ez_token 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 2b13ed8392a2ad5fe9ebacf4572a7f1d7ffbe240
+  data.tar.gz: 7d9b30e3c173720d800d60dbf75290b8fbb6923b
+SHA512:
+  metadata.gz: 2b6e4aca886cb3736c14d9d50bb197c7a91364d3b58bda6c5c656aec143eae6280934bd74e7c20a1f6734c0c9cbf580a2d9e444440f21e96fbafd76227c39dd9
+  data.tar.gz: e91c22e94e74832cea0a210b4cee488d1c299b52a852e5f08782b44dafd08b19637ea39354a0d276803d9beaa7831dbbf89e8e8832e3e43de6eb5ca84981a4dc

data/.gitignore

@@ -0,0 +1,10 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/
+/log/*

data/.rspec

@@ -0,0 +1,2 @@
+--format documentation
+--color

data/.travis.yml

@@ -0,0 +1,5 @@
+sudo: false
+language: ruby
+rvm:
+  - 2.3.0
+before_install: gem install bundler -v 1.13.6

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in ez_token.gemspec
+gemspec

data/README.md

@@ -0,0 +1,38 @@
+# EzToken
+
+Generates and verifies SHA1-based Tokens. Automatically converts to/from String, Array and Hash objects.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'ez_token'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install ez_token
+
+## Usage
+
+token = EzToken.generate(['a', {a: 'a'}, 'str'])
+valid = EzToken.verify?(token) 
+or pass a timestamp
+valid = EzToken.verify?(token, 300) # is the token more than 300 seconds old 
+original_payload = EzToken.verify(token)
+ 
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/devforce/ez_token.
+

data/Rakefile

@@ -0,0 +1,6 @@
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec

data/bin/console

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+require 'bundler/setup'
+require 'ez_token'
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require 'pry'
+# Pry.start
+
+require 'irb'
+IRB.start

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/ez_token.gemspec

@@ -0,0 +1,28 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'ez_token/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = 'ez_token'
+  spec.version       = EzTokenVersion::VERSION
+  spec.authors       = ['Mike Papper']
+  spec.email         = ['bodaro@gmail.com']
+
+  spec.summary       = 'SHA1 Token creation from Ruby Arrays, Hash or Strings.'
+  spec.description   = 'Allows Ruby String, Hash and Array objects to be encoded and decoded'
+  spec.homepage      = 'https://github.com/devforce/ez-token'
+
+  spec.files         = `git ls-files -z`.split("\x0").reject do |f|
+    f.match(%r{^(test|spec|features)/})
+  end
+  spec.bindir        = 'exe'
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ['lib']
+
+  spec.add_dependency 'type_caster'
+
+  spec.add_development_dependency 'bundler', '~> 1.13'
+  spec.add_development_dependency 'rake', '~> 10.0'
+  spec.add_development_dependency 'rspec', '~> 3.0'
+end

data/lib/ez_token/version.rb

@@ -0,0 +1,3 @@
+module EzTokenVersion
+  VERSION = '1.0.0'.freeze
+end

data/lib/ez_token.rb

@@ -0,0 +1,139 @@
+require 'ez_token/version'
+require 'type_caster'
+
+# This class helps to create and decode SHA1 encoded tokens
+# utf-8 strings are supported:
+class EzToken
+  attr_reader :secret
+
+  # pass your secret
+  def initialize(sec)
+    @secret = sec
+  end
+
+  # Return a token representing the params + the timestamp + a digest
+  # the digest is a generate a 40 hex-character (640bit) SHA1 encoding of the params + timestamp + secret
+  # params can be a String, an Array (each item in the array is joined with a &)
+  # or a Hash (each item in the hash is of the form key=value and each of those are joined with &).
+  # We url encode the array items, the hash values and the String value. Array items and Hash values are turned into
+  # their String representation.
+  # If params is a Hash, the keys cannot contain a & or =. Values that are nil will be replaced by the empty
+  # string upon decoding/verify.
+  # For arrays, nil items in an array will be replaced by the string representation of nil which is ''.
+  def generate(params, now = Time.now.to_i)
+    # Note: for oddly utf-8 encoded strings empty? will fail, we circumvent this by testing the length first
+    raise 'EzToken.generate: Params cannot be empty' if params.empty?
+
+    # order hash by keys
+    return get_hash_token(params, now) if params.class == Hash
+    return get_array_token(params, now) if params.class == Array
+    return get_string_token(params, now) if params.class == String
+    raise "EzToken.generate: Params of class #{params.class} is invalid. Must be String, Hash or Array"
+  end
+
+  # Decode token that was originally encoded in the form <payload>&ts=<integer timestamp>&SECRET
+  # where payload can be a string separated by &. Take the <payload> and turn into
+  # a String, Hash or Array depending on its format:
+  #   if there are no & and no '=' its a URL encoded String
+  #   if there are just & its an Array (separated by &)
+  #   otherwise it is a hash of the form key=value&key=value...
+  # If interval is non-nil it represents the length in seconds for the max age of this token
+  # We return false if the decoding didnt work, we return "expired" if the interval is non-nil and
+  #   the token has expired
+  # Otherwise we return the original payload encoded in the token.
+  def verify(token, interval = nil, allow_expired = false)
+    payload, ts = decode_token_into_payload(token)
+    return false if payload == false
+
+    is_expired = !interval.nil? && ts + interval < Time.now.to_i
+    return 'expired' if allow_expired && is_expired
+    return false if is_expired
+
+    return TypeCaster.new(payload).uri_decode if payload !~ /[&=]/ # a (url encoded) string
+    return decode_array(payload) if payload !~ /=/ # its an Array - it has a & in it
+    decode_hash(payload)
+  end
+
+  def verify!(token, interval = nil)
+    params = verify(token, interval, true)
+    raise 'EzToken.verify!: Token is invalid' if params == false
+    raise 'EzToken.verify!: Token has expired' if params == 'expired'
+    params
+  end
+
+  def verify?(token, interval = nil)
+    params = verify(token, interval, true)
+    return false if params == false || params == 'expired'
+    true
+  end
+
+  private
+
+  def get_hash_token(params, now)
+    keys = params.keys.sort
+
+    payload = keys.map do |key|
+      msg = 'EzToken.generate: Params for Token generation cannot have & or = characters in the key - please encode this'
+      raise msg if key =~ /[&=]/
+      val = params[key].to_s # get the string representation of the value
+      "#{key}=#{TypeCaster.new(val).uri_encode}&" # FYI: nil is encoded as 'nil'
+    end.join
+    payload.chomp!('&')
+    payload = '=' if payload.empty? # encode so EzToken decode knows it an empty Hash
+    encode_token(payload, now)
+  end
+
+  def get_array_token(params, now)
+    encoded = params.map { |i| TypeCaster.new(i.to_s).uri_encode }
+    payload = encoded.join('&')
+    payload += '&' # a trailing & to ensure the "decoding" of this EzToken sees this as an array (in case there is just 1 item)
+    encode_token(payload, now)
+  end
+
+  def get_string_token(params, now)
+    encode_token(TypeCaster.new(params).uri_encode, now)
+  end
+
+  def encode_token(payload, now)
+    "#{payload}&ts=#{now}&#{Digest::SHA1.hexdigest("#{payload}&ts=#{now}&#{secret}")[0..39]}"
+  end
+
+  def decode_token_into_payload(token)
+    return [false, nil] if token.empty?
+
+    digest_pos = token.rindex('&')
+    return [false, nil] if digest_pos.nil?
+
+    ts_pos = token.rindex('&', digest_pos - 1)
+    return [false, nil] if ts_pos.nil?
+
+    extract_payload(token, ts_pos, digest_pos)
+  end
+
+  # return the payload and tisemstamp from the token.
+  # We expect ts_pos to be the index on the timeytsamp in the token
+  # and digest pos is the index of the digest in the token (the last component of the token)
+  def extract_payload(token, ts_pos, digest_pos)
+    payload = token[0...ts_pos]
+    ts = token[ts_pos + 4...digest_pos].to_i
+    digest = token[digest_pos + 1..-1]
+    calculated_digest = Digest::SHA1.hexdigest("#{payload}&ts=#{ts}&#{secret}")[0..39]
+    # debugging only: puts("EzToken.extract_payload: digest #{digest} and calculated digest #{calculated_digest}")
+
+    return [false, ts] if digest != calculated_digest
+    [payload, ts]
+  end
+
+  def decode_array(payload)
+    payload.split('&').map { |i| TypeCaster.new(i).uri_decode }
+  end
+
+  def decode_hash(payload)
+    return {} if payload == '=' # an empty hash
+    payload.split('&').each_with_object({}) do |item, result|
+      key, value, error = item.split('=')
+      raise "Invalid Hash for payload #{payload}" if key.empty? || error
+      result[key.to_sym] = TypeCaster.new(value).uri_decode || ''
+    end # all symbols
+  end
+end

metadata

@@ -0,0 +1,110 @@
+--- !ruby/object:Gem::Specification
+name: ez_token
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Mike Papper
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2017-03-29 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: type_caster
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.13'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.13'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: Allows Ruby String, Hash and Array objects to be encoded and decoded
+email:
+- bodaro@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
+- Gemfile
+- README.md
+- Rakefile
+- bin/console
+- bin/setup
+- ez_token.gemspec
+- lib/ez_token.rb
+- lib/ez_token/version.rb
+homepage: https://github.com/devforce/ez-token
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.1
+signing_key: 
+specification_version: 4
+summary: SHA1 Token creation from Ruby Arrays, Hash or Strings.
+test_files: []