chat_sdk-gchat 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '08f7bf3bc0128b23b9e9bb9d68431f7ce573179c6e40e6f61d942cf1c4770dea'
-  data.tar.gz: e13b88766dfe5be010298320aa8406d818068dfd7709298e3c2da958a6c2993a
+  metadata.gz: 78386a734193c0fd0557415787e8071933bb90f23c3a7c9b8a3a5981df5df15e
+  data.tar.gz: 5548dc38e75827c76603a337dc15313da54d45a22b746fd0d6650c5b9f2772a9
 SHA512:
-  metadata.gz: 9498945602865b18d40f6389afe9673a46460b0fc25fe56318d7b621901d2aa586fa189eb2159adde02358eb95c6ed67e04c1e713450bf981d71c7a2e56268ba
-  data.tar.gz: 87693f0e0e19e74e753ee79df79f20708a35e63182df5bd370cd970556e811e93ce273a10a61243f65fd843b4dcb0b73f8000077809487e7eec4d25e6e7b58fe
+  metadata.gz: 97c182dc7e84015d6b9f2cad180b463f4607d3e2b8b6c16fef48488365840f1e4566e58838e8616e29d72964bcb164de648ede6c61df1c8e16af5ea38a7e3dd7
+  data.tar.gz: 86115605552b3ed47f4c5a7f85f64456b35a1a4a0de4a6e6a9529bf3a66bdd6f605ad233535efdc587229954cdca22253cf0563228cf27265ed6073847d586d4

data/lib/chat_sdk/gchat/adapter.rb

@@ -11,16 +11,48 @@ module ChatSDK
 
       attr_reader :client
 
-      def initialize(project_number:, credentials: nil)
-        @project_number = project_number.to_s
+      def initialize(
+        project_number: nil,
+        endpoint_url: nil,
+        pubsub_audience: nil,
+        pubsub_service_account_email: nil,
+        workspace_add_on_service_account_email: nil,
+        disable_signature_verification: ENV["GOOGLE_CHAT_DISABLE_SIGNATURE_VERIFICATION"] == "true",
+        credentials: nil
+      )
+        @project_number = normalize_config_value(project_number || ENV["GOOGLE_CHAT_PROJECT_NUMBER"])
+        @endpoint_url = normalize_config_value(endpoint_url)
+        @pubsub_audience = normalize_config_value(pubsub_audience || ENV["GOOGLE_CHAT_PUBSUB_AUDIENCE"])
+        @pubsub_service_account_email = normalize_config_value(
+          pubsub_service_account_email || ENV["GOOGLE_CHAT_PUBSUB_SERVICE_ACCOUNT_EMAIL"]
+        )
+        @workspace_add_on_service_account_email = normalize_config_value(
+          workspace_add_on_service_account_email || ENV["GOOGLE_CHAT_WORKSPACE_ADDON_SERVICE_ACCOUNT_EMAIL"]
+        )
+        @disable_signature_verification = if disable_signature_verification.nil?
+          ENV["GOOGLE_CHAT_DISABLE_SIGNATURE_VERIFICATION"] == "true"
+        else
+          disable_signature_verification
+        end
 
-        raise ChatSDK::ConfigurationError, "Google Chat project_number required" if @project_number.empty?
+        unless @project_number || @endpoint_url || @pubsub_audience || @disable_signature_verification
+          raise ChatSDK::ConfigurationError,
+            "Google Chat webhook verification requires project_number, endpoint_url, or pubsub_audience; " \
+            "set disable_signature_verification to true to accept unverified requests"
+        end
 
         @credentials = build_credentials(credentials)
         @client = Google::Apps::Chat::V1::ChatService::Client.new do |config|
           config.credentials = @credentials if @credentials
         end
-        @verifier = TokenVerifier.new(@project_number)
+        @verifier = TokenVerifier.new(
+          @project_number,
+          endpoint_url: @endpoint_url,
+          pubsub_audience: @pubsub_audience,
+          pubsub_service_account_email: @pubsub_service_account_email,
+          workspace_add_on_service_account_email: @workspace_add_on_service_account_email,
+          disable_signature_verification: @disable_signature_verification
+        )
         @renderer = CardV2Renderer.new
       end
 
@@ -30,36 +62,28 @@ module ChatSDK
 
       # Inbound
       def verify_request!(rack_request)
-        auth_header = rack_request.env["HTTP_AUTHORIZATION"] || ""
-        token = auth_header.sub(/\ABearer\s+/i, "")
-        @verifier.verify!(token)
-        true
+        @verifier.verify_request!(rack_request)
       end
 
       def parse_events(rack_request)
         payload = read_json_body(rack_request)
+        return parse_pubsub_payload(payload) if PubSubPush.pubsub_push?(payload)
+
         EventParser.parse(payload)
       rescue JSON::ParserError
         []
       end
 
