bunq-client 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9740e877575d04b4f9651481d14ebe99c9e72fa1c84784df9723682c390eb3a6
-  data.tar.gz: c7917f47979a39be25f38ef56ea76f781209f592b1f519ac770f41784f116d66
+  metadata.gz: bd7688576042b6d4767eeb9f3ba6a5571a296070b44cf3da4aabcc221eb83b3c
+  data.tar.gz: d81a7e0a729a790315ea24fc630815c2145c89fea9ac577e7ff80e40f1bf4096
 SHA512:
-  metadata.gz: f4dd1de0cb4cd712176d715fd4f2b71439c04642ea5b9cc5f4858e8a6e23d84140081fd0bc3bfd56ee024f56d2c031fec96d0fa8effc7c690852859dd65f0ec2
-  data.tar.gz: 4b224b06310d349d5cc243ed6c1c8b60e5c859d3e58c30627af7986163f7e82a8860d63eb5660626ba3a9631ec681589dd1fc9bcde31d9ede397e72b848ee54f
+  metadata.gz: 40cc75610a053e7cf0476ee8f752333041f3e8d777ad58d29632dcfe8ae4a961888e41d4a8cfd9ff9cbbabfd6c4265902d0f787e2fb5628e2f7667c2b568c530
+  data.tar.gz: 7c78e3b0840ad09acc5060bb2b509655032c73f39b4fc540b5ba16764413216e8d4a87d4ea362a977eacda744859988a9888848c441e2d4ec142319fdd40746b

data/lib/bunq/errors.rb

@@ -26,7 +26,7 @@ module Bunq
   end
 
   class UnexpectedResponse < ResponseError; end
-  class RequestSignatureRequired < ResponseError; end
+  class InvalidResponseSignature < ResponseError; end
   class AbsentResponseSignature < ResponseError; end
   class TooManyRequestsResponse < ResponseError; end
   class UnauthorisedResponse < ResponseError; end

data/lib/bunq/signature.rb

@@ -34,8 +34,8 @@ module Bunq
       end
 
       signature = Base64.strict_decode64(signature_headers_value.first)
-      unless server_public_key.verify(digest, signature, "#{response.code}\n#{response.body}")
-        fail RequestSignatureRequired.new(code: response.code, headers: response.raw_headers, body: response.body)
+      if !verify_modern(signature, response) && !verify_legacy(signature, response)
+        fail InvalidResponseSignature.new(code: response.code, headers: response.raw_headers, body: response.body)
       end
     end
 
@@ -55,5 +55,26 @@ module Bunq
     def skip_signature_check(responseCode)
       (Bunq::configuration.sandbox && responseCode == 409) || responseCode == 429
     end
+
+    def verify_legacy(signature, response)
+      sorted_bunq_headers = response
+        .raw_headers
+        .select(&method(:verifiable_header?))
+        .sort
+        .to_h
+        .map do |k, v|
+          "#{k.to_s.split('-').map(&:capitalize).join('-')}: #{v.first}"
+        end
+
+      verify(signature, %Q{#{response.code}\n#{sorted_bunq_headers.join("\n")}\n\n#{response.body}})
+    end
+
+    def verify_modern(signature, response)
+      verify(signature, response.body)
+    end
+
+    def verify(signature, data)
+      server_public_key.verify(digest, signature, data)
+    end
   end
 end

data/lib/bunq/version.rb

@@ -1,3 +1,3 @@
 module Bunq
-  VERSION = "0.6.1"
+  VERSION = "0.7.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bunq-client
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.7.0
 platform: ruby
 authors:
 - Lars Vonk
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-03-09 00:00:00.000000000 Z
+date: 2020-03-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client