cerner-oauth1a 2.0.1 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0dfb4c9bf4b9fa35f52b7fad741f860bde8fd792412bbd33e0715371019dd130
-  data.tar.gz: ea584dbe2eb91a9965249c2f1330cdaa315fba73a4d5e6665e9fd27506ff1dd3
+  metadata.gz: cd0cf4f52bc3f90e247bc8c507415f540ababac1483da4c626294328857dc270
+  data.tar.gz: 2ae54c85c1ab06b6a3d9581cc062fae1a4a3857037131fbcb479812474f72756
 SHA512:
-  metadata.gz: 9371797cb286811967f7e3af33428fc525e4b464bebd1ab550e99ed28daba6a1878eee561959a0469af9937bdb405591548aed1aba9b317137080554fad97f54
-  data.tar.gz: 65398309db80afb19529f0d2d9988d4c1f061aedc6d6406b4f03eed5e9cae55e6da89605780d2f762532cb77a3964f5c1316868df10fa227f4c0e2c13b79cc3a
+  metadata.gz: 429eb27f3433283a68643968c83ab8ff0b0322bd751ac8da475bb62978922dd4e78d110e3561128b91010a8998070b06d286ebd2ccaa87f730f72943340d69e6
+  data.tar.gz: 3ada2c0200c845f5710a7eacbf77fbea95a3171a9ca56dc1270265a5d2511c7ee7de62fb58371f23f7eb960ce846ba3b762cce0a9d1292938280eae0177be872

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+# v2.1.0
+Added an attribute for the Protection Realm to Cerner::OAuth1a::AccessTokenAgent, 
+Cerner::OAuth1a::AccessToken, and Cerner::OAuth1a::OAuthError. This value will be
+parsed as the canonical root URI of the agent's configured access_token_url. When
+this value is available, it will be added to errors and generated authorization
+headers.
+
 # v2.0.1
 Allow parsing authorization headers that do not include an oauth_version parameter as per
 the spec:

data/CONTRIBUTORS.md

@@ -1,3 +1,3 @@
 * Cerner Corporation
 * Nathan Beyer [@nbeyer](https://github.com/nbeyer)
-* John leacox [@johnlcox](https://github.com/johnlcox)
+* John Leacox [@johnlcox](https://github.com/johnlcox)

data/lib/cerner/oauth1a/access_token.rb

@@ -48,7 +48,8 @@ module Cerner
           timestamp: timestamp,
           token: token,
           signature_method: signature_method,
-          signature: signature
+          signature: signature,
+          realm: params[:realm]
         )
       end
 
@@ -74,6 +75,8 @@ module Cerner
       # This value is only populated after a successful #authenticate and only if the #token (oauth_token)
       # contains a 'Consumer.Principal' parameter.
       attr_reader :consumer_principal
+      # Returns a String, but may be nil, with the Protection Realm related to this token.
+      attr_reader :realm
 
       # Public: Constructs an instance.
       #
@@ -93,6 +96,8 @@ module Cerner
       #                                 Defaults to PLAINTEXT.
       #             :signature        - The optional String representing the signature.
       #                                 Defaults to nil.
+      #             :realm            - The optional String representing the protection realm.
+      #                                 Defaults to nil.
       #
       # Raises ArgumentError if consumer_key, nonce, timestamp, token or signature_method is nil.
       def initialize(
@@ -104,7 +109,8 @@ module Cerner
         signature_method: 'PLAINTEXT',
         timestamp:,
         token:,
-        token_secret: nil
+        token_secret: nil,
+        realm: nil
       )
         raise ArgumentError, 'consumer_key is nil' unless consumer_key
         raise ArgumentError, 'nonce is nil' unless nonce
@@ -122,6 +128,7 @@ module Cerner
         @timestamp = convert_to_time(timestamp)
         @token = token
         @token_secret = token_secret || nil
+        @realm = realm || nil
       end
 
       # Public: Generates a value suitable for use as an HTTP Authorization header. If #signature is
@@ -136,7 +143,7 @@ module Cerner
         return @authorization_header if @authorization_header
 
         unless @signature_method == 'PLAINTEXT'
-          raise OAuthError.new('signature_method must be PLAINTEXT', nil, 'signature_method_rejected')
+          raise OAuthError.new('signature_method must be PLAINTEXT', nil, 'signature_method_rejected', nil, @realm)
         end
 
         if @signature
@@ -144,10 +151,11 @@ module Cerner
         elsif @accessor_secret && @token_secret
           sig = "#{@accessor_secret}&#{@token_secret}"
         else
-          raise OAuthError.new('accessor_secret or token_secret is nil', nil, 'parameter_absent')
+          raise OAuthError.new('accessor_secret or token_secret is nil', nil, 'parameter_absent', nil, @realm)
         end
 
         tuples = {
+          realm: @realm,
           oauth_version: '1.0',
           oauth_signature_method: @signature_method,
           oauth_signature: sig,
@@ -174,14 +182,21 @@ module Cerner
       def authenticate(access_token_agent)
         raise ArgumentError, 'access_token_agent is nil' unless access_token_agent
 
+        if @realm && !@realm.eql?(access_token_agent.realm)
+          raise OAuthError.new('realm does not match provider', nil, 'token_rejected', nil, access_token_agent.realm)
+        end
+
+        # Set realm to the provider's realm if it's not already set
+        @realm ||= access_token_agent.realm
+
         unless @signature_method == 'PLAINTEXT'
-          raise OAuthError.new('signature_method must be PLAINTEXT', nil, 'signature_method_rejected')
+          raise OAuthError.new('signature_method must be PLAINTEXT', nil, 'signature_method_rejected', nil, @realm)
         end
 
         tuples = Protocol.parse_url_query_string(@token)
 
         unless @consumer_key == tuples.delete(:ConsumerKey)
-          raise OAuthError.new('consumer keys do not match', nil, 'consumer_key_rejected')
+          raise OAuthError.new('consumer keys do not match', nil, 'consumer_key_rejected', nil, @realm)
         end
 
         verify_expiration(tuples.delete(:ExpiresOn))
@@ -232,7 +247,8 @@ module Cerner
           token == other.token &&
           token_secret == other.token_secret &&
           signature_method == other.signature_method &&
-          signature == other.signature
+          signature == other.signature &&
+          realm == other.realm
       end
 
       # Public: Compare this to other based on the attributes. Equivalent to calling #==.
@@ -258,7 +274,8 @@ module Cerner
           token_secret: @token_secret,
           signature_method: @signature_method,
           signature: @signature,
-          consumer_principal: @consumer_principal
+          consumer_principal: @consumer_principal,
+          realm: @realm
         }
       end
 
@@ -290,7 +307,8 @@ module Cerner
             'token missing ExpiresOn',
             nil,
             'oauth_parameters_rejected',
-            'oauth_token'
+            'oauth_token',
+            @realm
           )
         end
 
@@ -300,7 +318,9 @@ module Cerner
           raise OAuthError.new(
             'token has expired',
             nil,
-            'token_expired'
+            'token_expired',
+            nil,
+            @realm
           )
         end
       end
@@ -311,14 +331,21 @@ module Cerner
             'token missing KeysVersion',
             nil,
             'oauth_parameters_rejected',
-            'oauth_token'
+            'oauth_token',
+            @realm
           )
         end
 
         begin
           access_token_agent.retrieve_keys(keys_version)
         rescue OAuthError
-          raise OAuthError.new('token references invalid keys version', nil, 'oauth_parameters_rejected', 'oauth_token')
+          raise OAuthError.new(
+            'token references invalid keys version',
+            nil,
+            'oauth_parameters_rejected',
+            'oauth_token',
+            @realm
+          )
         end
       end
 
@@ -329,7 +356,7 @@ module Cerner
       # Raises OAuthError if the parameter is not authentic
       def verify_token(keys)
         unless keys.verify_rsasha1_signature(@token)
-          raise OAuthError.new('token is not authentic', nil, 'oauth_parameters_rejected', 'oauth_token')
+          raise OAuthError.new('token is not authentic', nil, 'oauth_parameters_rejected', 'oauth_token', @realm)
         end
       end
 
