caren-api 0.1.0 → 0.2.0

data/README.rdoc

@@ -1,8 +1,15 @@
 = Caren API reference implementation
 
 This is the reference implementation for the Caren CareProvider API (http://caren-cares.com). 
-To get started you will need a care provider API shared key. Set `Caren::Api.shared_key` to that key.
-Next you will need to set your care provider url `Caren::Api.url` to your specific URL like https://example.caren-cares.com
+
+To get started you will need a care provider API shared key. Set `Caren::Api.shared_key` to the key file.
+
+Generate a private key using: `openssl genrsa -out example 1024`
+Then extract the public key from it: `openssl rsa -in example -pubout -out example.pub`
+Send the public key to info@caren-cares.com with an access request.
+
+Next you will need to set your care provider url `Caren::Api.url` to your specific URL like https://example.caren-cares.com. 
+This url will be provided.
 
 == Contributing to caren-api
  

data/VERSION

@@ -1 +1 @@
-0.1.0
+0.2.0

data/caren-api.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = %q{caren-api}
-  s.version = "0.1.0"
+  s.version = "0.2.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andre Foeken"]
@@ -25,6 +25,9 @@ Gem::Specification.new do |s|
     "Rakefile",
     "VERSION",
     "caren-api.gemspec",
+    "certs/caren-api.pub",
+    "certs/example",
+    "certs/example.pub",
     "init.rb",
     "lib/caren-api.rb",
     "lib/caren/base.rb",

data/certs/caren-api.pub

@@ -0,0 +1,6 @@
+-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDll+UxqVoqgd6ZHkw8av/0XYbZ
+RP7JIZ8zNst1kK4SnBV0YZBlxl5j+1tRgjvzSUOxJehp0ikFquZk2dm9i7JHIeXL
+OnfSjN4Hbw/C/d8RXDcmbtF/7RmYs4mVrhQS5eQNR7bDo6NKA1UfDEB0OFIcvhks
+6ev6vuETYzu7Y+DroQIDAQAB
+-----END PUBLIC KEY-----

data/certs/example

@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICXQIBAAKBgQDCbPwFkQhkA21mF96N0LSK0YtlyyCnkRcXMRgj9cxGZ88c5qti
+VTD5As6YdEn4GHaHfEr/dMlJpT8eTYHmy4eb35gw+jiGYm24LqJqsQFK7rAJ1I0b
+iE356NF8YaEOKP327K0QzTnftHijTrzDVm/6cHkXQxzAEpPaofU4TW0ljwIDAQAB
+AoGBALoQDkdNepgr53/yi9tvxbervRmXgRKbeVuKci3HxswCAGUKIy2hlZJYK1oe
+v8MbtiMGwcci/pbp+zOGvTAfyw+lZRP2aYIedRnRRLlmNtSYqD9BiD+F+ZfHUsHY
+kFGZdQIF8FPs6utjdbqqfi3YnAkyYvEC/1ecoGb8JkqIkwRxAkEA93/E+CaXxure
+/AteMIbm7CxEzasCPCvK7JQjRGgJbdRg5geB2Tjs6GjsCB1QI93KE0ZnK4M4bevI
+gxzJaffIpQJBAMkajAs5OI+cpOBGZg1KMJ1GgLL21HH/47rt40KWJbZxAsbOd2Vy
+4rBdu/X40JGYT/adVJh76Pw11P1gwMolKyMCQDCK+OELAL3dFzssJ58w9l3gGOaV
+4exXUoewTnJ+TUsjWpYDZu5qAd1bpt+4kB1YxOee6WFZbVnx4vQEU2TbWpkCQQCe
+sK8f0Ch80swcGhE/nXKdONwn3LSpvJX0lPGHQrpBrA3X2WbIDA8rwtumbpAOw9Ud
+surlZKnmE4id5LJdEVVnAkAsUiPowyInJKUNEN6PbvyVsjkgZq6ykDTyTJdWcR2o
+cT4sb4UzePHAAeh8g6VZeipCmO4SaugphkrPYvifWd7l
+-----END RSA PRIVATE KEY-----

data/certs/example.pub

@@ -0,0 +1,6 @@
+-----BEGIN PUBLIC KEY-----
+MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCbPwFkQhkA21mF96N0LSK0Ytl
+yyCnkRcXMRgj9cxGZ88c5qtiVTD5As6YdEn4GHaHfEr/dMlJpT8eTYHmy4eb35gw
++jiGYm24LqJqsQFK7rAJ1I0biE356NF8YaEOKP327K0QzTnftHijTrzDVm/6cHkX
+QxzAEpPaofU4TW0ljwIDAQAB
+-----END PUBLIC KEY-----

data/init.rb

@@ -1,4 +1,5 @@
 require "lib/caren.rb"
 
