epics 2.11.0 → 3.0.0.rc2

data/lib/epics/ptk.rb

@@ -1,17 +1,6 @@
 class Epics::PTK < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'PTK',
-      order_attribute: 'DZHNN',
-      order_params: !!options[:from] && !!options[:to] ? {
-        DateRange: {
-          Start: options[:from],
-          End: options[:to]
-        }
-      } : {},
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_ptk(options[:from], options[:to])
+    builder.to_xml
   end
 end

data/lib/epics/response.rb

@@ -1,6 +1,9 @@
 class Epics::Response
-  attr_accessor :doc
-  attr_accessor :client
+  # Informational body return codes. Every other 01xxxx code in Epics::Error is a
+  # failure -- 011001 is a negative acknowledgement, 011101 a segment underrun.
+  BUSINESS_OK_CODES = ['', '000000', '011000', '011301'].freeze
+
+  attr_accessor :doc, :client
 
   def initialize(client, xml)
     self.doc = Nokogiri::XML.parse(xml)
@@ -8,7 +11,7 @@ class Epics::Response
   end
 
   def technical_error?
-    !["011000", "000000"].include?(technical_code)
+    !%w[011000 000000].include?(technical_code)
   end
 
   def technical_code
@@ -16,19 +19,19 @@ class Epics::Response
   end
 
   def mutable_return_code
-    doc.xpath("//xmlns:header/xmlns:mutable/xmlns:ReturnCode", xmlns: "urn:org:ebics:H004").text
+    doc.xpath('//xmlns:header/xmlns:mutable/xmlns:ReturnCode', xmlns: client.urn_schema).text
   end
 
   def system_return_code
-    doc.xpath("//xmlns:SystemReturnCode/xmlns:ReturnCode", xmlns: 'http://www.ebics.org/H000').text
+    doc.xpath('//xmlns:SystemReturnCode/xmlns:ReturnCode', xmlns: 'http://www.ebics.org/H000').text
   end
 
   def business_error?
-    !["", "000000"].include?(business_code)
+    !BUSINESS_OK_CODES.include?(business_code)
   end
 
   def business_code
-    doc.xpath("//xmlns:body/xmlns:ReturnCode", xmlns: "urn:org:ebics:H004").text
+    doc.xpath('//xmlns:body/xmlns:ReturnCode', xmlns: client.urn_schema).text
   end
 
   def ok?
@@ -36,63 +39,84 @@ class Epics::Response
   end
 
   def last_segment?
-    !!doc.at_xpath("//xmlns:header/xmlns:mutable/*[@lastSegment='true']", xmlns: "urn:org:ebics:H004")
+    !!doc.at_xpath("//xmlns:header/xmlns:mutable/*[@lastSegment='true']", xmlns: client.urn_schema)
   end
 
   def segmented?
-    !!doc.at_xpath("//xmlns:header/xmlns:mutable/xmlns:SegmentNumber", xmlns: "urn:org:ebics:H004")
+    !!doc.at_xpath('//xmlns:header/xmlns:mutable/xmlns:SegmentNumber', xmlns: client.urn_schema)
+  end
+
+  def num_segments
+    Integer(doc.xpath('//xmlns:header/xmlns:static/xmlns:NumSegments', xmlns: client.urn_schema).text, 10)
+  rescue ArgumentError => e
+    raise Epics::InvalidResponseError.new('NumSegments', e)
   end
 
   def return_code
-    doc.xpath("//xmlns:ReturnCode", xmlns: "urn:org:ebics:H004").last.content
+    doc.xpath('//xmlns:ReturnCode', xmlns: client.urn_schema).last.content
   rescue NoMethodError
     nil
   end
 
   def report_text
-    doc.xpath("//xmlns:ReportText", xmlns: "urn:org:ebics:H004").first.content
+    doc.xpath('//xmlns:ReportText', xmlns: client.urn_schema).first.content
   end
 
   def transaction_id
-    doc.xpath("//xmlns:header/xmlns:static/xmlns:TransactionID", xmlns: 'urn:org:ebics:H004').text
+    doc.xpath('//xmlns:header/xmlns:static/xmlns:TransactionID', xmlns: client.urn_schema).text
   end
 
   def order_id
-    doc.xpath("//xmlns:header/xmlns:mutable/xmlns:OrderID", xmlns: "urn:org:ebics:H004").text
+    doc.xpath('//xmlns:header/xmlns:mutable/xmlns:OrderID', xmlns: client.urn_schema).text
   end
 
   def digest_valid?
     authenticated = doc.xpath("//*[@authenticate='true']").map(&:canonicalize).join
-    digest_value = doc.xpath("//ds:DigestValue", ds: "http://www.w3.org/2000/09/xmldsig#").first
+    digest_value = doc.xpath('//ds:DigestValue', ds: 'http://www.w3.org/2000/09/xmldsig#').first
 
-    digest = Base64.encode64(digester.digest(authenticated)).strip
+    digest = Base64.encode64(OpenSSL::Digest.digest('sha256', authenticated)).strip
 
     digest == digest_value.content
   end
 
   def signature_valid?
-    signature = doc.xpath("//ds:SignedInfo", ds: "http://www.w3.org/2000/09/xmldsig#").first.canonicalize
-    signature_value = doc.xpath("//ds:SignatureValue", ds: "http://www.w3.org/2000/09/xmldsig#").first
+    key = client.bank_authentication_key
+    raise Epics::MissingKeyError, "The bank's authentication key" if !key
 
-    client.bank_x.key.verify(digester, Base64.decode64(signature_value.content), signature)
+    signature = doc.xpath('//ds:SignedInfo', ds: 'http://www.w3.org/2000/09/xmldsig#').first.canonicalize
+    signature_value = doc.xpath('//ds:SignatureValue', ds: 'http://www.w3.org/2000/09/xmldsig#').first
+
+    key.verify(signature_value.content, signature)
   end
 
   def public_digest_valid?
-    encryption_pub_key_digest = doc.xpath("//xmlns:EncryptionPubKeyDigest", xmlns: 'urn:org:ebics:H004').first
+    key = client.encryption_key
+    raise Epics::MissingKeyError, 'The encryption key' if !key
+
+    encryption_pub_key_digest = doc.xpath('//xmlns:EncryptionPubKeyDigest', xmlns: client.urn_schema).first
 
-    client.e.public_digest == encryption_pub_key_digest.content
+    key.public_digest == encryption_pub_key_digest.content
   end
 
   def order_data
-    order_data_encrypted = Base64.decode64(doc.xpath("//xmlns:OrderData", xmlns: 'urn:org:ebics:H004').first.content)
+    decrypt_order_data(order_data_encrypted)
+  end
 
-    data = (cipher.update(order_data_encrypted) + cipher.final)
+  def order_data_encrypted
+    Base64.decode64(doc.xpath('//xmlns:OrderData', xmlns: client.urn_schema).first.content)
+  end
+
+  # Segments cannot be decrypted on their own, so pass all of them joined. Only the first
+  # response carries the transaction key.
+  def decrypt_order_data(order_data_encrypted)
+    decipher = cipher
+    data = decipher.update(order_data_encrypted) + decipher.final
 
-    Zlib::Inflate.new.inflate(data)
+    Zlib::Inflate.inflate(data)
   end
 
   def cipher
-    cipher = OpenSSL::Cipher.new("aes-128-cbc")
+    cipher = OpenSSL::Cipher.new('aes-128-cbc')
 
     cipher.decrypt
     cipher.padding = 0
@@ -101,13 +125,9 @@ class Epics::Response
   end
 
   def transaction_key
-    transaction_key_encrypted = Base64.decode64(doc.xpath("//xmlns:TransactionKey", xmlns: 'urn:org:ebics:H004').first.content)
+    transaction_key_encrypted = Base64.decode64(doc.xpath('//xmlns:TransactionKey',
+                                                          xmlns: client.urn_schema).first.content)
 
-    @transaction_key ||= client.e.key.private_decrypt(transaction_key_encrypted)
+    @transaction_key ||= client.encryption_key.key.private_decrypt(transaction_key_encrypted)
   end
-
-  def digester
-    @digester ||= OpenSSL::Digest::SHA256.new
-  end
-
 end

data/lib/epics/services/crypt_service.rb

@@ -0,0 +1,62 @@
+class Epics::Services::CryptService
+  def initialize
+    @aes_factory = Epics::Factories::Crypt::AesFactory.new
+  end
+
+  def encrypt(signature, data)
+    case signature.version
+    when Epics::Signature::A_VERSION_6, Epics::Signature::X_VERSION_2
+      signature.key.sign(data)
+    when Epics::Signature::A_VERSION_5
+      encrypt_by_rsa(signature.key, data)
+    end
+  end
+
+  def decrypt_by_key(key, encrypted)
+    aes = @aes_factory.create
+    aes.key_length = 128
+    aes.key = key
+    aes.decrypt(encrypted)
+  end
+
+  def encrypt_by_key(key, data)
+    aes = @aes_factory.create
+    aes.key_length = 128
+    aes.key = key
+    aes.encrypt(data)
+  end
+
+  def encrypt_transaction_key(key, transaction_key)
+    encrypt_by_rsa_public_key(key, transaction_key)
+  end
+
+  def hash(text, algorithm = 'sha256')
+    OpenSSL::Digest.digest(algorithm, text)
+  end
+
+  def calculate_digest(signature, algorithm = 'sha256')
+    exponent = signature.exponent.to_s(16)
+    modulus = signature.modulus.to_s(16)
+    key = calculate_key(exponent, modulus)
+
+    hash(key, algorithm)
+  end
+
+  def calculate_key(exponent, modulus)
+    [exponent.gsub(/^0*/,''), modulus.gsub(/^0*/,'')].map(&:downcase).join(' ')
+  end
+
+  def calculate_certificate_fingerprint(certificate, algorithm = 'sha256')
+    hash(certificate.to_der, algorithm)
+  end
+
+  private
+
+  def encrypt_by_rsa_public_key(key, data)
+    key.encrypt(data)
+  end
+
+  def encrypt_by_rsa(key, data)
+    key.private_encrypt(data)
+  end
+end

data/lib/epics/services/digest_resolver/base.rb

@@ -0,0 +1,30 @@
+class Epics::Services::DigestResolver::Base
+  def self.for_version(version)
+    case version
+    when Epics::Keyring::VERSION_24, Epics::Keyring::VERSION_25
+      Epics::Services::DigestResolver::V2.new
+    when Epics::Keyring::VERSION_30
+      Epics::Services::DigestResolver::V3.new
+    else
+      raise ArgumentError, "Unsupported EBICS version for DigestResolver: #{version}"
+    end
+  end
+
+  def initialize
+    @crypt_service = Epics::Services::CryptService.new
+  end
+
+  def sign_digest(signature, algorithm = 'sha256')
+    raise NotImplementedError
+  end
+
+  def confirm_digest(signature, algorithm = 'sha256')
+    raise NotImplementedError
+  end
+
+  private
+
+  def bin2hex(date)
+    date.unpack1('H*')
+  end
+end

data/lib/epics/services/digest_resolver/v2.rb

@@ -0,0 +1,13 @@
+class Epics::Services::DigestResolver::V2 < Epics::Services::DigestResolver::Base
+  def sign_digest(signature, algorithm = 'sha256')
+    @crypt_service.calculate_digest(signature.key, algorithm)
+  end
+
+  def confirm_digest(signature, algorithm = 'sha256')
+    bin2hex(if signature.certificate
+      @crypt_service.calculate_certificate_fingerprint(signature.certificate, algorithm)
+    else
+      @crypt_service.calculate_digest(signature.key, algorithm)
+    end)
+  end
+end

data/lib/epics/services/digest_resolver/v3.rb

@@ -0,0 +1,19 @@
+class Epics::Services::DigestResolver::V3 < Epics::Services::DigestResolver::Base
+  def sign_digest(signature, algorithm = 'sha256')
+    if signature.certificate
+      @crypt_service.calculate_certificate_fingerprint(signature.certificate, algorithm)
+    else
+      warn '[epics] WARNING: EBICS 3.0 sign_digest falling back to key-based digest ' \
+           "for #{signature.version}. Bank certificate may be missing -- consider running HPB."
+      @crypt_service.calculate_digest(signature.key, algorithm)
+    end
+  end
+
+  def confirm_digest(signature, algorithm = 'sha256')
+    bin2hex(if signature.certificate
+              @crypt_service.calculate_certificate_fingerprint(signature.certificate, algorithm)
+            else
+              @crypt_service.calculate_digest(signature.key, algorithm)
+            end)
+  end
+end

data/lib/epics/services/digest_resolver.rb

@@ -0,0 +1,6 @@
+module Epics::Services::DigestResolver
+end
+
+require 'epics/services/digest_resolver/base'
+require 'epics/services/digest_resolver/v2'
+require 'epics/services/digest_resolver/v3'

data/lib/epics/services.rb

@@ -0,0 +1,5 @@
+module Epics::Services
+end
+
+require 'epics/services/crypt_service'
+require 'epics/services/digest_resolver'

data/lib/epics/signature.rb

@@ -0,0 +1,50 @@
+class Epics::Signature
+  A_VERSION_5 = 'A005'
+  A_VERSION_6 = 'A006'
+  E_VERSION_2 = 'E002'
+  X_VERSION_2 = 'X002'
+
+  A_VERSIONS = [A_VERSION_5, A_VERSION_6]
+  E_VERSIONS = [E_VERSION_2]
+  X_VERSIONS = [X_VERSION_2]
+
+  TYPE_A = 'A'
+  TYPE_X = 'X'
+  TYPE_E = 'E'
+
+  TYPES = [TYPE_A, TYPE_X, TYPE_E]
+
+  attr_reader :type, :version
+  attr_accessor :key, :certificate
+
+  def initialize(version, key)
+    self.key = key
+    self.version = version
+  end
+
+  def version=(value)
+    @type = value[0]
+    raise UnknownTypeError, type unless TYPES.include?(type)
+
+    @version = value
+    raise UnknownVersionError, version unless self.class.const_get("#{type}_VERSIONS").include?(version)
+  end
+
+  class UnknownVersionError < StandardError
+    attr_reader :version
+
+    def initialize(version)
+      @version = version
+      super("Unsupported version: #{version}")
+    end
+  end
+
+  class UnknownTypeError < StandardError
+    attr_reader :type
+
+    def initialize(type)
+      @type = type
+      super("Unsupported type: #{type}")
+    end
+  end
+end

data/lib/epics/{key.rb → signature_algorithm/base.rb}

@@ -1,12 +1,8 @@
-class Epics::Key
+class Epics::SignatureAlgorithm::Base
   attr_accessor :key
 
   def initialize(encoded_key, passphrase = nil)
-    if encoded_key.kind_of?(OpenSSL::PKey::RSA)
-      self.key = encoded_key
-    else
-      self.key = OpenSSL::PKey::RSA.new(encoded_key)
-    end
+    self.key = encoded_key
   end
 
   ###
@@ -15,33 +11,30 @@ class Epics::Key
   # calculate digest (SHA256)
   # encode as Base64
   ####
+  # TODO: remove this method
   def public_digest
     c = [ e.gsub(/^0*/,''), n.gsub(/^0*/,'') ].map(&:downcase).join(" ")
 
     Base64.encode64(digester.digest(c)).strip
   end
 
-  def n
-    self.key.n.to_s(16)
+  def exponent
+    raise NotImplementedError
   end
 
-  def e
-    self.key.e.to_s(16)
+  def modulus
+    raise NotImplementedError
   end
 
-  def sign(msg)
-    Base64.encode64(
-      key.sign_pss(
-        'SHA256',
-        msg,
-        salt_length: :digest,
-        mgf1_hash:   'SHA256',
-      ),
-    ).gsub("\n", '')
+  def encrypt(data)
+    raise NotImplementedError
   end
 
-  def digester
-    @digester ||= OpenSSL::Digest::SHA256.new
+  def sign(msg)
+    raise NotImplementedError
   end
 
+  def verify(signature, msg)
+    raise NotImplementedError
+  end
 end

data/lib/epics/signature_algorithm/rsa.rb

@@ -0,0 +1,50 @@
+class Epics::SignatureAlgorithm::Rsa < Epics::SignatureAlgorithm::Base
+  HASH_ALGORITHM = 'sha256'
+
+  def initialize(encoded_key, passphrase = nil)
+    if encoded_key.kind_of?(OpenSSL::PKey::RSA)
+      self.key = encoded_key
+    else
+      self.key = OpenSSL::PKey::RSA.new(encoded_key)
+    end
+  end
+
+  def exponent
+    key.e
+  end
+
+  # TODO: remove this method
+  def e
+    exponent.to_s(16)
+  end
+
+  def modulus
+    key.n
+  end
+
+  # TODO: remove this method
+  def n
+    modulus.to_s(16)
+  end
+
+  def mgf1_hash_algorithm
+    OpenSSL::Digest.new(HASH_ALGORITHM)
+  end
+
+  def hash_algorithm
+    OpenSSL::Digest.new(HASH_ALGORITHM)
+  end
+
+  def encrypt(data)
+    key.public_encrypt(data)
+  end
+
+  def private_encrypt(data)
+    key.private_encrypt(data)
+  end
+
+  # TODO: remove this method
+  def digester
+    @digester ||= OpenSSL::Digest::SHA256.new
+  end
+end