@@ -341,8 +368,12 @@ module Cerner
       # Raises OAuthError if there is no signature, the parameter is invalid or the signature does
       # not match the secrets
       def verify_signature(keys, hmac_secrets)
-        raise OAuthError.new('missing signature', nil, 'oauth_parameters_absent', 'oauth_signature') unless @signature
-        raise OAuthError.new('missing HMACSecrets', nil, 'oauth_parameters_rejected', 'oauth_token') unless hmac_secrets
+        unless @signature
+          raise OAuthError.new('missing signature', nil, 'oauth_parameters_absent', 'oauth_signature', @realm)
+        end
+        unless hmac_secrets
+          raise OAuthError.new('missing HMACSecrets', nil, 'oauth_parameters_rejected', 'oauth_token', @realm)
+        end
 
         begin
           secrets = keys.decrypt_hmac_secrets(hmac_secrets)
@@ -351,14 +382,17 @@ module Cerner
             "unable to decrypt HMACSecrets: #{e.message}",
             nil,
             'oauth_parameters_rejected',
-            'oauth_token'
+            'oauth_token',
+            @realm
           )
         end
 
         secrets_parts = Protocol.parse_url_query_string(secrets)
         expected_signature = "#{secrets_parts[:ConsumerSecret]}&#{secrets_parts[:TokenSecret]}"
 
-        raise OAuthError.new('signature is not valid', nil, 'signature_invalid') unless @signature == expected_signature
+        unless @signature == expected_signature
+          raise OAuthError.new('signature is not valid', nil, 'signature_invalid', nil, @realm)
+        end
       end
     end
   end

data/lib/cerner/oauth1a/access_token_agent.rb

@@ -25,6 +25,8 @@ module Cerner
       attr_reader :consumer_key
       # Returns the String Consumer Secret.
       attr_reader :consumer_secret
+      # Returns the String Protection Realm. The realm is root of the access_token_url (scheme + hostname).
+      attr_reader :realm
 
       # Public: Constructs an instance of the agent.
       #
@@ -72,6 +74,7 @@ module Cerner
         @consumer_secret = consumer_secret
 
         @access_token_url = convert_to_http_uri(access_token_url)
+        @realm = canonical_root_url_for(@access_token_url)
 
         @open_timeout = (open_timeout ? open_timeout.to_i : 5)
         @read_timeout = (read_timeout ? read_timeout.to_i : 5)
@@ -215,6 +218,18 @@ module Cerner
         uri
       end
 
+      # Internal: Returns a String containing the canonical root url.
+      #
+      # url - A URL to get the canonical root url String from.
+      #
+      # raises ArgumentError if url is nil.
+      def canonical_root_url_for(url)
+        raise ArgumentError, 'url is nil' unless url
+
+        realm = URI("#{url.scheme}://#{url.host}:#{url.port}")
+        realm.to_s
+      end
+
       # Internal: Prepare a request for #retrieve
       def retrieve_prepare_request(timestamp, nonce, accessor_secret, principal)
         # construct a POST request
@@ -252,14 +267,15 @@ module Cerner
             nonce: nonce,
             timestamp: timestamp,
             token: tuples[:oauth_token],
-            token_secret: tuples[:oauth_token_secret]
+            token_secret: tuples[:oauth_token_secret],
+            realm: @realm
           )
           access_token
         else
           # Extract any OAuth Problems reported in the response
           oauth_data = Protocol.parse_authorization_header(response['WWW-Authenticate'])
           # Raise an error for a failure to acquire a token
-          raise OAuthError.new('unable to acquire token', response.code, oauth_data[:oauth_problem])
+          raise OAuthError.new('unable to acquire token', response.code, oauth_data[:oauth_problem], nil, @realm)
         end
       end
 
@@ -278,10 +294,10 @@ module Cerner
         when Net::HTTPSuccess
           parsed_response = JSON.parse(response.body)
           aes_key = parsed_response.dig('aesKey', 'secretKey')
-          raise OAuthError, 'AES secret key retrieved was invalid' unless aes_key
+          raise OAuthError.new('AES secret key retrieved was invalid', nil, nil, nil, @realm) unless aes_key
 
           rsa_key = parsed_response.dig('rsaKey', 'publicKey')
-          raise OAuthError, 'RSA public key retrieved was invalid' unless rsa_key
+          raise OAuthError.new('RSA public key retrieved was invalid', nil, nil, nil, @realm) unless rsa_key
 
