ey_api_hmac 0.0.4 → 0.0.5

data/.gitignore

@@ -0,0 +1 @@
+*.gem

data/Gemfile

@@ -8,4 +8,6 @@ gem 'json'
 
 group :test, :development do
   gem 'halorgium-auth-hmac'
+  gem 'rack-client'
+  gem 'rack-contrib'
 end

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ey_api_hmac (0.0.1)
+    ey_api_hmac (0.0.5)
       json
       rack-client
 
@@ -14,6 +14,8 @@ GEM
     rack (1.3.2)
     rack-client (0.4.0)
       rack (>= 1.0.0)
+    rack-contrib (1.1.0)
+      rack (>= 0.9.1)
     rake (0.9.2)
     rspec (2.6.0)
       rspec-core (~> 2.6.0)
@@ -31,5 +33,7 @@ DEPENDENCIES
   ey_api_hmac!
   halorgium-auth-hmac
   json
+  rack-client
+  rack-contrib
   rake
   rspec

data/lib/ey_api_hmac/api_auth.rb

@@ -1,39 +1,58 @@
 module EY
   module ApiHMAC
     module ApiAuth
-      CONSUMER = "ey_api_hmac.consumer_id"
 
-      #a Server middleware to validate requests, setup with a block to lookup the auth_key based on auth_id
+      # Server middleware to validate requests, setup with a block that returns the auth_key given an auth_id
+      #
+      # To pass authentication information through to your app, be sure to set something in env.
+      # Look at EY::ApiHMAC::ApiAuth::Server for an example
+      #
+      # raise EY::ApiHMAC::HmacAuthFail, "your message" to fail authentication.
       class LookupServer
         def initialize(app, &lookup)
           @app, @lookup = app, lookup
         end
 
-        #TODO: rescue HmacAuthFail and return 403?
         def call(env)
-          ApiHMAC.authenticate!(env) do |auth_id|
-            @lookup.call(env, auth_id)
+          begin
+            ApiHMAC.authenticate!(env) do |auth_id|
+              @lookup.call(env, auth_id)
+            end
+          rescue HmacAuthFail
+            return [401, {}, ["Authentication failure"]]
           end
           @app.call(env)
         end
       end
 
-      #a Server middleware to validate requests, setup with a class that responds_to :find_by_auth_id, :id, :auth_key
+      # Consumer id is set to this env key when using EY::ApiHMAC::ApiAuth::Server
+      CONSUMER = "ey_api_hmac.consumer_id"
+
+      # Server middleware to validate requests
+      #
+      # Initialize with a class that responds_to :find_by_auth_id, :id, :auth_key
+      #
+      # Sets env['ey_api_hmac.consumer_id'] to the id of the object returned by class.find_by_auth_id(auth_id)
       class Server < LookupServer
         def initialize(app, klass)
+          unless klass.respond_to?(:find_by_auth_id)
+            raise ArgumentError, "EY::ApiHMAC::ApiAuth::Server class must respond to find_by_auth_id"
+          end
+
           lookup = Proc.new do |env, auth_id|
             if consumer = klass.find_by_auth_id(auth_id)
               env[CONSUMER] = consumer.id
               consumer.auth_key
             else
-              raise "no #{klass} consumer #{auth_id.inspect}"
+              raise HmacAuthFail
             end
           end
+
           super(app, &lookup)
         end
       end
 
-      #the Client middleware that's used to add authentication to requests
+      # Client middleware that's used to add authentication to requests.
       class Client
         def initialize(app, auth_id, auth_key)
           @app, @auth_id, @auth_key = app, auth_id, auth_key
@@ -46,4 +65,4 @@ module EY
 
     end
   end
-end
+end

data/lib/ey_api_hmac/version.rb

@@ -1,5 +1,5 @@
 module EY
   module ApiHMAC
-    VERSION = "0.0.4"
+    VERSION = "0.0.5"
   end
 end

data/spec/api_auth_spec.rb

@@ -1,5 +1,9 @@
+require 'spec_helper'
+
 require 'ey_api_hmac'
 require 'auth-hmac'
+require 'rack/contrib'
+require 'time'
 
 describe EY::ApiHMAC::ApiAuth do
 
@@ -10,8 +14,8 @@ describe EY::ApiHMAC::ApiAuth do
     before(:each) do
       @env = {'PATH_INFO' => "/path/to/put",
         'QUERY_STRING' => 'foo=bar&bar=foo',
-        'CONTENT_TYPE' => 'text/plain', 
-        'HTTP_CONTENT_MD5' => 'blahblah', 
+        'CONTENT_TYPE' => 'text/plain',
+        'HTTP_CONTENT_MD5' => 'blahblah',
         'REQUEST_METHOD' => "PUT",
         'HTTP_DATE' => "Thu, 10 Jul 2008 03:29:56 GMT",
         "rack.input" => StringIO.new}
@@ -40,8 +44,8 @@ describe EY::ApiHMAC::ApiAuth do
       end
 
       it "signs as expected with AuthHMAC" do
-       AuthHMAC.sign!(@request, "my-key-id", "secret")
-       @request['Authorization'].should == @expected
+        AuthHMAC.sign!(@request, "my-key-id", "secret")
+        @request['Authorization'].should == @expected
       end
 
       it "signs as expected with ApiAuth" do
@@ -85,13 +89,76 @@ describe EY::ApiHMAC::ApiAuth do
       end
     end
 
