epics 2.10.0 → 3.0.0.rc1

data/spec/handlers_spec.rb

@@ -0,0 +1,267 @@
+RSpec.describe 'Handlers' do
+  let(:client) { Epics::Client.new(File.open(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')), 'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS', version:) }
+  let(:version) { Epics::Keyring::VERSION_25 }
+
+  describe Epics::Handlers::UserSignatureHandler do
+    let(:digest) { OpenSSL::Digest::SHA256.digest('test document') }
+
+    describe '::Base' do
+      it 'raises NotImplementedError' do
+        base = described_class::Base.new(client)
+        expect { base.handle(digest) }.to raise_error(NotImplementedError)
+      end
+    end
+
+    describe '::V2' do
+      subject(:handler) { described_class::V2.new(client) }
+
+      it 'generates UserSignatureData with S001 namespace' do
+        result = handler.handle(digest)
+        xml = Nokogiri::XML(result.to_xml)
+        expect(xml.root.name).to eq('UserSignatureData')
+        expect(xml.root.namespace.href).to eq('http://www.ebics.org/S001')
+      end
+
+      it 'includes OrderSignatureData with correct structure' do
+        result = handler.handle(digest)
+        xml = Nokogiri::XML(result.to_xml)
+        xml.remove_namespaces!
+        expect(xml.at('//SignatureVersion').text).to eq(client.keyring.user_signature.version)
+        expect(xml.at('//PartnerID').text).to eq(client.partner_id)
+        expect(xml.at('//UserID').text).to eq(client.user_id)
+      end
+
+      it 'produces a verifiable SignatureValue' do
+        result = handler.handle(digest)
+        xml = Nokogiri::XML(result.to_xml)
+        xml.remove_namespaces!
+        sig_value = xml.at('//SignatureValue').text
+        expect(client.keyring.user_signature.key.verify(sig_value, digest)).to be true
+      end
+    end
+
+    describe '::V3' do
+      let(:version) { Epics::Keyring::VERSION_30 }
+      subject(:handler) { described_class::V3.new(client) }
+
+      it 'generates UserSignatureData with S002 namespace' do
+        result = handler.handle(digest)
+        xml = Nokogiri::XML(result.to_xml)
+        expect(xml.root.name).to eq('UserSignatureData')
+        expect(xml.root.namespace.href).to eq('http://www.ebics.org/S002')
+      end
+
+      it 'includes OrderSignatureData with correct structure' do
+        result = handler.handle(digest)
+        xml = Nokogiri::XML(result.to_xml)
+        xml.remove_namespaces!
+        expect(xml.at('//SignatureVersion').text).to eq(client.keyring.user_signature.version)
+        expect(xml.at('//PartnerID').text).to eq(client.partner_id)
+        expect(xml.at('//UserID').text).to eq(client.user_id)
+      end
+
+      it 'produces a verifiable SignatureValue' do
+        result = handler.handle(digest)
+        xml = Nokogiri::XML(result.to_xml)
+        xml.remove_namespaces!
+        sig_value = xml.at('//SignatureValue').text
+        expect(client.keyring.user_signature.key.verify(sig_value, digest)).to be true
+      end
+    end
+
+    describe 'V2 vs V3 namespace difference' do
+      let(:digest) { OpenSSL::Digest::SHA256.digest('test') }
+
+      it 'V2 uses S001, V3 uses S002' do
+        v2_client = Epics::Client.new(File.open(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')), 'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS', version: Epics::Keyring::VERSION_25)
+        v3_client = Epics::Client.new(File.open(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')), 'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS', version: Epics::Keyring::VERSION_30)
+
+        v2_xml = Nokogiri::XML(described_class::V2.new(v2_client).handle(digest).to_xml)
+        v3_xml = Nokogiri::XML(described_class::V3.new(v3_client).handle(digest).to_xml)
+        expect(v2_xml.root.namespace.href).to eq('http://www.ebics.org/S001')
+        expect(v3_xml.root.namespace.href).to eq('http://www.ebics.org/S002')
+      end
+    end
+  end
+
+  describe Epics::Handlers::OrderDataHandler do
+    let(:timestamp) { Time.utc(2024, 6, 15, 10, 30, 0) }
+
+    shared_examples 'an OrderDataHandler' do |handler_class, hia_namespace, sig_namespace|
+      subject(:handler) { handler_class.new(client) }
+
+      describe '#handle_ini' do
+        it 'generates SignaturePubKeyOrderData XML' do
+          handler.handle_ini(client.keyring.user_signature, timestamp)
+          xml = Nokogiri::XML(handler.to_xml)
+          xml.remove_namespaces!
+          expect(xml.at('SignaturePubKeyOrderData')).not_to be_nil
+        end
+
+        it "uses #{sig_namespace} namespace" do
+          handler.handle_ini(client.keyring.user_signature, timestamp)
+          xml = Nokogiri::XML(handler.to_xml)
+          node = xml.root
+          expect(node.namespace.href).to eq(sig_namespace)
+        end
+
+        it 'includes SignatureVersion' do
+          handler.handle_ini(client.keyring.user_signature, timestamp)
+          xml = Nokogiri::XML(handler.to_xml)
+          xml.remove_namespaces!
+          expect(xml.at('//SignatureVersion').text).to eq(client.keyring.user_signature.version)
+        end
+
+        it 'includes PartnerID and UserID' do
+          handler.handle_ini(client.keyring.user_signature, timestamp)
+          xml = Nokogiri::XML(handler.to_xml)
+          xml.remove_namespaces!
+          expect(xml.at('//PartnerID').text).to eq(client.partner_id)
+          expect(xml.at('//UserID').text).to eq(client.user_id)
+        end
+      end
+
+      describe '#handle_hia' do
+        it 'generates HIARequestOrderData XML' do
+          handler.handle_hia(client.keyring.user_authentication, client.keyring.user_encryption, timestamp)
+          xml = Nokogiri::XML(handler.to_xml)
+          xml.remove_namespaces!
+          expect(xml.at('HIARequestOrderData')).not_to be_nil
+        end
+
+        it 'includes AuthenticationVersion and EncryptionVersion' do
+          handler.handle_hia(client.keyring.user_authentication, client.keyring.user_encryption, timestamp)
+          xml = Nokogiri::XML(handler.to_xml)
+          xml.remove_namespaces!
+          expect(xml.at('//AuthenticationVersion').text).to eq(client.keyring.user_authentication.version)
+          expect(xml.at('//EncryptionVersion').text).to eq(client.keyring.user_encryption.version)
+        end
+
+        it 'includes PartnerID and UserID' do
+          handler.handle_hia(client.keyring.user_authentication, client.keyring.user_encryption, timestamp)
+          xml = Nokogiri::XML(handler.to_xml)
+          xml.remove_namespaces!
+          expect(xml.at('//PartnerID').text).to eq(client.partner_id)
+          expect(xml.at('//UserID').text).to eq(client.user_id)
+        end
+      end
+    end
+
+    context 'V24 (H003)' do
+      let(:version) { Epics::Keyring::VERSION_24 }
+      include_examples 'an OrderDataHandler',
+        Epics::Handlers::OrderDataHandler::V24, 'http://www.ebics.org/H003', 'http://www.ebics.org/S001'
+
+      it 'includes PubKeyValue with RSA key material in INI' do
+        handler = Epics::Handlers::OrderDataHandler::V24.new(client)
+        handler.handle_ini(client.keyring.user_signature, timestamp)
+        xml = Nokogiri::XML(handler.to_xml)
+        xml.remove_namespaces!
+        expect(xml.at('//RSAKeyValue/Modulus')).not_to be_nil
+        expect(xml.at('//RSAKeyValue/Exponent')).not_to be_nil
+        expect(xml.at('//PubKeyValue/TimeStamp').text).to eq('2024-06-15T10:30:00Z')
+      end
+    end
+
+    context 'V25 (H004)' do
+      let(:version) { Epics::Keyring::VERSION_25 }
+      include_examples 'an OrderDataHandler',
+        Epics::Handlers::OrderDataHandler::V25, 'urn:org:ebics:H004', 'http://www.ebics.org/S001'
+
+      it 'includes PubKeyValue with RSA key material in HIA (2 keys)' do
+        handler = Epics::Handlers::OrderDataHandler::V25.new(client)
+        handler.handle_hia(client.keyring.user_authentication, client.keyring.user_encryption, timestamp)
+        xml = Nokogiri::XML(handler.to_xml)
+        xml.remove_namespaces!
+        moduli = xml.xpath('//RSAKeyValue/Modulus')
+        expect(moduli.size).to eq(2)
+      end
+    end
+
+    context 'V3 (H005)' do
+      let(:version) { Epics::Keyring::VERSION_30 }
+      include_examples 'an OrderDataHandler',
+        Epics::Handlers::OrderDataHandler::V3, 'urn:org:ebics:H005', 'http://www.ebics.org/S002'
+
+      it 'does NOT include PubKeyValue (relies on certificates)' do
+        handler = Epics::Handlers::OrderDataHandler::V3.new(client)
+        handler.handle_ini(client.keyring.user_signature, timestamp)
+        xml = Nokogiri::XML(handler.to_xml)
+        xml.remove_namespaces!
+        expect(xml.at('//PubKeyValue')).to be_nil
+      end
+
+      it 'includes X509Data when certificate is present' do
+        handler = Epics::Handlers::OrderDataHandler::V3.new(client)
+        handler.handle_ini(client.keyring.user_signature, timestamp)
+        xml = Nokogiri::XML(handler.to_xml)
+        xml.remove_namespaces!
+        expect(xml.at('//X509Data')).not_to be_nil
+        expect(xml.at('//X509Certificate')).not_to be_nil
+      end
+    end
+  end
+
+  describe Epics::Handlers::AuthSignatureHandler do
+    it 'adds AuthSignature element to XML builder output' do
+      hpb = Epics::HPB.new(client)
+      xml = Nokogiri::XML(hpb.to_xml)
+      xml.remove_namespaces!
+      expect(xml.at('//AuthSignature')).not_to be_nil
+    end
+
+    it 'includes ds:SignedInfo with correct algorithms' do
+      hpb = Epics::HPB.new(client)
+      xml = Nokogiri::XML(hpb.to_xml)
+      ds = { 'ds' => 'http://www.w3.org/2000/09/xmldsig#' }
+      signed_info = xml.at_xpath('//ds:SignedInfo', ds)
+      expect(signed_info).not_to be_nil
+
+      canon_method = signed_info.at_xpath('ds:CanonicalizationMethod', ds)
+      expect(canon_method['Algorithm']).to include('REC-xml-c14n-20010315')
+
+      sig_method = signed_info.at_xpath('ds:SignatureMethod', ds)
+      expect(sig_method['Algorithm']).to include('rsa-sha256')
+    end
+
+    it 'includes ds:DigestValue that matches header hash' do
+      allow(SecureRandom).to receive(:hex).with(16).and_return('014a82626a51ee1cab547bbaf18a13a0')
+      allow(Time).to receive(:now).and_return(Time.parse('2014-09-09T09:33:12Z'))
+
+      hpb = Epics::HPB.new(client)
+      xml = Nokogiri::XML(hpb.to_xml)
+
+      headers_node = xml.xpath("//*[@authenticate='true']").first
+      crypt_service = Epics::Services::CryptService.new
+      expected_hash = crypt_service.hash(headers_node.canonicalize)
+
+      ds = { 'ds' => 'http://www.w3.org/2000/09/xmldsig#' }
+      digest_value = xml.at_xpath('//ds:DigestValue', ds).text
+      expect(digest_value).to eq(Base64.strict_encode64(expected_hash))
+    end
+
+    it 'produces a verifiable ds:SignatureValue' do
+      hpb = Epics::HPB.new(client)
+      xml = Nokogiri::XML(hpb.to_xml)
+      ds = { 'ds' => 'http://www.w3.org/2000/09/xmldsig#' }
+      sig_value = xml.at_xpath('//ds:SignatureValue', ds).text
+      signed_info = xml.at_xpath('//ds:SignedInfo', ds)
+      expect(client.keyring.user_authentication.key.verify(sig_value, signed_info.canonicalize)).to be true
+    end
+
+    context 'with different EBICS versions' do
+      [Epics::Keyring::VERSION_24, Epics::Keyring::VERSION_25, Epics::Keyring::VERSION_30].each do |ver|
+        it "works with version #{ver}" do
+          c = Epics::Client.new(
+            File.open(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')),
+            'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS', version: ver
+          )
+          hpb = Epics::HPB.new(c)
+          xml = Nokogiri::XML(hpb.to_xml)
+          xml.remove_namespaces!
+          expect(xml.at('//AuthSignature')).not_to be_nil
+        end
+      end
+    end
+  end
+end

