castle-rb 5.0.0 → 6.0.0

data/lib/castle/verdict.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Castle
+  # handles verdict consts
+  module Verdict
+    # allow
+    ALLOW = 'allow'
+    # deny
+    DENY = 'deny'
+    # challenge
+    CHALLENGE = 'challenge'
+  end
+end

data/lib/castle/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Castle
-  VERSION = '5.0.0'
+  VERSION = '6.0.0'
 end

data/lib/castle/webhooks/verify.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Castle
+  module Webhooks
+    # Verify a webhook
+    class Verify
+      class << self
+        # Checks if webhook is valid
+        # @param webhook [Request]
+        # @param config [Castle::Configuration, Castle::SingletonConfiguration]
+        def call(webhook, config = Castle.config)
+          expected_signature = compute_signature(webhook, config.api_secret)
+          signature = webhook.env['HTTP_X_CASTLE_SIGNATURE']
+          verify_signature(signature, expected_signature)
+        end
+
+        private
+
+        # Computes a webhook signature using provided user_id
+        # @param webhook [Request]
+        # @param api_secret [String]
+        def compute_signature(webhook, api_secret)
+          Base64.encode64(
+            OpenSSL::HMAC.digest(
+              OpenSSL::Digest.new('sha256'),
+              api_secret,
+              Castle::Core::ProcessWebhook.call(webhook)
+            )
+          ).strip
+        end
+
+        # Check if the signatures are matching
+        # @param signature [String] first signature to be compared
+        # @param expected_signature [String] second signature to be compared
+        def verify_signature(signature, expected_signature)
+          return if Castle::Utils::SecureCompare.call(signature, expected_signature)
+
+          raise Castle::WebhookVerificationError, 'Signature not matching the expected signature'
+        end
+      end
+    end
+  end
+end

data/spec/integration/rails/rails_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 require_relative 'support/all'
 
 RSpec.describe HomeController, type: :request do
-  describe '#index' do
+  context 'with index pages' do
     let(:request) do
       {
         'event' => '$login.succeeded',
@@ -16,7 +16,6 @@ RSpec.describe HomeController, type: :request do
         'context' => {
           'client_id' => '',
           'active' => true,
-          'origin' => 'web',
           'headers' => {
             'Accept' => 'text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5',
             'Authorization' => true,
@@ -45,17 +44,44 @@ RSpec.describe HomeController, type: :request do
     before do
       Timecop.freeze(now)
       stub_request(:post, 'https://api.castle.io/v1/track')
-      get '/', headers: headers
     end
 
     after { Timecop.return }
 
-    it do
-      assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
-        JSON.parse(req.body) == request
+    describe '#index1' do
+      before { get '/index1', headers: headers }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
+          JSON.parse(req.body) == request
+        end
       end
+
+      it { expect(response).to be_successful }
     end
 
-    it { expect(response).to be_successful }
+    describe '#index2' do
+      before { get '/index2', headers: headers }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
+          JSON.parse(req.body) == request
+        end
+      end
+
+      it { expect(response).to be_successful }
+    end
+
+    describe '#index3' do
+      before { get '/index3', headers: headers }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/track', times: 1 do |req|
+          JSON.parse(req.body) == request
+        end
+      end
+
+      it { expect(response).to be_successful }
+    end
   end
 end

data/spec/integration/rails/support/application.rb

@@ -10,6 +10,8 @@ class TestApp < Rails::Application
   Rails.logger = config.logger
 
   routes.draw do
-    get '/' => 'home#index'
+    get '/index1' => 'home#index1'
+    get '/index2' => 'home#index2'
+    get '/index3' => 'home#index3'
   end
 end

data/spec/integration/rails/support/home_controller.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
 
