escher 0.0.6 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fafe8251429eca34659b05cbfd03b41806151ddb
-  data.tar.gz: e72cc2f8a09062dad8135608f592be74aa40e257
+  metadata.gz: 3076cb75aeec8d2b0bed7769215425f78e772c66
+  data.tar.gz: 30f7f2a24e421f7ff31fb73cc0cc1c96efb337b3
 SHA512:
-  metadata.gz: bf8f4c964e4b95519ffa8ef0c71efe76aaef857d3687fc77c487e21d46536953f050f63c7fcc1fa65100d6c0d3789004376d0ae88c9415e8da2ba2d08fc755db
-  data.tar.gz: 592b9154e1475bddef6b956aa4875b684b1e40cd3d014a990af1282c9940522a1d88871679f83a82607bc464eea937488e901013de5cf2e3a100467f2bbc58d8
+  metadata.gz: 3491c84f589d3505d461610e6d23925f186f6b1cd76af3a08277a480cb974f92cc813b12d904e3d035b062435384227954a594f9aa6c81dac616dfa7a0608067
+  data.tar.gz: fde96a3a6e197c600e0c0c89d21137a98e01ccbf540ffd96b3589c1a8452c15418b6c9f7642c2cdaf073d7b4804c4401245015f656385c1e9fdbe45baf8dbcc9

