class_attribute :api_auth_options
-          else
-            base.class_inheritable_accessor :hmac_access_id
-            base.class_inheritable_accessor :hmac_secret_key
-            base.class_inheritable_accessor :use_hmac
-            base.class_inheritable_accessor :api_auth_options
-          end
+          base.class_attribute :hmac_access_id
+          base.class_attribute :hmac_secret_key
+          base.class_attribute :use_hmac
+          base.class_attribute :api_auth_options
         end
 
         module ClassMethods

data/lib/api_auth/request_drivers/action_controller.rb

@@ -43,13 +43,15 @@ module ApiAuth
       end
 
       def content_type
-        value = find_header(%w(CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE])
       end
 
       def content_md5
-        value = find_header(%w(CONTENT-MD5 CONTENT_MD5 HTTP_CONTENT_MD5))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-MD5 CONTENT_MD5 HTTP_CONTENT_MD5])
+      end
+
+      def original_uri
+        find_header(%w[X-ORIGINAL-URI X_ORIGINAL_URI HTTP_X_ORIGINAL_URI])
       end
 
       def request_uri
@@ -62,12 +64,11 @@ module ApiAuth
       end
 
       def timestamp
-        value = find_header(%w(DATE HTTP_DATE))
-        value.nil? ? '' : value
+        find_header(%w[DATE HTTP_DATE])
       end
 
       def authorization_header
-        find_header %w(Authorization AUTHORIZATION HTTP_AUTHORIZATION)
+        find_header %w[Authorization AUTHORIZATION HTTP_AUTHORIZATION]
       end
 
       private

data/lib/api_auth/request_drivers/curb.rb

@@ -32,13 +32,15 @@ module ApiAuth
       end
 
       def content_type
-        value = find_header(%w(CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE])
       end
 
       def content_md5
-        value = find_header(%w(CONTENT-MD5 CONTENT_MD5))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-MD5 CONTENT_MD5])
+      end
+
+      def original_uri
+        find_header(%w[X-ORIGINAL-URI X_ORIGINAL_URI HTTP_X_ORIGINAL_URI])
       end
 
       def request_uri
@@ -51,12 +53,11 @@ module ApiAuth
       end
 
       def timestamp
-        value = find_header(%w(DATE HTTP_DATE))
-        value.nil? ? '' : value
+        find_header(%w[DATE HTTP_DATE])
       end
 
       def authorization_header
-        find_header %w(Authorization AUTHORIZATION HTTP_AUTHORIZATION)
+        find_header %w[Authorization AUTHORIZATION HTTP_AUTHORIZATION]
       end
 
       private

data/lib/api_auth/request_drivers/faraday.rb

@@ -21,13 +21,13 @@ module ApiAuth
       end
 
       def populate_content_md5
-        return unless %w(POST PUT).include?(@request.method.to_s.upcase)
+        return unless %w[POST PUT].include?(@request.method.to_s.upcase)
         @request.headers['Content-MD5'] = calculated_md5
         fetch_headers
       end
 
       def md5_mismatch?
-        if %w(POST PUT).include?(@request.method.to_s.upcase)
+        if %w[POST PUT].include?(@request.method.to_s.upcase)
           calculated_md5 != content_md5
         else
           false
@@ -43,13 +43,15 @@ module ApiAuth
       end
 
       def content_type
-        value = find_header(%w(CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE])
       end
 
       def content_md5
-        value = find_header(%w(CONTENT-MD5 CONTENT_MD5 HTTP-CONTENT-MD5 HTTP_CONTENT_MD5))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-MD5 CONTENT_MD5 HTTP-CONTENT-MD5 HTTP_CONTENT_MD5])
+      end
+
+      def original_uri
+        find_header(%w[X-ORIGINAL-URI X_ORIGINAL_URI HTTP_X_ORIGINAL_URI])
       end
 
       def request_uri
@@ -65,12 +67,11 @@ module ApiAuth
       end
 
       def timestamp
-        value = find_header(%w(DATE HTTP_DATE))
-        value.nil? ? '' : value
+        find_header(%w[DATE HTTP_DATE])
       end
 
       def authorization_header
-        find_header %w(Authorization AUTHORIZATION HTTP_AUTHORIZATION)
+        find_header %w[Authorization AUTHORIZATION HTTP_AUTHORIZATION]
       end
 
       private

data/lib/api_auth/request_drivers/httpi.rb

@@ -42,13 +42,15 @@ module ApiAuth
       end
 
       def content_type
-        value = find_header(%w(CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE])
       end
 
