cybersource_rest_client 0.0.76 → 0.0.77

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c6b20336697e89273dfc512c1b9c0fd24d5fab7551d870a661fe9622dc9d34b2
-  data.tar.gz: 339e408681cb07de1adda75545b428e4d57ce25c017c927740ec9af3458c32da
+  metadata.gz: 6a4660ce3a2439827b4430b708a803b17fe917e318e7aed05da06f06fc6b12d1
+  data.tar.gz: a9bd3db3a6435bb1f41762888ebbeb183570abff85a7244963f2c924ed74c6c5
 SHA512:
-  metadata.gz: 8bb08ab59e2704b7d8f89c310f70b33cce3bbf21de9ac70fce8410fb24b0d781f0d9af4ee6a79195efb4d4f2f20bb8e14a3884393191585b5923c8604347a775
-  data.tar.gz: 94a2fbd70e8a9089b54ee2267e2a7d19c6ddb1c39ba89e9babe2f118e8cd4ad32e1bcb5f0b78c2bde455a96e99afca9707ecb326c5cece9ff66a4d0d8675fd87
+  metadata.gz: 79954c4037b3c493be01acfa324711fa40e3f434d953db784e3cea2f5dd79be0f04d1af185b99c16dc9f6dc2cfd3524ee9c714c1cd441f450eba503b327fa427
+  data.tar.gz: b6a82130c16579b41c618a5180c96c8aa1969058ef5bc0615c8fde44f2e24efaf9965bd8e75e650675ad1ddc469cd54ba429ad75a27f9c469986d160739e1cc8

data/lib/AuthenticationSDK/authentication/jwt/JwtToken.rb

@@ -25,7 +25,7 @@ public
       jwtBody=getJwtBody(request_type, gmtDatetime, merchantconfig_obj)
       claimSet = JSON.parse(jwtBody)
 
-      cache_value = Cache.new.fetchJwtCertsAndKeys(merchantconfig_obj)
+      cache_value = Cache.new.fetchCachedP12Certificate(merchantconfig_obj)
       privateKey = cache_value.private_key
       jwt_cert_obj = cache_value.cert
       jwt_cert_in_der= Base64.strict_encode64(jwt_cert_obj.to_der)

data/lib/AuthenticationSDK/core/MerchantConfig.rb

@@ -2,58 +2,69 @@ require_relative '../util/Constants.rb'
 require_relative '../util/ExceptionHandler.rb'
 require_relative '../logging/log_factory.rb'
 require_relative '../logging/log_configuration.rb'
+require_relative '../util/CertificateUtility.rb'
 
 public
 # This fuction has all the merchantConfig properties getters and setters methods
   class Merchantconfig
     def initialize(cybsPropertyObj)
-    # Common Parameters
-    @merchantId = cybsPropertyObj['merchantID']
-    @runEnvironment = cybsPropertyObj['runEnvironment']
-    @intermediateHost = cybsPropertyObj['intermediateHost']
-    @defaultDeveloperId = cybsPropertyObj['defaultDeveloperId']
-    @authenticationType = cybsPropertyObj['authenticationType']
-    @proxyAddress = cybsPropertyObj['proxyAddress']
-    @proxyPort = cybsPropertyObj['proxyPort']
-    @getId = ''
-    @requestHost = ''
-    @requestTarget = ''
-    @requestJsonData = ''
-    # HTTP Parameters
-    @merchantSecretKey = cybsPropertyObj['merchantsecretKey']
-    @merchantKeyId = cybsPropertyObj['merchantKeyId']
-    # JWT Parameters
-    @keysDirectory = cybsPropertyObj['keysDirectory']
-    @keyAlias = cybsPropertyObj['keyAlias']
-    @keyPass = cybsPropertyObj['keyPass']
-    @keyFilename = cybsPropertyObj['keyFilename']
-    @useMetaKey = cybsPropertyObj['useMetaKey']
-    @portfolioID = cybsPropertyObj['portfolioID']
-    @solutionId = cybsPropertyObj['solutionId']
-    # MutualAuth & OAuth Parameters
-    @enableClientCert = cybsPropertyObj['enableClientCert']
-    @clientCertDirectory = cybsPropertyObj['clientCertDirectory']
-    @sslClientCert = cybsPropertyObj['sslClientCert']
-    @privateKey = cybsPropertyObj['privateKey']
-    @sslKeyPassword = cybsPropertyObj['sslKeyPassword']
-    @clientId = cybsPropertyObj['clientId']
-    @clientSecret = cybsPropertyObj['clientSecret']
-    @accessToken = cybsPropertyObj['accessToken']
-    @refreshToken = cybsPropertyObj['refreshToken']
-    # LogConfiguration
-    @log_config = LogConfiguration.new(cybsPropertyObj['logConfiguration'])
-    # Custom Default Headers
-    @defaultCustomHeaders = cybsPropertyObj['defaultCustomHeaders']
-    # Keep Alive Time for Connection Pooling
-    @keepAliveTime = cybsPropertyObj['keepAliveTime'] || 118 # Default to 118 seconds as same as default of libcurl
-    # Path to client JWE pem file directory
-    @pemFileDirectory = cybsPropertyObj['pemFileDirectory']
-    @mleKeyAlias = cybsPropertyObj['mleKeyAlias']
-    @useMLEGlobally = cybsPropertyObj['useMLEGlobally']
-    @mapToControlMLEonAPI = cybsPropertyObj['mapToControlMLEonAPI']
-    validateMerchantDetails
-    logAllProperties(cybsPropertyObj)
-    validateMLEConfiguration
+      # Common Parameters
+      @merchantId = cybsPropertyObj['merchantID']
+      @runEnvironment = cybsPropertyObj['runEnvironment']
+      @intermediateHost = cybsPropertyObj['intermediateHost']
+      @defaultDeveloperId = cybsPropertyObj['defaultDeveloperId']
+      @authenticationType = cybsPropertyObj['authenticationType']
+      @proxyAddress = cybsPropertyObj['proxyAddress']
+      @proxyPort = cybsPropertyObj['proxyPort']
+      @getId = ''
+      @requestHost = ''
+      @requestTarget = ''
+      @requestJsonData = ''
+      # HTTP Parameters
+      @merchantSecretKey = cybsPropertyObj['merchantsecretKey']
+      @merchantKeyId = cybsPropertyObj['merchantKeyId']
+      # JWT Parameters
+      @keysDirectory = cybsPropertyObj['keysDirectory']
+      @keyAlias = cybsPropertyObj['keyAlias']
+      @keyPass = cybsPropertyObj['keyPass']
+      @keyFilename = cybsPropertyObj['keyFilename']
+      @useMetaKey = cybsPropertyObj['useMetaKey']
+      @portfolioID = cybsPropertyObj['portfolioID']
+      @solutionId = cybsPropertyObj['solutionId']
+      @p12KeyFilePath = nil
+      # MutualAuth & OAuth Parameters
+      @enableClientCert = cybsPropertyObj['enableClientCert']
+      @clientCertDirectory = cybsPropertyObj['clientCertDirectory']
+      @sslClientCert = cybsPropertyObj['sslClientCert']
+      @privateKey = cybsPropertyObj['privateKey']
+      @sslKeyPassword = cybsPropertyObj['sslKeyPassword']
+      @clientId = cybsPropertyObj['clientId']
+      @clientSecret = cybsPropertyObj['clientSecret']
+      @accessToken = cybsPropertyObj['accessToken']
+      @refreshToken = cybsPropertyObj['refreshToken']
+      # LogConfiguration
+      @log_config = LogConfiguration.new(cybsPropertyObj['logConfiguration'])
+      # Custom Default Headers
+      @defaultCustomHeaders = cybsPropertyObj['defaultCustomHeaders']
+      # Keep Alive Time for Connection Pooling
+      @keepAliveTime = cybsPropertyObj['keepAliveTime'] || 118 # Default to 118 seconds as same as default of libcurl
+      # Path to client JWE pem file directory
+      @pemFileDirectory = cybsPropertyObj['pemFileDirectory']
+      @mleKeyAlias = cybsPropertyObj['mleKeyAlias']
+      @useMLEGlobally = cybsPropertyObj['useMLEGlobally']
+      @enableRequestMLEForOptionalApisGlobally = !!(cybsPropertyObj['enableRequestMLEForOptionalApisGlobally'] || cybsPropertyObj['useMLEGlobally'])
+      @disableRequestMLEForMandatoryApisGlobally = cybsPropertyObj['disableRequestMLEForMandatoryApisGlobally']
+
+      
+      if !cybsPropertyObj['mleForRequestPublicCertPath'].nil? && !cybsPropertyObj['mleForRequestPublicCertPath'].to_s.strip.empty?
+          @mleForRequestPublicCertPath = cybsPropertyObj['mleForRequestPublicCertPath'].to_s.strip
+      end
+
+      @mapToControlMLEonAPI = cybsPropertyObj['mapToControlMLEonAPI']
+      validateMerchantDetails
+      validateMLEConfiguration(cybsPropertyObj)
+      @p12KeyFilePath = File.join(@keysDirectory, @keyFilename + ".p12")
+      logAllProperties(cybsPropertyObj)
     end
 
     #fall back logic
@@ -164,6 +175,9 @@ public
         elsif !@keyFilename.instance_of? String
           @keyFilename=@keyFilename.to_s
         end
+        if !check_key_file
+          @log_obj.logger.error(ExceptionHandler.new.new_custom_error "Error finding or accessing the Key Directory or Key File. Please review the values in the merchant configuration.")
+        end
       end
       if @authenticationType.upcase == Constants::AUTH_TYPE_MUTUAL_AUTH
         if @clientId.to_s.empty?
@@ -237,16 +251,30 @@ public
       end
     end
 
-    def validateMLEConfiguration
-      if @useMLEGlobally.nil?
-        @useMLEGlobally = false
+    def validateMLEConfiguration(cybsPropertyObj)
+
+      if !@useMLEGlobally.nil? && !cybsPropertyObj['enableRequestMLEForOptionalApisGlobally'].nil?
+        if @useMLEGlobally != cybsPropertyObj['enableRequestMLEForOptionalApisGlobally']
+          raise StandardError.new(Constants::ERROR_PREFIX + "useMLEGlobally and enableRequestMLEForOptionalApisGlobally must have the same value if both are set")
+        end
       end
 
-      unless [true, false].include?(@useMLEGlobally)
-        err = StandardError.new(Constants::ERROR_PREFIX + "useMLEGlobally must be a boolean")
+      if @disableRequestMLEForMandatoryApisGlobally.nil?
+        @disableRequestMLEForMandatoryApisGlobally = false
+      end
+
+      unless [true, false].include?(@disableRequestMLEForMandatoryApisGlobally)
+        err = StandardError.new(Constants::ERROR_PREFIX + "disableRequestMLEForMandatoryApisGlobally must be a boolean")
         @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
         raise err
       end
+
+      unless [true, false].include?(@enableRequestMLEForOptionalApisGlobally)
+        err = StandardError.new(Constants::ERROR_PREFIX + "enableRequestMLEForOptionalApisGlobally must be a boolean")
+        @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
+        raise err
+      end
+
       unless @mapToControlMLEonAPI.nil?
         unless @mapToControlMLEonAPI.is_a?(Hash) && @mapToControlMLEonAPI.keys.all? {|k| k.is_a?(String)} && @mapToControlMLEonAPI.values.all? { |v| [true, false].include?(v) }
           err = StandardError.new(Constants::ERROR_PREFIX + "mapToControlMLEonAPI must be a map with boolean values")
@@ -264,18 +292,27 @@ public
         @mleKeyAlias = Constants::DEFAULT_ALIAS_FOR_MLE_CERT
       end
 
-      mle_configured = @useMLEGlobally
+      if @mleForRequestPublicCertPath && !@mleForRequestPublicCertPath.to_s.strip.empty?
+        begin
+          CertificateUtility.validatePathAndFile(@mleForRequestPublicCertPath, "mleForRequestPublicCertPath", @log_config)
+        rescue => err
+          @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
+          raise err
+        end
+      end
+
+      request_mle_configured = @enableRequestMLEForOptionalApisGlobally
       if !@mapToControlMLEonAPI.nil? && !@mapToControlMLEonAPI.empty?
         @mapToControlMLEonAPI.each do |_, value|
           unless [true, false].include?(value) && value
-            mle_configured = true
+            request_mle_configured = true
             break
           end
         end
       end
 
-      if mle_configured && !Constants::AUTH_TYPE_JWT.eql?(@authenticationType.upcase)
-        err = StandardError.new(Constants::ERROR_PREFIX + "MLE can only be used with JWT authentication")
+      if request_mle_configured && !Constants::AUTH_TYPE_JWT.eql?(@authenticationType.upcase)
+        err = StandardError.new(Constants::ERROR_PREFIX + "Request MLE can only be used with JWT authentication")
         @log_obj.logger.error(ExceptionHandler.new.new_api_exception err)
         raise err
       end
@@ -299,6 +336,35 @@ public
       @log_obj.logger.info('Merchant Configuration :\n' + propertyObj.to_s)
     end
 
+    def check_key_file
+      # Directory exists?
+      unless Dir.exist?(@keysDirectory)
+        @log_obj.logger.error("Keys Directory not found. Entered directory : #{@keysDirectory}")
+        return false
+      end
+
+      key_file_pathname = File.join(@keysDirectory, @keyFilename + ".p12")
+
+      # File exists?
+      unless File.exist?(key_file_pathname)
+        @log_obj.logger.error("Key File not found. Check path/filename entered. Entered path/filename : #{key_file_pathname}")
+        return false
+      end
+
+      @log_obj.logger.info("Entered value for Key File Path : #{key_file_pathname}")
+
+      # Can file be opened for reading?
+      begin
+        File.open(key_file_pathname, 'rb') do |f|
+          # Just open and close
+        end
+        return true
+      rescue => e
+        @log_obj.logger.info("File cannot be accessed. Permission denied : #{key_file_pathname}")
+        return false
+      end
+    end
+
     # getter and setter methods
     attr_accessor :merchantId
     attr_accessor :merchantSecretKey
@@ -337,6 +403,10 @@ public
     attr_accessor :defaultCustomHeaders
     attr_accessor :pemFileDirectory
     attr_accessor :useMLEGlobally
+    attr_accessor :enableRequestMLEForOptionalApisGlobally
+    attr_accessor :disableRequestMLEForMandatoryApisGlobally
+    attr_accessor :mleForRequestPublicCertPath
     attr_accessor :mapToControlMLEonAPI
     attr_accessor :mleKeyAlias
+    attr_accessor :p12KeyFilePath
   end

data/lib/AuthenticationSDK/util/Cache.rb

@@ -3,110 +3,141 @@ require 'base64'
 require 'active_support'
 require 'thread'
 require_relative 'CacheValue'
+require_relative 'CertificateUtility'
+require_relative '../util/Constants.rb'
+require_relative '../logging/log_factory.rb'
+require_relative '../logging/log_configuration.rb'
 
 public
 # P12 file certificate Cache
   class Cache
     @@cache_obj = ActiveSupport::Cache::MemoryStore.new
     @@mutex = Mutex.new
+    @@logger
 
-    def fetchJwtCertsAndKeys(merchantConfig)
+    def fetchCachedP12Certificate(merchantConfig)
       merchantId = merchantConfig.merchantId
-      filePath = merchantConfig.keysDirectory + '/' + merchantConfig.keyFilename + '.p12'
-      if (!File.exist?(filePath))
-        raise Constants::ERROR_PREFIX + Constants::FILE_NOT_FOUND + File.expand_path(filePath)
-      end
+      certificateFilePath = merchantConfig.p12KeyFilePath
+
+      cacheKey = merchantConfig.keyFilename + "_JWT"
 
-      cacheKey = merchantId.to_s + '_JWT'
-      
-      # Thread-safe cache access with race condition protection
       @@mutex.synchronize do
-        certCache = @@cache_obj.read(cacheKey)
-        fileModTime = File.mtime(filePath)
+        cachedCertificateInfo = @@cache_obj.read(cacheKey)
+        fileModifiedTime = File.mtime(certificateFilePath)
 
-        if !certCache || certCache.empty? || certCache.file_modified_time != fileModTime
-          setupCache(cacheKey, filePath, merchantConfig)
-          certCache = @@cache_obj.read(cacheKey)
+        if !cachedCertificateInfo || cachedCertificateInfo.empty? || fileModifiedTime != cachedCertificateInfo.file_modified_time
+          setupCache(cacheKey, certificateFilePath, merchantConfig)
+          cachedCertificateInfo = @@cache_obj.read(cacheKey)
         end
-        
-        return certCache
+
+        return cachedCertificateInfo
       end
-    end    
-    
-    def fetchMLECert(merchantConfig)
-      merchantId = merchantConfig.merchantId
-      filePath = merchantConfig.keysDirectory + '/' + merchantConfig.keyFilename + '.p12'
-      if (!File.exist?(filePath))
-        raise Constants::ERROR_PREFIX + Constants::FILE_NOT_FOUND + File.expand_path(filePath)
+    end
+
+    def setupCache(cacheKey, certificateFilePath, merchantConfig)
+      if !Cache.class_variable_defined?(:@@logger) || @@logger.nil?
+        @@logger = Log.new merchantConfig.log_config, "Cache"
       end
+      logger = @@logger.logger
+      fileModifiedTime = File.mtime(certificateFilePath)
 
-      cacheKey = merchantId.to_s + '_MLE'
-      
-      # Thread-safe cache access with race condition protection
-      @@mutex.synchronize do
-        certCache = @@cache_obj.read(cacheKey)
-        fileModTime = File.mtime(filePath)
+      if (cacheKey.end_with?("_JWT"))
+        privateKey, certificateList = CertificateUtility.getCertificateCollectionAndPrivateKeyFromP12(certificateFilePath, merchantConfig)
+        jwtCertificate = CertificateUtility.getCertificateBasedOnKeyAlias(certificateList, merchantConfig.keyAlias)
+
+        cacheValue = CacheValue.new(privateKey, jwtCertificate, fileModifiedTime)
+
+        @@cache_obj.write(cacheKey, cacheValue)
+        return
+      end
+
+      if (cacheKey.end_with?(Constants::MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT))
+        certificateList = CertificateUtility.getCertificatesFromPemFile(certificateFilePath)
+        mleCertificate = CertificateUtility.getCertificateBasedOnKeyAlias(certificateList, merchantConfig.mleKeyAlias)
+        if (!mleCertificate)
+          fileName = File.basename(certificateFilePath)
+          logger.warn("No certificate found for the specified mle_key_alias '#{merchantConfig.mleKeyAlias}'. Using the first certificate from file #{fileName} as the MLE request certificate.")
+          mleCertificate = certificateList[0]
+        end
+
+        cacheValue = CacheValue.new(nil, mleCertificate, fileModifiedTime)
+
+        @@cache_obj.write(cacheKey, cacheValue)
+        return
+      end
 
-        if !certCache || certCache.empty? || certCache.file_modified_time != fileModTime
-          setupCache(cacheKey, filePath, merchantConfig)
-          certCache = @@cache_obj.read(cacheKey)
+      if (cacheKey.end_with?(Constants::MLE_CACHE_IDENTIFIER_FOR_P12_CERT))
+        privateKey, certificateList = CertificateUtility.getCertificateCollectionAndPrivateKeyFromP12(certificateFilePath, merchantConfig)
+        mleCertificate = CertificateUtility.getCertificateBasedOnKeyAlias(certificateList, merchantConfig.mleKeyAlias)
+        if (!mleCertificate)
+          fileName = File.basename(certificateFilePath)
+          logger.error("No certificate found for the specified mle_key_alias '#{merchantConfig.mleKeyAlias}' in file #{fileName}.")
+          raise ArgumentError, "No certificate found for the specified mle_key_alias '#{merchantConfig.mleKeyAlias}' in file #{fileName}."
         end
-        
-        return certCache
+
+        cacheValue = CacheValue.new(privateKey, mleCertificate, fileModifiedTime)
+
+        @@cache_obj.write(cacheKey, cacheValue)
+        return
       end
     end
 
-    def setupCache(cacheKey, filePath, merchantConfig)
-      if(cacheKey.end_with?("_JWT"))
-        private_key, certs = getCertsAndKeysFromP12(filePath, merchantConfig)
-        jwt_cert = Utility.getCertBasedOnKeyAlias(certs, merchantConfig.keyAlias)
-        currentFileLastModifiedTime = File.mtime(filePath)
-        
-        # Create CacheValue object with all 3 parameters
-        cache_value = CacheValue.new(private_key, jwt_cert, currentFileLastModifiedTime)
-        
-        # Store the cache value object in cache
-        @@cache_obj.write(cacheKey, cache_value)
+    def getRequestMLECertificateFromCache(merchantConfig)
+      if !Cache.class_variable_defined?(:@@logger) || @@logger.nil?
+        @@logger = Log.new merchantConfig.log_config, "Cache"
       end
-      if(cacheKey.end_with?("_MLE"))
-        private_key, certs = getCertsAndKeysFromP12(filePath, merchantConfig)
-        mle_cert = Utility.getCertBasedOnKeyAlias(certs, merchantConfig.mleKeyAlias)
-        currentFileLastModifiedTime = File.mtime(filePath)
-        
-        # Create CacheValue object with all 3 parameters
-        cache_value = CacheValue.new(nil, mle_cert, currentFileLastModifiedTime)
-        
-        # Store the cache value object in cache
-        @@cache_obj.write(cacheKey, cache_value)
+
+      logger = @@logger.logger
+      merchantId = merchantConfig.merchantId
+      certificate_identifier = nil
+      certificate_file_path = nil
+
+      # Priority #1: Get cert from merchantConfig.mleForRequestPublicCertPath if certPath is provided
+      if merchantConfig.mleForRequestPublicCertPath && !merchantConfig.mleForRequestPublicCertPath.strip.empty?
+        certificate_identifier = Constants::MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT
+        certificate_file_path = merchantConfig.mleForRequestPublicCertPath
+      # Priority #2: If mleForRequestPublicCertPath not provided, get mlecert from p12 if provided and jwt auth type
+      elsif Constants::AUTH_TYPE_JWT.downcase == merchantConfig.authenticationType.downcase && merchantConfig.p12KeyFilePath
+        certificate_identifier = Constants::MLE_CACHE_IDENTIFIER_FOR_P12_CERT
+        certificate_file_path = merchantConfig.p12KeyFilePath
+      # Priority #3: Get mlecert from default cert in SDK as per CAS or PROD env.
+      else
+        logger.debug("The certificate to use for MLE for requests is not provided in the merchant configuration. Please ensure that the certificate path is provided.")
+        return nil
       end
 
+      cache_key = "#{merchantId}_#{certificate_identifier}"
+      mle_certificate = getMLECertificateBasedOnCacheKey(merchantConfig, cache_key, certificate_file_path)
+
+      CertificateUtility.validateCertificateExpiry(mle_certificate, merchantConfig.keyAlias, certificate_identifier, merchantConfig.log_config)
+
+      mle_certificate
     end
 
