ey-hmac 2.1.0 → 2.4.0

data/lib/ey-hmac/adapter.rb

@@ -1,12 +1,22 @@
+# frozen_string_literal: true
+
 # This class is responsible for forming the canonical string to used to sign requests
 # @abstract override methods {#method}, {#path}, {#body}, {#content_type} and {#content_digest}
 class Ey::Hmac::Adapter
-  AUTHORIZATION_REGEXP = /\w+ ([^:]+):(.+)$/
+  AUTHORIZATION_REGEXP = /\w+ ([^:]+):(.+)$/.freeze
+  DEFAULT_CANONICALIZE_WITH = %i[method content_type content_digest date path].freeze
 
-  autoload :Rack, "ey-hmac/adapter/rack"
-  autoload :Faraday, "ey-hmac/adapter/faraday"
+  autoload :Rack, 'ey-hmac/adapter/rack'
+  autoload :Faraday, 'ey-hmac/adapter/faraday'
 
-  attr_reader :request, :options, :authorization_header, :service, :sign_with, :accept_digests
+  attr_reader :request,
+              :options,
+              :authorization_header,
+              :service,
+              :sign_with,
+              :accept_digests,
+              :include_query_string,
+              :canonicalize_with
 
   # @param [Object] request signer-specific request implementation
   # @option options [Integer] :version signature version
@@ -14,15 +24,21 @@ class Ey::Hmac::Adapter
   # @option options [String] :authorization_header ('Authorization') Authorization header key.
   # @option options [String] :server ('EyHmac') service name prefixed to {#authorization}. set to {#service}
   # @option options [Symbol] :sign_with (:sha_256) outgoing signature digest algorithm. See {OpenSSL::Digest#new}
+  # @option options [Symbol] :include_query_string (false) canonicalize with the request query string.
   # @option options [Array] :accepted_digests ([:sha_256]) accepted incoming signature digest algorithm. See {OpenSSL::Digest#new}
-  def initialize(request, options={})
-    @request, @options = request, options
+  def initialize(request, options = {})
+    @request = request
+    @options = options
 
     @ttl                  = options[:ttl]
     @authorization_header = options[:authorization_header] || 'Authorization'
     @service              = options[:service] || 'EyHmac'
     @sign_with            = options[:sign_with] || :sha256
-    @accept_digests       = Array(options[:accept_digests] || :sha256)
+    @include_query_string = options.fetch(:include_query_string, false)
+    @accept_digests = Array(options[:accept_digests] || :sha256)
+
+    @canonicalize_with = DEFAULT_CANONICALIZE_WITH
+    @canonicalize_with += :query_string if include_query_string
   end
 
   # In order for the server to correctly authorize the request, the client and server MUST AGREE on this format
@@ -30,14 +46,18 @@ class Ey::Hmac::Adapter
   # default canonical string formation is '{#method}\\n{#content_type}\\n{#content_digest}\\n{#date}\\n{#path}'
   # @return [String] canonical string used to form the {#signature}
   def canonicalize
-    [method, content_type, content_digest, date, path].join("\n")
+    canonicalize_with.map { |message| public_send(message) }.join("\n")
   end
 
   # @param [String] key_secret private HMAC key
   # @param [String] signature digest hash function. Defaults to #sign_with
   # @return [String] HMAC signature of {#request}
-  def signature(key_secret, digest = self.sign_with)
-    Base64.encode64(OpenSSL::HMAC.digest(OpenSSL::Digest.new(digest.to_s), key_secret, canonicalize)).strip
+  def signature(key_secret, digest = sign_with)
+    Base64.strict_encode64(
+      OpenSSL::HMAC.digest(
+        OpenSSL::Digest.new(digest.to_s), key_secret, canonicalize
+      )
+    ).strip
   end
 
   # @param [String] key_id public HMAC key
@@ -104,7 +124,7 @@ class Ey::Hmac::Adapter
   # @yieldparam key_id [String] public HMAC key
   # @return [Boolean] true if block yields matching private key and signature matches, else false
   # @see #authenticated!
-  def authenticated?(options={}, &block)
+  def authenticated?(_options = {}, &block)
     authenticated!(&block)
   rescue Ey::Hmac::Error
     false
@@ -112,43 +132,63 @@ class Ey::Hmac::Adapter
 
   # @see Ey::Hmac#authenticate!
   def authenticated!(&block)
-    unless authorization_match = AUTHORIZATION_REGEXP.match(authorization_signature)
-      raise(Ey::Hmac::MissingAuthorization, "Failed to parse authorization_signature #{authorization_signature}")
-    end
+    key_id, signature_value = check_signature!
+    key_secret = block.call(key_id)
 
-    key_id          = authorization_match[1]
-    signature_value = authorization_match[2]
-
-    unless key_secret = block.call(key_id)
-      raise(Ey::Hmac::MissingSecret, "Failed to find secret matching #{key_id.inspect}")
+    unless key_secret
+      raise Ey::Hmac::MissingSecret,
+            "Failed to find secret matching #{key_id.inspect}"
     end
 
-    unless @ttl.nil?
-      expiry = Time.parse(date).to_i + @ttl
-      current_time = Time.now.to_i
-      unless expiry > current_time
-        raise(Ey::Hmac::ExpiredHmac, "Signature has expired passed #{expiry}. Current time is #{current_time}")
-      end
-    end
+    check_ttl!
 
-    calculated_signatures = self.accept_digests.map { |ad| signature(key_secret, ad) }
+    matching_signature =
+      accept_digests
+      .lazy
+      .map { |ad| signature(key_secret, ad) }
+      .any? { |cs| secure_compare(signature_value, cs) }
+
+    raise Ey::Hmac::SignatureMismatch unless matching_signature
 
-    unless calculated_signatures.any? { |cs| secure_compare(signature_value, cs) }
-      raise(Ey::Hmac::SignatureMismatch, "Calculated signature #{signature_value} does not match #{calculated_signatures.inspect} using #{canonicalize.inspect}")
-    end
     true
   end
   alias authenticate! authenticated!
 
+  protected
+
   # Constant time string comparison.
   # pulled from https://github.com/rack/rack/blob/master/lib/rack/utils.rb#L399
   def secure_compare(a, b)
     return false unless a.bytesize == b.bytesize
 
-    l = a.unpack("C*")
+    l = a.unpack('C*')
+
+    r = 0
+    i = -1
+    b.each_byte { |v| r |= v ^ l[i += 1] }
+    r.zero?
+  end
+
+  def check_ttl!
+    if @ttl && date
+      expiry       = Time.parse(date).to_i + @ttl
+      current_time = Time.now.to_i
+
+      unless expiry > current_time
+        raise Ey::Hmac::ExpiredHmac,
+              "Signature has expired passed #{expiry}. Current time is #{current_time}"
+      end
+    end
+  end
+
+  def check_signature!
+    authorization_match = AUTHORIZATION_REGEXP.match(authorization_signature)
+
+    unless authorization_match
+      raise Ey::Hmac::MissingAuthorization,
+            "Failed to parse authorization_signature #{authorization_signature}"
+    end
 
-    r, i = 0, -1
-    b.each_byte { |v| r |= v ^ l[i+=1] }
-    r == 0
+    [authorization_match[1], authorization_match[2]]
   end
 end

data/lib/ey-hmac/faraday.rb

@@ -1,21 +1,24 @@
+# frozen_string_literal: true
+
 require 'ey-hmac'
 require 'faraday'
 
-class Ey::Hmac::Faraday < Faraday::Response::Middleware
-  dependency("ey-hmac")
+class Ey::Hmac::Faraday < Faraday::Middleware
+  dependency('ey-hmac') if respond_to?(:dependency)
 
   attr_reader :key_id, :key_secret, :options
 
   def initialize(app, key_id, key_secret, options = {})
     super(app)
-    @key_id, @key_secret = key_id, key_secret
+    @key_id = key_id
+    @key_secret = key_secret
     @options = options
   end
 
   def call(env)
-    Ey::Hmac.sign!(env, key_id, key_secret, {adapter: Ey::Hmac::Adapter::Faraday}.merge(options))
+    Ey::Hmac.sign!(env, key_id, key_secret, { adapter: Ey::Hmac::Adapter::Faraday }.merge(options))
     @app.call(env)
   end
 end
 