 class HomeController < ActionController::Base
-  def index
-    request_context = ::Castle::Client.to_context(request)
-    track_options = ::Castle::Client.to_options(
+  # prepare context and calling track with client example
+  def index1
+    request_context = ::Castle::Context::Prepare.call(request)
+    payload = {
       event: '$login.succeeded',
       user_id: '123',
       properties: {
@@ -12,9 +13,50 @@ class HomeController < ActionController::Base
       user_traits: {
         key: 'value'
       }
+    }
+    client = ::Castle::Client.new(context: request_context)
+    client.track(payload)
+
+    render inline: 'hello'
+  end
+
+  # prepare payload and calling track with client example
+  def index2
+    payload = ::Castle::Payload::Prepare.call(
+      {
+        event: '$login.succeeded',
+        user_id: '123',
+        properties: {
+          key: 'value'
+        },
+        user_traits: {
+          key: 'value'
+        }
+      },
+      request
+    )
+    client = ::Castle::Client.new
+    client.track(payload)
+
+    render inline: 'hello'
+  end
+
+  # prepare payload and calling track with direct API::Track service
+  def index3
+    payload = ::Castle::Payload::Prepare.call(
+      {
+        event: '$login.succeeded',
+        user_id: '123',
+        properties: {
+          key: 'value'
+        },
+        user_traits: {
+          key: 'value'
+        }
+      },
+      request
     )
-    client = ::Castle::Client.new(request_context)
-    client.track(track_options)
+    Castle::API::Track.call(payload)
 
     render inline: 'hello'
   end

data/spec/lib/castle/api/approve_device_spec.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+describe Castle::API::ApproveDevice do
+  before do
+    stub_request(:any, /api.castle.io/).with(
+      basic_auth: ['', 'secret']
+    ).to_return(status: 200, body: '{}', headers: {})
+  end
+
+  describe '.call' do
+    subject(:retrieve) { described_class.call(device_token: device_token) }
+
+    let(:device_token) { '1234' }
+
+    before { retrieve }
+
+    it do
+      assert_requested :put, "https://api.castle.io/v1/devices/#{device_token}/approve", times: 1
+    end
+  end
+end

data/spec/lib/castle/api/authenticate_spec.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+describe Castle::API::Authenticate do
+  subject(:call_subject) { described_class.call(options) }
+
+  let(:ip) { '1.2.3.4' }
+  let(:cookie_id) { 'abcd' }
+  let(:ua) { 'Chrome' }
+  let(:env) do
+    Rack::MockRequest.env_for(
+      '/',
+      'HTTP_USER_AGENT' => ua,
+      'HTTP_X_FORWARDED_FOR' => ip,
+      'HTTP_COOKIE' => "__cid=#{cookie_id};other=efgh"
+    )
+  end
+  let(:request) { Rack::Request.new(env) }
+  let(:context) { Castle::Context::Prepare.call(request) }
+  let(:time_now) { Time.now }
+  let(:time_auto) { time_now.utc.iso8601(3) }
+  let(:time_user) { (Time.now - 10_000).utc.iso8601(3) }
+  let(:response_body) { {}.to_json }
+
+  before do
+    Timecop.freeze(time_now)
+    stub_const('Castle::VERSION', '2.2.0')
+  end
+
+  after { Timecop.return }
+
+  describe '.call' do
+    let(:request_body) do
+      { event: '$login.succeeded', context: context, user_id: '1234',
+        sent_at: time_auto }
+    end
+
+    context 'when used with symbol keys' do
+      before do
+        stub_request(:any, /api.castle.io/).with(
+          basic_auth: ['', 'secret']
+        ).to_return(status: 200, body: response_body, headers: {})
+        call_subject
+      end
+
+      let(:options) { { event: '$login.succeeded', user_id: '1234', context: context } }
+
+      it do
+        assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+          JSON.parse(req.body) == JSON.parse(request_body.to_json)
+        end
+      end
+
+      context 'when passed timestamp in options and no defined timestamp' do
+        let(:options) do
+          { event: '$login.succeeded', user_id: '1234', timestamp: time_user, context: context }
+        end
+        let(:request_body) do
+          { event: '$login.succeeded', user_id: '1234', context: context,
+            timestamp: time_user, sent_at: time_auto }
+        end
+
+        it do
+          assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+            JSON.parse(req.body) == JSON.parse(request_body.to_json)
+          end
+        end
+      end
+    end
+
+    context 'when denied' do
+      let(:failover_appendix) { { failover: false, failover_reason: nil } }
+
+      let(:options) { { event: '$login.succeeded', user_id: '1234', context: context } }
+
+      context 'when denied without any risk policy' do
+        let(:response_body) { deny_response_without_rp.to_json }
+        let(:deny_response_without_rp) do
+          {
+            action: 'deny',
+            user_id: '12345',
+            device_token: 'abcdefg1234'
+          }
+        end
+        let(:deny_without_rp_failover_result) do
+          deny_response_without_rp.merge(failover_appendix)
+        end
+
+        before do
+          stub_request(:any, /api.castle.io/).with(
+            basic_auth: ['', 'secret']
+          ).to_return(status: 200, body: deny_response_without_rp.to_json, headers: {})
+          call_subject
+        end
+
+        it do
+          assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+            JSON.parse(req.body) == JSON.parse(request_body.to_json)
+          end
+        end
+
+        it { expect(call_subject).to eql(deny_without_rp_failover_result) }
+      end
+
+      context 'when denied with risk policy' do
+        let(:deny_response_with_rp) do
+          {
+            action: 'deny',
+            user_id: '12345',
+            device_token: 'abcdefg1234',
+            risk_policy: {
+              id: 'q-rbeMzBTdW2Fd09sbz55A',
+              revision_id: 'pke4zqO2TnqVr-NHJOAHEg',
+              name: 'Block Users from X',
+              type: 'bot'
+            }
+          }
+        end
+        let(:response_body) { deny_response_with_rp.to_json }
+        let(:deny_with_rp_failover_result) do
+          deny_response_with_rp.merge(failover_appendix)
+        end
+
+        before do
+          stub_request(:any, /api.castle.io/).with(
+            basic_auth: ['', 'secret']
+          ).to_return(status: 200, body: deny_response_with_rp.to_json, headers: {})
+          call_subject
+        end
+
+        it do
+          assert_requested :post, 'https://api.castle.io/v1/authenticate', times: 1 do |req|
+            JSON.parse(req.body) == JSON.parse(request_body.to_json)
+          end
+        end
+
+        it { expect(call_subject).to eql(deny_with_rp_failover_result) }
+      end
+    end
+  end
+end

