cybersource_rest_client 0.0.83 → 0.0.85

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7b2145187caddc5e65d832429b125682e89bd7cb5524cce56ac174480dd8fb8
-  data.tar.gz: '05439a8ea021577faf619bc4ceff17236524baf1cfaa3738f8712ae278c1f671'
+  metadata.gz: 34454664d9ec155d9dd0094a993b16a4fa5fa3d15348271dad33d48ec0ca8dea
+  data.tar.gz: '09efd41467183272900951d0182defdb85e63ff12d0328ca340ceb94fd5b5752'
 SHA512:
-  metadata.gz: 82bf63f6b1166f9822849d41bbad0999a78318d158bd891af281e7cee28b6f421b45cc56c6bb309feaf660ecdd1551801976f5091f7bc5419c82f7fdd8e70e27
-  data.tar.gz: a2b31e89fea58024cf133481dc8ee379a7ab7f94d810150b77738456f62763125da4a0d0c7342cb7adc4cb05aa365c39ff8afe254ba65e089c7ce6f7146a96ad
+  metadata.gz: 3eb75e9385dd046a83fd2fd9539e18f6e8e3510d544759608058efa5d36ac61d71ade3c8123ceef8ddee1e690dacd84d604135ede80a639c61f276827b6e76de
+  data.tar.gz: 770a3cf7980a42709df7fa1122fe22d8576ccd25363b25d48b10fc4046baef465608e726c27ae00be313c36113edb6f0de05a04754eb01194952dbc9ba996afb

data/lib/AuthenticationSDK/authentication/jwt/JwtToken.rb

@@ -22,19 +22,41 @@ public
       @log_obj = Log.new merchantconfig_obj.log_config, "JwtToken"
 
       begin
-        # Get payload claim set for JWTv2
+        # Get payload claim set for JWTv2 (identical for both key types)
         payload_claim_set = getPayloadClaimSet(merchantconfig_obj, isResponseMLEForApi)
-        
-        # Get cached certificate and private key
-        cache_value = Cache.new.fetchCachedP12Certificate(merchantconfig_obj)
-        private_key = cache_value.private_key
-        jwt_cert_obj = cache_value.cert
-
-        # Get header claim set for JWTv2
-        header_claim_set = getHeaderClaimSet(jwt_cert_obj)
-        
-        # Generate JWT token using RS256 algorithm
-        token = JWT.encode(payload_claim_set, private_key, 'RS256', header_claim_set)
+        token = ''
+        if merchantconfig_obj.is_shared_secret_key_type?
+          # Shared Secret (HMAC-SHA256) signing
+          @log_obj.logger.debug('Generating JWT token using shared secret (HS256)')
+
+          secret_key = merchantconfig_obj.merchantSecretKey
+          begin
+            secret_key_decoded = Base64.strict_decode64(secret_key)
+            rescue ArgumentError => e
+            raise StandardError.new("Invalid base64-encoded secret key: #{e.message}")
+          end
+
+          # Get header claim set with merchantKeyId as kid
+          header_claim_set = getHeaderClaimSet(merchant_key_id: merchantconfig_obj.merchantKeyId)
+
+          # Generate JWT token using HS256 algorithm
+          token = JWT.encode(payload_claim_set, secret_key_decoded, 'HS256', header_claim_set)
+        else
+          # P12 Certificate (RSA-SHA256) signing — existing behavior
+          @log_obj.logger.debug('Generating JWT token using P12 certificate (RS256)')
+
+          # Get cached certificate and private key
+          cache_value = Cache.new.fetchCachedP12Certificate(merchantconfig_obj)
+          private_key = cache_value.private_key
+          jwt_cert_obj = cache_value.cert
+
+          # Get header claim set with certificate serial number as kid
+          header_claim_set = getHeaderClaimSet(certificate: jwt_cert_obj)
+
+          # Generate JWT token using RS256 algorithm
+          token = JWT.encode(payload_claim_set, private_key, 'RS256', header_claim_set)
+        end
+
         return token
       rescue StandardError => err
         if err.message.include? 'PKCS12_parse: mac verify failure'
@@ -68,7 +90,7 @@ public
       # Set the request method, host and resource path in the JWT body as per the specification for all request types
       jwt_payload['request-method'] = request_type
       jwt_payload['request-host'] = merchantconfig_obj.requestHost
-      jwt_payload['request-resource-path'] = extractResourcePath(merchantconfig_obj.requestTarget)
+      jwt_payload['request-resource-path'] = merchantconfig_obj.requestTarget
 
