ey_api_hmac 0.0.1 → 0.0.2

data/Gemfile.lock

@@ -2,6 +2,7 @@ PATH
   remote: .
   specs:
     ey_api_hmac (0.0.1)
+      json
       rack-client
 
 GEM
@@ -9,6 +10,7 @@ GEM
   specs:
     diff-lcs (1.1.2)
     halorgium-auth-hmac (1.1.1.2010100601)
+    json (1.5.3)
     rack (1.3.2)
     rack-client (0.4.0)
       rack (>= 1.0.0)

data/README.md

@@ -0,0 +1,32 @@
+# Engine Yard HMAC api implementation
+
+HMAC basic implementation for Engine Yard services.
+
+# How to use it
+
+Server Rack middleware:
+
+```ruby
+  use EY::ApiHMAC::ApiAuth::Server, Consumer
+```
+
+Where `Consumer` is a class that responds to find_by_auth_id(auth_id), and returns an object that responds to `id` and `auth_key`.
+
+```ruby
+  use EY::ApiHMAC::ApiAuth::LookupServer do |env, auth_id|
+    #return the appropriate auth_key here
+  end
+```
+
+this will validate the Authorization header for all requests and raise on failures
+
+Rack-Client middleware:
+
+```ruby
+  client = Rack::Client.new do
+    use EY::ApiHMAC::ApiAuth::Client, auth_id_arg, auth_key_arg
+    run Rack::Client::Handler::NetHTTP
+  end
+```
+
+this will add the correct Authorization header to all requests made with this rack-client.

data/ey_api_hmac.gemspec

@@ -19,5 +19,6 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
 
   s.add_dependency 'rack-client'
+  s.add_dependency 'json'
   s.add_development_dependency "rspec"
 end

data/lib/ey_api_hmac/sso.rb

@@ -0,0 +1,27 @@
+module EY
+  module ApiHMAC
+    module SSO
+
+      def self.sign(url, parameters, auth_id, auth_key)
+        uri = URI.parse(url)
+        raise ArgumentError, "use parameters argument, got query: '#{uri.query}'" if uri.query
+        uri.query = parameters.sort.map {|e| e.map{|str| CGI.escape(str.to_s)}.join '='}.join '&'
+        signature = CGI.escape(signature_param(uri.to_s, auth_id, auth_key))
+        uri.query += "&signature=#{signature}"
+        uri.to_s
+      end
+
+      def self.authenticated?(url, auth_id, auth_key)
+        uri = URI.parse(url)
+        signature = CGI.unescape(uri.query.match(/&signature=(.*)$/)[1])
+        signed_string = uri.to_s.gsub(/&signature=(.*)$/,"")
+        signature_param(signed_string.to_s, auth_id, auth_key) == signature
+      end
+
+      def self.signature_param(signed_string, auth_id, auth_key)
+        ApiHMAC.auth_string(auth_id, ApiHMAC.base64digest(signed_string, auth_key))
+      end
+
+    end
+  end
+end

data/lib/ey_api_hmac/version.rb

@@ -1,5 +1,5 @@
 module EY
   module ApiHMAC
-    VERSION = "0.0.1"
+    VERSION = "0.0.2"
   end
 end

data/lib/ey_api_hmac.rb

@@ -1,28 +1,13 @@
 require 'ey_api_hmac/base_connection'
 require 'ey_api_hmac/api_auth'
+require 'ey_api_hmac/sso'
 
 module EY
   module ApiHMAC
     require 'openssl'
 
-    def self.sign_for_sso(url, parameters, auth_id, auth_key)
-      uri = URI.parse(url)
-      raise ArgumentError, "use parameters argument, got query: '#{uri.query}'" if uri.query
-      uri.query = parameters.sort.map {|e| e.map{|str| CGI.escape(str.to_s)}.join '='}.join '&'
-      signature = CGI.escape(base64digest(uri.query.to_s, auth_key))
-      uri.query += "&signature=#{signature}"
-      uri.to_s
-    end
-
-    def self.verify_for_sso(url, auth_id, auth_key)
-      uri = URI.parse(url)
-      signature = CGI.unescape(uri.query.match(/&signature=(.*)$/)[1])
-      signed_string = uri.query.gsub(/&signature=(.*)$/,"")
-      base64digest(signed_string.to_s, auth_key) == signature
-    end
-
     def self.sign!(env, key_id, secret, strict = false)
-      env["HTTP_AUTHORIZATION"] = "AuthHMAC #{key_id}:#{signature(env, secret, strict)}"
+      env["HTTP_AUTHORIZATION"] = auth_string(key_id, signature(env, secret, strict))
     end
 
     def self.canonical_string(env, strict = false)
@@ -45,6 +30,10 @@ module EY
       parts.join("\n")
     end
 