data/spec/hpb_malformed_certificate_spec.rb

@@ -0,0 +1,36 @@
+RSpec.describe 'HPB with an unreadable certificate' do
+  let(:client) do
+    Epics::Client.new(File.open(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')),
+                      'secret', 'https://194.180.18.30/ebicsweb/ebicsweb', 'SIZBN001', 'EBIX', 'EBICS',
+                      version: Epics::Keyring::VERSION_30)
+  end
+
+  let(:order_data) do
+    <<~XML
+      <?xml version="1.0" encoding="UTF-8"?>
+      <HPBResponseOrderData xmlns="urn:org:ebics:H005" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <AuthenticationPubKeyInfo>
+          <ds:X509Data><ds:X509Certificate>bm90LWEtY2VydGlmaWNhdGU=</ds:X509Certificate></ds:X509Data>
+          <AuthenticationVersion>X002</AuthenticationVersion>
+        </AuthenticationPubKeyInfo>
+        <HostID>SIZBN001</HostID>
+      </HPBResponseOrderData>
+    XML
+  end
+
+  before { allow(client).to receive(:download).and_return(order_data) }
+
+  # A keyring built from a partly unreadable HPB response is not usable, and a warning
+  # on stderr is easy to miss on a server.
+  it 'fails rather than storing an incomplete keyring' do
+    expect { client.HPB }.to raise_error(Epics::InvalidCertificateError)
+  end
+
+  it 'says where the certificate came from' do
+    expect { client.HPB }.to raise_error(/from the HPB response/)
+  end
+
+  it 'includes the underlying OpenSSL error' do
+    expect { client.HPB }.to raise_error(/PEM_read_bio_X509/)
+  end
+end