       # Choose issuer claim in the JWT body as per the use_metakey flag in the config file
       if merchantconfig_obj.useMetaKey
@@ -90,26 +112,23 @@ public
       return jwt_payload
     end
 
-    def getHeaderClaimSet(jwt_cert_obj)
-      # Extract serial number from certificate for kid header
-      serial_number = MLEUtility.extract_serial_number_from_certificate(jwt_cert_obj)
-      
+    def getHeaderClaimSet(merchant_key_id: nil, certificate: nil)
+      kid_value = ''
+      if !certificate.nil?
+        kid_value = MLEUtility.extract_serial_number_from_certificate(certificate)
+      elsif !merchant_key_id.nil? && !merchant_key_id.to_s.empty?
+        kid_value = merchant_key_id
+      else
+        raise StandardError.new("Either certificate or merchant_key_id must be provided for JWT header")
+      end
+
       jwt_headers = {
-        'kid' => serial_number,
+        'kid' => kid_value,
         'typ' => 'JWT'
       }
 
-      # Add any other future parameters to the header claim set here
       return jwt_headers
     end
 
-    def extractResourcePath(request_target)
-      return '' if request_target.nil? || request_target.empty?
-      
-      # Split the string to remove the query params
-      parts = request_target.split('?', 2)
-      return parts[0]
-    end
-
     implements TokenInterface
   end

