ey_api_hmac 0.0.13 → 0.0.14

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ey_api_hmac (0.0.13.pre)
+    ey_api_hmac (0.0.14.pre)
       json
       rack-client
 

data/lib/ey_api_hmac.rb

@@ -6,27 +6,23 @@ module EY
   module ApiHMAC
     require 'openssl'
 
-    def self.sign!(env, key_id, secret, strict = false)
-      env["HTTP_AUTHORIZATION"] = auth_string(key_id, signature(env, secret, strict))
+    def self.sign!(env, key_id, secret)
+      env["HTTP_AUTHORIZATION"] = auth_string(key_id, signature(env, secret))
     end
 
-    def self.canonical_string(env, strict = false)
+    def self.canonical_string(env)
       parts = []
-      adder = Proc.new do |var|
+      expect = Proc.new do |var|
         unless env[var]
           raise HmacAuthFail, "'#{var}' header missing and required in #{env.inspect}"
         end
-        parts << env[var]
+        env[var]
       end
-      adder["REQUEST_METHOD"]
-      adder["CONTENT_TYPE"]
-      if env["HTTP_CONTENT_MD5"]
-        adder["HTTP_CONTENT_MD5"]
-      else
-        parts << generated_md5(env)
-      end
-      adder["HTTP_DATE"]
-      adder["PATH_INFO"]
+      parts << expect["REQUEST_METHOD"]
+      parts << expect["CONTENT_TYPE"]
+      parts << generated_md5(env)
+      parts << expect["HTTP_DATE"]
+      parts << URI.parse(expect["REQUEST_URI"]).path
       parts.join("\n")
     end
 
@@ -34,8 +30,8 @@ module EY
       "AuthHMAC #{key_id}:#{signature}"
     end
 
-    def self.signature(env, secret, strict = false)
-      base64digest(canonical_string(env, strict), secret)
+    def self.signature(env, secret)
+      base64digest(canonical_string(env), secret)
     end
 
     def self.base64digest(data,secret)
@@ -55,7 +51,7 @@ module EY
           raise HmacAuthFail, "couldn't find auth for #{access_key_id}"
         end
         unless hmac == signature(env, secret)
-          raise HmacAuthFail, "signature mismatch"
+          raise HmacAuthFail, "signature mismatch. Calculated canonical_string: #{canonical_string(env).inspect}"
         end
       else
         raise HmacAuthFail, "no authorization header"

data/lib/ey_api_hmac/api_auth.rb

@@ -18,8 +18,8 @@ module EY
             ApiHMAC.authenticate!(env) do |auth_id|
               @lookup.call(env, auth_id)
             end
-          rescue HmacAuthFail
-            return [401, {}, ["Authentication failure"]]
+          rescue HmacAuthFail => e
+            return [401, {}, ["Authentication failure: #{e.message}"]]
           end
           @app.call(env)
         end
@@ -64,7 +64,7 @@ module EY
           ApiHMAC.sign!(env, @auth_id, @auth_key)
           tuple = @app.call(env)
           if tuple.first.to_i == 401
-            raise AuthFailure, "HMAC Authentication Failed."
+            raise AuthFailure, "HMAC Authentication Failed: #{tuple.last}"
           end
           tuple
         end

data/lib/ey_api_hmac/base_connection.rb

@@ -89,7 +89,9 @@ module EY
         response = nil
         request_headers = @standard_headers
         if body
-          response = client.send(method, url, request_headers, body.to_json)
+          body_json = body.to_json
+          request_headers["CONTENT_LENGTH"] = body_json.size.to_s
+          response = client.send(method, url, request_headers, body_json)
         else
           response = client.send(method, url, request_headers)
         end

data/lib/ey_api_hmac/sso.rb

@@ -6,7 +6,7 @@ module EY
         uri = URI.parse(url)
         if uri.query
           extra_params = CGI.parse(uri.query)
-          verify_params!(extra_params, parameters)
+          verify_params!(url, extra_params, parameters)
           parameters.merge!(extra_params)
         end
         uri.query = parameters.sort_by(&:to_s).map {|e| e.map{|str| CGI.escape(str.to_s)}.join '='}.join '&'
@@ -28,7 +28,7 @@ module EY
 
       private
 
-      def self.verify_params!(extra_params, parameters)
+      def self.verify_params!(url, extra_params, parameters)
         illegal_query_params = parameters.keys.map(&:to_s) + ["signature"]
         extra_params.keys.each do |k|
           raise ArgumentError, "Got illegal paramter: '#{k}' in '#{url}'" if illegal_query_params.include?(k.to_s)

data/lib/ey_api_hmac/version.rb

@@ -1,5 +1,5 @@
 module EY
   module ApiHMAC
-    VERSION = "0.0.13"
+    VERSION = "0.0.14"
   end
 end

data/spec/api_auth_spec.rb

@@ -12,15 +12,17 @@ describe EY::ApiHMAC::ApiAuth do
   describe "AuthHMAC working" do
 