+    describe "middleware behavior" do
+      MockApp = lambda do |is_found, auth_key|
+        Rack::Builder.new do
+          use EY::ApiHMAC::ApiAuth::Server, MockAuth.new(is_found, auth_key)
+          run lambda { |x| [200, {}, ['Success']] }
+        end
+      end
+
+      def hmac_client(client_auth_key, app)
+        client = Rack::Client.new('http://localhost') do
+          use Rack::Config do |env|
+            env['HTTP_DATE'] = Time.now.httpdate
+          end
+          use EY::ApiHMAC::ApiAuth::Client, 1, client_auth_key
+          run app
+        end
+      end
+
+      it "responds 401 Unauthorized with no authorization" do
+        client = Rack::Client.new('http://localhost') do
+          run MockApp.call(true, 'key')
+        end
+
+        response = client.get('/')
+        response.status.should == 401
+        response.body.should_not == 'Success'
+      end
+
+      it "works with correct signing" do
+        auth_key = 'key'
+        is_found = true
+
+        client = hmac_client(auth_key, MockApp.call(is_found, auth_key))
+
+        response = client.get('/')
+        response.status.should == 200
+        response.body.should == 'Success'
+      end
+
+      it "fails when auth_key isn't correct" do
+        auth_id  = 1
+        is_found = true
+
+        client = hmac_client('wrongkey', MockApp.call(is_found, 'rightkey'))
+
+        response = client.get('/')
+        response.status.should == 401
+        response.body.should_not == 'Success'
+      end
+
+      it "fails when no consumer by that auth_id is found" do
+        auth_id  = 1
+        is_found = false
+        auth_key = 'key'
+
+        client = hmac_client(auth_key, MockApp.call(is_found, auth_key))
+
+        response = client.get('/')
+        response.status.should == 401
+        response.body.should_not == 'Success'
+      end
+    end
   end
 
+
   describe "without CONTENT_MD5" do
     before do
       @env = {'PATH_INFO' => "/path/to/put",
         'QUERY_STRING' => 'foo=bar&bar=foo',
-        'CONTENT_TYPE' => 'text/plain', 
+        'CONTENT_TYPE' => 'text/plain',
         'REQUEST_METHOD' => "PUT",
         'HTTP_DATE' => "Thu, 10 Jul 2008 03:29:56 GMT",
         "rack.input" => StringIO.new("something, something?")}
@@ -114,7 +181,6 @@ describe EY::ApiHMAC::ApiAuth do
       end
 
     end
-
   end
 
   it "complains when there is no HTTP_DATE" do
@@ -128,4 +194,4 @@ describe EY::ApiHMAC::ApiAuth do
     }.should raise_error(/'HTTP_DATE' header missing and required/)
   end
 
-end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,20 @@
+class MockAuth
+  def initialize(is_found, auth_key)
+    @is_found = is_found
+    @auth_key = auth_key
+  end
+
+  attr_reader :auth_key
+
+  def find_by_auth_id(auth_id)
+    if @is_found
+      self
+    else
+      nil
+    end
+  end
+
+  def id
+    1
+  end
+end

data/spec/sso_spec.rb

@@ -69,5 +69,4 @@ describe EY::ApiHMAC do
       # signature – HMAC digest of the other parameters and url (using the API secret)
 
   end
-  
-end
+end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ey_api_hmac
 version: !ruby/object:Gem::Version 
-  hash: 23
+  hash: 21
   prerelease: 
   segments: 
   - 0
   - 0
-  - 4
-  version: 0.0.4
+  - 5
+  version: 0.0.5
 platform: ruby
 authors: 
 - "Jacob Burkhart & Thorben Schr\xC3\xB6der & David Calavera & others"
@@ -15,7 +15,8 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2011-08-17 00:00:00 Z
+date: 2011-08-18 00:00:00 -07:00
+default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
   name: rack-client
@@ -69,6 +70,7 @@ extensions: []
 extra_rdoc_files: []
 
 files: 
+- .gitignore
 - Gemfile
 - Gemfile.lock
 - LICENSE
@@ -81,7 +83,9 @@ files:
 - lib/ey_api_hmac/sso.rb
 - lib/ey_api_hmac/version.rb
 - spec/api_auth_spec.rb
+- spec/spec_helper.rb
 - spec/sso_spec.rb
+has_rdoc: true
 homepage: ""
 licenses: []
 
@@ -111,10 +115,11 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: ey_api_hmac
-rubygems_version: 1.8.8
+rubygems_version: 1.4.2
 signing_key: 
 specification_version: 3
 summary: HMAC Rack basic implementation for Engine Yard services
 test_files: 
 - spec/api_auth_spec.rb
+- spec/spec_helper.rb
 - spec/sso_spec.rb