bookingsync_application 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d0697e1d6620be8da3f34c424aa2da55dd8496e8
-  data.tar.gz: 735aeb9b1b2d0115cdaa1fdcefd7b1cdbf596969
+  metadata.gz: db3882b8207bb164374f0b62f6daed2eb8c43887
+  data.tar.gz: 571170a81a8c6434adc8e55436f37729fcadf7b4
 SHA512:
-  metadata.gz: a39078ba5b1c687d41aad25814e790c31941515b2bbbaccd5b11d9794038f237ffdb5e11ff77e3b26ad6257968701402c86985213abdd12b0352e016e175541a
-  data.tar.gz: d4b4adcab7f988bb16f4913f240eef0fea7c24178e26173827ee97576e285cffc4334e09f9ff7b5a897399611bf401ab9ac36989e91c5f5ec73ca21c751c2e66
+  metadata.gz: b03b0499dffd2543b8c09852899a0055c354c4ad79c1140529f80cc2da2c938b856d114b8ad2105e1553d34ec0ca08637b5505831fed6d47c9a536aa5f51241b
+  data.tar.gz: d1c50083935102e473361dad2f49d8dafbee2d4d7da17de23a43dc2ca356b37daa98a865f0e040de7f8c461923e3f9602298215db837efe978686c56573278e3

data/app/controllers/bookingsync_application/webhooks/base_controller.rb

@@ -0,0 +1,40 @@
+class BookingsyncApplication::Webhooks::BaseController < ApplicationController
+  skip_before_action :verify_authenticity_token
+  before_action :verify_signature
+
+  protected
+
+  def invalidate_request_and_log(message)
+    logger.info "Failing with 422 because: #{message}"
+    head 422
+  end
+
+  def verify_signature
+    Rails.logger.debug "bookingsync_hook_raw_post: #{request.raw_post}"
+    unless [old_signature, new_signature].include? request.headers["X-Content-Signature"]
+      invalidate_request_and_log "Bad BookingSync signature"
+    end
+  end
+
+  def old_signature
+    OpenSSL::HMAC.hexdigest(digest, ENV["BOOKINGSYNC_APP_SECRET"],
+      base64_encoded_payload)
+  end
+
+  def new_signature
+    OpenSSL::HMAC.hexdigest(digest, ENV["BOOKINGSYNC_APP_SECRET"],
+      base64_strict_encoded_payload)
+  end
+
+  def digest
+    OpenSSL::Digest.new("sha1")
+  end
+
+  def base64_encoded_payload
+    Base64.encode64(request.raw_post)
+  end
+
+  def base64_strict_encoded_payload
+    Base64.strict_encode64(request.raw_post)
+  end
+end

data/lib/bookingsync_application/version.rb

@@ -1,3 +1,3 @@
 module BookingsyncApplication
-  VERSION = '0.4.0'
+  VERSION = '0.4.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bookingsync_application
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Marcin Nowicki
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-02 00:00:00.000000000 Z
+date: 2016-02-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -191,6 +191,7 @@ files:
 - README.md
 - Rakefile
 - app/controllers/bookingsync_application/admin/base_controller.rb
+- app/controllers/bookingsync_application/webhooks/base_controller.rb
 - config/routes.rb
 - lib/bookingsync_application.rb
 - lib/bookingsync_application/admin/common_base_controller.rb
@@ -223,3 +224,4 @@ signing_key:
 specification_version: 4
 summary: A Rails engine to simplify building BookingSync Applications
 test_files: []
+has_rdoc: