epics 2.10.0 → 3.0.0.rc1

data/lib/epics/z01.rb

@@ -1,17 +1,5 @@
 class Epics::Z01 < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'Z01',
-      order_attribute: 'DZHNN',
-      order_params: {
-        DateRange: {
-          Start: options[:from],
-          End: options[:to]
-        }
-      },
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    request_factory.create_z01(options[:from], options[:to], **service_options).to_xml
   end
 end

data/lib/epics/z52.rb

@@ -1,17 +1,5 @@
 class Epics::Z52 < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'Z52',
-      order_attribute: 'DZHNN',
-      order_params: {
-        DateRange: {
-          Start: options[:from],
-          End: options[:to]
-        }
-      },
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    request_factory.create_z52(options[:from], options[:to], **service_options).to_xml
   end
 end

data/lib/epics/z53.rb

@@ -1,17 +1,5 @@
 class Epics::Z53 < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'Z53',
-      order_attribute: 'DZHNN',
-      order_params: {
-        DateRange: {
-          Start: options[:from],
-          End: options[:to]
-        }
-      },
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    request_factory.create_z53(options[:from], options[:to], **service_options).to_xml
   end
 end

data/lib/epics/z54.rb

@@ -1,17 +1,5 @@
 class Epics::Z54 < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'Z54',
-      order_attribute: 'DZHNN',
-      order_params: {
-        DateRange: {
-          Start: options[:from],
-          End: options[:to]
-        }
-      },
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    request_factory.create_z54(options[:from], options[:to], **service_options).to_xml
   end
 end

data/lib/epics/zsr.rb

@@ -0,0 +1,5 @@
+class Epics::ZSR < Epics::GenericRequest
+  def to_xml
+    request_factory.create_zsr(options[:from], options[:to], **service_options).to_xml
+  end
+end

data/lib/epics.rb

@@ -10,15 +10,19 @@ require 'faraday'
 require 'securerandom'
 require 'time'
 require "epics/version"
-require "epics/key"
+require "epics/keyring"
+require "epics/signature"
+require "epics/signature_algorithm"
+require "epics/signature_algorithm/base"
+require "epics/signature_algorithm/rsa"
+require "epics/signature_algorithm/rsapss"
+require "epics/signature_algorithm/rsapkcs1"
 require "epics/response"
 require "epics/error"
 require 'epics/letter_renderer'
-require "epics/middleware/xmlsig"
 require "epics/middleware/parse_ebics"
 require "epics/generic_request"
 require "epics/generic_upload_request"
-require "epics/header_request"
 require "epics/azv"
 require "epics/hpb"
 require "epics/hkd"
@@ -26,6 +30,7 @@ require "epics/htd"
 require "epics/haa"
 require "epics/sta"
 require "epics/fdl"
+require "epics/ful"
 require "epics/vmk"
 require "epics/bka"
 require "epics/c52"
@@ -55,18 +60,77 @@ require "epics/c2s"
 require "epics/cdz"
 require "epics/crz"
 require "epics/xct"
+require "epics/xek"
+require "epics/yct"
+require "epics/zsr"
 require "epics/hia"
 require "epics/ini"
 require "epics/hev"
-require "epics/signer"
-require "epics/x_509_certificate"
 require "epics/client"
 
+require 'epics/builders'
+require 'epics/crypt'
+require 'epics/factories'
+require 'epics/handlers'
+require 'epics/services'
+
 I18n.load_path += Dir[File.join(File.dirname(__FILE__), 'letter/locales', '*.yml')]
 
