boxr 1.8.0 → 1.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 06a2fa3c34dacf915b7bb788e854bc9235d2eb0cd92c7ca59e480737553146c4
-  data.tar.gz: 7413454a658067aabe3ff90625e30a029335166ed50f7e05569cd2fe4e583e84
+  metadata.gz: 2229eb1062b34eabf5e7040caf0a2c497caa7d2ef13c75f896eb76e1e7c25fea
+  data.tar.gz: 4404394473173cfa99b4f5b22af110fa2dbd1f9018262fa3b4c48c49f51ba99a
 SHA512:
-  metadata.gz: 74d6a804d79c88de453c3d348a69950b9a08f85da70ae258ad689daf50c3318dd7eb776763c371f600981a1a2ad2c10652811d2a031a6059b1426abb8fdb61ed
-  data.tar.gz: 3b525fa9e91ee3417247128fb733e6feecaaf328916bcb1cca51ded9f0a2ef9d288f7d33a8f6cabf54580c6505d4e4e9a914f495c115bd17b43a1785ba36d57b
+  metadata.gz: 958241267042bcdcbd94247873beefe73afbd43da4860047411c5891fcc25cd56555b719b2f760d9e949c14e6a88c4a90e7658b4c12cc11b4a592c367f02ddf0
+  data.tar.gz: 8d6c582d64c0be4ca4da7cc87f629b2735d90b4640eb2ee154b9cf32597e2f3fa9f65c1fe2c544c075d671d1d0a8d89ac7eabc42cc86fc69ec7d68e9487d524a

data/.env.example

@@ -1,4 +1,4 @@
-#1. go to https://developers.box.com, 
+#1. go to https://developers.box.com,
 #2. find or create your Box Content API app for testing
 #3. click 'Edit Application'
 #4. check the boxes for 'Read and write all files and folders' and 'Manage an enterprise'
@@ -11,5 +11,5 @@ BOX_DEVELOPER_TOKEN={a valid developer token for your Box app}
 BOX_CLIENT_ID={client id of your Box app}
 BOX_CLIENT_SECRET={client secret of your Box app}
 BOX_ENTERPRISE_ID={box enterprise id}
-JWT_SECRET_KEY_PATH={path to your JWT private key}
-JWT_SECRET_KEY_PASSWORD={JWT private key password}
+JWT_PRIVATE_KEY_PATH={path to your JWT private key}
+JWT_PRIVATE_KEY_PASSWORD={JWT private key password}

data/.gitignore

@@ -14,6 +14,7 @@
 /tmp/
 *.gem
 *.bundle
+*.pem
 *.so
 *.o
 *.a

data/README.md

@@ -1,4 +1,7 @@
 # Boxr
+
+[![Gem Version](https://badge.fury.io/rb/boxr.svg)](https://badge.fury.io/rb/boxr)
+
 Boxr is a Ruby client library for the Box V2 Content API.  Box employees affectionately refer to one another as Boxers, hence the name of this gem.
 
 The purpose of this gem is to provide a clear, efficient, and intentional method of interacting with the Box Content API. As with any SDK that wraps a REST API, it is important to fully understand the Box Content API at the REST endpoint level.  You are strongly encouraged to read through the Box documentation located [here](https://box-content.readme.io/).

data/lib/boxr/auth.rb

@@ -1,6 +1,8 @@
 module Boxr
 
   JWT_GRANT_TYPE="urn:ietf:params:oauth:grant-type:jwt-bearer"
+  TOKEN_EXCHANGE_TOKEN_TYPE="urn:ietf:params:oauth:token-type:access_token"
+  TOKEN_EXCHANGE_GRANT_TYPE="urn:ietf:params:oauth:grant-type:token-exchange"
 
   def self.oauth_url(state, host: "app.box.com", response_type: "code", scope: nil, folder_id: nil, client_id: ENV['BOX_CLIENT_ID'])
     template = Addressable::Template.new("https://{host}/api/oauth2/authorize{?query*}")
@@ -8,13 +10,13 @@ module Boxr
     query = {"response_type" => "#{response_type}", "state" => "#{state}", "client_id" => "#{client_id}"}
     query["scope"] = "#{scope}" unless scope.nil?
     query["folder_id"] = "#{folder_id}" unless folder_id.nil?
-    
+
     uri = template.expand({"host" => "#{host}", "query" => query})
     uri
   end
 
   def self.get_tokens(code=nil, grant_type: "authorization_code", assertion: nil, scope: nil, username: nil, client_id: ENV['BOX_CLIENT_ID'], client_secret: ENV['BOX_CLIENT_SECRET'])
-    uri = "https://api.box.com/oauth2/token"
+    uri = Boxr::Client::AUTH_URI
     body = "grant_type=#{grant_type}&client_id=#{client_id}&client_secret=#{client_secret}"
     body = body + "&code=#{code}" unless code.nil?
     body = body + "&scope=#{scope}" unless scope.nil?
@@ -25,7 +27,7 @@ module Boxr
   end
 
   def self.get_enterprise_token(private_key: ENV['JWT_PRIVATE_KEY'], private_key_password: ENV['JWT_PRIVATE_KEY_PASSWORD'],
-                                public_key_id: ENV['JWT_PUBLIC_KEY_ID'], enterprise_id: ENV['BOX_ENTERPRISE_ID'], 
+                                public_key_id: ENV['JWT_PUBLIC_KEY_ID'], enterprise_id: ENV['BOX_ENTERPRISE_ID'],
                                 client_id: ENV['BOX_CLIENT_ID'], client_secret: ENV['BOX_CLIENT_SECRET'])
     unlocked_private_key = unlock_key(private_key, private_key_password)
     assertion = jwt_assertion(unlocked_private_key, client_id, enterprise_id, "enterprise", public_key_id)
@@ -40,19 +42,31 @@ module Boxr
   end
 
   def self.refresh_tokens(refresh_token, client_id: ENV['BOX_CLIENT_ID'], client_secret: ENV['BOX_CLIENT_SECRET'])
-    uri = "https://api.box.com/oauth2/token"
+    uri = Boxr::Client::AUTH_URI
     body = "grant_type=refresh_token&refresh_token=#{refresh_token}&client_id=#{client_id}&client_secret=#{client_secret}"
 
     auth_post(uri, body)
   end
 
   def self.revoke_tokens(token, client_id: ENV['BOX_CLIENT_ID'], client_secret: ENV['BOX_CLIENT_SECRET'])
-    uri = "https://api.box.com/oauth2/revoke"
+    uri = Boxr::Client::REVOKE_AUTH_URI
     body = "client_id=#{client_id}&client_secret=#{client_secret}&token=#{token}"
 
     auth_post(uri, body)
   end
 
+  # Exchange an existing token for a lesser-scoped token
+  def self.exchange_token(subject_token, scope, resource_id: nil, resource_type: :file)
+    uri = Boxr::Client::AUTH_URI
+    resouce_uri = resource_type == :file ? Boxr::Client::FILES_URI : Boxr::Client::FOLDERS_URI
+    resource_url = "#{resouce_uri}/#{resource_id}"
+
+    body = "subject_token=#{subject_token}&subject_token_type=#{TOKEN_EXCHANGE_TOKEN_TYPE}&scope=#{scope}&grant_type=#{TOKEN_EXCHANGE_GRANT_TYPE}"
+    body = body + "&resource=#{resource_url}" unless resource_id.nil?
+
+    auth_post(uri, body)
+  end
+
   class << self
     alias :get_token :get_tokens
     alias :refresh_token :refresh_tokens
@@ -67,14 +81,14 @@ module Boxr
       iss: iss,
       sub: sub,
       box_sub_type: box_sub_type,
-      aud: "https://api.box.com/oauth2/token",
+      aud: Boxr::Client::AUTH_URI,
       jti: SecureRandom.hex(64),
       exp: (Time.now.utc + 10).to_i
     }
 
     additional_headers = {}
     additional_headers['kid'] = public_key_id unless public_key_id.nil?
-    
+
     JWT.encode(payload, private_key, "RS256", additional_headers)
   end
 
@@ -98,5 +112,4 @@ module Boxr
       OpenSSL::PKey::RSA.new(private_key, private_key_password)
     end
   end
-
-end
+end

data/lib/boxr/client.rb

@@ -8,6 +8,8 @@ module Boxr
     #UPLOAD_URI = "https://upload.wcheng.inside-box.net/api/2.0"
 
     API_URI = "https://api.box.com/2.0"
+    AUTH_URI = "https://api.box.com/oauth2/token"
+    REVOKE_AUTH_URI = "https://api.box.com/oauth2/revoke"
     UPLOAD_URI = "https://upload.box.com/api/2.0"
     FILES_URI = "#{API_URI}/files"
     FILES_UPLOAD_URI = "#{UPLOAD_URI}/files/content"

data/lib/boxr/version.rb

@@ -1,3 +1,3 @@
 module Boxr
-  VERSION = "1.8.0"
+  VERSION = "1.9.0"
 end

data/spec/boxr/auth_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+#rake spec SPEC_OPTS="-e \"invokes auth operations"\"
+describe 'auth operations' do
+  it "invokes auth operations" do
+    private_key = OpenSSL::PKey::RSA.new(File.read(ENV['JWT_PRIVATE_KEY_PATH']), ENV['JWT_PRIVATE_KEY_PASSWORD'])
+
+    puts "get enterprise token"
+    enterprise_token = Boxr::get_enterprise_token(private_key: private_key)
+    expect(enterprise_token).to include('access_token', 'expires_in')
+
+    puts "downgrade token"
+    child_token = Boxr::exchange_token(enterprise_token['access_token'], 'root_readonly')
+    expect(child_token).to include('access_token','expires_in')
+
+    # Currently cannot test due to user requiring
+    puts "get user token"
+    second_test_user = BOX_CLIENT.create_user("Second Test User", login: "second_test_user@#{('a'..'z').to_a.shuffle[0,10].join}.com", role: 'user', is_platform_access_only: true)
+    user_token = Boxr::get_user_token(second_test_user.id, private_key: private_key)
+    expect(user_token).to include('access_token','expires_in')
+
+    puts "revoke user token"
+    user_client = Boxr::Client.new(user_token['access_token'])
+    expect(user_client.root_folder_items).to eq []
+    Boxr::revoke_token(user_token['access_token'])
+    expect{user_client.root_folder_items}.to raise_error{Boxr::BoxrError}
+
+    puts "cleanup data"
+    BOX_CLIENT.delete_user(second_test_user, force: true)
+  end
+end

data/spec/boxr/collaborations_spec.rb

@@ -32,6 +32,6 @@ describe 'collaborations operations' do
     expect(pending_collaborations).to eq([])
 
     puts "add invalid collaboration"
-    expect { BOX_CLIENT.add_collaboration(@test_folder, {id: @test_user.id, type: :user}, :invalid_role)}.to raise_error
+    expect { BOX_CLIENT.add_collaboration(@test_folder, {id: @test_user.id, type: :user}, :invalid_role)}.to raise_error{Boxr::BoxrError}
   end
 end

data/spec/boxr_spec.rb

@@ -10,7 +10,11 @@ describe Boxr::Client do
 
   #REQUIRED BOX SETTINGS
   # 1. The developer token used must have admin or co-admin priviledges
+  # 1.5 In the admin settings, advanced features must be enabled (perform as user and create user access tokens)
   # 2. Enterprise settings must allow Admin and Co-admins to permanently delete content in Trash
+  # 3. In Box Admin settings, you must authorize the app.
+  #   - Admin Console > Enterprise Settings > Apps > Custom Applications > Authorize New App. Insert you client ID (API key)
+  #   - You may need to re-authorize the app if you're running into issues with user tokens
 
   #follow the directions in .env.example to set up your BOX_DEVELOPER_TOKEN
   #keep in mind it is only valid for 60 minutes

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: boxr
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.9.0
 platform: ruby
 authors:
 - Chad Burnette
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-05-31 00:00:00.000000000 Z
+date: 2019-06-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -209,6 +209,7 @@ files:
 - lib/boxr/version.rb
 - lib/boxr/watermarking.rb
 - lib/boxr/web_links.rb
+- spec/boxr/auth_spec.rb
 - spec/boxr/collaborations_spec.rb
 - spec/boxr/comments_spec.rb
 - spec/boxr/files_spec.rb
@@ -247,6 +248,7 @@ signing_key:
 specification_version: 4
 summary: A Ruby client library for the Box V2 Content API.
 test_files:
+- spec/boxr/auth_spec.rb
 - spec/boxr/collaborations_spec.rb
 - spec/boxr/comments_spec.rb
 - spec/boxr/files_spec.rb