ey_api_hmac 0.3.1 → 0.4.0

data/lib/ey_api_hmac.rb

@@ -10,7 +10,7 @@ module EY
       env["HTTP_AUTHORIZATION"] = auth_string(key_id, signature(env, secret))
     end
 
-    def self.canonical_string(env)
+    def self.canonical_string(env, legacy = false)
       parts = []
       expect = Proc.new do |var|
         unless env[var]
@@ -20,7 +20,7 @@ module EY
       end
       parts << expect["REQUEST_METHOD"]
       parts << env["CONTENT_TYPE"]
-      parts << generated_md5(env)
+      parts << generated_md5(env, legacy)
       parts << expect["HTTP_DATE"]
       if env["REQUEST_URI"]
         parts << URI.parse(env["REQUEST_URI"]).path
@@ -38,6 +38,10 @@ module EY
       base64digest(canonical_string(env), secret)
     end
 
+    def self.signature_legacy(env, secret)
+      base64digest(canonical_string(env, true), secret)
+    end
+
     def self.base64digest(data,secret)
       digest = OpenSSL::Digest::Digest.new('sha1')
       [OpenSSL::HMAC.digest(digest, secret, data)].pack('m').strip
@@ -54,7 +58,7 @@ module EY
         unless secret
           raise HmacAuthFail, "couldn't find auth for #{access_key_id}"
         end
-        unless hmac == signature(env, secret)
+        unless hmac == signature(env, secret) || hmac == signature_legacy(env, secret)
           raise HmacAuthFail, "signature mismatch. Calculated canonical_string: #{canonical_string(env).inspect}"
         end
       else
@@ -73,11 +77,15 @@ module EY
 
     private
 
-    def self.generated_md5(env)
+    def self.generated_md5(env, legacy = false)
       env["rack.input"].rewind
       request_body = env["rack.input"].read
       env["rack.input"].rewind
-      request_body.empty? ? nil : OpenSSL::Digest::MD5.hexdigest(request_body)
+      if legacy
+        OpenSSL::Digest::MD5.hexdigest(request_body)
+      else
+        request_body.empty? ? nil : OpenSSL::Digest::MD5.hexdigest(request_body)
+      end
     end
 
   end

data/lib/ey_api_hmac/version.rb

@@ -1,5 +1,5 @@
 module EY
   module ApiHMAC
-    VERSION = "0.3.1"
+    VERSION = "0.4.0"
   end
 end

data/spec/api_auth_spec.rb

@@ -109,8 +109,17 @@ describe EY::ApiHMAC::ApiAuth do
     end
 
     describe "authenticated?" do
-      describe "request signed by AuthHMAC" do
 
+      it "verifies the old signing method without body" do
+        @env['rack.input'] = StringIO.new
+        @env.delete('HTTP_CONTENT_MD5')
+        @request = Rack::Request.new(@env)
+        @env["HTTP_AUTHORIZATION"] = "AuthHMAC access key 1:isJ7zHHPrpnSdZ/XbvqxFhVUf0c="
+        @lookup = Proc.new{ |key| 'secret' if key == 'access key 1' }
+        EY::ApiHMAC.authenticated?(@env, &@lookup).should be_true
+      end
+
+      describe "request signed by AuthHMAC" do
         describe do
           before do
             AuthHMAC.sign!(@request, 'access key 1', 'secret')

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ey_api_hmac
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2011-12-16 00:00:00.000000000 Z
+date: 2011-12-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack-client
-  requirement: &2161109420 !ruby/object:Gem::Requirement
+  requirement: &70174232520240 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2161109420
+  version_requirements: *70174232520240
 - !ruby/object:Gem::Dependency
   name: json
-  requirement: &2161108660 !ruby/object:Gem::Requirement
+  requirement: &70174232519780 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2161108660
+  version_requirements: *70174232519780
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &2161107340 !ruby/object:Gem::Requirement
+  requirement: &70174232519200 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,7 +43,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2161107340
+  version_requirements: *70174232519200
 description: basic wrapper for rack-client + middlewares for HMAC auth + helpers for
   SSO auth
 email:
@@ -90,7 +90,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: ey_api_hmac
-rubygems_version: 1.8.12
+rubygems_version: 1.8.10
 signing_key: 
 specification_version: 3
 summary: HMAC Rack basic implementation for Engine Yard services