 module Epics
   DEFAULT_PRODUCT_NAME = 'EPICS - a ruby ebics kernel'
   DEFAULT_LOCALE = :de
+
+  # EBICS 3.0 (H005) carries public keys inside `ds:X509Data`, which the key management
+  # schemas declare mandatory (EBICS 3.0.2 §3.9). There is no raw modulus/exponent form.
+  class MissingCertificateError < StandardError
+    attr_reader :signature_version, :option_name
+
+    def initialize(signature_version, option_name)
+      @signature_version = signature_version
+      @option_name = option_name
+      super("EBICS 3.0 (H005) requires an X.509 certificate for #{signature_version}. " \
+            "Pass #{option_name}: to Epics::Client.new, or use Epics::Client.setup " \
+            'to generate a self-signed one.')
+    end
+  end
+
+  # Raised when a check needs a key the client has not loaded, e.g. verifying a bank
+  # signature before HPB has run.
+  class MissingKeyError < StandardError
+    def initialize(what)
+      super("#{what} is not available; run HPB or load a key file that contains it")
+    end
+  end
+
+  class InvalidCertificateError < StandardError
+    attr_reader :source
+
+    # `source` says where the certificate came from: a constructor option name, or a
+    # description such as "the HPB response".
+    def initialize(source, original = nil)
+      @source = source
+      message = "Could not parse the X.509 certificate from #{source}"
+      message += " (#{original.message})" if original
+      super(message)
+    end
+  end
+
+  class VersionSupportError < StandardError
+    attr_reader :version
+
+    def initialize(version, direction = 'above')
+      @version = version
+      message = case direction
+      when 'above'
+        "Supported from version #{version}"
+      when 'below'
+        "Support for versions below #{version}"
+      else
+        raise ArgumentError, "Invalid direction: #{direction}. Use 'above' or 'below'."
+      end
+      super(message)
+    end
+  end
 end
 
 Ebics = Epics

data/lib/letter/ini.erb

@@ -100,7 +100,7 @@
                     <%= t('version') %> :
                   </td>
                   <td>
-                    A006
+                    <%= signature_version %>
                   </td>
                 </tr>
               </table>
@@ -108,12 +108,19 @@
           </td>
         </tr>
       </table>
+      <% if keyring.user_signature.certificate %>
+      <p><%= t('certificate') %> :</p>
+      <pre class="code"><code><%= keyring.user_signature.certificate.to_pem %></code></pre>
+      <p><%= t('hash') %> (SHA-256) :</p>
+      <p class="code"><code><%= keyring.user_signature.certificate.fingerprint.scan(/../).join(":") %></code></p>
+      <% else %>
       <p><%= t('exponent') %> (<%= t('bit', bit: a.key.e.num_bytes * 8) %>) :</p>
       <p class="code"><code><%= a.e %></code></p>
       <p><%= t('modulus') %> (<%= t('bit', bit: a.key.n.num_bytes * 8) %>) :</p>
       <p class="code"><code><%= a.n.scan(/.{2}/).join(' ') %></code></p>
       <p><%= t('hash') %> (SHA-256) :</p>
-      <p class="code"><code><%= Base64.decode64(a.public_digest).unpack('H*').join.upcase.scan(/.{2}/).join(' ') %></code></p>
+      <p class="code"><code><%= confirm_digest(keyring.user_signature).upcase.scan(/.{2}/).join(' ') %></code></p>
+      <% end %>
       <p><%= t('confirmation') %></p>
       <br/>
       <br/>
@@ -211,7 +218,7 @@
                     <%= t('version') %> :
                   </td>
                   <td>
-                    X002
+                    <%= authentication_version %>
                   </td>
                 </tr>
               </table>
@@ -219,12 +226,19 @@
           </td>
         </tr>
       </table>
+      <% if keyring.user_authentication.certificate %>
+      <p><%= t('certificate') %> :</p>
+      <pre class="code"><code><%= keyring.user_authentication.certificate.to_pem %></code></pre>
+      <p><%= t('hash') %> (SHA-256) :</p>
+      <p class="code"><code><%= keyring.user_authentication.certificate.fingerprint.scan(/../).join(":") %></code></p>
+      <% else %>
       <p><%= t('exponent') %> (<%= t('bit', bit: x.key.e.num_bytes * 8) %>) :</p>
       <p class="code"><code><%= x.e %></code></p>
       <p><%= t('modulus') %> (<%= t('bit', bit: x.key.n.num_bytes * 8) %>) :</p>
       <p class="code"><code><%= x.n.scan(/.{2}/).join(' ') %></code></p>
       <p><%= t('hash') %> (SHA-256) :</p>
-      <p class="code"><code><%= Base64.decode64(x.public_digest).unpack('H*').join.upcase.scan(/.{2}/).join(' ') %></code></p>
+      <p class="code"><code><%= confirm_digest(keyring.user_authentication).upcase.scan(/.{2}/).join(' ') %></code></p>
+      <% end %>
     </div>
     <div style="page-break-after:always"></div>
     <div>
@@ -293,7 +307,7 @@
                     <%= t('version') %> :
                   </td>
                   <td>
-                    E002
+                    <%= encryption_version %>
                   </td>
                 </tr>
               </table>
@@ -301,12 +315,19 @@
           </td>
         </tr>
       </table>
+      <% if keyring.user_encryption.certificate %>
+      <p><%= t('certificate') %> :</p>
+      <pre class="code"><code><%= keyring.user_encryption.certificate.to_pem %></code></pre>
+      <p><%= t('hash') %> (SHA-256) :</p>
+      <p class="code"><code><%= keyring.user_encryption.certificate.fingerprint.scan(/../).join(":") %></code></p>
+      <% else %>
       <p><%= t('exponent') %> (<%= t('bit', bit: e.key.e.num_bytes * 8) %>) :</p>
       <p class="code"><code><%= e.e %></code></p>
       <p><%= t('modulus') %> (<%= t('bit', bit: e.key.n.num_bytes * 8) %>) :</p>
       <p class="code"><code><%= e.n.scan(/.{2}/).join(' ') %></code></p>
       <p><%= t('hash') %> (SHA-256) :</p>
-      <p class="code"><code><%= Base64.decode64(e.public_digest).unpack('H*').join.upcase.scan(/.{2}/).join(' ') %></code></p>
+      <p class="code"><code><%= confirm_digest(keyring.user_encryption).upcase.scan(/.{2}/).join(' ') %></code></p>
+      <% end %>
       <p><%= t('confirmation') %></p>
       <br/>
       <br/>

