ey-hmac 0.0.5 → 0.1.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: d66a44d088fc9384dc6e9058dad00bb4264dcbb6
+  data.tar.gz: 0cc4a68974d4f73b2f3081c2d58e59d235456445
+SHA512:
+  metadata.gz: c3dcc933b1577141c16c55e861fc09bedba9ed6558b517a91e2d75f9a8882b3473b45222473029d4931aa2948e96b11d7396ee2e078adf108f6f4957b3952643
+  data.tar.gz: 2aa4b84886e85a7be13db759a22aa337fa566b0ca1cfd9a5f1372872b583e91d15b89179cd3b7ac2dd9779ec0e74ec29b676b17a5e1c01d40613cd66bc14eea8

data/lib/ey-hmac/adapter.rb

@@ -6,7 +6,7 @@ class Ey::Hmac::Adapter
   autoload :Rack, "ey-hmac/adapter/rack"
   autoload :Faraday, "ey-hmac/adapter/faraday"
 
-  attr_reader :request, :options, :authorization_header, :service
+  attr_reader :request, :options, :authorization_header, :service, :sign_with, :accept_digests
 
   # @param [Object] request signer-specific request implementation
   # @option options [Integer] :version signature version
@@ -16,7 +16,9 @@ class Ey::Hmac::Adapter
     @request, @options = request, options
 
     @authorization_header = options[:authorization_header] || 'Authorization'
-    @service = options[:service] || 'EyHmac'
+    @service              = options[:service] || 'EyHmac'
+    @sign_with            = options[:sign_with] || :sha256
+    @accept_digests       = Array(options[:accept_digests] || :sha256)
   end
 
   # In order for the server to correctly authorize the request, the client and server MUST AGREE on this format
@@ -28,17 +30,17 @@ class Ey::Hmac::Adapter
   end
 
   # @param [String] key_secret private HMAC key
+  # @param [String] signature digest hash function. Defaults to #sign_with
   # @return [String] HMAC signature of {#request}
-  # @todo handle multiple hash functions
-  def signature(key_secret)
-    Base64.encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new('sha1'), key_secret, canonicalize)).strip
+  def signature(key_secret, digest = self.sign_with)
+    Base64.encode64(OpenSSL::HMAC.digest(OpenSSL::Digest::Digest.new(digest.to_s), key_secret, canonicalize)).strip
   end
 
   # @param [String] key_id public HMAC key
   # @param [String] key_secret private HMAC key
   # @return [String] HMAC header value of {#request}
   def authorization(key_id, key_secret)
-    "#{service} #{key_id}:#{signature(key_secret)}"
+    "#{service} #{key_id}:#{signature(key_secret, sign_with)}"
   end
 
   # @abstract
@@ -55,7 +57,6 @@ class Ey::Hmac::Adapter
 
   # @abstract
   # Digest of body. Default is MD5.
-  # @todo support explicit digest methods
   # @return [String] digest of body
   def content_digest
     raise NotImplementedError
@@ -99,7 +100,7 @@ class Ey::Hmac::Adapter
   # @yieldparam key_id [String] public HMAC key
   # @return [Boolean] true if block yields matching private key and signature matches, else false
   # @see #authenticated!
-  def authenticated?(&block)
+  def authenticated?(options={}, &block)
     authenticated!(&block)
   rescue Ey::Hmac::Error
     false
@@ -107,20 +108,22 @@ class Ey::Hmac::Adapter
 
   # @see Ey::Hmac#authenticate!
   def authenticated!(&block)
-    if authorization_match = AUTHORIZATION_REGEXP.match(authorization_signature)
-      key_id          = authorization_match[1]
-      signature_value = authorization_match[2]
-
-      if key_secret = block.call(key_id)
-        calculated_signature = signature(key_secret)
-        if secure_compare(signature_value, calculated_signature)
-        else raise(Ey::Hmac::SignatureMismatch, "Calculated siganature #{signature_value} does not match #{calculated_signature} using #{canonicalize.inspect}")
-        end
-      else raise(Ey::Hmac::MissingSecret, "Failed to find secret matching #{key_id.inspect}")
-      end
-    else
+    unless authorization_match = AUTHORIZATION_REGEXP.match(authorization_signature)
       raise(Ey::Hmac::MissingAuthorization, "Failed to parse authorization_signature #{authorization_signature}")
     end
+
+    key_id          = authorization_match[1]
+    signature_value = authorization_match[2]
+
+    unless key_secret = block.call(key_id)
+      raise(Ey::Hmac::MissingSecret, "Failed to find secret matching #{key_id.inspect}")
+    end
+
+    calculated_signatures = self.accept_digests.map { |ad| signature(key_secret, ad) }
+
+    unless calculated_signatures.any? { |cs| secure_compare(signature_value, cs) }
+      raise(Ey::Hmac::SignatureMismatch, "Calculated siganature #{signature_value} does not match #{calculated_signatures.inspect} using #{canonicalize.inspect}")
+    end
     true
   end
   alias authenticate! authenticated!