       def content_md5
-        value = find_header(%w(CONTENT-MD5 CONTENT_MD5))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-MD5 CONTENT_MD5])
+      end
+
+      def original_uri
+        find_header(%w[X-ORIGINAL-URI X_ORIGINAL_URI HTTP_X_ORIGINAL_URI])
       end
 
       def request_uri
@@ -61,12 +63,11 @@ module ApiAuth
       end
 
       def timestamp
-        value = find_header(%w(DATE HTTP_DATE))
-        value.nil? ? '' : value
+        find_header(%w[DATE HTTP_DATE])
       end
 
       def authorization_header
-        find_header %w(Authorization AUTHORIZATION HTTP_AUTHORIZATION)
+        find_header %w[Authorization AUTHORIZATION HTTP_AUTHORIZATION]
       end
 
       private

data/lib/api_auth/request_drivers/net_http.rb

@@ -49,13 +49,15 @@ module ApiAuth
       end
 
       def content_type
-        value = find_header(%w(CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE])
       end
 
       def content_md5
-        value = find_header(%w(CONTENT-MD5 CONTENT_MD5))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-MD5 CONTENT_MD5])
+      end
+
+      def original_uri
+        find_header(%w[X-ORIGINAL-URI X_ORIGINAL_URI HTTP_X_ORIGINAL_URI])
       end
 
       def request_uri
@@ -67,12 +69,11 @@ module ApiAuth
       end
 
       def timestamp
-        value = find_header(%w(DATE HTTP_DATE))
-        value.nil? ? '' : value
+        find_header(%w[DATE HTTP_DATE])
       end
 
       def authorization_header
-        find_header %w(Authorization AUTHORIZATION HTTP_AUTHORIZATION)
+        find_header %w[Authorization AUTHORIZATION HTTP_AUTHORIZATION]
       end
 
       private

data/lib/api_auth/request_drivers/rack.rb

@@ -26,13 +26,13 @@ module ApiAuth
       end
 
       def populate_content_md5
-        return unless %w(POST PUT).include?(@request.request_method)
+        return unless %w[POST PUT].include?(@request.request_method)
         @request.env['Content-MD5'] = calculated_md5
         fetch_headers
       end
 
       def md5_mismatch?
-        if %w(POST PUT).include?(@request.request_method)
+        if %w[POST PUT].include?(@request.request_method)
           calculated_md5 != content_md5
         else
           false
@@ -48,13 +48,15 @@ module ApiAuth
       end
 
       def content_type
-        value = find_header(%w(CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE])
       end
 
       def content_md5
-        value = find_header(%w(CONTENT-MD5 CONTENT_MD5 HTTP-CONTENT-MD5 HTTP_CONTENT_MD5))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-MD5 CONTENT_MD5 HTTP-CONTENT-MD5 HTTP_CONTENT_MD5])
+      end
+
+      def original_uri
+        find_header(%w[X-ORIGINAL-URI X_ORIGINAL_URI HTTP_X_ORIGINAL_URI])
       end
 
       def request_uri
@@ -67,12 +69,11 @@ module ApiAuth
       end
 
       def timestamp
-        value = find_header(%w(DATE HTTP_DATE))
-        value.nil? ? '' : value
+        find_header(%w[DATE HTTP_DATE])
       end
 
       def authorization_header
-        find_header %w(Authorization AUTHORIZATION HTTP_AUTHORIZATION)
+        find_header %w[Authorization AUTHORIZATION HTTP_AUTHORIZATION]
       end
 
       private

data/lib/api_auth/request_drivers/rest_client.rb

@@ -29,13 +29,13 @@ module ApiAuth
       end
 
       def populate_content_md5
-        return unless [:post, :put].include?(@request.method)
+        return unless %i[post put].include?(@request.method)
         @request.headers['Content-MD5'] = calculated_md5
         save_headers
       end
 
       def md5_mismatch?
-        if [:post, :put].include?(@request.method)
+        if %i[post put].include?(@request.method)
           calculated_md5 != content_md5
         else
           false
@@ -51,13 +51,15 @@ module ApiAuth
       end
 
       def content_type
-        value = find_header(%w(CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-TYPE CONTENT_TYPE HTTP_CONTENT_TYPE])
       end
 
       def content_md5
-        value = find_header(%w(CONTENT-MD5 CONTENT_MD5))
-        value.nil? ? '' : value
+        find_header(%w[CONTENT-MD5 CONTENT_MD5])
+      end
+
+      def original_uri
+        find_header(%w[X-ORIGINAL-URI X_ORIGINAL_URI HTTP_X_ORIGINAL_URI])
       end
 
       def request_uri
@@ -70,12 +72,11 @@ module ApiAuth
       end
 
       def timestamp
-        value = find_header(%w(DATE HTTP_DATE))
-        value.nil? ? '' : value
+        find_header(%w[DATE HTTP_DATE])
       end
 
       def authorization_header
-        find_header %w(Authorization AUTHORIZATION HTTP_AUTHORIZATION)
+        find_header %w[Authorization AUTHORIZATION HTTP_AUTHORIZATION]
       end
 
       private

data/spec/.rubocop.yml

@@ -0,0 +1,5 @@
+inherit_from:
+  - ../.rubocop.yml
+
+Metrics/BlockLength:
+  Enabled: false

data/spec/api_auth_spec.rb

@@ -1,4 +1,3 @@
-# encoding: UTF-8
 require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
 
 describe 'ApiAuth' do
@@ -25,7 +24,7 @@ describe 'ApiAuth' do
   end
 
   describe '.sign!' do
-    let(:request) { RestClient::Request.new(:url => 'http://google.com', :method => :get) }
+    let(:request) { RestClient::Request.new(url: 'http://google.com', method: :get) }
     let(:headers) { ApiAuth::Headers.new(request) }
 
     it 'generates date header before signing' do
@@ -66,7 +65,7 @@ describe 'ApiAuth' do
       let(:canonical_string) { ApiAuth::Headers.new(request).canonical_string }
 
       it 'calculates the hmac_signature with http method' do
-        ApiAuth.sign!(request, '1044', '123', :digest => 'sha256')
+        ApiAuth.sign!(request, '1044', '123', digest: 'sha256')
         signature = hmac('123', request, canonical_string, 'sha256')
         expect(request['Authorization']).to eq("APIAuth-HMAC-SHA256 1044:#{signature}")
       end
@@ -139,13 +138,13 @@ describe 'ApiAuth' do
 
         context 'matching client digest' do
           it 'validates matching digest' do
-            expect(ApiAuth.authentic?(request, '123', :digest => 'sha256')).to eq true
+            expect(ApiAuth.authentic?(request, '123', digest: 'sha256')).to eq true
           end
         end
 
         context 'different client digest' do
           it 'raises an exception' do
-            expect { ApiAuth.authentic?(request, '123', :digest => 'sha512') }.to raise_error(ApiAuth::InvalidRequestDigest)
+            expect { ApiAuth.authentic?(request, '123', digest: 'sha512') }.to raise_error(ApiAuth::InvalidRequestDigest)
           end
         end
       end
@@ -154,19 +153,31 @@ describe 'ApiAuth' do
         let(:digest) { 'SHA111' }
 
         it 'fails validation' do
-          expect(ApiAuth.authentic?(request, '123', :digest => 'sha111')).to eq false
+          expect(ApiAuth.authentic?(request, '123', digest: 'sha111')).to eq false
         end
       end
     end
+
+    context 'when passed the clock_skew option' do
+      it 'fails to validate expired requests' do
+        request['date'] = 90.seconds.ago.utc.httpdate
+        expect(ApiAuth.authentic?(signed_request, '123', clock_skew: 60.seconds)).to eq false
+      end
+
+      it 'fails to validate far future requests' do
+        request['date'] = 90.seconds.from_now.utc.httpdate
+        expect(ApiAuth.authentic?(signed_request, '123', clock_skew: 60.seconds)).to eq false
+      end
+    end
   end
 
   describe '.access_id' do
     context 'normal APIAuth Auth header' do
       let(:request) do
         RestClient::Request.new(
-          :url => 'http://google.com',
-          :method => :get,
-          :headers => { :authorization => 'APIAuth 1044:aGVsbG8gd29ybGQ=' }
+          url: 'http://google.com',
+          method: :get,
+          headers: { authorization: 'APIAuth 1044:aGVsbG8gd29ybGQ=' }
         )
       end
 
@@ -178,9 +189,9 @@ describe 'ApiAuth' do
     context 'Corporate prefixed APIAuth header' do
       let(:request) do
         RestClient::Request.new(
-          :url => 'http://google.com',
-          :method => :get,
-          :headers => { :authorization => 'Corporate APIAuth 1044:aGVsbG8gd29ybGQ=' }
+          url: 'http://google.com',
+          method: :get,
+          headers: { authorization: 'Corporate APIAuth 1044:aGVsbG8gd29ybGQ=' }
         )
       end
 

data/spec/headers_spec.rb

@@ -3,7 +3,7 @@ require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
 describe ApiAuth::Headers do
   describe '#canonical_string' do
     context 'uri edge cases' do
-      let(:request) { RestClient::Request.new(:url => uri, :method => :get) }
+      let(:request) { RestClient::Request.new(url: uri, method: :get) }
       subject(:headers) { described_class.new(request) }
       let(:uri) { '' }
 