data/spec/aes_spec.rb

@@ -0,0 +1,46 @@
+RSpec.describe Epics::Crypt::Aes do
+  subject { described_class.new.tap { |aes| aes.key = Base64.decode64('5fXINXF7C+gRpK+q1Y12lw==') } }
+  let(:pad) {
+    ->(text) {
+      cipher = subject.instance_eval { use_cipher(:encrypt) }
+      subject.instance_eval { pad(cipher, text) }
+    }
+  }
+  let(:unpad) {
+    ->(text) {
+      subject.instance_eval { unpad(text) }
+    }
+  }
+
+  describe '#encrypt' do
+    it 'valid' do
+      expect(Base64.strict_encode64(subject.encrypt('a' * 13))).to eq('f8kId9dqBLaEbhSz9PBv7g==')
+    end
+  end
+
+  describe '#decrypt' do
+    it 'valid' do
+      expect(subject.decrypt(Base64.strict_decode64('f8kId9dqBLaEbhSz9PBv7g=='))).to eq('a' * 13)
+    end
+  end
+
+  describe '#pad' do
+    it 'will complete the block to the next 16byte' do
+      expect(pad.("\x01" * 13).size).to eq(16)
+    end
+
+    it 'will pad a complete block if the size is a multiple of 16' do
+      expect(pad.("\x01" * 16).size).to eq(32)
+    end
+
+    it 'will set the last byte to the padding length' do
+      expect(pad.("\x01" * 13)[-1]).to eq([3].pack('C*'))
+    end
+  end
+
+  describe '#unpad' do
+    it 'valid' do
+      expect(unpad.(pad.('a' * 13))).to eq('a' * 13)
+    end
+  end
+end

data/spec/auth_signature_handler_spec.rb

@@ -0,0 +1,58 @@
+RSpec.describe Epics::Handlers::AuthSignatureHandler do
+  let(:client) { Epics::Client.new( File.open(File.join( File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')), 'secret' , 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS') }
+  let(:hpb) { Epics::HPB.new(client) }
+
+  before { allow(SecureRandom).to receive(:hex).with(16).and_return('014a82626a51ee1cab547bbaf18a13a0') }
+  before { allow(Time).to receive(:now).and_return(Time.parse('2014-09-09T09:33:12Z')) }
+
+  subject { Nokogiri::XML(hpb.to_xml) }
+  let(:headers_node) { subject.xpath("//*[@authenticate='true']").first }
+  let(:crypt_service) { Epics::Services::CryptService.new }
+  let(:header_hash) { crypt_service.hash(headers_node.canonicalize) }
+  let(:digest_node) { subject.xpath('//ds:DigestValue', ds: 'http://www.w3.org/2000/09/xmldsig#').first }
+  let(:signature_value_node) { subject.xpath('//ds:SignatureValue', ds: 'http://www.w3.org/2000/09/xmldsig#').first }
+  let(:signature_node) { subject.xpath('//ds:SignedInfo', ds: 'http://www.w3.org/2000/09/xmldsig#').first }
+
+  describe '#digest!' do
+    it 'creates a digest of the *[authorized=true] nodes' do
+      expect(digest_node.content).to eq('j0WiGMS9D6Bt1xw92ZAOWUsAJ+OBlUYKtHRQI7TbpbY=')
+    end
+
+    it 'bar' do
+      expect(digest_node.content).to eq(Base64.strict_encode64(header_hash))
+    end
+  end
+
+  describe '#sign!' do
+    it 'signs the complete ds:SignedInfo node' do
+      expect(signature_value_node.content).to eq('K3FNqdg90AoFqgc1bM2CgAKHNfy7SWWcrm03CXEfu9XF4q4/2QWRyOAShcoF+kG60lnKjADqMqLTpMqXMTKg2AX9IItdl3p8IDocaZ4fVBdL8yUvE4/iH9569oj8QX4gvndwwS46TRVVYyZno1l44r9aEuUfaaqATp3ITQcyM3xDXFsNwVdJuUjzYHPTEOMXGxZlD/wIcLTQwMLLn0D/gitgsXQKqvGH3VI80bAG7aIxmLpcPEBqrAaZGCIghZWvJK2CBfgjSstcdmIK5YRCYF5UjCqoEywnp8ELaFtWMTcLPtq0GfJ1e84vGCVSNRdIH30dNRKINDWl+4YtzJpa5A==')
+    end
+
+    it 'can be verified with the same key' do
+      expect(client.keyring.user_authentication.key.verify(signature_value_node.content, signature_node.canonicalize)).to be(true)
+    end
+  end
+
+  describe 'XML structure' do
+    it 'inserts AuthSignature before body element' do
+      body_node = subject.at('body')
+      auth_signature_node = subject.at('AuthSignature')
+      expect(auth_signature_node).not_to be_nil
+      expect(body_node.previous).to eq(auth_signature_node)
+    end
+
+    it 'replaces placeholder with actual signature value' do
+      expect(signature_value_node.content).not_to eq('PLACEHOLDER')
+      expect(signature_value_node.content).not_to be_empty
+      expect(signature_value_node.content).to match(%r{\A[A-Za-z0-9+/=]+\z})
+    end
+
+    it 'canonicalizes SignedInfo in main document context' do
+      signed_info_canonicalized = signature_node.canonicalize
+      expect(signed_info_canonicalized).to include('ds:SignedInfo')
+      expect(signed_info_canonicalized).to include('ds:CanonicalizationMethod')
+      expect(signed_info_canonicalized).to include('ds:SignatureMethod')
+      expect(signed_info_canonicalized).to include('ds:Reference')
+    end
+  end
+end