data/lib/escher/base.rb

@@ -0,0 +1,324 @@
+require 'escher/version'
+
+require 'time'
+require 'digest'
+require 'pathname'
+require 'addressable/uri'
+
+class EscherError < RuntimeError
+end
+
+class Escher
+
+  def initialize(credential_scope, options)
+    @credential_scope = credential_scope
+    @algo_prefix      = options[:algo_prefix]      || 'ESR'
+    @vendor_key       = options[:vendor_key]       || 'Escher'
+    @hash_algo        = options[:hash_algo]        || 'SHA256'
+    @current_time     = options[:current_time]     || Time.now
+    @auth_header_name = options[:auth_header_name] || 'X-Escher-Auth'
+    @date_header_name = options[:date_header_name] || 'X-Escher-Date'
+    @clock_skew       = options[:clock_skew]       || 900
+  end
+
+  def sign!(req, client)
+    request = EscherRequest.new(req)
+    auth_header = generate_auth_header(client, request.method, uri_parsed.host, uri_parsed.path, request.body || '', request.to_enum.to_a, [])
+
+    request.set_header('Host', request.host) # TODO: we shouldn't remove port from Host here
+    request.set_header(@date_header_name, format_date_for_header)
+    request.set_header(@auth_header_name, auth_header)
+    request
+  end
+
+  def is_valid?(*args)
+    begin
+      authenticate(*args)
+      return true
+    rescue
+      return false
+    end
+  end
+
+  def authenticate(req, key_db)
+    request = EscherRequest.new(req)
+    method = request.method
+    body = request.body
+    headers = request.headers
+    path = request.path
+    query_parts = request.query_values
+
+    signature_from_query = get_signing_param('Signature', query_parts)
+
+    validate_headers(headers, !signature_from_query)
+
+    if method == 'GET' && signature_from_query
+      raw_date = get_signing_param('Date', query_parts)
+      algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires = get_auth_parts_from_query(query_parts)
+
+      body = 'UNSIGNED-PAYLOAD'
+      query_parts.delete [query_key_for('Signature'), signature]
+      query_parts = query_parts.map { |k, v| [uri_decode(k), uri_decode(v)] }
+    else
+      raw_date = get_header(@date_header_name, headers)
+      auth_header = get_header(@auth_header_name, headers)
+      algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires = get_auth_parts_from_header(auth_header)
+    end
+
+    date = Time.parse(raw_date)
+    api_secret = key_db[api_key_id]
+
+    raise EscherError, 'Invalid API key' unless api_secret
+    raise EscherError, 'Only SHA256 and SHA512 hash algorithms are allowed' unless %w(SHA256 SHA512).include?(algorithm)
+    raise EscherError, 'Invalid request date' unless short_date(date) == short_date
+    raise EscherError, 'The request date is not within the accepted time range' unless is_date_within_range?(date, expires)
+    raise EscherError, 'Invalid credentials' unless credential_scope == @credential_scope
+    raise EscherError, 'Host header is not signed' unless signed_headers.include? 'host'
+    raise EscherError, 'Only the host header should be signed' if signature_from_query && signed_headers != ['host']
+    raise EscherError, 'Date header is not signed' if !signature_from_query && !signed_headers.include?(@date_header_name.downcase)
+
+    escher = reconfig(algorithm, credential_scope, date)
+    expected_signature = escher.generate_signature(api_secret, body, headers, method, signed_headers, path, query_parts)
+    raise EscherError, 'The signatures do not match' unless signature == expected_signature
+    api_key_id
+  end
+
+  def validate_headers(headers, authenticated_by_header)
+    (['Host'] + (authenticated_by_header ? [@auth_header_name, @date_header_name] : [])).each do |header|
+      raise EscherError, 'Missing header: ' + header unless get_header(header, headers)
+    end
+  end
+
+  def reconfig(algorithm, credential_scope, date)
+    Escher.new(
+        credential_scope,
+        algo_prefix: @algo_prefix,
+        vendor_key: @vendor_key,
+        hash_algo: algorithm,
+        auth_header_name: @auth_header_name,
+        date_header_name: @date_header_name,
+        current_time: date
+    )
+  end
+
+  def generate_auth_header(client, method, host, request_uri, body, headers, headers_to_sign)
+    path, query_parts = parse_uri(request_uri)
+    headers = add_defaults_to(headers, host)
+    headers_to_sign |= [@date_header_name.downcase, 'host']
+    signature = generate_signature(client[:api_secret], body, headers, method, headers_to_sign, path, query_parts)
+    "#{get_algorithm_id} Credential=#{client[:api_key_id]}/#{short_date(@current_time)}/#{@credential_scope}, SignedHeaders=#{prepare_headers_to_sign headers_to_sign}, Signature=#{signature}"
+  end
+
+  def generate_signed_url(url_to_sign, client, expires = 86400)
+    uri = Addressable::URI.parse(url_to_sign)
+    protocol = uri.scheme
+    host = uri.host
+    path = uri.path
+    query_parts = parse_query(uri.query)
+
+    headers = [['host', host]]
+    headers_to_sign = ['host']
+    body = 'UNSIGNED-PAYLOAD'
+    query_parts += get_signing_params(client, expires, headers_to_sign)
+
+    signature = generate_signature(client[:api_secret], body, headers, 'GET', headers_to_sign, path, query_parts)
+    query_parts_with_signature = (query_parts.map { |k, v| [uri_encode(k), uri_encode(v)] } << query_pair('Signature', signature))
+
+    protocol + '://' + host + path + '?' + query_parts_with_signature.map { |k, v| k + '=' + v }.join('&')
+  end
+
+  def get_signing_params(client, expires, headers_to_sign)
+    [
+        ['Algorithm', get_algorithm_id],
+        ['Credentials', "#{client[:api_key_id]}/#{short_date(@current_time)}/#{@credential_scope}"],
+        ['Date', long_date(@current_time)],
+        ['Expires', expires.to_s],
+        ['SignedHeaders', headers_to_sign.join(';')],
+    ].map { |k, v| query_pair(k, v) }
+  end
+
+  def query_pair(k, v)
+    [query_key_for(k), v]
+  end
+
+  def query_key_for(key)
+    "X-#{@vendor_key}-#{key}"
+  end
+
+  def query_key_truncate(key)
+    key[@vendor_key.length + 3..-1]
+  end
+
+  def get_header(header_name, headers)
+    the_header = (headers.detect { |header| header[0].downcase == header_name.downcase })
+    the_header ? the_header[1] : nil
+  end
+
+  def get_signing_param(key, query_parts)
+    the_param = (query_parts.detect { |param| param[0] === query_key_for(key) })
+    the_param ? uri_decode(the_param[1]) : nil
+  end
+
+  def get_auth_parts_from_header(auth_header)
+    m = /#{@algo_prefix}-HMAC-(?<algo>[A-Z0-9\,]+) Credential=(?<api_key_id>[A-Za-z0-9\-_]+)\/(?<short_date>[0-9]{8})\/(?<credentials>[A-Za-z0-9\-_\/]+), SignedHeaders=(?<signed_headers>[A-Za-z\-;]+), Signature=(?<signature>[0-9a-f]+)$/
+    .match auth_header
+    raise EscherError, 'Malformed authorization header' unless m && m['credentials']
+    return m['algo'], m['api_key_id'], m['short_date'], m['credentials'], m['signed_headers'].split(';'), m['signature'], 0
+  end
+
+  def get_auth_parts_from_query(query_parts)
+    expires = get_signing_param('Expires', query_parts).to_i
+    api_key_id, short_date, credential_scope = get_signing_param('Credentials', query_parts).split('/', 3)
+    signed_headers = get_signing_param('SignedHeaders', query_parts).split ';'
+    algorithm = parse_algo(get_signing_param('Algorithm', query_parts))
+    signature = get_signing_param('Signature', query_parts)
+    return algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires
+  end
+
+  def generate_signature(api_secret, body, headers, method, signed_headers, path, query_parts)
+    canonicalized_request = canonicalize(method, path, query_parts, body, headers, signed_headers.uniq)
+    string_to_sign = get_string_to_sign(canonicalized_request)
+    signing_key = calculate_signing_key(api_secret)
+    Digest::HMAC.hexdigest(string_to_sign, signing_key, create_algo)
+  end
+
+  def add_defaults_to(headers, host)
+    [['host', host], [@date_header_name, format_date_for_header]]
+      .each { |k, v| headers = add_if_missing headers, k, v }
+    headers
+  end
+
+  def format_date_for_header
+    @date_header_name.downcase == 'date' ? @current_time.utc.rfc2822.sub('-0000', 'GMT') : long_date(@current_time)
+  end
+
+  def add_if_missing(headers, header_to_find, value)
+    headers += [header_to_find, value] unless headers.find { |header| header[0].downcase == header_to_find.downcase }
+    headers
+  end
+
+  def canonicalize(method, path, query_parts, body, headers, headers_to_sign)    [
+      method,
+      canonicalize_path(path),
+      canonicalize_query(query_parts),
+      canonicalize_headers(headers, headers_to_sign).join("\n"),
+      '',
+      prepare_headers_to_sign(headers_to_sign),
+      create_algo.new.hexdigest(body || '') # TODO: we should set the default value at the same level at every implementation
+    ].join "\n"
+  end
+
+  def prepare_headers_to_sign(headers_to_sign)
+    headers_to_sign.sort.uniq.join(';')
+  end
+
+  def parse_uri(request_uri)
+    path, query = request_uri.split '?', 2
+    return path, parse_query(query)
+  end
+
+  def parse_query(query)
+    (query || '')
+    .split('&', -1)
+    .map { |pair| pair.split('=', -1) }
+    .map { |k, v| (k.include?' ') ? [k.str(/\S+/), ''] : [k, v] }
+  end
+
+  def get_string_to_sign(canonicalized_req)
+    [
+      get_algorithm_id,
+      long_date(@current_time),
+      short_date(@current_time) + '/' + @credential_scope,
+      create_algo.new.hexdigest(canonicalized_req)
+    ].join("\n")
+  end
+
+  def create_algo
+    case @hash_algo
+      when 'SHA256'
+        return Digest::SHA2.new 256
+      when 'SHA512'
+        return Digest::SHA2.new 512
+      else
+        raise EscherError, 'Unidentified hash algorithm'
+    end
+  end
+
+  def long_date(date)
+    date.utc.strftime('%Y%m%dT%H%M%SZ')
+  end
+
+  def short_date(date)
+    date.utc.strftime('%Y%m%d')
+  end
+
+  def is_date_within_range?(request_date, expires)
+    (request_date - @clock_skew .. request_date + expires + @clock_skew).cover? @current_time
+  end
+
+  def get_algorithm_id
+    @algo_prefix + '-HMAC-' + @hash_algo
+  end
+
+  def parse_algo(algorithm)
+    m = /^#{@algo_prefix}-HMAC-(?<algo>[A-Z0-9\,]+)$/.match(algorithm)
+    m && m['algo']
+  end
+
+  def calculate_signing_key(api_secret)
+    algo = create_algo
+    signing_key = @algo_prefix + api_secret
+    key_parts = [short_date(@current_time)] + @credential_scope.split('/')
+    key_parts.each { |data|
+      signing_key = Digest::HMAC.digest(data, signing_key, algo)
+    }
+    signing_key
+  end
+
+  def canonicalize_path(path)
+    while path.gsub!(%r{([^/]+)/\.\./?}) { |match| $1 == '..' ? match : '' } do end
+    path.gsub(%r{/\./}, '/').sub(%r{/\.\z}, '/').gsub(/\/+/, '/')
+  end
+
+  def canonicalize_headers(raw_headers, headers_to_sign)
+    collect_headers(raw_headers)
+      .sort
+      .select { |h| headers_to_sign.include?(h[0]) }
+      .map { |k, v| k + ':' + v.map { |piece| normalize_white_spaces piece} .join(',') }
+  end
+
+  def normalize_white_spaces(value)
+    value.strip.split('"', -1).map.with_index { |piece, index|
+      is_inside_of_quotes = (index % 2 === 1)
+      is_inside_of_quotes ? piece : piece.gsub(/\s+/, ' ')
+    }.join '"'
+  end
+
+  def collect_headers(raw_headers)
+    headers = {}
+    raw_headers.each do |raw_header|
+      if raw_header[0].downcase != @auth_header_name.downcase
+        if headers[raw_header[0].downcase]
+          headers[raw_header[0].downcase] << raw_header[1]
+        else
+          headers[raw_header[0].downcase] = [raw_header[1]]
+        end
+      end
+    end
+    headers
+  end
+
+  def canonicalize_query(query_parts)
+    query_parts
+      .map { |k, v| uri_encode(k.gsub('+', ' ')) + '=' + uri_encode(v || '') }
+      .sort.join '&'
+  end
+
+  def uri_encode(component)
+    Addressable::URI.encode_component(component, Addressable::URI::CharacterClasses::UNRESERVED)
+  end
+
+  def uri_decode(component)
+    Addressable::URI.unencode_component(component)
+  end
+end

data/lib/escher/request.rb

@@ -0,0 +1,77 @@
+
+class EscherRequest
+
+  def initialize(request)
+    @request = request
+    @request_uri = Addressable::URI.parse(uri)
+    prepare_request_headers
+  end
+
+  def prepare_request_headers
+    @request_headers = []
+    case @request.class.to_s
+      when 'Hash'
+        @request_headers = @request[:headers]
+      when 'Sinatra::Request' # TODO: not working yet
+        @request.env.each { |key, value|
+          if key.downcase[0, 5] == "http_"
+            @request_headers += [[ key[5..-1].gsub("_", "-"), value ]]
+          end
+        }
+      when 'WEBrick::HTTPRequest'
+        @request.header.each { |key, values|
+          values.each { |value|
+            @request_headers += [[ key, value ]]
+          }
+        }
+    end
+  end
+
+  def request
+    @request
+  end
+
+  def headers
+    @request_headers
+  end
+
+  def set_header(key, value)
+    @request[key] = value
+  end
+
+  def method
+    case @request.class.to_s
+      when 'Hash'
+        @request[:method]
+      else
+        @request.request_method
+    end
+  end
+
+  def uri
+    case @request.class.to_s
+      when 'Hash'
+        @request[:uri]
+      else
+        @request.uri
+    end
+  end
+
+  def body
+    case @request.class.to_s
+      when 'Hash'
+        @request[:body]
+      else
+        @request.body
+    end
+  end
+
+  def path
+    @request_uri.path
+  end
+
+  def query_values
+    @request_uri.query_values(Array) || []
+  end
+
+end

data/lib/escher/version.rb

@@ -1,3 +1,3 @@
 class Escher
-  VERSION = "0.0.6"
+  VERSION = '0.1.0'
 end

data/lib/escher.rb

@@ -1,325 +1,3 @@
+require 'escher/base'
 require 'escher/version'
-
-require 'time'
-require 'digest'
-require 'pathname'
-require 'addressable/uri'
-
-class EscherError < RuntimeError
-end
-
-class Escher
-
-  def initialize(credential_scope, options)
-    @credential_scope = credential_scope
-    @algo_prefix      = options[:algo_prefix]      || 'ESR'
-    @vendor_key       = options[:vendor_key]       || 'Escher'
-    @hash_algo        = options[:hash_algo]        || 'SHA256'
-    @current_time     = options[:current_time]     || Time.now
-    @auth_header_name = options[:auth_header_name] || 'X-Escher-Auth'
-    @date_header_name = options[:date_header_name] || 'X-Escher-Date'
-    @clock_skew       = options[:clock_skew]       || 900
-  end
-
-  def sign!(request, client)
-    uri_parsed = URI.parse(request.path)
-    request['Host'] = uri_parsed.host # TODO: we shouldn't remove port from Host here
-    request[@date_header_name] = format_date_for_header
-    request[@auth_header_name] = generate_auth_header(client, request.method, uri_parsed.host, uri_parsed.path, request.body || '', request.to_enum.to_a, [])
-    request
-  end
-
-  def validate(request, key_db)
-    headers = []
-    request.header.each { |key, values|
-      values.each { |value|
-        headers += [[ key, value ]]
-      }
-    }
-    validate_request(key_db, request.request_method, request.path, request.body, headers)
-  end
-
-  def is_valid?(*args)
-    begin
-      validate(*args)
-      return true
-    rescue
-      return false
-    end
-  end
-
-  def validate_request(key_db, method, request_uri, body, headers)
-    path, query_parts = parse_uri(request_uri)
-    signature_from_query = get_signing_param('Signature', query_parts)
-
-    validate_headers(headers, signature_from_query)
-
-    if method == 'GET' && signature_from_query
-      raw_date = get_signing_param('Date', query_parts)
-      algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires = get_auth_parts_from_query(query_parts)
-
-      body = 'UNSIGNED-PAYLOAD'
-      query_parts.delete [query_key_for('Signature'), signature]
-      query_parts = query_parts.map { |k, v| [uri_decode(k), uri_decode(v)] }
-    else
-      raw_date = get_header(@date_header_name, headers)
-      auth_header = get_header(@auth_header_name, headers)
-      algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires = get_auth_parts_from_header(auth_header)
-    end
-
-    date = Time.parse(raw_date)
-    api_secret = key_db[api_key_id]
-
-    raise EscherError, 'Invalid API key' unless api_secret
-    raise EscherError, 'Only SHA256 and SHA512 hash algorithms are allowed' unless %w(SHA256 SHA512).include?(algorithm)
-    raise EscherError, 'Invalid request date' unless short_date(date) == short_date
-    raise EscherError, 'The request date is not within the accepted time range' unless is_date_within_range?(date, expires)
-    raise EscherError, 'Invalid credentials' unless credential_scope == @credential_scope
-    raise EscherError, 'Host header is not signed' unless signed_headers.include? 'host'
-    raise EscherError, 'Only the host header should be signed' if signature_from_query && signed_headers != ['host']
-    raise EscherError, 'Date header is not signed' if !signature_from_query && !signed_headers.include?(@date_header_name.downcase)
-
-    escher = reconfig(algorithm, credential_scope, date)
-    expected_signature = escher.generate_signature(api_secret, body, headers, method, signed_headers, path, query_parts)
-    raise EscherError, 'The signatures do not match' unless signature == expected_signature
-  end
-
-  def validate_headers(headers, using_query_string_for_validation)
-    (['Host'] + (using_query_string_for_validation ? [] : [@auth_header_name, @date_header_name])).each do |header|
-      raise EscherError, 'Missing header: ' + header unless get_header(header, headers)
-    end
-  end
-
-  def reconfig(algorithm, credential_scope, date)
-    Escher.new(
-        credential_scope,
-        algo_prefix: @algo_prefix,
-        vendor_key: @vendor_key,
-        hash_algo: algorithm,
-        auth_header_name: @auth_header_name,
-        date_header_name: @date_header_name,
-        current_time: date
-    )
-  end
-
-  def generate_auth_header(client, method, host, request_uri, body, headers, headers_to_sign)
-    path, query_parts = parse_uri(request_uri)
-    headers = add_defaults_to(headers, host)
-    headers_to_sign |= [@date_header_name.downcase, 'host']
-    signature = generate_signature(client[:api_secret], body, headers, method, headers_to_sign, path, query_parts)
-    "#{get_algorithm_id} Credential=#{client[:api_key_id]}/#{short_date(@current_time)}/#{@credential_scope}, SignedHeaders=#{prepare_headers_to_sign headers_to_sign}, Signature=#{signature}"
-  end
-
-  def generate_signed_url(url_to_sign, client, expires = 86400)
-    uri = Addressable::URI.parse(url_to_sign)
-    protocol = uri.scheme
-    host = uri.host
-    path = uri.path
-    query_parts = parse_query(uri.query)
-
-    headers = [['host', host]]
-    headers_to_sign = ['host']
-    body = 'UNSIGNED-PAYLOAD'
-    query_parts += get_signing_params(client, expires, headers_to_sign)
-
-    signature = generate_signature(client[:api_secret], body, headers, 'GET', headers_to_sign, path, query_parts)
-    query_parts_with_signature = (query_parts.map { |k, v| [uri_encode(k), uri_encode(v)] } << query_pair('Signature', signature))
-
-    protocol + '://' + host + path + '?' + query_parts_with_signature.map { |k, v| k + '=' + v }.join('&')
-  end
-
-  def get_signing_params(client, expires, headers_to_sign)
-    [
-        ['Algorithm', get_algorithm_id],
-        ['Credentials', "#{client[:api_key_id]}/#{short_date(@current_time)}/#{@credential_scope}"],
-        ['Date', long_date(@current_time)],
-        ['Expires', expires.to_s],
-        ['SignedHeaders', headers_to_sign.join(';')],
-    ].map { |k, v| query_pair(k, v) }
-  end
-
-  def query_pair(k, v)
-    [query_key_for(k), v]
-  end
-
-  def query_key_for(key)
-    "X-#{@vendor_key}-#{key}"
-  end
-
-  def query_key_truncate(key)
-    key[@vendor_key.length + 3..-1]
-  end
-
-  def get_header(header_name, headers)
-    the_header = (headers.detect { |header| header[0].downcase == header_name.downcase })
-    the_header ? the_header[1] : nil
-  end
-
-  def get_signing_param(key, query_parts)
-    the_param = (query_parts.detect { |param| param[0] === query_key_for(key) })
-    the_param ? uri_decode(the_param[1]) : nil
-  end
-
-  def get_auth_parts_from_header(auth_header)
-    m = /#{@algo_prefix}-HMAC-(?<algo>[A-Z0-9\,]+) Credential=(?<api_key_id>[A-Za-z0-9\-_]+)\/(?<short_date>[0-9]{8})\/(?<credentials>[A-Za-z0-9\-_\/]+), SignedHeaders=(?<signed_headers>[A-Za-z\-;]+), Signature=(?<signature>[0-9a-f]+)$/
-    .match auth_header
-    raise EscherError, 'Malformed authorization header' unless m && m['credentials']
-    return m['algo'], m['api_key_id'], m['short_date'], m['credentials'], m['signed_headers'].split(';'), m['signature'], 0
-  end
-
-  def get_auth_parts_from_query(query_parts)
-    expires = get_signing_param('Expires', query_parts).to_i
-    api_key_id, short_date, credential_scope = get_signing_param('Credentials', query_parts).split('/', 3)
-    signed_headers = get_signing_param('SignedHeaders', query_parts).split ';'
-    algorithm = parse_algo(get_signing_param('Algorithm', query_parts))
-    signature = get_signing_param('Signature', query_parts)
-    return algorithm, api_key_id, short_date, credential_scope, signed_headers, signature, expires
-  end
-
-  def generate_signature(api_secret, body, headers, method, signed_headers, path, query_parts)
-    canonicalized_request = canonicalize(method, path, query_parts, body, headers, signed_headers.uniq)
-    string_to_sign = get_string_to_sign(canonicalized_request)
-    signing_key = calculate_signing_key(api_secret)
-    Digest::HMAC.hexdigest(string_to_sign, signing_key, create_algo)
-  end
-
-  def add_defaults_to(headers, host)
-    [['host', host], [@date_header_name, format_date_for_header]]
-      .each { |k, v| headers = add_if_missing headers, k, v }
-    headers
-  end
-
-  def format_date_for_header
-    @date_header_name.downcase == 'date' ? @current_time.utc.rfc2822.sub('-0000', 'GMT') : long_date(@current_time)
-  end
-
-  def add_if_missing(headers, header_to_find, value)
-    headers += [header_to_find, value] unless headers.find { |header| header[0].downcase == header_to_find.downcase }
-    headers
-  end
-
-  def canonicalize(method, path, query_parts, body, headers, headers_to_sign)    [
-      method,
-      canonicalize_path(path),
-      canonicalize_query(query_parts),
-      canonicalize_headers(headers, headers_to_sign).join("\n"),
-      '',
-      prepare_headers_to_sign(headers_to_sign),
-      create_algo.new.hexdigest(body || '') # TODO: we should set the default value at the same level at every implementation
-    ].join "\n"
-  end
-
-  def prepare_headers_to_sign(headers_to_sign)
-    headers_to_sign.sort.uniq.join(';')
-  end
-
-  def parse_uri(request_uri)
-    path, query = request_uri.split '?', 2
-    return path, parse_query(query)
-  end
-
-  def parse_query(query)
-    (query || '')
-    .split('&', -1)
-    .map { |pair| pair.split('=', -1) }
-    .map { |k, v| (k.include?' ') ? [k.str(/\S+/), ''] : [k, v] }
-  end
-
-  def get_string_to_sign(canonicalized_req)
-    [
-      get_algorithm_id,
-      long_date(@current_time),
-      short_date(@current_time) + '/' + @credential_scope,
-      create_algo.new.hexdigest(canonicalized_req)
-    ].join("\n")
-  end
-
-  def create_algo
-    case @hash_algo
-      when 'SHA256'
-        return Digest::SHA2.new 256
-      when 'SHA512'
-        return Digest::SHA2.new 512
-      else
-        raise EscherError, 'Unidentified hash algorithm'
-    end
-  end
-
-  def long_date(date)
-    date.utc.strftime('%Y%m%dT%H%M%SZ')
-  end
-
-  def short_date(date)
-    date.utc.strftime('%Y%m%d')
-  end
-
-  def is_date_within_range?(request_date, expires)
-    (request_date - @clock_skew .. request_date + expires + @clock_skew).cover? @current_time
-  end
-
-  def get_algorithm_id
-    @algo_prefix + '-HMAC-' + @hash_algo
-  end
-
-  def parse_algo(algorithm)
-    m = /^#{@algo_prefix}-HMAC-(?<algo>[A-Z0-9\,]+)$/.match(algorithm)
-    m && m['algo']
-  end
-
-  def calculate_signing_key(api_secret)
-    algo = create_algo
-    signing_key = @algo_prefix + api_secret
-    key_parts = [short_date(@current_time)] + @credential_scope.split('/')
-    key_parts.each { |data|
-      signing_key = Digest::HMAC.digest(data, signing_key, algo)
-    }
-    signing_key
-  end
-
-  def canonicalize_path(path)
-    while path.gsub!(%r{([^/]+)/\.\./?}) { |match| $1 == '..' ? match : '' } do end
-    path.gsub(%r{/\./}, '/').sub(%r{/\.\z}, '/').gsub(/\/+/, '/')
-  end
-
-  def canonicalize_headers(raw_headers, headers_to_sign)
-    collect_headers(raw_headers)
-      .sort
-      .select { |k, v| headers_to_sign.include?(k) }
-      .map { |k, v| k + ':' + v.map { |piece| normalize_white_spaces piece} .join(',') }
-  end
-
-  def normalize_white_spaces(value)
-    value.strip.split('"', -1).map.with_index { |piece, index|
-      is_inside_of_quotes = (index % 2 === 1)
-      is_inside_of_quotes ? piece : piece.gsub(/\s+/, ' ')
-    }.join '"'
-  end
-
-  def collect_headers(raw_headers)
-    headers = {}
-    raw_headers.each do |raw_header|
-      if raw_header[0].downcase != @auth_header_name.downcase
-        if headers[raw_header[0].downcase]
-          headers[raw_header[0].downcase] << raw_header[1]
-        else
-          headers[raw_header[0].downcase] = [raw_header[1]]
-        end
-      end
-    end
-    headers
-  end
-
-  def canonicalize_query(query_parts)
-    query_parts
-      .map { |k, v| uri_encode(k.gsub('+', ' ')) + '=' + uri_encode(v || '') }
-      .sort.join '&'
-  end
-
-  def uri_encode(component)
-    Addressable::URI.encode_component(component, Addressable::URI::CharacterClasses::UNRESERVED)
-  end
-
-  def uri_decode(component)
-    Addressable::URI.unencode_component(component)
-  end
-end
+require 'escher/request'