data/lib/ey-hmac/adapter/faraday.rb

@@ -4,11 +4,11 @@ class Ey::Hmac::Adapter::Faraday < Ey::Hmac::Adapter
   end
 
   def content_type
-    %w[CONTENT-TYPE CONTENT_TYPE Content-Type Content_Type].inject(nil){|r, h| r || request[:request_headers][h]}
+    %w[CONTENT-TYPE CONTENT_TYPE Content-Type Content_Type].inject(nil) { |r,h| r || request[:request_headers][h] }
   end
 
   def content_digest
-    if existing = %w[CONTENT-DIGEST CONTENT_DIGEST Content-Digest Content_Digest].inject(nil){|r,h| r || request[:request_headers][h]}
+    if existing = %w[CONTENT-DIGEST CONTENT_DIGEST Content-Digest Content_Digest].inject(nil) { |r,h| r || request[:request_headers][h] }
       existing
     elsif digestable = body && Digest::MD5.hexdigest(body)
       request[:request_headers]['Content-Digest'] = digestable
@@ -24,7 +24,7 @@ class Ey::Hmac::Adapter::Faraday < Ey::Hmac::Adapter
   end
 
   def date
-    existing = %w[DATE Date].inject(nil){|r,h| r || request[h]}
+    existing = %w[DATE Date].inject(nil) { |r,h| r || request[h] }
     existing || (request[:request_headers]['Date'] = Time.now.httpdate)
   end
 

data/lib/ey-hmac/adapter/rack.rb

@@ -24,7 +24,7 @@ class Ey::Hmac::Adapter::Rack < Ey::Hmac::Adapter
       request.env['HTTP_CONTENT_DIGEST'] = digest
     end
   end
-  
+
   def body
     if request.env["rack.input"]
       request.env["rack.input"].rewind

data/lib/ey-hmac/rack.rb

@@ -9,7 +9,8 @@ class Ey::Hmac::Rack
   end
 
   def call(env)
-    Ey::Hmac.sign!(env, key_id, key_secret, {adapter: Ey::Hmac::Adapter::Rack}.merge(options))
+    Ey::Hmac.sign!(env, key_id, key_secret, { adapter: Ey::Hmac::Adapter::Rack }.merge(options))
+
     @app.call(env)
   end
 end

data/lib/ey-hmac/version.rb

@@ -1,5 +1,5 @@
 module Ey
   module Hmac
-    VERSION = "0.0.5"
+    VERSION = "0.1.1"
   end
 end

data/spec/faraday_spec.rb

@@ -97,7 +97,27 @@ describe "faraday" do
   end
 
   describe "middleware" do
-    it "should sign request" do
+    it "should accept a SHA1 signature" do
+      require 'ey-hmac/faraday'
+      Bundler.require(:rack)
+
+      app = lambda do |env|
+        authenticated = Ey::Hmac.authenticated?(env, accept_digests: :sha1, adapter: Ey::Hmac::Adapter::Rack) do |auth_id|
+          (auth_id == key_id) && key_secret
+        end
+        [(authenticated ? 200 : 401), {"Content-Type" => "text/plain"}, []]
+      end
+
+      request_env = nil
+      connection = Faraday.new do |c|
+        c.request :hmac, key_id, key_secret, sign_with: :sha1
+        c.adapter(:rack, app)
+      end
+
+      connection.get("/resources").status.should == 200
+    end
+
+    it "should accept a SHA256 signature" do # default
       require 'ey-hmac/faraday'
       Bundler.require(:rack)
 
@@ -117,6 +137,26 @@ describe "faraday" do
       connection.get("/resources").status.should == 200
     end
 