-      # Parses a Google Cloud Pub/Sub push message containing a Google Chat event.
-      #
-      # When a Pub/Sub subscription is configured externally (via Google Cloud
-      # Console or Terraform) for Google Workspace Events, push messages arrive
-      # as HTTP POSTs with the Chat event base64-encoded inside
-      # `message.data`. This method decodes the envelope and delegates to
-      # {EventParser}.
+      # Parses a Pub/Sub push after its request has been verified with #verify_request!.
+      # The standard webhook endpoint verifies and parses Pub/Sub pushes automatically.
       #
       # @param rack_request [Rack::Request] the incoming Pub/Sub push request
       # @return [Array<ChatSDK::Events::Base>] parsed events (empty on bad payload)
       def parse_pubsub_event(rack_request)
         envelope = read_json_body(rack_request)
-        data = envelope.dig("message", "data")
-        return [] unless data
+        return [] unless PubSubPush.pubsub_push?(envelope)
 
-        decoded = JSON.parse(Base64.decode64(data))
-        EventParser.parse(decoded)
+        parse_pubsub_payload(envelope)
       rescue JSON::ParserError, ArgumentError
         []
       end
@@ -182,6 +206,23 @@ module ChatSDK
 
       private
 
+      def parse_pubsub_payload(envelope)
+        data = envelope.dig("message", "data")
+        return [] unless data
+
+        decoded = JSON.parse(Base64.decode64(data))
+        EventParser.parse(decoded)
+      rescue JSON::ParserError, ArgumentError
+        []
+      end
+
+      def normalize_config_value(value)
+        return nil if value.nil?
+
+        normalized = value.to_s
+        normalized.empty? ? nil : normalized
+      end
+
       def build_credentials(credentials)
         case credentials
         when nil

data/lib/chat_sdk/gchat/pub_sub_push.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+module ChatSDK
+  module GChat
+    module PubSubPush
+      def self.pubsub_push?(payload)
+        return false unless payload.is_a?(Hash)
+
+        message = payload["message"]
+        message.is_a?(Hash) && message.key?("data") && payload.key?("subscription")
+      end
+    end
+  end
+end

data/lib/chat_sdk/gchat/token_verifier.rb

@@ -1,31 +1,171 @@
 # frozen_string_literal: true
 
+require "json"
+require "openssl"
+require "socket"
+require "timeout"
+
 module ChatSDK
   module GChat
     class TokenVerifier
       EXPECTED_ISSUER = "chat@system.gserviceaccount.com"
+      CHAT_ISSUER_CERTS_URL = "https://www.googleapis.com/service_accounts/v1/metadata/x509/chat@system.gserviceaccount.com"
+      WORKSPACE_ADD_ON_EMAIL_PATTERN = /\Aservice-\d+@gcp-sa-gsuiteaddons\.iam\.gserviceaccount\.com\z/
 
-      def initialize(project_number)
-        @project_number = project_number.to_s
+      def initialize(
+        project_number = nil,
+        endpoint_url: nil,
+        pubsub_audience: nil,
+        pubsub_service_account_email: nil,
+        workspace_add_on_service_account_email: nil,
+        disable_signature_verification: false
+      )
+        @project_number = project_number.to_s unless project_number.nil?
+        @endpoint_url = endpoint_url
+        @pubsub_audience = pubsub_audience
+        @pubsub_service_account_email = pubsub_service_account_email
+        @workspace_add_on_service_account_email = workspace_add_on_service_account_email
+        @disable_signature_verification = disable_signature_verification
+        @warned_unverified_direct = false
+        @warned_unverified_pubsub = false
       end
 
       def verify!(token)
+        verify_direct!(token)
+      end
+
+      def verify_request!(rack_request)
+        rack_request.body.rewind
+        body = rack_request.body.read
+        rack_request.body.rewind
+
+        payload = parse_request_body(body)
+        if PubSubPush.pubsub_push?(payload)
+          verify_pubsub!(bearer_token(rack_request))
+        else
+          verify_direct!(bearer_token(rack_request))
+        end
+        true
+      ensure
+        rack_request.body.rewind
+      end
+
+      private
+
+      def verify_direct!(token)
+        unless @endpoint_url || @project_number
+          return allow_unverified!(:direct) if @disable_signature_verification
+
+          raise ChatSDK::SignatureVerificationError, "Direct Google Chat webhook verification is not configured"
+        end
+
         raise ChatSDK::SignatureVerificationError, "Missing bearer token" if token.nil? || token.empty?
 