data/spec/lib/castle/api/end_impersonation_spec.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+describe Castle::API::EndImpersonation do
+  subject(:call) { described_class.call(options) }
+
+  let(:ip) { '1.2.3.4' }
+  let(:cookie_id) { 'abcd' }
+  let(:ua) { 'Chrome' }
+  let(:env) do
+    Rack::MockRequest.env_for(
+      '/',
+      'HTTP_USER_AGENT' => ua,
+      'HTTP_X_FORWARDED_FOR' => ip,
+      'HTTP_COOKIE' => "__cid=#{cookie_id};other=efgh"
+    )
+  end
+  let(:request) { Rack::Request.new(env) }
+  let(:context) { Castle::Context::Prepare.call(request) }
+  let(:time_now) { Time.now }
+  let(:time_auto) { time_now.utc.iso8601(3) }
+
+  before do
+    Timecop.freeze(time_now)
+    stub_const('Castle::VERSION', '2.2.0')
+    stub_request(:any, /api.castle.io/).with(
+      basic_auth: ['', 'secret']
+    ).to_return(status: 200, body: response_body, headers: {})
+  end
+
+  after { Timecop.return }
+
+  describe 'call' do
+    let(:impersonator) { 'test@castle.io' }
+    let(:request_body) do
+      { user_id: '1234', sent_at: time_auto,
+        properties: { impersonator: impersonator }, context: context }
+    end
+    let(:response_body) { { success: true }.to_json }
+    let(:options) do
+      { user_id: '1234', properties: { impersonator: impersonator }, context: context }
+    end
+
+    context 'when used with symbol keys' do
+      before { call }
+
+      it do
+        assert_requested :delete, 'https://api.castle.io/v1/impersonate', times: 1 do |req|
+          JSON.parse(req.body) == JSON.parse(request_body.to_json)
+        end
+      end
+    end
+
+    context 'when request is not successful' do
+      let(:response_body) { {}.to_json }
+
+      it { expect { call }.to raise_error(Castle::ImpersonationFailed) }
+    end
+  end
+end

data/spec/lib/castle/api/get_device_spec.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+describe Castle::API::GetDevice do
+  before do
+    stub_request(:any, /api.castle.io/).with(
+      basic_auth: ['', 'secret']
+    ).to_return(status: 200, body: '{}', headers: {})
+  end
+
+  describe '.call' do
+    subject(:retrieve) { described_class.call(device_token: device_token) }
+
+    let(:device_token) { '1234' }
+
+    before { retrieve }
+
+    it { assert_requested :get, "https://api.castle.io/v1/devices/#{device_token}", times: 1 }
+  end
+end