ey_api_hmac 0.0.17 → 0.0.18

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ey_api_hmac (0.0.16)
+    ey_api_hmac (0.0.17)
       json
       rack-client
 

data/lib/ey_api_hmac/sso.rb

@@ -18,10 +18,11 @@ module EY
       def self.authenticated?(url, auth_id, auth_key)
         uri = URI.parse(url)
         return false unless uri.query
-        query_params = CGI::parse(uri.query)
-        signature = query_params.delete("signature").to_s
+        query_params = CGI.parse(uri.query)
+        signature = arr_to_string(query_params.delete("signature"))
         uri.query = params_to_string(query_params)
-        signature == signature_param(uri.to_s, auth_id, auth_key)
+        expected = signature_param(uri.to_s, auth_id, auth_key)
+        signature == expected
       end
 
       def self.signature_param(signed_string, auth_id, auth_key)
@@ -30,8 +31,20 @@ module EY
 
       private
 
+      def self.arr_to_string(arr)
+        if arr.respond_to?(:join)
+          arr = arr.join("")
+        end
+        arr.to_s
+      end
+
       def self.params_to_string(parameters)
-        parameters.sort_by(&:to_s).map {|e| e.map{|str| CGI.escape(str.to_s)}.join '='}.join '&'
+        result = parameters.sort_by(&:to_s).map do |e|
+          e.map do |str| 
+            CGI.escape(arr_to_string(str))
+          end.join '='
+        end.join '&'
+        result
       end
 
       def self.verify_params!(url, extra_params, parameters)

data/lib/ey_api_hmac/version.rb

@@ -1,5 +1,5 @@
 module EY
   module ApiHMAC
-    VERSION = "0.0.17"
+    VERSION = "0.0.18"
   end
 end

data/spec/base_connection_spec.rb

@@ -9,7 +9,7 @@ describe EY::ApiHMAC::BaseConnection do
     describe "on 500" do
       before do
         @connection.backend = lambda do |env|
-          ["500", {}, ""]
+          ["500", {}, [""]]
         end
       end
       it "raises an error" do

data/spec/sso_spec.rb

@@ -66,6 +66,15 @@ describe EY::ApiHMAC do
       }.should raise_error(/foo/)
     end
 
+    it "verifies this random real-world use case" do
+      auth_id = "676f8731f9d3bfd0"
+      auth_key = "b7c65a18f6955d58f06a439fb881d1565c17e840999500f2aed6859144de5bac4d1a670119c9b7a9"
+
+      url = "http://ec2-107-22-254-37.compute-1.amazonaws.com/eyintegration/sso/customers/1?access_level=owner&ey_return_to_url=https%3A%2F%2Fcloud.engineyard.com%2Faccounts%2F10398%2Fservices&ey_user_id=10133&ey_user_name=Jacob+Chronatog-Demo+Burkhart&timestamp=2011-10-07T23%3A15%3A50%2B00%3A00&signature=AuthHMAC+676f8731f9d3bfd0%3AnvsCICd%2F00dvFCpJYfvI9LTl81s%3D"
+
+      EY::ApiHMAC::SSO.authenticated?(url, auth_id, auth_key).should be_true
+    end
+
     #TODO: write a test that fails if we skip the CGI.unescape
 
     #TODO: provide signature methods

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ey_api_hmac
 version: !ruby/object:Gem::Version 
-  hash: 61
+  hash: 59
   prerelease: 
   segments: 
   - 0
   - 0
-  - 17
-  version: 0.0.17
+  - 18
+  version: 0.0.18
 platform: ruby
 authors: 
 - "Jacob Burkhart & Thorben Schr\xC3\xB6der & David Calavera & others"