-Faraday::Middleware.register_middleware :hmac => Ey::Hmac::Faraday
+Faraday::Middleware.register_middleware hmac: Ey::Hmac::Faraday

data/lib/ey-hmac/rack.rb

@@ -1,10 +1,13 @@
+# frozen_string_literal: true
+
 # Request middleware that performs HMAC request signing
 class Ey::Hmac::Rack
   attr_reader :key_id, :key_secret, :options
 
   def initialize(app, key_id, key_secret, options = {})
     @app = app
-    @key_id, @key_secret = key_id, key_secret
+    @key_id = key_id
+    @key_secret = key_secret
     @options = options
   end
 

data/lib/ey-hmac/version.rb

@@ -1,5 +1,7 @@
-module Ey
+# frozen_string_literal: true
+
+module Ey # rubocop:disable Style/ClassAndModuleChildren
   module Hmac
-    VERSION = "2.1.0"
+    VERSION = '2.4.0'
   end
 end

data/lib/ey-hmac.rb

@@ -1,103 +1,102 @@
-require "ey-hmac/version"
+# frozen_string_literal: true
+
+require 'ey-hmac/version'
 
 require 'base64'
 require 'digest/md5'
 require 'openssl'
 require 'time'
 
-module Ey
-  module Hmac
-    Error = Class.new(StandardError)
-
-    MissingSecret        = Class.new(Error)
-    MissingAuthorization = Class.new(Error)
-    SignatureMismatch    = Class.new(Error)
-    ExpiredHmac          = Class.new(Error)
-
-    autoload :Adapter, "ey-hmac/adapter"
-    autoload :Faraday, "ey-hmac/faraday"
-    autoload :Rack, "ey-hmac/rack"
-
-    def self.default_adapter=(default_adapter)
-      @default_adapter = default_adapter
-    end
-
-    def self.default_adapter
-      @default_adapter ||= begin
-                             if defined?(Rack) || defined?(Rails)
-                               Ey::Hmac::Adapter::Rack
-                             elsif defined?(Faraday)
-                               Ey::Hmac::Adapter::Rails
-                             end
-                           end
-    end
-
-    # Signs request by calculating signature and adding it to the specified header
-    # @example
-    #   Ey::Hmac.sign!(env, @key_id, @key_secret)
-    #
-    # @see Ey::Hmac::Adapter#sign!
-    #
-    # @param request [Hash] request environment
-    # @option options [Ey::Hmac::Adapter] :adapter (#{default_adapter}) adapter to sign request with
-    # @option options [Integer] :version (nil) signature version
-    # @option options [String] :authorization_header ('Authorization') Authorization header key.
-    # @option options [String] :service ('EyHmac') service name prefixed to {Ey::Hmac::Adapter#authorization}
-    #
-    # @return [String] authorization signature
-    def self.sign!(request, key_id, key_secret, options={})
-      adapter = options[:adapter] || Ey::Hmac.default_adapter
-
-      raise ArgumentError, "Missing adapter and Ey::Hmac.default_adapter" unless adapter
-
-      adapter.new(request, options).sign!(key_id, key_secret)
-    end
-
-    # @example
-    #   Ey::Hmac.authenticated? do |key_id|
-    #     @consumer = Consumer.where(auth_id: key_id).first
-    #     @consumer && @consumer.auth_key
-    #   end
-    #
-    # @see Ey::Hmac::Adapter#authenticated?
-    # @see Ey::Hmac#authenticate!
-    #
-    # @param request [Hash] request environment
-    # @option options [Ey::Hmac::Adapter] :adapter ({#default_adapter}) adapter to verify request with
-    # @yieldparam key_id [String] public HMAC key
-    #
-    # @return [Boolean] success of authentication
-    def self.authenticated?(request, options={}, &block)
-      adapter = options[:adapter] || Ey::Hmac.default_adapter
-
-      raise ArgumentError, "Missing adapter and Ey::Hmac.default_adapter" unless adapter
-
-      adapter.new(request, options).authenticated?(&block)
-    end
-
-    # Check {Ey::Hmac::Adapter#authorization_signature} against calculated {Ey::Hmac::Adapter#signature}
-    # @example
-    #   Ey::Hmac.authenticate! do |key_id|
-    #     @consumer = Consumer.where(auth_id: key_id).first
-    #     @consumer && @consumer.auth_key
-    #   end
-    #
-    # @see Ey::Hmac::Adapter#authenticate!
-    #
-    # @param request [Hash] request environment
-    # @yieldparam key_id [String] public HMAC key
-    # @option options [Ey::Hmac::Adapter] :adapter ({#default_adapter}) adapter to verify request with
-    #
-    # @raise [SignatureMismatch] if the value of {Ey::Hmac::Adapter#authorization_signature} does not match {Ey::Hmac::Adapter#signature}
-    # @raise [MissingSecret] if the block does not return a private key matching +key_id+
-    # @raise [MissingAuthorization] if the value of {Ey::Hmac::Adapter#authorization_signature} is nil
-    # @return [TrueClass] if authentication was successful
-    def self.authenticate!(request, options={}, &block)
-      adapter = options[:adapter] || Ey::Hmac.default_adapter
-
-      raise ArgumentError, "Missing adapter and Ey::Hmac.default_adapter" unless adapter
-
-      adapter.new(request, options).authenticate!(&block)
-    end
+module Ey::Hmac
+  Error = Class.new(StandardError)
+
+  MissingSecret        = Class.new(Error)
+  MissingAuthorization = Class.new(Error)
+  SignatureMismatch    = Class.new(Error)
+  ExpiredHmac          = Class.new(Error)
+
+  autoload :Adapter, 'ey-hmac/adapter'
+  autoload :Faraday, 'ey-hmac/faraday'
+  autoload :Rack, 'ey-hmac/rack'
+
+  def self.default_adapter=(default_adapter)
+    @default_adapter = default_adapter
+  end
+
+  def self.default_adapter
+    @default_adapter ||= if defined?(::Rack) || defined?(::Rails)
+                           Ey::Hmac::Adapter::Rack
+                         elsif defined?(::Faraday)
+                           Ey::Hmac::Adapter::Faraday
+                         end
+  end
+
+  # Signs request by calculating signature and adding it to the specified header
+  # @example
+  #   Ey::Hmac.sign!(env, @key_id, @key_secret)
+  #
+  # @see Ey::Hmac::Adapter#sign!
+  #
+  # @param request [Hash] request environment
+  # @option options [Ey::Hmac::Adapter] :adapter (#{default_adapter}) adapter to sign request with
+  # @option options [Integer] :version (nil) signature version
+  # @option options [String] :authorization_header ('Authorization') Authorization header key.
+  # @option options [String] :service ('EyHmac') service name prefixed to {Ey::Hmac::Adapter#authorization}
+  #
+  # @return [String] authorization signature
+  def self.sign!(request, key_id, key_secret, options = {})
+    adapter = options[:adapter] || Ey::Hmac.default_adapter
+
+    raise ArgumentError, 'Missing adapter and Ey::Hmac.default_adapter' unless adapter
+
+    adapter.new(request, options).sign!(key_id, key_secret)
+  end
+
+  # @example
+  #   Ey::Hmac.authenticated? do |key_id|
+  #     @consumer = Consumer.where(auth_id: key_id).first
+  #     @consumer && @consumer.auth_key
+  #   end
+  #
+  # @see Ey::Hmac::Adapter#authenticated?
+  # @see Ey::Hmac#authenticate!
+  #
+  # @param request [Hash] request environment
+  # @option options [Ey::Hmac::Adapter] :adapter ({#default_adapter}) adapter to verify request with
+  # @yieldparam key_id [String] public HMAC key
+  #
+  # @return [Boolean] success of authentication
+  def self.authenticated?(request, options = {}, &block)
+    adapter = options[:adapter] || Ey::Hmac.default_adapter
+
+    raise ArgumentError, 'Missing adapter and Ey::Hmac.default_adapter' unless adapter
+
+    adapter.new(request, options).authenticated?(&block)
+  end
+
+  # Check {Ey::Hmac::Adapter#authorization_signature} against calculated {Ey::Hmac::Adapter#signature}
+  # @example
+  #   Ey::Hmac.authenticate! do |key_id|
+  #     @consumer = Consumer.where(auth_id: key_id).first
+  #     @consumer && @consumer.auth_key
+  #   end
+  #
+  # @see Ey::Hmac::Adapter#authenticate!
+  #
+  # @param request [Hash] request environment
+  # @yieldparam key_id [String] public HMAC key
+  # @option options [Ey::Hmac::Adapter] :adapter ({#default_adapter}) adapter to verify request with
+  #
+  # @raise [SignatureMismatch] if the value of {Ey::Hmac::Adapter#authorization_signature} does not
+  #   match {Ey::Hmac::Adapter#signature}
+  # @raise [MissingSecret] if the block does not return a private key matching +key_id+
+  # @raise [MissingAuthorization] if the value of {Ey::Hmac::Adapter#authorization_signature} is nil
+  # @return [TrueClass] if authentication was successful
+  def self.authenticate!(request, options = {}, &block)
+    adapter = options[:adapter] || Ey::Hmac.default_adapter
+
+    raise ArgumentError, 'Missing adapter and Ey::Hmac.default_adapter' unless adapter
+
+    adapter.new(request, options).authenticate!(&block)
   end
 end