+    it "should accept multiple digest signatures" do # default
+      require 'ey-hmac/faraday'
+      Bundler.require(:rack)
+
+      app = lambda do |env|
+        authenticated = Ey::Hmac.authenticated?(env, accept_digests: [:sha1, :sha256], adapter: Ey::Hmac::Adapter::Rack) do |auth_id|
+          (auth_id == key_id) && key_secret
+        end
+        [(authenticated ? 200 : 401), {"Content-Type" => "text/plain"}, []]
+      end
+
+      request_env = nil
+      connection = Faraday.new do |c|
+        c.request :hmac, key_id, key_secret
+        c.adapter(:rack, app)
+      end
+
+      connection.get("/resources").status.should == 200
+    end
+
     it "should sign empty request" do
       require 'ey-hmac/faraday'
       Bundler.require(:rack)

data/spec/rack_spec.rb

@@ -3,8 +3,8 @@ require 'spec_helper'
 describe "rack" do
   before(:all) { Bundler.require(:rack) }
 
-  let!(:key_id)     { (0...8).map{ 65.+(rand(26)).chr}.join }
-  let!(:key_secret) { (0...16).map{ 65.+(rand(26)).chr}.join }
+  let!(:key_id)     { SecureRandom.hex(8) }
+  let!(:key_secret) { SecureRandom.hex(16) }
 
   describe "adapter" do
     let(:adapter)     { Ey::Hmac::Adapter::Rack }
@@ -89,7 +89,24 @@ describe "rack" do
   end
 
   describe "middleware" do
-    it "should sign and read request" do
+    it "should accept a SHA1 signature" do
+      app = lambda do |env|
+        authenticated = Ey::Hmac.authenticated?(env, accept_digests: [:sha1, :sha256], adapter: Ey::Hmac::Adapter::Rack) do |auth_id|
+          (auth_id == key_id) && key_secret
+        end
+        [(authenticated ? 200 : 401), {"Content-Type" => "text/plain"}, []]
+      end
+
+      _key_id, _key_secret = key_id, key_secret
+      client = Rack::Client.new do
+        use Ey::Hmac::Rack, _key_id, _key_secret, sign_with: :sha1
+        run app
+      end
+
+      client.get("/resource").status.should == 200
+    end
+
+    it "should accept a SHA256 signature" do # default
       app = lambda do |env|
         authenticated = Ey::Hmac.authenticated?(env, adapter: Ey::Hmac::Adapter::Rack) do |auth_id|
           (auth_id == key_id) && key_secret
@@ -105,5 +122,25 @@ describe "rack" do
 
       client.get("/resource").status.should == 200
     end
+
+    it "should accept multiple digest signatures" do # default
+      require 'ey-hmac/faraday'
+      Bundler.require(:rack)
+
+      app = lambda do |env|
+        authenticated = Ey::Hmac.authenticated?(env, adapter: Ey::Hmac::Adapter::Rack) do |auth_id|
+          (auth_id == key_id) && key_secret
+        end
+        [(authenticated ? 200 : 401), {"Content-Type" => "text/plain"}, []]
+      end
+
+      request_env = nil
+      connection = Faraday.new do |c|
+        c.request :hmac, key_id, key_secret, digest: [:sha1, :sha256]
+        c.adapter(:rack, app)
+      end
+
+      connection.get("/resources").status.should == 200
+    end
   end
 end

metadata

@@ -1,36 +1,32 @@
 --- !ruby/object:Gem::Specification
 name: ey-hmac
 version: !ruby/object:Gem::Version
-  version: 0.0.5
-  prerelease: 
+  version: 0.1.1
 platform: ruby
 authors:
 - Josh Lane & Jason Hansen
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-10-18 00:00:00.000000000 Z
+date: 2014-02-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
-    - - ! '>='
+    - - '>='
       - !ruby/object:Gem::Version
         version: '0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -38,7 +34,6 @@ dependencies:
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    none: false
     requirements:
     - - ~>
       - !ruby/object:Gem::Version
@@ -71,31 +66,29 @@ files:
 - spec/spec_helper.rb
 homepage: ''
 licenses: []
+metadata: {}
 post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
-  none: false
   requirements:
-  - - ! '>='
+  - - '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.25
+rubygems_version: 2.0.3
 signing_key: 
-specification_version: 3
+specification_version: 4
 summary: Lightweight HMAC signing libraries and middleware for Farday and Rack
 test_files:
 - spec/faraday_spec.rb
 - spec/rack_spec.rb
 - spec/shared/authenticated.rb
 - spec/spec_helper.rb
-has_rdoc: