castle-rb 4.1.0 → 6.0.0

data/lib/castle/utils/clean_invalid_chars.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Castle
+  module Utils
+    module CleanInvalidChars
+      class << self
+        def call(arg)
+          case arg
+          when ::String
+            arg.encode('UTF-8', invalid: :replace, undef: :replace)
+          when ::Hash
+            arg.transform_values do |v|
+              Castle::Utils::CleanInvalidChars.call(v)
+            end
+          when ::Array
+            arg.map { |el| Castle::Utils::CleanInvalidChars.call(el) }
+          else
+            arg
+          end
+        end
+      end
+    end
+  end
+end

data/lib/castle/utils/clone.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Castle
+  module Utils
+    # Clones any object
+    class Clone
+      class << self
+        # Returns a cloned object of any type
+        def call(object)
+          Marshal.load(Marshal.dump(object))
+        end
+      end
+    end
+  end
+end

data/lib/castle/utils/deep_symbolize_keys.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Castle
+  module Utils
+    module DeepSymbolizeKeys
+      class << self
+        # Returns a new hash with all keys converted to symbols, as long as
+        # they respond to +to_sym+. This includes the keys from the root hash
+        # and from all nested hashes and arrays.
+        #
+        #   hash = { 'person' => { 'name' => 'Rob', 'age' => '28' } }
+        #
+        #   Castle::Hash.deep_symbolize_keys(hash)
+        #   # => {:person=>{:name=>"Rob", :age=>"28"}}
+        def call(object, &block)
+          case object
+          when Hash
+            object.each_with_object({}) do |(key, value), result|
+              result[key.to_sym] = Castle::Utils::DeepSymbolizeKeys.call(value, &block)
+            end
+          when Array
+            object.map { |e| Castle::Utils::DeepSymbolizeKeys.call(e, &block) }
+          else
+            object
+          end
+        end
+
+        def call!(object, &block)
+          case object
+          when Hash
+            object.each_key do |key|
+              value = object.delete(key)
+              object[key.to_sym] = Castle::Utils::DeepSymbolizeKeys.call!(value, &block)
+            end
+            object
+          when Array
+            object.map! { |e| Castle::Utils::DeepSymbolizeKeys.call!(e, &block) }
+          else
+            object
+          end
+        end
+      end
+    end
+  end
+end

data/lib/castle/utils/get_timestamp.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Castle
+  module Utils
+    # Generates a timestamp
+    class GetTimestamp
+      class << self
+        # Returns current time as ISO8601 formatted string
+        def call
+          Time.now.utc.iso8601(3)
+        end
+      end
+    end
+  end
+end

data/lib/castle/utils/{merger.rb → merge.rb}

@@ -2,10 +2,10 @@
 
 module Castle
   module Utils
-    class Merger
+    class Merge
       def self.call(base, extra)
-        base_s = Castle::Utils.deep_symbolize_keys(base)
-        extra_s = Castle::Utils.deep_symbolize_keys(extra)
+        base_s = Castle::Utils::DeepSymbolizeKeys.call(base)
+        extra_s = Castle::Utils::DeepSymbolizeKeys.call(extra)
 
         extra_s.each do |name, value|
           if value.nil?

data/lib/castle/utils/secure_compare.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Castle
+  module Utils
+    # Code borrowed from ActiveSupport
+    class SecureCompare
+      class << self
+        # @param str_a [String] first string to be compared
+        # @param str_b [String] second string to be compared
+        def call(str_a, str_b)
+          return false unless str_a.bytesize == str_b.bytesize
+
+          l = str_a.unpack "C#{str_a.bytesize}"
+
+          res = 0
+          str_b.each_byte { |byte| res |= byte ^ l.shift }
+          res.zero?
+        end
+      end
+    end
+  end
+end

data/lib/castle/validators/not_supported.rb

@@ -2,6 +2,7 @@
 
 module Castle
   module Validators
+    # Checks if required keys are supported
     class NotSupported
       class << self
         def call(options, keys)

data/lib/castle/validators/present.rb

@@ -2,6 +2,7 @@
 
 module Castle
   module Validators
+    # Checks if required keys are present
     class Present
       class << self
         def call(options, keys)

data/lib/castle/verdict.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Castle
+  # handles verdict consts
+  module Verdict
+    # allow
+    ALLOW = 'allow'
+    # deny
+    DENY = 'deny'
+    # challenge
+    CHALLENGE = 'challenge'
+  end
+end

data/lib/castle/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Castle
-  VERSION = '4.1.0'
+  VERSION = '6.0.0'
 end

data/lib/castle/webhooks/verify.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Castle
+  module Webhooks
+    # Verify a webhook
+    class Verify
+      class << self
+        # Checks if webhook is valid
+        # @param webhook [Request]
+        # @param config [Castle::Configuration, Castle::SingletonConfiguration]
+        def call(webhook, config = Castle.config)
+          expected_signature = compute_signature(webhook, config.api_secret)
+          signature = webhook.env['HTTP_X_CASTLE_SIGNATURE']
+          verify_signature(signature, expected_signature)
+        end
+
+        private
+
+        # Computes a webhook signature using provided user_id
+        # @param webhook [Request]
+        # @param api_secret [String]
+        def compute_signature(webhook, api_secret)
+          Base64.encode64(
+            OpenSSL::HMAC.digest(
+              OpenSSL::Digest.new('sha256'),
+              api_secret,
+              Castle::Core::ProcessWebhook.call(webhook)
+            )
+          ).strip
+        end
+
+        # Check if the signatures are matching
+        # @param signature [String] first signature to be compared
+        # @param expected_signature [String] second signature to be compared
+        def verify_signature(signature, expected_signature)
+          return if Castle::Utils::SecureCompare.call(signature, expected_signature)
+
+          raise Castle::WebhookVerificationError, 'Signature not matching the expected signature'
+        end
+      end
+    end
+  end
+end

data/spec/integration/rails/rails_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 require_relative 'support/all'
 
 RSpec.describe HomeController, type: :request do
-  describe '#index' do
+  context 'with index pages' do
     let(:request) do
       {
         'event' => '$login.succeeded',
@@ -16,7 +16,6 @@ RSpec.describe HomeController, type: :request do
         'context' => {
           'client_id' => '',
           'active' => true,
-          'origin' => 'web',
           'headers' => {
             'Accept' => 'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5',
             'Authorization' => true,
@@ -45,17 +44,44 @@ RSpec.describe HomeController, type: :request do
     before do
       Timecop.freeze(now)
       stub_request(:post, 'https://api.castle.io/v1/track')
-      get '/', headers: headers
     end
 
     after { Timecop.return }
 
-    it do
-      assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
-        JSON.parse(req.body) == request
+    describe '#index1' do
+      before { get '/index1', headers: headers }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
+          JSON.parse(req.body) == request
+        end
       end
+
+      it { expect(response).to be_successful }
     end
 
-    it { expect(response).to be_successful }
+    describe '#index2' do
+      before { get '/index2', headers: headers }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
+          JSON.parse(req.body) == request
+        end
+      end
+
+      it { expect(response).to be_successful }
+    end
+
+    describe '#index3' do
+      before { get '/index3', headers: headers }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
+          JSON.parse(req.body) == request
+        end
+      end
+
+      it { expect(response).to be_successful }
+    end
   end
 end

data/spec/integration/rails/support/application.rb

@@ -10,6 +10,8 @@ class TestApp < Rails::Application
   Rails.logger = config.logger
 
   routes.draw do
-    get '/' => 'home#index'
+    get '/index1' => 'home#index1'
+    get '/index2' => 'home#index2'
+    get '/index3' => 'home#index3'
   end
 end

data/spec/integration/rails/support/home_controller.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
 
 class HomeController < ActionController::Base
-  def index
-    request_context = ::Castle::Client.to_context(request)
-    track_options = ::Castle::Client.to_options(
+  # prepare context and calling track with client example
+  def index1
+    request_context = ::Castle::Context::Prepare.call(request)
+    payload = {
       event: '$login.succeeded',
       user_id: '123',
       properties: {
@@ -12,9 +13,50 @@ class HomeController < ActionController::Base
       user_traits: {
         key: 'value'
       }
+    }
+    client = ::Castle::Client.new(context: request_context)
+    client.track(payload)
+
+    render inline: 'hello'
+  end
+
+  # prepare payload and calling track with client example
+  def index2
+    payload = ::Castle::Payload::Prepare.call(
+      {
+        event: '$login.succeeded',
+        user_id: '123',
+        properties: {
+          key: 'value'
+        },
+        user_traits: {
+          key: 'value'
+        }
+      },
+      request
+    )
+    client = ::Castle::Client.new
+    client.track(payload)
+
+    render inline: 'hello'
+  end
+
+  # prepare payload and calling track with direct API::Track service
+  def index3
+    payload = ::Castle::Payload::Prepare.call(
+      {
+        event: '$login.succeeded',
+        user_id: '123',
+        properties: {
+          key: 'value'
+        },
+        user_traits: {
+          key: 'value'
+        }
+      },
+      request
     )
-    client = ::Castle::Client.new(request_context)
-    client.track(track_options)
+    Castle::API::Track.call(payload)
 