+    def self.auth_string(key_id, signature)
+      "AuthHMAC #{key_id}:#{signature}"
+    end
+
     def self.signature(env, secret, strict = false)
       base64digest(canonical_string(env, strict), secret)
     end

data/spec/sso_spec.rb

@@ -17,7 +17,7 @@ describe EY::ApiHMAC do
     end
 
     it "can sign sso calls" do
-      signed_url = EY::ApiHMAC.sign_for_sso(@url, @parameters, @auth_id, @auth_key)
+      signed_url = EY::ApiHMAC::SSO.sign(@url, @parameters, @auth_id, @auth_key)
       uri = URI.parse(signed_url)
 
       uri.scheme.should eq 'http'
@@ -25,13 +25,28 @@ describe EY::ApiHMAC do
       uri.path.should eq '/sign_test'
 
       parameters = CGI::parse(uri.query)
-      parameters["signature"].first.should eq EY::ApiHMAC.base64digest("foo=bar&xargs=5&zarg=boot", @auth_key)
+      parameters["signature"].first.should eq EY::ApiHMAC::SSO.signature_param(
+        "http://example.com/sign_test?foo=bar&xargs=5&zarg=boot", @auth_id, @auth_key)
     end
 
     it "can verify signed requests" do
-      signed_url = EY::ApiHMAC.sign_for_sso(@url, @parameters, @auth_id, @auth_key)
-      EY::ApiHMAC.verify_for_sso(signed_url,  @auth_id, @auth_key).should be_true
-      EY::ApiHMAC.verify_for_sso(signed_url + 'a',  @auth_id, @auth_key).should be_false
+      signed_url = EY::ApiHMAC::SSO.sign(@url, @parameters, @auth_id, @auth_key)
+      EY::ApiHMAC::SSO.authenticated?(signed_url,  @auth_id, @auth_key).should be_true
+      EY::ApiHMAC::SSO.authenticated?(signed_url + 'a',  @auth_id, @auth_key).should be_false
+    end
+
+    it "catches changes to the url" do
+      signed_url = EY::ApiHMAC::SSO.sign(@url, @parameters, @auth_id, @auth_key)
+      EY::ApiHMAC::SSO.authenticated?(signed_url,  @auth_id, @auth_key).should be_true
+      tampered_url = signed_url.gsub("sign_test", "admin")
+      EY::ApiHMAC::SSO.authenticated?(tampered_url,  @auth_id, @auth_key).should be_false
+    end
+
+    it "catches changes to the parameters" do
+      signed_url = EY::ApiHMAC::SSO.sign(@url, @parameters, @auth_id, @auth_key)
+      EY::ApiHMAC::SSO.authenticated?(signed_url,  @auth_id, @auth_key).should be_true
+      tampered_url = signed_url.gsub("foo", "fool")
+      EY::ApiHMAC::SSO.authenticated?(tampered_url,  @auth_id, @auth_key).should be_false
     end
 
     #TODO: write a test that fails if we skip the CGI.unescape
@@ -40,13 +55,9 @@ describe EY::ApiHMAC do
 
     #TODO: test that you get an error when you try to sign a url with any of the "Reserved" parameters (signature or timestamp)
 
-    #TODO: send the auth_id in the params too
-
     #TODO: Rename "signature" to "ey_api_sso_hmac_signature"
 
-    #TODO: provide a time
-
-    #TODO: maybe an expiry time would be better
+    #TODO: provide a timestamp? maybe an expiry time would be better
 
     #TODO: should the other params be part of the gem?
       # ey_user_id – the unique identifier for the user.

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ey_api_hmac
 version: !ruby/object:Gem::Version 
-  hash: 29
+  hash: 27
   prerelease: 
   segments: 
   - 0
   - 0
-  - 1
-  version: 0.0.1
+  - 2
+  version: 0.0.2
 platform: ruby
 authors: 
 - "Jacob Burkhart & Thorben Schr\xC3\xB6der & David Calavera & others"
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-08-15 00:00:00 -07:00
+date: 2011-08-16 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -33,7 +33,7 @@ dependencies:
   type: :runtime
   version_requirements: *id001
 - !ruby/object:Gem::Dependency 
-  name: rspec
+  name: json
   prerelease: false
   requirement: &id002 !ruby/object:Gem::Requirement 
     none: false
@@ -44,8 +44,22 @@ dependencies:
         segments: 
         - 0
         version: "0"
-  type: :development
+  type: :runtime
   version_requirements: *id002
+- !ruby/object:Gem::Dependency 
+  name: rspec
+  prerelease: false
+  requirement: &id003 !ruby/object:Gem::Requirement 
+    none: false
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        hash: 3
+        segments: 
+        - 0
+        version: "0"
+  type: :development
+  version_requirements: *id003
 description: basic wrapper for rack-client + middlewares for HMAC auth + helpers for SSO auth
 email: 
 - jacob@engineyard.com
@@ -59,11 +73,13 @@ files:
 - Gemfile
 - Gemfile.lock
 - LICENSE
+- README.md
 - Rakefile
 - ey_api_hmac.gemspec
 - lib/ey_api_hmac.rb
 - lib/ey_api_hmac/api_auth.rb
 - lib/ey_api_hmac/base_connection.rb
+- lib/ey_api_hmac/sso.rb
 - lib/ey_api_hmac/version.rb
 - spec/api_auth_spec.rb
 - spec/sso_spec.rb