chat_sdk-gchat 1.2.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3a9d22b76276f761a3436f508397dbef8b15fc177d03f390a1898e4f981bc9c1
-  data.tar.gz: 0f92f166374ea5b14dcc81e3ccd8742de0a3b244cf3e51bb71bc4c8b50ef276b
+  metadata.gz: 78386a734193c0fd0557415787e8071933bb90f23c3a7c9b8a3a5981df5df15e
+  data.tar.gz: 5548dc38e75827c76603a337dc15313da54d45a22b746fd0d6650c5b9f2772a9
 SHA512:
-  metadata.gz: f4aa6693d9ce80cec67766859a5aa95f28bf8db6dad55505cd404602db828231d47f08c57cf19881e9f008c7c8ca888ff73b857f4d779aae7c4135d9cfae7100
-  data.tar.gz: 869d867f863ac6201a63167e0dfa72f2f6e3e6b889a96454ecd54f7a733ca255006ebc3316314e1aa4f4efdbba18c8db1b21204cdc0a8d66d993296792a1e4e1
+  metadata.gz: 97c182dc7e84015d6b9f2cad180b463f4607d3e2b8b6c16fef48488365840f1e4566e58838e8616e29d72964bcb164de648ede6c61df1c8e16af5ea38a7e3dd7
+  data.tar.gz: 86115605552b3ed47f4c5a7f85f64456b35a1a4a0de4a6e6a9529bf3a66bdd6f605ad233535efdc587229954cdca22253cf0563228cf27265ed6073847d586d4

data/lib/chat_sdk/gchat/adapter.rb

@@ -11,16 +11,48 @@ module ChatSDK
 
       attr_reader :client
 
-      def initialize(project_number:, credentials: nil)
-        @project_number = project_number.to_s
+      def initialize(
+        project_number: nil,
+        endpoint_url: nil,
+        pubsub_audience: nil,
+        pubsub_service_account_email: nil,
+        workspace_add_on_service_account_email: nil,
+        disable_signature_verification: ENV["GOOGLE_CHAT_DISABLE_SIGNATURE_VERIFICATION"] == "true",
+        credentials: nil
+      )
+        @project_number = normalize_config_value(project_number || ENV["GOOGLE_CHAT_PROJECT_NUMBER"])
+        @endpoint_url = normalize_config_value(endpoint_url)
+        @pubsub_audience = normalize_config_value(pubsub_audience || ENV["GOOGLE_CHAT_PUBSUB_AUDIENCE"])
+        @pubsub_service_account_email = normalize_config_value(
+          pubsub_service_account_email || ENV["GOOGLE_CHAT_PUBSUB_SERVICE_ACCOUNT_EMAIL"]
+        )
+        @workspace_add_on_service_account_email = normalize_config_value(
+          workspace_add_on_service_account_email || ENV["GOOGLE_CHAT_WORKSPACE_ADDON_SERVICE_ACCOUNT_EMAIL"]
+        )
+        @disable_signature_verification = if disable_signature_verification.nil?
+          ENV["GOOGLE_CHAT_DISABLE_SIGNATURE_VERIFICATION"] == "true"
+        else
+          disable_signature_verification
+        end
 
-        raise ChatSDK::ConfigurationError, "Google Chat project_number required" if @project_number.empty?
+        unless @project_number || @endpoint_url || @pubsub_audience || @disable_signature_verification
+          raise ChatSDK::ConfigurationError,
+            "Google Chat webhook verification requires project_number, endpoint_url, or pubsub_audience; " \
+            "set disable_signature_verification to true to accept unverified requests"
+        end
 
         @credentials = build_credentials(credentials)
         @client = Google::Apps::Chat::V1::ChatService::Client.new do |config|
           config.credentials = @credentials if @credentials
         end
-        @verifier = TokenVerifier.new(@project_number)
+        @verifier = TokenVerifier.new(
+          @project_number,
+          endpoint_url: @endpoint_url,
+          pubsub_audience: @pubsub_audience,
+          pubsub_service_account_email: @pubsub_service_account_email,
+          workspace_add_on_service_account_email: @workspace_add_on_service_account_email,
+          disable_signature_verification: @disable_signature_verification
+        )
         @renderer = CardV2Renderer.new
       end
 
@@ -30,36 +62,28 @@ module ChatSDK
 
       # Inbound
       def verify_request!(rack_request)
-        auth_header = rack_request.env["HTTP_AUTHORIZATION"] || ""
-        token = auth_header.sub(/\ABearer\s+/i, "")
-        @verifier.verify!(token)
-        true
+        @verifier.verify_request!(rack_request)
       end
 
       def parse_events(rack_request)
         payload = read_json_body(rack_request)
+        return parse_pubsub_payload(payload) if PubSubPush.pubsub_push?(payload)
+
         EventParser.parse(payload)
       rescue JSON::ParserError
         []
       end
 
