api_authenticator 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 321edb7c0d50d3e4b73771824e994e2a049242e80ec36edf5e7ab97ea64fb8fd
-  data.tar.gz: b3f867b93a93fb9295c3cbe28b04d46ccf809b0099a1fd96cd9eac5b343ec8f8
+  metadata.gz: ab1bb241ecc07c6ad6a16ce196fb7fa29880e419344d150a414ab3cb794c8f8e
+  data.tar.gz: 686903c5026f217edfea3caa738f7611cacbcba6f5cc5ae4954d3afc936a8b58
 SHA512:
-  metadata.gz: 887bc481a0eac05ca8527d7fd7e9ee7a0890f8f1907f05ef43727a1d7af7d61968d48c6eb22e59a24ddfee841be12a9369b436d03a90bb49ac7102cd17b9e211
-  data.tar.gz: 4e1b13ca8e25a1b986ad13868802ae04da105be95baa2914fbd53af98c6e1f2552b89ab2c85dcf15ae034dde5b25cf84921b3ea7084b1ce51905ad69fecfcb3e
+  metadata.gz: 52fa2bb023130b0a7809d10d1c67ce41b64b420f0a5f4536acfe312988d245771ea5df59f59518cf9d4a1fab4492ae16134247372f2e4020027ff6e3fefa410c
+  data.tar.gz: d239d3da4e14b7244aa106b2689beca3ad2565e6285bad6508ec4eaeffeb496dc63b14a64b0149c6e8a7c92230dd42728e8ee9f91041ef64af939574fc4e5ceb

data/README.md

@@ -51,6 +51,7 @@ env['API-Token'] = OpenSSL::HMAC.hexdigest(digest, shared_secret_key, "#{DateTim
 ApiAuthenticator.configure do |config|
   config.shared_secret_keys = ["my_shared_token", "my_shared_token2"]
   config.time_threshold = 2.hours
+  config.request_type = :path # :url by default if nothing is set
   config.logger = Rails.logger
   config.report_unauthenticated_requests = true
 end
@@ -58,6 +59,7 @@ end
 
  - shared_secret_keys: An Array of approved shared secret keys between the client and the server.
  - time_threshold: The time threshold to allow requests.  So for example the entry above will only allow requests from 2 hours before now and 2 hours in the future.
+ - request_type: 2 options: :url or :path.  By default it's :url which uses the full URL has as the hashing mechanism.  :path only uses the path for the hashing mechanism.
  - logger: Your logger
  - report_unauthenticated_requests: will throw some basic information into your logger.warn.
 

data/lib/api_authenticator/authenticated_request.rb

@@ -13,11 +13,19 @@ module ApiAuthenticator
     rescue ArgumentError, TypeError
     end
     valid_api_time?(time)
-    valid_api_token?(request.original_url, time, token)
+    valid_api_token?(originating_request(request), time, token)
   end
 
   protected
 
+  def self.originating_request(request)
+    if request_type == PATH_REQUEST_TYPE
+      request.original_fullpath
+    else
+      request.original_url
+    end
+  end
+
   def self.valid_api_time?(time)
     return false if time.nil?
     utc_now = DateTime.now.new_offset(0)

data/lib/api_authenticator/configuration.rb

@@ -1,5 +1,9 @@
 module ApiAuthenticator
   @@logger = nil
+  URL_REQUEST_TYPE = :url
+  PATH_REQUEST_TYPE = :path
+  @@request_type = URL_REQUEST_TYPE
+  REQUEST_TYPES = [URL_REQUEST_TYPE, PATH_REQUEST_TYPE]
 
   def self.configure
     yield self
@@ -13,6 +17,17 @@ module ApiAuthenticator
     @@shared_secret_keys
   end
 
+  def self.request_type
+    @@request_type
+  end
+
+  def self.request_type=(request_type)
+    unless REQUEST_TYPES.include?(request_type)
+      raise ArgumentError.new("Request types must be one of the following #{REQUEST_TYPES.join(', ')}}")
+    end
+    @@request_type = request_type
+  end
+
   def self.time_threshold=(time_threshold)
     @@time_threshold = time_threshold
   end
@@ -32,4 +47,4 @@ module ApiAuthenticator
   def self.logger
     @@logger || Logger.new($stdout)
   end
-end
+end

data/lib/api_authenticator/version.rb

@@ -1,3 +1,3 @@
 module ApiAuthenticator
-  VERSION = "0.2.1"
+  VERSION = "0.3.0"
 end

data/spec/api_authenticator_spec.rb

@@ -15,9 +15,19 @@ describe 'ApiAuthenticator' do
     OpenSSL::HMAC.hexdigest(digest, shared_key, "#{DateTime.now.new_offset(0)}http://www.austinrocks.com/asdf")
   end
 
