ey_api_hmac 0.0.12 → 0.0.13

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ey_api_hmac (0.0.12.pre)
+    ey_api_hmac (0.0.13.pre)
       json
       rack-client
 

data/lib/ey_api_hmac/sso.rb

@@ -4,7 +4,11 @@ module EY
 
       def self.sign(url, parameters, auth_id, auth_key)
         uri = URI.parse(url)
-        raise ArgumentError, "use parameters argument, got query: '#{uri.query}'" if uri.query
+        if uri.query
+          extra_params = CGI.parse(uri.query)
+          verify_params!(extra_params, parameters)
+          parameters.merge!(extra_params)
+        end
         uri.query = parameters.sort_by(&:to_s).map {|e| e.map{|str| CGI.escape(str.to_s)}.join '='}.join '&'
         signature = CGI.escape(signature_param(uri.to_s, auth_id, auth_key))
         uri.query += "&signature=#{signature}"
@@ -22,6 +26,15 @@ module EY
         ApiHMAC.auth_string(auth_id, ApiHMAC.base64digest(signed_string, auth_key))
       end
 
+      private
+
+      def self.verify_params!(extra_params, parameters)
+        illegal_query_params = parameters.keys.map(&:to_s) + ["signature"]
+        extra_params.keys.each do |k|
+          raise ArgumentError, "Got illegal paramter: '#{k}' in '#{url}'" if illegal_query_params.include?(k.to_s)
+        end
+      end
+
     end
   end
 end

data/lib/ey_api_hmac/version.rb

@@ -1,5 +1,5 @@
 module EY
   module ApiHMAC
-    VERSION = "0.0.12"
+    VERSION = "0.0.13"
   end
 end

data/spec/sso_spec.rb

@@ -49,6 +49,19 @@ describe EY::ApiHMAC do
       EY::ApiHMAC::SSO.authenticated?(tampered_url,  @auth_id, @auth_key).should be_false
     end
 
+    it "can sign and verify urls with parameters" do
+      url_with_params = "http://example.com/sign_test?baz=bert&stuff=awesome"
+      signed_url = EY::ApiHMAC::SSO.sign(url_with_params, @parameters, @auth_id, @auth_key)
+      EY::ApiHMAC::SSO.authenticated?(signed_url,  @auth_id, @auth_key).should be_true
+    end
+
+    it "raises when the same parameter appears both in query and in arg" do
+      url = "http://example.com/sign_test?foo=bar"
+      lambda{
+        EY::ApiHMAC::SSO.sign(url, @parameters, @auth_id, @auth_key)
+      }.should raise_error(/foo/)
+    end
+
     #TODO: write a test that fails if we skip the CGI.unescape
 
     #TODO: provide signature methods

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ey_api_hmac
 version: !ruby/object:Gem::Version 
-  hash: 7
+  hash: 5
   prerelease: 
   segments: 
   - 0
   - 0
-  - 12
-  version: 0.0.12
+  - 13
+  version: 0.0.13
 platform: ruby
 authors: 
 - "Jacob Burkhart & Thorben Schr\xC3\xB6der & David Calavera & others"
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-09-14 00:00:00 Z
+date: 2011-09-19 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: rack-client