-      # Parses a Google Cloud Pub/Sub push message containing a Google Chat event.
-      #
-      # When a Pub/Sub subscription is configured externally (via Google Cloud
-      # Console or Terraform) for Google Workspace Events, push messages arrive
-      # as HTTP POSTs with the Chat event base64-encoded inside
-      # `message.data`. This method decodes the envelope and delegates to
-      # {EventParser}.
+      # Parses a Pub/Sub push after its request has been verified with #verify_request!.
+      # The standard webhook endpoint verifies and parses Pub/Sub pushes automatically.
       #
       # @param rack_request [Rack::Request] the incoming Pub/Sub push request
       # @return [Array<ChatSDK::Events::Base>] parsed events (empty on bad payload)
       def parse_pubsub_event(rack_request)
         envelope = read_json_body(rack_request)
-        data = envelope.dig("message", "data")
-        return [] unless data
+        return [] unless PubSubPush.pubsub_push?(envelope)
 
-        decoded = JSON.parse(Base64.decode64(data))
-        EventParser.parse(decoded)
+        parse_pubsub_payload(envelope)
       rescue JSON::ParserError, ArgumentError
         []
       end
@@ -182,6 +206,23 @@ module ChatSDK
 
       private
 
+      def parse_pubsub_payload(envelope)
+        data = envelope.dig("message", "data")
+        return [] unless data
+
+        decoded = JSON.parse(Base64.decode64(data))
+        EventParser.parse(decoded)
+      rescue JSON::ParserError, ArgumentError
+        []
+      end
+
+      def normalize_config_value(value)
+        return nil if value.nil?
+
+        normalized = value.to_s
+        normalized.empty? ? nil : normalized
+      end
+
       def build_credentials(credentials)
         case credentials
         when nil

data/lib/chat_sdk/gchat/card_v2_renderer.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module ChatSDK
   module GChat
     class CardV2Renderer
@@ -24,10 +26,16 @@ module ChatSDK
       end
 
       def build_header(node)
-        return nil unless node.attributes[:title]
+        image_url = node.attributes[:image_url]
+        has_image_url = image_url && !image_url.empty?
+        return nil unless node.attributes[:title] || has_image_url
 
-        header = {title: node.attributes[:title]}
+        header = {title: node.attributes[:title] || ""}
         header[:subtitle] = node.attributes[:subtitle] if node.attributes[:subtitle]
+        if has_image_url
+          header[:imageUrl] = image_url
+          header[:imageType] = "SQUARE"
+        end
         header
       end
 
@@ -60,11 +68,13 @@ module ChatSDK
       def render_widget(node)
         case node.type
         when :text then render_text(node)
+        when :link then render_link(node)
         when :fields then render_fields(node)
         when :image then render_image(node)
         when :actions then render_actions(node)
         when :divider then {divider: {}}
         when :select then render_select(node)
+        when :radio_select then render_radio_select(node)
         end
       end
 
@@ -78,7 +88,15 @@ module ChatSDK
       end
 
       def render_text(node)
-        {textParagraph: {text: node.attributes[:content]}}
+        text = node.attributes[:content]
+        text = "*#{text}*" if node.attributes[:style] == :bold
+        {textParagraph: {text: text}}
+      end
+
+      def render_link(node)
+        url = CGI.escapeHTML(node.attributes[:url].to_s)
+        label = CGI.escapeHTML(node.attributes[:label].to_s)
+        {textParagraph: {text: %(<a href="#{url}">#{label}</a>)}}
       end
 
       def render_fields(node)
@@ -106,10 +124,15 @@ module ChatSDK
         widgets = []
         buttons = []
         node.children.each do |child|
-          if child.type == :select
+          if %i[select radio_select].include?(child.type)
             widgets << render_button_list(buttons) unless buttons.empty?
             buttons = []
-            widgets << render_select(child)
+            widget = if child.type == :radio_select
+              render_radio_select(child)
+            else
+              render_select(child)
+            end
+            widgets << widget
           else
             btn = render_action_element(child)
             buttons << btn if btn
@@ -152,36 +175,56 @@ module ChatSDK
         elsif node.attributes[:style] == :danger
           btn[:color] = {red: 0.87, green: 0.17, blue: 0.17, alpha: 1.0}
         end
+        btn[:disabled] = true if node.attributes[:disabled]
 
         btn
       end
 
       def render_link_button(node)
-        {
+        button = {
           text: node.attributes[:text],
           onClick: {
             openLink: {url: node.attributes[:url]}
           }
         }
+        if node.attributes[:style] == :primary
+          button[:color] = {red: 0.0, green: 0.53, blue: 0.87, alpha: 1.0}
+        elsif node.attributes[:style] == :danger
+          button[:color] = {red: 0.87, green: 0.17, blue: 0.17, alpha: 1.0}
+        end
+        button
       end
 
       def render_select(node)
+        render_selection_input(node, type: "DROPDOWN")
+      end
+
+      def render_radio_select(node)
+        render_selection_input(node, type: "RADIO_BUTTON")
+      end
+
+      def render_selection_input(node, type:)
         {
           selectionInput: {
             name: node.attributes[:id],
-            label: node.attributes[:placeholder] || "Select",
-            type: "DROPDOWN",
-            items: node.children.map { |opt| render_select_option(opt) }
+            label: node.attributes[:label] || node.attributes[:placeholder] || "Select",
+            type: type,
+            items: node.children.map { |option| render_select_option(option, node.attributes[:initial_option]) }
           }
         }
       end
 
-      def render_select_option(node)
-        {
+      def render_select_option(node, initial_option)
+        option = {
           text: node.attributes[:text],
-          value: node.attributes[:value],
-          selected: false
+          value: node.attributes[:value]
         }
+        if initial_option.nil?
+          option[:selected] = false
+        elsif node.attributes[:value] == initial_option
+          option[:selected] = true
+        end
+        option
       end
     end
   end

data/lib/chat_sdk/gchat/pub_sub_push.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module ChatSDK
+  module GChat
+    module PubSubPush
+      def self.pubsub_push?(payload)
+        return false unless payload.is_a?(Hash)
+
+        message = payload["message"]
+        message.is_a?(Hash) && message.key?("data") && payload.key?("subscription")
+      end
+    end
+  end
+end

data/lib/chat_sdk/gchat/token_verifier.rb

@@ -1,31 +1,171 @@
 # frozen_string_literal: true
 
+require "json"
+require "openssl"
+require "socket"
+require "timeout"
+
 module ChatSDK
   module GChat
     class TokenVerifier
       EXPECTED_ISSUER = "chat@system.gserviceaccount.com"
+      CHAT_ISSUER_CERTS_URL = "https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com"
+      WORKSPACE_ADD_ON_EMAIL_PATTERN = /\Aservice-\d+@gcp-sa-gsuiteaddons\.iam\.gserviceaccount\.com\z/
 
-      def initialize(project_number)
-        @project_number = project_number.to_s
+      def initialize(
+        project_number = nil,
+        endpoint_url: nil,
+        pubsub_audience: nil,
+        pubsub_service_account_email: nil,
+        workspace_add_on_service_account_email: nil,
+        disable_signature_verification: false
+      )
+        @project_number = project_number.to_s unless project_number.nil?
+        @endpoint_url = endpoint_url
+        @pubsub_audience = pubsub_audience
+        @pubsub_service_account_email = pubsub_service_account_email
+        @workspace_add_on_service_account_email = workspace_add_on_service_account_email
+        @disable_signature_verification = disable_signature_verification
+        @warned_unverified_direct = false
+        @warned_unverified_pubsub = false
       end
 
       def verify!(token)
+        verify_direct!(token)
+      end
+
+      def verify_request!(rack_request)
+        rack_request.body.rewind
+        body = rack_request.body.read
+        rack_request.body.rewind
+
+        payload = parse_request_body(body)
+        if PubSubPush.pubsub_push?(payload)
+          verify_pubsub!(bearer_token(rack_request))
+        else
+          verify_direct!(bearer_token(rack_request))
+        end
+        true
+      ensure
+        rack_request.body.rewind
+      end
+
+      private
+
+      def verify_direct!(token)
+        unless @endpoint_url || @project_number
+          return allow_unverified!(:direct) if @disable_signature_verification
+
+          raise ChatSDK::SignatureVerificationError, "Direct Google Chat webhook verification is not configured"
+        end
+
         raise ChatSDK::SignatureVerificationError, "Missing bearer token" if token.nil? || token.empty?
 
-        payload = Google::Auth::IDTokens.verify_oidc(
-          token,
-          aud: @project_number
-        )
+        failures = []
+        if @endpoint_url
+          begin
+            payload = Google::Auth::IDTokens.verify_oidc(token, aud: @endpoint_url)
+            return payload if endpoint_payload_trusted?(payload)
+
+            failures << "Untrusted endpoint URL token identity"
+          rescue Google::Auth::IDTokens::VerificationError,
+            Google::Auth::IDTokens::KeySourceError,
+            SocketError,
+            Timeout::Error,
+            IOError,
+            SystemCallError,
+            OpenSSL::OpenSSLError => e
+            failures << e.message
+          end
+        end
+
+        if @project_number
+          begin
+            return project_number_verifier.verify(token)
+          rescue Google::Auth::IDTokens::VerificationError,
+            Google::Auth::IDTokens::KeySourceError,
+            SocketError,
+            Timeout::Error,
+            IOError,
+            SystemCallError,
+            OpenSSL::OpenSSLError => e
+            failures << e.message
+          end
+        end
+
+        message = failures.last ? ": #{failures.last}" : ""
+        raise ChatSDK::SignatureVerificationError, "Google Chat webhook token verification failed#{message}"
+      end
 
-        issuer = payload["iss"] || payload["email"]
-        unless issuer == EXPECTED_ISSUER
-          raise ChatSDK::SignatureVerificationError,
-            "Unexpected issuer: #{issuer} (expected #{EXPECTED_ISSUER})"
+      def verify_pubsub!(token)
+        unless @pubsub_audience
+          return allow_unverified!(:pubsub) if @disable_signature_verification
+
+          raise ChatSDK::SignatureVerificationError, "Google Chat Pub/Sub verification is not configured"
+        end
+
+        raise ChatSDK::SignatureVerificationError, "Missing bearer token" if token.nil? || token.empty?
+
+        payload = Google::Auth::IDTokens.verify_oidc(token, aud: @pubsub_audience)
+        unless pubsub_payload_trusted?(payload)
+          raise ChatSDK::SignatureVerificationError, "Untrusted Google Chat Pub/Sub service account"
         end
 
         payload
-      rescue Google::Auth::IDTokens::VerificationError => e
-        raise ChatSDK::SignatureVerificationError, "Google ID token verification failed: #{e.message}"
+      rescue Google::Auth::IDTokens::VerificationError,
+        Google::Auth::IDTokens::KeySourceError,
+        SocketError,
+        Timeout::Error,
+        IOError,
+        SystemCallError,
+        OpenSSL::OpenSSLError => e
+        raise ChatSDK::SignatureVerificationError, "Google Pub/Sub ID token verification failed: #{e.message}"
+      end
+
+      def endpoint_payload_trusted?(payload)
+        return false unless payload["email_verified"] == true
+
+        email = payload["email"]
+        return true if email == EXPECTED_ISSUER
+
+        email.is_a?(String) &&
+          WORKSPACE_ADD_ON_EMAIL_PATTERN.match?(email) &&
+          email == @workspace_add_on_service_account_email
+      end
+
+      def pubsub_payload_trusted?(payload)
+        payload["email_verified"] == true &&
+          @pubsub_service_account_email &&
+          payload["email"] == @pubsub_service_account_email
+      end
+
+      def project_number_verifier
+        @project_number_verifier ||= Google::Auth::IDTokens::Verifier.new(
+          key_source: Google::Auth::IDTokens::X509CertHttpKeySource.new(CHAT_ISSUER_CERTS_URL),
+          aud: @project_number,
+          iss: EXPECTED_ISSUER
+        )
+      end
+
+      def allow_unverified!(transport)
+        warning_ivar = :"@warned_unverified_#{transport}"
+        return true if instance_variable_get(warning_ivar)
+
+        ChatSDK::Log.warn("Google Chat #{transport} signature verification is disabled.")
+        instance_variable_set(warning_ivar, true)
+        true
+      end
+
+      def parse_request_body(body)
+        JSON.parse(body)
+      rescue JSON::ParserError
+        nil
+      end
+
+      def bearer_token(rack_request)
+        authorization = rack_request.env["HTTP_AUTHORIZATION"].to_s
+        match = /\ABearer\s+(.+)\z/i.match(authorization)
+        match && match[1]
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chat_sdk-gchat
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Quentin Rousseau
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: google-apps-chat-v1
   requirement: !ruby/object:Gem::Requirement
@@ -63,6 +63,7 @@ files:
 - lib/chat_sdk/gchat/card_v2_renderer.rb
 - lib/chat_sdk/gchat/event_parser.rb
 - lib/chat_sdk/gchat/format_converter.rb
+- lib/chat_sdk/gchat/pub_sub_push.rb
 - lib/chat_sdk/gchat/resource_name.rb
 - lib/chat_sdk/gchat/token_verifier.rb
 homepage: https://github.com/rootlyhq/chat-sdk