data/lib/AuthenticationSDK/core/MerchantConfig.rb

@@ -28,9 +28,11 @@ public
       @keyAlias = cybsPropertyObj['keyAlias']
       @keyPass = cybsPropertyObj['keyPass']
       @keyFilename = cybsPropertyObj['keyFilename']
+      @jwtKeyType = cybsPropertyObj['jwtKeyType'] ? cybsPropertyObj['jwtKeyType'].to_s.upcase : Constants::JWT_KEY_TYPE_P12
       @useMetaKey = cybsPropertyObj['useMetaKey']
       @portfolioID = cybsPropertyObj['portfolioID']
       @solutionId = cybsPropertyObj['solutionId']
+      @isSDK = cybsPropertyObj['isSDK'] == true || cybsPropertyObj['isSDK'].to_s.strip.casecmp?('true')
       @p12KeyFilePath = nil
       # MutualAuth & OAuth Parameters
       @enableClientCert = cybsPropertyObj['enableClientCert']
@@ -229,40 +231,52 @@ public
         elsif !@merchantId.instance_of? String
           @merchantId=@merchantId.to_s
         end
-        if @keyAlias.to_s.empty?
-          @keyAlias = @merchantId
-          @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_ALIAS_NULL_EMPTY)
-        elsif !@keyAlias.instance_of? String
-          @keyAlias=@keyAlias.to_s
-        end
-        if !@useMetaKey && @keyAlias != @merchantId
-          @keyAlias = @merchantId
-          @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::INCORRECT_KEY_ALIAS)
-        end
-        if @useMetaKey && @keyAlias != @portfolioID
-          @keyAlias = @portfolioID
-          @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::INCORRECT_KEY_ALIAS_USE_METAKEY)
-        end
-        if @keyPass.to_s.empty?
-          @keyPass = @merchantId
-          @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_PASS_NULL)
-        elsif !@keyPass.instance_of? String
-          @keyPass=@keyPass.to_s
-        end
-        if @keysDirectory.to_s.empty?
-          @keysDirectory = Constants::DEFAULT_KEY_DIRECTORY
-          @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_DIRECTORY_EMPTY + @keysDirectory)
-        elsif !@keysDirectory.instance_of? String
-          @keysDirectory=@keysDirectory.to_s
-        end
-        if @keyFilename.to_s.empty?
-          @keyFilename = @merchantId
-          @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_FILE_NAME_NULL_EMPTY)
-        elsif !@keyFilename.instance_of? String
-          @keyFilename=@keyFilename.to_s
-        end
-        if !check_key_file
-          @log_obj.logger.error(ExceptionHandler.new.new_custom_error "Error finding or accessing the Key Directory or Key File. Please review the values in the merchant configuration.")
+
+        # Validate jwtKeyType
+        check_jwt_key_type
+
+        if is_shared_secret_key_type?
+          # Shared Secret validation — same credentials as HTTP_SIGNATURE
+          validateSharedSecretKeyCredentials()
+        else
+          # P12 validation (existing behavior)
+          if @keyAlias.to_s.empty?
+            @keyAlias = @merchantId
+            @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_ALIAS_NULL_EMPTY)
+          elsif !@keyAlias.instance_of? String
+            @keyAlias=@keyAlias.to_s
+          end
+          if !@useMetaKey && @keyAlias != @merchantId
+            @keyAlias = @merchantId
+            @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::INCORRECT_KEY_ALIAS)
+          end
+          if @useMetaKey && @keyAlias != @portfolioID
+            @keyAlias = @portfolioID
+            @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::INCORRECT_KEY_ALIAS_USE_METAKEY)
+          end
+          if @keyPass.to_s.empty?
+            @keyPass = @merchantId
+            @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_PASS_NULL)
+          elsif !@keyPass.instance_of? String
+            @keyPass=@keyPass.to_s
+          end
+          if @keysDirectory.to_s.empty?
+            @keysDirectory = Constants::DEFAULT_KEY_DIRECTORY
+            @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_DIRECTORY_EMPTY + @keysDirectory)
+          elsif !@keysDirectory.instance_of? String
+            @keysDirectory=@keysDirectory.to_s
+          end
+          if @keyFilename.to_s.empty?
+            @keyFilename = @merchantId
+            @log_obj.logger.warn(ExceptionHandler.new.new_api_warning Constants::WARNING_PREFIX + Constants::KEY_FILE_NAME_NULL_EMPTY)
+          elsif !@keyFilename.instance_of? String
+            @keyFilename=@keyFilename.to_s
+          end
+          if !check_key_file
+            err = StandardError.new(Constants::ERROR_PREFIX + "Cannot find or access the Key Directory or Key File. Please review the values in the merchant configuration.")
+            @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
+            raise err
+          end
         end
       end
       if @authenticationType.upcase == Constants::AUTH_TYPE_MUTUAL_AUTH
@@ -305,20 +319,7 @@ public
         elsif !@merchantId.instance_of? String
           @merchantId=@merchantId.to_s
         end
-        if @merchantKeyId.to_s.empty?
-          err = StandardError.new(Constants::ERROR_PREFIX+ Constants::MERCHANT_KEY_ID_MANDATORY)
-          @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
-          raise err
-        elsif !@merchantKeyId.instance_of? String
-          @merchantKeyId=@merchantKeyId.to_s
-        end
-        if @merchantSecretKey.to_s.empty?
-          err = StandardError.new(Constants::ERROR_PREFIX+ Constants::MERCHANT_SECRET_KEY_MANDATORY)
-          @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
-          raise err
-        elsif !@merchantSecretKey.instance_of? String
-          @merchantSecretKey=@merchantSecretKey.to_s
-        end
+        validateSharedSecretKeyCredentials()
       end
       if @useMetaKey && @portfolioID.to_s.empty?
         err = StandardError.new(Constants::ERROR_PREFIX+ Constants::PORTFOLIO_ID_MANDATORY)
@@ -337,6 +338,23 @@ public
       end
     end
 