           Keys.new(
             version: keys_version,
@@ -292,7 +308,7 @@ module Cerner
           # Extract any OAuth Problems reported in the response
           oauth_data = Protocol.parse_authorization_header(response['WWW-Authenticate'])
           # Raise an error for a failure to acquire keys
-          raise OAuthError.new('unable to acquire keys', response.code, oauth_data[:oauth_problem])
+          raise OAuthError.new('unable to acquire keys', response.code, oauth_data[:oauth_problem], nil, @realm)
         end
       end
     end

data/lib/cerner/oauth1a/oauth_error.rb

@@ -18,6 +18,9 @@ module Cerner
       # May be nil.
       attr_reader :oauth_parameters
 
+      # Returns a String with the Protection Realm associated with this error. May be nil.
+      attr_reader :realm
+
       # Public: Construct an instance with a message, optional HTTP response code
       # and optional OAuth Problem string.
       #
@@ -27,30 +30,35 @@ module Cerner
       # oauth_parameters   - A String/Symbol or Array of Strings/Symbols containing the names of parameters that
       #                      are absent or rejected. This is should only be used when oauth_problem
       #                      is 'parameter_absent' or 'parameter_rejected' Optional.
+      # realm              - The protection realm associated with the error. Optional.
       def initialize(
         message,
         http_response_code = nil,
         oauth_problem = nil,
-        oauth_parameters = nil
+        oauth_parameters = nil,
+        realm = nil
       )
         @http_response_code = http_response_code
         @oauth_problem = oauth_problem
         @oauth_parameters = oauth_parameters ? Array(oauth_parameters) : nil
+        @realm = realm
 
         parts = []
         parts << message if message
         parts << "HTTP #{@http_response_code}" if @http_response_code
         parts << "OAuth Problem #{@oauth_problem}" if @oauth_problem
         parts << "OAuth Parameters [#{@oauth_parameters.join(', ')}]" if @oauth_parameters
+        parts << "OAuth Realm #{@realm}" if @realm
         super(parts.empty? ? nil : parts.join(' '))
       end
 
       # Public: Generates an HTTP WWW-Authenticate header value based from the
       # data in this OAuthError.
       #
-      # Returns the generated value or nil if there is no #oauth_problem and #oauth_parameters.
+      # Returns the generated value or nil if there is no #oauth_problem or #realm.
       def to_http_www_authenticate_header
         params = {}
+        params[:realm] = @realm if @realm
         params[:oauth_problem] = @oauth_problem if @oauth_problem
 
         if @oauth_problem && @oauth_parameters

data/lib/cerner/oauth1a/protocol.rb

@@ -69,19 +69,22 @@ module Cerner
       #
       #   params = { realm: 'https://test.host', oauth_problem: 'token_expired' }
       #   Cerner::OAuth1a::Protocol.generate_www_authenticate_header(params)
-      #   # => "OAuth realm=\"https%3A%2F%2Ftest.host\",oauth_problem=\"token_expired\""
+      #   # => "OAuth realm=\"https://test.host\",oauth_problem=\"token_expired\""
       #
       # Returns the String containing the generated value or nil if params is nil or empty.
       def self.generate_authorization_header(params)
         return nil unless params && !params.empty?
 
+        realm = "realm=\"#{params.delete(:realm)}\"" if params[:realm]
+        realm += ', ' if realm && !params.empty?
+
         encoded_params = params.map do |k, v|
           k = URI.encode_www_form_component(k).gsub('+', '%20')
           v = URI.encode_www_form_component(v).gsub('+', '%20')
           "#{k}=\"#{v}\""
         end
 
-        'OAuth ' + encoded_params.join(',')
+        "OAuth #{realm}#{encoded_params.join(',')}"
       end
 
       # Alias the parse and generate methods

data/lib/cerner/oauth1a/version.rb

@@ -2,6 +2,6 @@
 
 module Cerner
   module OAuth1a
-    VERSION = '2.0.1'
+    VERSION = '2.1.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cerner-oauth1a
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.1.0
 platform: ruby
 authors:
 - Nathan Beyer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-31 00:00:00.000000000 Z
+date: 2019-02-01 00:00:00.000000000 Z
 dependencies: []
 description: |
   A minimal dependency library for interacting with a Cerner OAuth 1.0a Access