     render inline: 'hello'
   end

data/spec/lib/castle/api/approve_device_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+describe Castle::API::ApproveDevice do
+  before do
+    stub_request(:any, /api.castle.io/).with(
+      basic_auth: ['', 'secret']
+    ).to_return(status: 200, body: '{}', headers: {})
+  end
+
+  describe '.call' do
+    subject(:retrieve) { described_class.call(device_token: device_token) }
+
+    let(:device_token) { '1234' }
+
+    before { retrieve }
+
+    it do
+      assert_requested :put, "https://api.castle.io/v1/devices/#{device_token}/approve", times: 1
+    end
+  end
+end

data/spec/lib/castle/api/authenticate_spec.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+describe Castle::API::Authenticate do
+  subject(:call_subject) { described_class.call(options) }
+
+  let(:ip) { '1.2.3.4' }
+  let(:cookie_id) { 'abcd' }
+  let(:ua) { 'Chrome' }
+  let(:env) do
+    Rack::MockRequest.env_for(
+      '/',
+      'HTTP_USER_AGENT' => ua,
+      'HTTP_X_FORWARDED_FOR' => ip,
+      'HTTP_COOKIE' => "__cid=#{cookie_id};other=efgh"
+    )
+  end
+  let(:request) { Rack::Request.new(env) }
+  let(:context) { Castle::Context::Prepare.call(request) }
+  let(:time_now) { Time.now }
+  let(:time_auto) { time_now.utc.iso8601(3) }
+  let(:time_user) { (Time.now - 10_000).utc.iso8601(3) }
+  let(:response_body) { {}.to_json }
+
+  before do
+    Timecop.freeze(time_now)
+    stub_const('Castle::VERSION', '2.2.0')
+  end
+
+  after { Timecop.return }
+
+  describe '.call' do
+    let(:request_body) do
+      { event: '$login.succeeded', context: context, user_id: '1234',
+        sent_at: time_auto }
+    end
+
+    context 'when used with symbol keys' do
+      before do
+        stub_request(:any, /api.castle.io/).with(
+          basic_auth: ['', 'secret']
+        ).to_return(status: 200, body: response_body, headers: {})
+        call_subject
+      end
+
+      let(:options) { { event: '$login.succeeded', user_id: '1234', context: context } }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+          JSON.parse(req.body) == JSON.parse(request_body.to_json)
+        end
+      end
+
+      context 'when passed timestamp in options and no defined timestamp' do
+        let(:options) do
+          { event: '$login.succeeded', user_id: '1234', timestamp: time_user, context: context }
+        end
+        let(:request_body) do
+          { event: '$login.succeeded', user_id: '1234', context: context,
+            timestamp: time_user, sent_at: time_auto }
+        end
+
+        it do
+          assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+            JSON.parse(req.body) == JSON.parse(request_body.to_json)
+          end
+        end
+      end
+    end
+
+    context 'when denied' do
+      let(:failover_appendix) { { failover: false, failover_reason: nil } }
+
+      let(:options) { { event: '$login.succeeded', user_id: '1234', context: context } }
+
+      context 'when denied without any risk policy' do
+        let(:response_body) { deny_response_without_rp.to_json }
+        let(:deny_response_without_rp) do
+          {
+            action: 'deny',
+            user_id: '12345',
+            device_token: 'abcdefg1234'
+          }
+        end
+        let(:deny_without_rp_failover_result) do
+          deny_response_without_rp.merge(failover_appendix)
+        end
+
+        before do
+          stub_request(:any, /api.castle.io/).with(
+            basic_auth: ['', 'secret']
+          ).to_return(status: 200, body: deny_response_without_rp.to_json, headers: {})
+          call_subject
+        end
+
+        it do
+          assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+            JSON.parse(req.body) == JSON.parse(request_body.to_json)
+          end
+        end
+
+        it { expect(call_subject).to eql(deny_without_rp_failover_result) }
+      end
+
+      context 'when denied with risk policy' do
+        let(:deny_response_with_rp) do
+          {
+            action: 'deny',
+            user_id: '12345',
+            device_token: 'abcdefg1234',
+            risk_policy: {
+              id: 'q-rbeMzBTdW2Fd09sbz55A',
+              revision_id: 'pke4zqO2TnqVr-NHJOAHEg',
+              name: 'Block Users from X',
+              type: 'bot'
+            }
+          }
+        end
+        let(:response_body) { deny_response_with_rp.to_json }
+        let(:deny_with_rp_failover_result) do
+          deny_response_with_rp.merge(failover_appendix)
+        end
+
+        before do
+          stub_request(:any, /api.castle.io/).with(
+            basic_auth: ['', 'secret']
+          ).to_return(status: 200, body: deny_response_with_rp.to_json, headers: {})
+          call_subject
+        end
+
+        it do
+          assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+            JSON.parse(req.body) == JSON.parse(request_body.to_json)
+          end
+        end
+
+        it { expect(call_subject).to eql(deny_with_rp_failover_result) }
+      end
+    end
+  end
+end