-    def getCertsAndKeysFromP12(filePath, merchantConfig)
-      p12File = File.binread(filePath)
-      p12Object = OpenSSL::PKCS12.new(p12File, merchantConfig.keyPass)
-      #Generating Private Key
-      private_key = OpenSSL::PKey::RSA.new(p12Object.key)
-      # Generating Public key.
-      # publicKey = OpenSSL::PKey::RSA.new(p12Object.key.public_key)
-
-      # Get all certs from p12
-      x5_cert_primary = p12Object.certificate
-      x5_certs_others = p12Object.ca_certs
-      certs = [x5_cert_primary]
-      certs.concat(x5_certs_others) if x5_certs_others
-      return [private_key, certs]
+    def getMLECertificateBasedOnCacheKey(merchantConfig, cacheKey, certificateFilePath)
+      cachedCertificateInfo = nil
+      @@mutex.synchronize do
+        cachedCertificateInfo = @@cache_obj.read(cacheKey)
+        fileTimestamp = File.mtime(certificateFilePath)
+
+        if cachedCertificateInfo.nil? || cachedCertificateInfo.file_modified_time != fileTimestamp
+          setupCache(cacheKey, certificateFilePath, merchantConfig)
+          cachedCertificateInfo = @@cache_obj.read(cacheKey)
+        end
+      end
+
+      cachedCertificateInfo ? cachedCertificateInfo.cert : nil
     end
 
     # <b>DEPRECATED:</b> This method has been marked as Deprecated and will be removed in coming releases.
     def fetchPEMFileForNetworkTokenization(filePath)
       warn("[DEPRECATED] 'fetchPEMFileForNetworkTokenization' method is deprecated and will be removed in coming releases.")
-      
+
       # Thread-safe cache access for deprecated method
       @@mutex.synchronize do
         pem_file_cache = @@cache_obj.read('privateKeyFromPEMFile')
         cached_pem_file_last_updated_time = @@cache_obj.read('cachedLastModifiedTimeOfPEMFile')
-        
+
         if File.exist?(filePath)
           current_last_modified_time_of_PEM_file = File.mtime(filePath)
           if pem_file_cache.nil? || pem_file_cache.to_s.empty? || current_last_modified_time_of_PEM_file > cached_pem_file_last_updated_time
@@ -115,9 +146,8 @@ public
             @@cache_obj.write('cachedLastModifiedTimeOfPEMFile', current_last_modified_time_of_PEM_file)
           end
         end
-        
+
         return @@cache_obj.read('privateKeyFromPEMFile')
       end
     end
-    
   end