-        payload = Google::Auth::IDTokens.verify_oidc(
-          token,
-          aud: @project_number
-        )
+        failures = []
+        if @endpoint_url
+          begin
+            payload = Google::Auth::IDTokens.verify_oidc(token, aud: @endpoint_url)
+            return payload if endpoint_payload_trusted?(payload)
+
+            failures << "Untrusted endpoint URL token identity"
+          rescue Google::Auth::IDTokens::VerificationError,
+            Google::Auth::IDTokens::KeySourceError,
+            SocketError,
+            Timeout::Error,
+            IOError,
+            SystemCallError,
+            OpenSSL::OpenSSLError => e
+            failures << e.message
+          end
+        end
+
+        if @project_number
+          begin
+            return project_number_verifier.verify(token)
+          rescue Google::Auth::IDTokens::VerificationError,
+            Google::Auth::IDTokens::KeySourceError,
+            SocketError,
+            Timeout::Error,
+            IOError,
+            SystemCallError,
+            OpenSSL::OpenSSLError => e
+            failures << e.message
+          end
+        end
+
+        message = failures.last ? ": #{failures.last}" : ""
+        raise ChatSDK::SignatureVerificationError, "Google Chat webhook token verification failed#{message}"
+      end
 
-        issuer = payload["iss"] || payload["email"]
-        unless issuer == EXPECTED_ISSUER
-          raise ChatSDK::SignatureVerificationError,
-            "Unexpected issuer: #{issuer} (expected #{EXPECTED_ISSUER})"
+      def verify_pubsub!(token)
+        unless @pubsub_audience
+          return allow_unverified!(:pubsub) if @disable_signature_verification
+
+          raise ChatSDK::SignatureVerificationError, "Google Chat Pub/Sub verification is not configured"
+        end
+
+        raise ChatSDK::SignatureVerificationError, "Missing bearer token" if token.nil? || token.empty?
+
+        payload = Google::Auth::IDTokens.verify_oidc(token, aud: @pubsub_audience)
+        unless pubsub_payload_trusted?(payload)
+          raise ChatSDK::SignatureVerificationError, "Untrusted Google Chat Pub/Sub service account"
         end
 
         payload
-      rescue Google::Auth::IDTokens::VerificationError => e
-        raise ChatSDK::SignatureVerificationError, "Google ID token verification failed: #{e.message}"
+      rescue Google::Auth::IDTokens::VerificationError,
+        Google::Auth::IDTokens::KeySourceError,
+        SocketError,
+        Timeout::Error,
+        IOError,
+        SystemCallError,
+        OpenSSL::OpenSSLError => e
+        raise ChatSDK::SignatureVerificationError, "Google Pub/Sub ID token verification failed: #{e.message}"
+      end
+
+      def endpoint_payload_trusted?(payload)
+        return false unless payload["email_verified"] == true
+
+        email = payload["email"]
+        return true if email == EXPECTED_ISSUER
+
+        email.is_a?(String) &&
+          WORKSPACE_ADD_ON_EMAIL_PATTERN.match?(email) &&
+          email == @workspace_add_on_service_account_email
+      end
+
+      def pubsub_payload_trusted?(payload)
+        payload["email_verified"] == true &&
+          @pubsub_service_account_email &&
+          payload["email"] == @pubsub_service_account_email
+      end
+
+      def project_number_verifier
+        @project_number_verifier ||= Google::Auth::IDTokens::Verifier.new(
+          key_source: Google::Auth::IDTokens::X509CertHttpKeySource.new(CHAT_ISSUER_CERTS_URL),
+          aud: @project_number,
+          iss: EXPECTED_ISSUER
+        )
+      end
+
+      def allow_unverified!(transport)
+        warning_ivar = :"@warned_unverified_#{transport}"
+        return true if instance_variable_get(warning_ivar)
+
+        ChatSDK::Log.warn("Google Chat #{transport} signature verification is disabled.")
+        instance_variable_set(warning_ivar, true)
+        true
+      end
+
+      def parse_request_body(body)
+        JSON.parse(body)
+      rescue JSON::ParserError
+        nil
+      end
+
+      def bearer_token(rack_request)
+        authorization = rack_request.env["HTTP_AUTHORIZATION"].to_s
+        match = /\ABearer\s+(.+)\z/i.match(authorization)
+        match && match[1]
       end
     end
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: chat_sdk-gchat
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Quentin Rousseau
@@ -63,6 +63,7 @@ files:
 - lib/chat_sdk/gchat/card_v2_renderer.rb
 - lib/chat_sdk/gchat/event_parser.rb
 - lib/chat_sdk/gchat/format_converter.rb
+- lib/chat_sdk/gchat/pub_sub_push.rb
 - lib/chat_sdk/gchat/resource_name.rb
 - lib/chat_sdk/gchat/token_verifier.rb
 homepage: https://github.com/rootlyhq/chat-sdk