     it "works for documented/realistic example" do
-      env = {'PATH_INFO' => "/api/1/service_accounts/1324/messages",
+      req_body = %q{{"message":{"message_type":"status","subject":"Everything looks good.","body":null}}}
+      env = {'REQUEST_URI' => "http://example.com/api/1/service_accounts/1324/messages",
+        'PATH_INFO' => "/api/1/service_accounts/1324/messages",
         'CONTENT_TYPE' => 'application/json',
         'HTTP_ACCEPT' => 'application/json',
         'REQUEST_METHOD' => "POST",
         'HTTP_DATE' => Time.now.httpdate,
-        "rack.input" => StringIO.new(
-          %q{{"message":{"message_type":"status","subject":"Everything looks good.","body":null}}})}
+        "rack.input" => StringIO.new(req_body)}
 
       puts "before signed: \n#{env.inspect}\n\n"
+      puts "request body: \n#{req_body}\n\n"
 
       auth_id = "123bc211233eabc"
       auth_key = "abc474e3fc9bddf6d41236b70cc5a952f3681166e1239214740d13eecd12318f7b8d27123b61eabc"
@@ -43,10 +45,11 @@ describe EY::ApiHMAC::ApiAuth do
     end
 
     before(:each) do
-      @env = {'PATH_INFO' => "/path/to/put",
+      @env = {'REQUEST_URI' => "http://example.com/path/to/put",
+        'PATH_INFO' => "/path/to/put",
         'QUERY_STRING' => 'foo=bar&bar=foo',
         'CONTENT_TYPE' => 'text/plain',
-        'HTTP_CONTENT_MD5' => 'blahblah',
+        'HTTP_CONTENT_MD5' => 'd41d8cd98f00b204e9800998ecf8427e',
         'REQUEST_METHOD' => "PUT",
         'HTTP_DATE' => "Thu, 10 Jul 2008 03:29:56 GMT",
         "rack.input" => StringIO.new}
@@ -55,7 +58,7 @@ describe EY::ApiHMAC::ApiAuth do
 
     describe ".canonical_string" do
       it "should generate a canonical string using default method" do
-        expected = "PUT\ntext/plain\nblahblah\nThu, 10 Jul 2008 03:29:56 GMT\n/path/to/put"
+        expected = "PUT\ntext/plain\nd41d8cd98f00b204e9800998ecf8427e\nThu, 10 Jul 2008 03:29:56 GMT\n/path/to/put"
         AuthHMAC.canonical_string(@request).should == expected
         EY::ApiHMAC.canonical_string(@env).should == expected
       end
@@ -63,7 +66,7 @@ describe EY::ApiHMAC::ApiAuth do
 
     describe ".signature" do
       it "should generate a valid signature string for a secret" do
-        expected = "71wAJM4IIu/3o6lcqx/tw7XnAJs="
+        expected = "isJ7zHHPrpnSdZ/XbvqxFhVUf0c="
         AuthHMAC.signature(@request, 'secret').should == expected
         EY::ApiHMAC.signature(@env, 'secret').should == expected
       end
@@ -71,7 +74,7 @@ describe EY::ApiHMAC::ApiAuth do
 
     describe "sign!" do
       before do
-        @expected = "AuthHMAC my-key-id:71wAJM4IIu/3o6lcqx/tw7XnAJs="
+        @expected = "AuthHMAC my-key-id:isJ7zHHPrpnSdZ/XbvqxFhVUf0c="
       end
 
       it "signs as expected with AuthHMAC" do
@@ -184,7 +187,8 @@ describe EY::ApiHMAC::ApiAuth do
 
   describe "without CONTENT_MD5" do
     before do
-      @env = {'PATH_INFO' => "/path/to/put",
+      @env = {'REQUEST_URI' => "http://example.com/path/to/put",
+        'PATH_INFO' => "/path/to/put",
         'QUERY_STRING' => 'foo=bar&bar=foo',
         'CONTENT_TYPE' => 'text/plain',
         'REQUEST_METHOD' => "PUT",
@@ -212,13 +216,14 @@ describe EY::ApiHMAC::ApiAuth do
   end
 
   it "complains when there is no HTTP_DATE" do
-    env = {'PATH_INFO' => "/path/to/put",
+    env = {'REQUEST_URI' => "http://example.com/path/to/put",
+      'PATH_INFO' => "/path/to/put",
       'QUERY_STRING' => 'foo=bar&bar=foo',
       'CONTENT_TYPE' => 'text/plain',
       'REQUEST_METHOD' => "PUT",
       "rack.input" => StringIO.new}
     lambda{
-      EY::ApiHMAC.sign!(env, 'my-key-id', 'secret', true)
+      EY::ApiHMAC.sign!(env, 'my-key-id', 'secret')
     }.should raise_error(/'HTTP_DATE' header missing and required/)
   end
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ey_api_hmac
 version: !ruby/object:Gem::Version 
-  hash: 5
+  hash: 3
   prerelease: 
   segments: 
   - 0
   - 0
-  - 13
-  version: 0.0.13
+  - 14
+  version: 0.0.14
 platform: ruby
 authors: 
 - "Jacob Burkhart & Thorben Schr\xC3\xB6der & David Calavera & others"
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-09-19 00:00:00 Z
+date: 2011-10-05 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: rack-client