@@ -38,11 +38,23 @@ describe ApiAuth::Headers do
           expect(request.url).to eq(uri)
         end
       end
+
+      context 'uri has a string matching http:// in it' do
+        let(:uri) { 'http://google.com/?redirect_to=https://www.example.com'.freeze }
+
+        it 'return /?redirect_to=https://www.example.com as canonical string path' do
+          expect(subject.canonical_string).to eq('GET,,,/?redirect_to=https://www.example.com,')
+        end
+
+        it 'does not change request url (by removing host)' do
+          expect(request.url).to eq(uri)
+        end
+      end
     end
 
     context 'string construction' do
       context 'with a driver that supplies http_method' do
-        let(:request) { RestClient::Request.new(:url => 'http://google.com', :method => :get) }
+        let(:request) { RestClient::Request.new(url: 'http://google.com', method: :get) }
         subject(:headers) { described_class.new(request) }
         let(:driver) { headers.instance_variable_get('@request') }
 
@@ -96,6 +108,31 @@ describe ApiAuth::Headers do
           end
         end
       end
+
+      context "when there's a proxy server (e.g. Nginx) with rewrite rules" do
+        let(:request) do
+          Faraday::Request.create('GET') do |req|
+            req.options = Faraday::RequestOptions.new(Faraday::FlatParamsEncoder)
+            req.params = Faraday::Utils::ParamsHash.new
+            req.url('/resource.xml?foo=bar&bar=foo')
+            req.headers = { 'X-Original-URI' => '/api/resource.xml?foo=bar&bar=foo' }
+          end
+        end
+        subject(:headers) { described_class.new(request) }
+        let(:driver) { headers.instance_variable_get('@request') }
+
+        before do
+          allow(driver).to receive(:content_type).and_return 'text/html'
+          allow(driver).to receive(:content_md5).and_return '12345'
+          allow(driver).to receive(:timestamp).and_return 'Mon, 23 Jan 1984 03:29:56 GMT'
+        end
+
+        context 'the driver uses the original_uri' do
+          it 'constructs the canonical_string with the original_uri' do
+            expect(headers.canonical_string).to eq 'GET,text/html,12345,/api/resource.xml?foo=bar&bar=foo,Mon, 23 Jan 1984 03:29:56 GMT'
+          end
+        end
+      end
     end
   end
 
@@ -106,9 +143,9 @@ describe ApiAuth::Headers do
     context 'no md5 already calculated' do
       let(:request) do
         RestClient::Request.new(
-          :url => 'http://google.com',
-          :method => :post,
-          :payload => "hello\nworld"
+          url: 'http://google.com',
+          method: :post,
+          payload: "hello\nworld"
         )
       end
 
@@ -121,10 +158,10 @@ describe ApiAuth::Headers do
     context 'md5 already calculated' do
       let(:request) do
         RestClient::Request.new(
-          :url => 'http://google.com',
-          :method => :post,
-          :payload => "hello\nworld",
-          :headers => { :content_md5 => 'abcd' }
+          url: 'http://google.com',
+          method: :post,
+          payload: "hello\nworld",
+          headers: { content_md5: 'abcd' }
         )
       end
 
@@ -136,7 +173,7 @@ describe ApiAuth::Headers do
   end
 
   describe '#md5_mismatch?' do
-    let(:request) { RestClient::Request.new(:url => 'http://google.com', :method => :get) }
+    let(:request) { RestClient::Request.new(url: 'http://google.com', method: :get) }
     subject(:headers) { described_class.new(request) }
     let(:driver) { headers.instance_variable_get('@request') }
 
@@ -151,14 +188,14 @@ describe ApiAuth::Headers do
 
     context 'when request has no md5' do
       it "doesn't ask the driver" do
-        allow(driver).to receive(:content_md5).and_return ''
+        allow(driver).to receive(:content_md5).and_return nil
 
         expect(driver).not_to receive(:md5_mismatch?).and_call_original
         headers.md5_mismatch?
       end
 
       it 'returns false' do
-        allow(driver).to receive(:content_md5).and_return ''
+        allow(driver).to receive(:content_md5).and_return nil
 
         expect(headers.md5_mismatch?).to be false
       end