data/lib/epics/signature_algorithm/rsapkcs1.rb

@@ -0,0 +1,16 @@
+class Epics::SignatureAlgorithm::RsaPkcs1 < Epics::SignatureAlgorithm::Rsa
+  def sign(msg)
+    key.sign(
+      hash_algorithm,
+      msg
+    )
+  end
+
+  def verify(signature, msg)
+    key.verify(
+      hash_algorithm,
+      Base64.decode64(signature),
+      msg
+    )
+  end
+end

data/lib/epics/signature_algorithm/rsapss.rb

@@ -0,0 +1,20 @@
+class Epics::SignatureAlgorithm::RsaPss < Epics::SignatureAlgorithm::Rsa
+  def sign(msg)
+    key.sign_pss(
+      hash_algorithm,
+      msg,
+      salt_length: :digest,
+      mgf1_hash:   mgf1_hash_algorithm,
+    )
+  end
+
+  def verify(signature, msg)
+    key.verify_pss(
+      hash_algorithm,
+      Base64.decode64(signature),
+      msg,
+      salt_length: :digest,
+      mgf1_hash:   mgf1_hash_algorithm,
+    )
+  end
+end

data/lib/epics/signature_algorithm.rb

@@ -0,0 +1,2 @@
+module Epics::SignatureAlgorithm
+end

data/lib/epics/sta.rb

@@ -1,17 +1,6 @@
 class Epics::STA < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'STA',
-      order_attribute: 'DZHNN',
-      order_params: !!options[:from] && !!options[:to] ? {
-        DateRange: {
-          Start: options[:from],
-          End: options[:to]
-        }
-      } : {},
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_sta(options[:from], options[:to])
+    builder.to_xml
   end
 end

data/lib/epics/version.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
 module Epics
-  VERSION = '2.11.0'
+
+  VERSION = '3.0.0.rc2'
+
 end

data/lib/epics/vmk.rb

@@ -1,17 +1,6 @@
 class Epics::VMK < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'VMK',
-      order_attribute: 'DZHNN',
-      order_params: !!options[:from] && !!options[:to] ? {
-        DateRange: {
-          Start: options[:from],
-          End: options[:to]
-        }
-      } : {},
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_vmk(options[:from], options[:to])
+    builder.to_xml
   end
 end

data/lib/epics/wss.rb

@@ -1,13 +1,7 @@
 class Epics::WSS < Epics::GenericRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'WSS',
-      order_attribute: 'DZHNN',
-      order_params: {},
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_wss
+    builder.to_xml
   end
 end
 

data/lib/epics/xct.rb

@@ -1,13 +1,6 @@
 class Epics::XCT < Epics::GenericUploadRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'XCT',
-      order_attribute: 'OZHNN',
-      order_params: {},
-      num_segments: 1,
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_xct(document_digest, transaction_key, **options)
+    builder.to_xml
   end
 end

data/lib/epics/xds.rb

@@ -1,13 +1,6 @@
 class Epics::XDS < Epics::GenericUploadRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'XDS',
-      order_attribute: 'OZHNN',
-      order_params: {},
-      num_segments: 1,
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_xds(document_digest, transaction_key, **options)
+    builder.to_xml
   end
 end

data/lib/epics/xe2.rb

@@ -1,13 +1,6 @@
 class Epics::XE2 < Epics::GenericUploadRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'XE2',
-      order_attribute: 'OZHNN',
-      order_params: {},
-      num_segments: 1,
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_xe2(document_digest, transaction_key, **options)
+    builder.to_xml
   end
 end

data/lib/epics/xe3.rb

@@ -1,13 +1,6 @@
 class Epics::XE3 < Epics::GenericUploadRequest
-  def header
-    client.header_request.build(
-      nonce: nonce,
-      timestamp: timestamp,
-      order_type: 'XE3',
-      order_attribute: 'OZHNN',
-      order_params: {},
-      num_segments: 1,
-      mutable: { TransactionPhase: 'Initialisation' }
-    )
+  def to_xml
+    builder = request_factory.create_xe3(document_digest, transaction_key, **options)
+    builder.to_xml
   end
 end