data/spec/key_file_decryption_spec.rb

@@ -0,0 +1,27 @@
+RSpec.describe 'key file decryption' do
+  let(:client) do
+    Epics::Client.new(File.open(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')),
+                      'secret', 'https://example.com/ebics', 'SIZBN001', 'EBIX', 'EBICS')
+  end
+
+  it 'round-trips a PEM' do
+    pem = client.keyring.user_signature.key.key.to_pem
+
+    expect(client.send(:decrypt, client.send(:encrypt, pem))).to eq(pem)
+  end
+
+  # The padding check catches a wrong passphrase 255 times out of 256. This is the
+  # remaining case: correctly padded plaintext that is not a key.
+  it 'rejects correctly padded plaintext that is not a PEM' do
+    expect { client.send(:decrypt, client.send(:encrypt, 'not a pem at all')) }
+      .to raise_error(OpenSSL::Cipher::CipherError, /wrong passphrase/)
+  end
+
+  it 'fails the same way whichever branch trips' do
+    json = client.send(:dump_keys)
+
+    expect do
+      Epics::Client.new(json, 'wrong_passphrase', 'https://example.com/ebics', 'SIZBN001', 'EBIX', 'EBICS')
+    end.to raise_error(OpenSSL::Cipher::CipherError)
+  end
+end

data/spec/key_file_preservation_spec.rb

@@ -0,0 +1,78 @@
+RSpec.describe 'key file preservation' do
+  let(:keyfile) { File.read(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key')) }
+  let(:url) { 'https://example.com/ebics' }
+
+  def load_client(host_id)
+    Epics::Client.new(keyfile, 'secret', url, host_id, 'EBIX', 'EBICS')
+  end
+
+  def entries(client)
+    JSON.parse(client.send(:dump_keys))
+  end
+
+  context 'when host_id matches the stored bank keys' do
+    subject(:reloaded) { load_client('SIZBN001') }
+
+    it 'loads the bank keys into the keyring' do
+      expect(reloaded.bank_authentication_key).not_to be_nil
+      expect(reloaded.bank_encryption_key).not_to be_nil
+    end
+
+    it 'writes every entry back' do
+      expect(entries(reloaded).keys).to match_array(JSON.parse(keyfile).keys)
+    end
+  end
+
+  # A renamed host, a reused key file or a case difference leaves the bank entries
+  # unrecognised. They must survive the round-trip regardless.
+  context 'when host_id does not match the stored bank keys' do
+    subject(:reloaded) { load_client('OTHERHOST') }
+
+    it 'cannot place the bank keys' do
+      expect(reloaded.bank_authentication_key).to be_nil
+    end
+
+    it 'still writes every entry back' do
+      expect(entries(reloaded).keys).to match_array(JSON.parse(keyfile).keys)
+    end
+
+    it 'leaves the unplaced entries untouched' do
+      original = JSON.parse(keyfile)
+      written = entries(reloaded)
+
+      %w[SIZBN001.E002 SIZBN001.X002].each do |name|
+        expect(written[name]).to eq(original[name])
+      end
+    end
+
+    it 'warns rather than dropping them silently' do
+      expect { load_client('OTHERHOST') }
+        .to output(/keeping "SIZBN001.E002" in the key file unchanged/).to_stderr
+    end
+  end
+
+  # A key written by an older EBICS version, still decryptable but of a version this
+  # gem no longer builds signatures for.
+  context 'with an entry of an unknown signature version' do
+    let(:original) { JSON.parse(File.read(File.join(File.dirname(__FILE__), 'fixtures', 'SIZBN001.key'))) }
+    let(:keyfile) { JSON.pretty_generate(original.merge('A004' => original['A006'])) }
+
+    it 'keeps it' do
+      reloaded = nil
+      expect { reloaded = load_client('SIZBN001') }.to output(/A004/).to_stderr
+      expect(entries(reloaded)['A004']).to eq(original['A006'])
+    end
+
+    it 'still loads the keys it does understand' do
+      reloaded = nil
+      expect { reloaded = load_client('SIZBN001') }.to output(/A004/).to_stderr
+      expect(reloaded.signature_key).not_to be_nil
+    end
+  end
+
+  # A wrong passphrase must still fail loudly rather than being kept as unmapped.
+  it 'raises on an undecryptable key file' do
+    expect { Epics::Client.new(keyfile, 'wrong', url, 'SIZBN001', 'EBIX', 'EBICS') }
+      .to raise_error(OpenSSL::Cipher::CipherError)
+  end
+end