+  let :api_token_from_request do
+    digest = OpenSSL::Digest.new('sha256')
+    OpenSSL::HMAC.hexdigest(digest, shared_key, "#{DateTime.now.new_offset(0)}/asdf")
+  end
+
   let :valid_request do
     time = DateTime.now.utc
-    double(:request, original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => api_token})
+    double(:request, original_fullpath: "/asdf", original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => api_token})
+  end
+
+  let :valid_request_with_path do
+    time = DateTime.now.utc
+    double(:request, original_fullpath: "/asdf", original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => api_token_from_request})
   end
 
   let :api_token2 do
@@ -27,26 +37,36 @@ describe 'ApiAuthenticator' do
 
   let :valid_request_shared_key2 do
     time = DateTime.now.utc
-    double(:request, original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => api_token})
+    double(:request, original_fullpath: "/asdf", original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => api_token})
   end
 
   let :bad_time_request do
     time = 6.years.from_now
-    double(:request, original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => api_token})
+    double(:request, original_fullpath: "/asdf", original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => api_token})
   end
 
   let :bad_token_request do
     time = Time.now.utc
-    double(:request, original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => "AUSTIN LIVES IN YO TESTS"})
+    double(:request, original_fullpath: "/asdf", original_url: "http://www.austinrocks.com/asdf", headers: {"API-Time" => time.to_s, "API-Token" => "AUSTIN LIVES IN YO TESTS"})
   end
 
+
+
   context "authenticated_request?" do
     before :each do
       ApiAuthenticator.configure do |config|
         config.time_threshold = 2.hours
+        request_type = :url
         config.shared_secret_keys = [shared_key, shared_key2]
       end
     end
+    context "authenticated_request? with request path" do
+      it "should be a valid request" do
+        ApiAuthenticator.request_type = :path
+        expect{ApiAuthenticator.authenticated_request?(valid_request_with_path)}.to_not raise_error
+        ApiAuthenticator.request_type = :url
+      end
+    end
 
     context 'valid_request' do
       it "should not throw an exception" do
@@ -58,6 +78,12 @@ describe 'ApiAuthenticator' do
       end
     end
 
+    context "passing a request dependent on URL but putting a path" do
+      it "should throw an exception" do
+        expect{ApiAuthenticator.authenticated_request?(valid_request_with_path)}.to raise_error(ApiAuthenticator::InvalidTokenError)
+      end
+    end
+
     context 'invalid time' do
       it "should raise InvalidTimeError" do
         expect{ApiAuthenticator.authenticated_request?(bad_time_request)}.to raise_error(ApiAuthenticator::InvalidTimeError)
@@ -70,4 +96,4 @@ describe 'ApiAuthenticator' do
       end
     end
   end
-end
+end

data/spec/configuration_spec.rb

@@ -0,0 +1,18 @@
+require 'spec_helper'
+
+describe "ApiAuthenticator configuration" do
+  it "by default request type should be URL" do
+    expect(ApiAuthenticator.request_type).to eql(ApiAuthenticator::URL_REQUEST_TYPE)
+  end
+
+  it "can assign request type to :path" do
+    ApiAuthenticator.request_type = ApiAuthenticator::PATH_REQUEST_TYPE
+    expect(ApiAuthenticator.request_type).to eql(ApiAuthenticator::PATH_REQUEST_TYPE)
+  end
+
+  it "should throw an ArgumentError if request_type isn't acceptable" do
+    expect do
+      ApiAuthenticator.request_type = 'foo'
+    end.to raise_error(ArgumentError)
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: api_authenticator
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Austin Fonacier
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-12 00:00:00.000000000 Z
+date: 2018-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -88,6 +88,7 @@ files:
 - lib/api_authenticator/version.rb
 - spec/api_authenticator_spec.rb
 - spec/authenticator_concern_spec.rb
+- spec/configuration_spec.rb
 - spec/errors_spec.rb
 - spec/spec_helper.rb
 homepage: https://github.com/Spokeo/api_authenticator
@@ -117,5 +118,6 @@ summary: This gem will authenticate API requests using a modified HMAC-SHA1
 test_files:
 - spec/api_authenticator_spec.rb
 - spec/authenticator_concern_spec.rb
+- spec/configuration_spec.rb
 - spec/errors_spec.rb
 - spec/spec_helper.rb