 Caren::Api.url = "https://www.carenzorgt.nl"
-Caren::Api.shared_key = ""
+Caren::Api.caren_public_key_path = "certs/caren-api.pub"
+Caren::Api.private_key_path = ""

data/lib/caren/caren.rb

@@ -19,11 +19,27 @@ module Caren
   end
 
   class Api
-    class << self
-      attr_accessor :shared_key
+    class << self      
+      # The public key file path used to verify request coming from Caren
+      attr_accessor :caren_public_key_path
+      
+      # The private key file path used to sign requests coming from you
+      attr_accessor :private_key_path
+      
+      # The care provider url provided by Caren. i.e. https://example.caren-cares.com
       attr_accessor :url
     end
     
+    # The public key file used to verify request coming from Caren
+    def self.caren_public_key
+      @caren_public_key ||= OpenSSL::PKey::RSA.new(File.read(self.caren_public_key_path))
+    end
+    
+    # The private key file used to sign requests coming from you
+    def self.private_key
+      @private_key ||= OpenSSL::PKey::RSA.new(File.read(self.private_key_path))
+    end
+    
     def self.put url, xml
       begin
         response = RestClient.put url, xml, :content_type => :xml, :accept => :xml, :signature => Caren::Api.sign(xml)
@@ -59,19 +75,29 @@ module Caren
         handle_error(e.response)
       end
     end
-        
+    
+    # Sign your string using Caren::Api.private_key
     def self.sign string=""
-      raise "No API key given: Caren::Api.shared_key" unless Caren::Api.shared_key
-      Digest::SHA256.hexdigest(string+Caren::Api.shared_key)
+      encrypted_digest = Caren::Api.private_key.sign( "sha1", string )
+      signature = CGI.escape(Base64.encode64(encrypted_digest))
+      return signature
     end
-    
+        
     private
-    
+        
+    # Check the signature of the response from rest-client
     def self.check_signature response
-      return response if response.headers[:signature] == Caren::Api.sign(response.to_str)
+      return response if self.verify_signature( response.headers[:signature], response )
       raise Caren::Exceptions::SignatureMismatch.new
     end
     
+    # Verify the signature using the caren public key file
+    def self.verify_signature signature, string=""
+      signature = Base64.decode64(CGI.unescape(signature))
+      Caren::Api.caren_public_key.verify( "sha1", signature, string )
+    end
+    
+    # Raise a Caren exception on errors
     def self.handle_error response
       errors = []
       doc = REXML::Document.new(response)

data/lib/caren-api.rb

@@ -1,7 +1,3 @@
-require "digest/sha2"
-require "uri"
-require "net/https"
-
 begin
   require "rubygems"
 rescue LoadError

data/spec/spec_helper.rb

@@ -6,7 +6,9 @@ require 'rspec'
 require 'fakeweb'
 require 'capybara'
 
-Caren::Api.shared_key = "specs"
+# For the tests we need to know both the public and private key, so we share them here.
+Caren::Api.caren_public_key_path = "certs/example.pub"
+Caren::Api.private_key_path = "certs/example"
 Caren::Api.url = "http://example.com"
 
 FakeWeb.allow_net_connect = false

metadata

@@ -4,10 +4,10 @@ version: !ruby/object:Gem::Version
   prerelease: false
   segments: 
   - 0
-  - 1
+  - 2
   - 0
   segments_generated: true
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors: 
 - Andre Foeken
@@ -166,6 +166,9 @@ files:
 - Rakefile
 - VERSION
 - caren-api.gemspec
+- certs/caren-api.pub
+- certs/example
+- certs/example.pub
 - init.rb
 - lib/caren-api.rb
 - lib/caren/base.rb