data/lib/AuthenticationSDK/util/CertificateUtility.rb

@@ -0,0 +1,124 @@
+require 'openssl'
+require_relative '../util/Constants.rb'
+require_relative '../logging/log_factory.rb'
+require_relative '../logging/log_configuration.rb'
+
+public
+  class CertificateUtility
+    @@logger
+
+    def self.getCertificateCollectionAndPrivateKeyFromP12(certificateFilePath, merchantConfig)
+      if !CertificateUtility.class_variable_defined?(:@@logger) || @@logger.nil?
+        @@logger = Log.new merchantConfig.log_config, "CertificateUtility"
+      end
+      logger = @@logger.logger
+
+      p12File = File.binread(certificateFilePath)
+      p12Object = OpenSSL::PKCS12.new(p12File, merchantConfig.keyPass)
+
+      privateKey = OpenSSL::PKey::RSA.new(p12Object.key)
+
+      primaryX5Certificate = p12Object.certificate
+      additionalX5Certificates = p12Object.ca_certs
+
+      certificateList = [primaryX5Certificate]
+      certificateList.concat(additionalX5Certificates) if additionalX5Certificates
+
+      return [privateKey, certificateList]
+    end
+
+    def self.getCertificateBasedOnKeyAlias(certificateList, keyAlias)
+      return nil if certificateList.nil?
+
+      certificateList.find do |cert|
+        cert.subject.to_a.any? { |_, value, _| value.include?(keyAlias) }
+      end
+    end
+
+    def self.getCertificatesFromPemFile(certificateFilePath)
+      pem_data = File.read(certificateFilePath)
+      certificateList = []
+
+      pem_data.scan(/-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----/m) do |certBlock|
+        certificateList << OpenSSL::X509::Certificate.new(certBlock)
+      end
+
+      certificateList
+    end
+
+    def self.validateCertificateExpiry(certificate, keyAlias, certificateIdentifier, logConfig)
+      if !CertificateUtility.class_variable_defined?(:@@logger) || @@logger.nil?
+        @@logger = Log.new logConfig, "CertificateUtility"
+      end
+      logger = @@logger.logger
+
+      warning_no_expiry_date = "Certificate does not have expiry date"
+      warning_expiring_soon = "Certificate with alias #{keyAlias} is going to expire on %s. Please update the certificate before then."
+      warning_expired = "Certificate with alias #{keyAlias} is expired as of %s. Please update the certificate."
+
+      if Constants::MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT == certificateIdentifier
+        warning_no_expiry_date = "Certificate for MLE Requests does not have expiry date from mleForRequestPublicCertPath in merchant configuration."
+        warning_expiring_soon = "Certificate for MLE Requests with alias #{keyAlias} is going to expire on %s. Please update the certificate provided in mleForRequestPublicCertPath in merchant configuration before then."
+        warning_expired = "Certificate for MLE Requests with alias #{keyAlias} is expired as of %s. Please update the certificate provided in mleForRequestPublicCertPath in merchant configuration."
+      end
+
+      if Constants::MLE_CACHE_IDENTIFIER_FOR_P12_CERT == certificateIdentifier
+        warning_no_expiry_date = "Certificate for MLE Requests does not have expiry date in the P12 file."
+        warning_expiring_soon = "Certificate for MLE Requests with alias #{keyAlias} is going to expire on %s. Please update the P12 file before then."
+        warning_expired = "Certificate for MLE Requests with alias #{keyAlias} is expired as of %s. Please update the P12 file."
+      end
+
+      not_after = certificate.not_after # This returns a Time object in Ruby's OpenSSL
+      if not_after.nil?
+        logger.warn(warning_no_expiry_date)
+      else
+        now = Time.now.utc
+        if not_after < now
+          logger.warn(warning_expired % [not_after])
+        else
+          time_to_expire = not_after - now
+          days_to_expire = (time_to_expire / 86400).to_i
+          if days_to_expire < Constants::CERTIFICATE_EXPIRY_DATE_WARNING_DAYS
+            logger.warn(warning_expiring_soon % [not_after])
+          end
+        end
+      end
+    end
+
+    def self.validatePathAndFile(filePath, pathType, logConfig)
+      if !CertificateUtility.class_variable_defined?(:@@logger) || @@logger.nil?
+        @@logger = Log.new logConfig, "CertificateUtility"
+      end
+      logger = @@logger.logger
+
+      if filePath.nil? || filePath.strip.empty?
+        logger.error("#{pathType} path cannot be null or empty.")
+        raise ArgumentError, "#{pathType} path cannot be null or empty."
+      end
+
+      normalized_path = filePath.dup
+      if File::SEPARATOR == '\\' && normalized_path =~ %r{^/[A-Za-z]:.*}
+        normalized_path = normalized_path[1..-1]
+      end
+
+      path = normalized_path
+
+      unless File.exist?(path)
+        logger.error("#{pathType} does not exist: #{path}")
+        raise IOError, "#{pathType} does not exist: #{path}"
+      end
+
+      if File.directory?(path)
+        logger.error("#{pathType} does not have valid file: #{path}")
+        raise IOError, "#{pathType} does not have valid file: #{path}"
+      end
+
+      begin
+        File.open(path, "rb") {} # Just to check readability
+        return path
+      rescue => e
+        logger.error("#{pathType} is not readable: #{path}")
+        raise IOError, "#{pathType} is not readable: #{path}"
+      end
+    end
+  end

data/lib/AuthenticationSDK/util/Constants.rb

@@ -169,4 +169,10 @@
       DEFAULT_ALIAS_FOR_MLE_CERT = 'CyberSource_SJC_US' unless const_defined?(:DEFAULT_ALIAS_FOR_MLE_CERT)
 
       CERTIFICATE_EXPIRY_DATE_WARNING_DAYS = 90 unless const_defined?(:CERTIFICATE_EXPIRY_DATE_WARNING_DAYS)
+
+      MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT = "mleCertFromMerchantConfig"
+
+      MLE_CACHE_IDENTIFIER_FOR_P12_CERT = "mleCertFromP12"
+
+      DEFAULT_KEY_FILE_PATH = File.join(Dir.pwd, "resources")
   end