data/spec/escher_spec.rb

@@ -1,4 +1,4 @@
-require'spec_helper'
+require 'spec_helper'
 
 test_suites = {
     # 'get-header-key-duplicate',
@@ -134,7 +134,12 @@ describe 'Escher' do
           'X-EMS-Signature=fbc9dbb91670e84d04ad2ae7505f4f52ab3ff9e192b8233feeae57e9022c2b67'
 
     client = {:api_key_id => 'th3K3y', :api_secret => 'very_secure'}
-    expect { escher.validate_request(key_db, 'GET', presigned_uri, 'IRRELEVANT', [%w(host example.com)]) }.not_to raise_error
+    expect { escher.authenticate({
+      :method => 'GET',
+      :headers => [%w(host example.com)],
+      :uri => presigned_uri,
+      :body => 'IRRELEVANT'
+    }, key_db) }.not_to raise_error
   end
 
   it 'should validate expiration' do
@@ -149,8 +154,12 @@ describe 'Escher' do
           'X-EMS-Signature=fbc9dbb91670e84d04ad2ae7505f4f52ab3ff9e192b8233feeae57e9022c2b67'
 
     client = {:api_key_id => 'th3K3y', :api_secret => 'very_secure'}
-    expect { escher.validate_request(key_db, 'GET', presigned_uri, 'IRRELEVANT', [%w(host example.com)]) }
-      .to raise_error(EscherError, 'The request date is not within the accepted time range')
+    expect { escher.authenticate({
+      :method => 'GET',
+      :headers => [%w(host example.com)],
+      :uri => presigned_uri,
+      :body => 'IRRELEVANT'
+    }, key_db) }.to raise_error(EscherError, 'The request date is not within the accepted time range')
   end
 
   it 'should validate request' do
@@ -159,7 +168,16 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', GOOD_AUTH_HEADER],
     ]
-    expect { call_validate_request(headers) }.not_to raise_error
+    expect { call_validate(headers) }.not_to raise_error
+  end
+
+  it 'should authenticate' do
+    headers = [
+        %w(Host host.foo.com),
+        ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
+        ['Authorization', GOOD_AUTH_HEADER],
+    ]
+    expect(call_validate(headers)).to eq 'AKIDEXAMPLE'
   end
 
   it 'should detect if signatures do not match' do
@@ -168,7 +186,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', 'AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'The signatures do not match')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'The signatures do not match')
   end
 
   it 'should detect if dates are not on the same day' do
@@ -178,7 +196,7 @@ describe 'Escher' do
         ['Date', "Mon, #{yesterday} Sep 2011 23:36:00 GMT"],
         ['Authorization', GOOD_AUTH_HEADER],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Invalid request date')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Invalid request date')
   end
 
   it 'should detect if date is not within the 15 minutes range' do
@@ -188,7 +206,7 @@ describe 'Escher' do
         ['Date', "Mon, 09 Sep 2011 23:#{long_ago}:00 GMT"],
         ['Authorization', GOOD_AUTH_HEADER],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'The request date is not within the accepted time range')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'The request date is not within the accepted time range')
   end
 
   it 'should detect missing host header' do
@@ -196,7 +214,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', GOOD_AUTH_HEADER],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Missing header: Host')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Missing header: Host')
   end
 
   it 'should detect missing date header' do
@@ -204,7 +222,7 @@ describe 'Escher' do
         %w(Host host.foo.com),
         ['Authorization', GOOD_AUTH_HEADER],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Missing header: Date')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Missing header: Date')
   end
 
   it 'should detect missing auth header' do
@@ -212,7 +230,7 @@ describe 'Escher' do
         %w(Host host.foo.com),
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Missing header: Authorization')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Missing header: Authorization')
   end
 
   it 'should detect malformed auth header' do
@@ -221,7 +239,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', 'AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=UNPARSABLE'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Malformed authorization header')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Malformed authorization header')
   end
 
   it 'should detect malformed credential scope' do
@@ -230,7 +248,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', 'AWS4-HMAC-SHA256 Credential=BAD-CREDENTIAL-SCOPE, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Malformed authorization header')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Malformed authorization header')
   end
 
   it 'should check mandatory signed headers: host' do
@@ -239,7 +257,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', 'AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Host header is not signed')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Host header is not signed')
   end
 
   it 'should check mandatory signed headers: date' do
@@ -248,7 +266,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', 'AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Date header is not signed')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Date header is not signed')
   end
 
   it 'should check algorithm' do
@@ -257,7 +275,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', 'AWS4-HMAC-INVALID Credential=AKIDEXAMPLE/20110909/us-east-1/host/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Only SHA256 and SHA512 hash algorithms are allowed')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Only SHA256 and SHA512 hash algorithms are allowed')
   end
 
   it 'should check credential scope' do
@@ -266,7 +284,7 @@ describe 'Escher' do
         ['Date', 'Mon, 09 Sep 2011 23:36:00 GMT'],
         ['Authorization', 'AWS4-HMAC-SHA256 Credential=AKIDEXAMPLE/20110909/us-east-1/INVALID/aws4_request, SignedHeaders=date;host, Signature=b27ccfbfa7df52a200ff74193ca6e32d4b48b8856fab7ebf1c595d0670a7e470'],
     ]
-    expect { call_validate_request(headers) }.to raise_error(EscherError, 'Invalid credentials')
+    expect { call_validate(headers) }.to raise_error(EscherError, 'Invalid credentials')
   end
 
   it 'should convert dates' do
@@ -274,9 +292,14 @@ describe 'Escher' do
     expect(Escher.new('irrelevant', date_header_name: 'date', current_time: Time.parse(date_str)).format_date_for_header).to eq date_str
   end
 
-  def call_validate_request(headers)
+  def call_validate(headers)
     escher = Escher.new('us-east-1/host/aws4_request', ESCHER_AWS4_OPTIONS.merge(current_time: Time.parse('Mon, 09 Sep 2011 23:40:00 GMT')))
-    escher.validate_request(key_db, 'GET', '/', '', headers)
+    escher.authenticate({
+      :method => 'GET',
+      :headers => headers,
+      :uri => '/',
+      :body => '',
+    }, key_db)
   end
 
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: escher
 version: !ruby/object:Gem::Version
-  version: 0.0.6
+  version: 0.1.0
 platform: ruby
 authors:
 - Andras Barthazi
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-09-11 00:00:00.000000000 Z
+date: 2014-09-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -82,6 +82,8 @@ files:
 - Rakefile
 - escher.gemspec
 - lib/escher.rb
+- lib/escher/base.rb
+- lib/escher/request.rb
 - lib/escher/version.rb
 - spec/aws4_testsuite/get-header-key-duplicate.authz
 - spec/aws4_testsuite/get-header-key-duplicate.creq