+    def validateSharedSecretKeyCredentials()
+      if @merchantKeyId.to_s.empty?
+        err = StandardError.new(Constants::ERROR_PREFIX+ Constants::MERCHANT_KEY_ID_MANDATORY)
+        @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
+        raise err
+      elsif !@merchantKeyId.instance_of? String
+        @merchantKeyId=@merchantKeyId.to_s
+      end
+      if @merchantSecretKey.to_s.empty?
+        err = StandardError.new(Constants::ERROR_PREFIX+ Constants::MERCHANT_SECRET_KEY_MANDATORY)
+        @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
+        raise err
+      elsif !@merchantSecretKey.instance_of? String
+        @merchantSecretKey=@merchantSecretKey.to_s
+      end
+    end
+
     def validateMLEConfiguration(cybsPropertyObj)
       if !@useMLEGlobally.nil? && !cybsPropertyObj['enableRequestMLEForOptionalApisGlobally'].nil?
         if @useMLEGlobally != cybsPropertyObj['enableRequestMLEForOptionalApisGlobally']
@@ -572,22 +590,37 @@ public
 
     def logAllProperties(merchantPropertyObj)
       propertyObj = Marshal.load(Marshal.dump(merchantPropertyObj))
-      merchantConfig = ''
-      hiddenProperties = (Constants::HIDDEN_MERCHANT_PROPERTIES).split(',')
-      hiddenPropArray = Array.new
-      hiddenProperties.each do |value|
-        hiddenPropArray << value.strip
-      end
-      hiddenPropArray.each do |prop|
-        propertyObj.each do |key, value|
-          if key == prop
-            propertyObj.delete(key)
+      hiddenProperties = Constants::HIDDEN_MERCHANT_PROPERTIES.split(',').map(&:strip)
+      hiddenPropertiesLower = hiddenProperties.map(&:downcase)
+      sensitivePatterns = Constants::SENSITIVE_PROPERTY_PATTERNS
+
+      if propertyObj.respond_to?(:each_pair)
+        propertyObj.each_key do |key|
+          keyStr = key.to_s
+          keyLower = keyStr.downcase
+          if hiddenPropertiesLower.include?(keyLower) || sensitivePatterns.any? { |p| keyLower.include?(p) }
+            propertyObj[key] = Constants::REDACTED_VALUE
           end
         end
       end
+
       @log_obj.logger.info('Merchant Configuration :\n' + propertyObj.to_s)
     end
 
+    # Returns true when jwtKeyType is SHARED_SECRET
+    def is_shared_secret_key_type?
+      !@jwtKeyType.nil? && @jwtKeyType.upcase == Constants::JWT_KEY_TYPE_SHARED_SECRET
+    end
+
+    # Validates that jwtKeyType is either P12 or SHARED_SECRET
+    def check_jwt_key_type
+      unless @jwtKeyType.upcase == Constants::JWT_KEY_TYPE_P12 || @jwtKeyType.upcase == Constants::JWT_KEY_TYPE_SHARED_SECRET
+        err = StandardError.new(Constants::ERROR_PREFIX + Constants::INVALID_JWT_KEY_TYPE)
+        @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
+        raise err
+      end
+    end
+
     def check_key_file
       # Directory exists?
       unless Dir.exist?(@keysDirectory)
@@ -629,6 +662,7 @@ public
     attr_accessor :keyAlias
     attr_accessor :keyPass
     attr_accessor :keyFilename
+    attr_accessor :jwtKeyType
     attr_accessor :useMetaKey
     attr_accessor :portfolioID
     attr_accessor :keepAliveTime
@@ -652,6 +686,7 @@ public
     attr_accessor :requestTarget
     attr_accessor :log_obj
     attr_accessor :solutionId
+    attr_accessor :isSDK
     attr_accessor :defaultCustomHeaders
     attr_accessor :pemFileDirectory
     attr_accessor :useMLEGlobally