fernet 2.0.rc2 → 2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/README.md +2 -2
- data/lib/fernet.rb +24 -21
- data/lib/fernet/configuration.rb +5 -5
- data/lib/fernet/encryption.rb +17 -17
- data/lib/fernet/generator.rb +13 -12
- data/lib/fernet/token.rb +12 -9
- data/lib/fernet/verifier.rb +6 -5
- data/lib/fernet/version.rb +1 -1
- metadata +5 -5
data/README.md
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
# Fernet
|
2
2
|
|
3
|
-
[](http://travis-ci.org/fernet/fernet-rb)
|
4
|
+
[](https://codeclimate.com/github/fernet/fernet-rb)
|
5
5
|
|
6
6
|
Fernet allows you to easily generate and verify **HMAC based authentication
|
7
7
|
tokens** for issuing API requests between remote servers. It also **encrypts**
|
data/lib/fernet.rb
CHANGED
@@ -15,12 +15,12 @@ module Fernet
|
|
15
15
|
# secret - a base64 encoded, 32 byte string
|
16
16
|
# message - the message being secured in plain text
|
17
17
|
#
|
18
|
-
# Returns the fernet token as a string
|
19
|
-
#
|
20
18
|
# Examples
|
21
19
|
#
|
22
20
|
# secret = ...
|
23
21
|
# token = Fernet.generate(secret, 'my secrets')
|
22
|
+
#
|
23
|
+
# Returns the fernet token as a string
|
24
24
|
def self.generate(secret, message = '', opts = {})
|
25
25
|
Generator.new(opts.merge({secret: secret, message: message})).
|
26
26
|
generate
|
@@ -30,36 +30,39 @@ module Fernet
|
|
30
30
|
#
|
31
31
|
# secret - the secret used to generate the token
|
32
32
|
# token - the token to verify as a string
|
33
|
-
# opts
|
34
|
-
#
|
35
|
-
#
|
33
|
+
# opts - an optional hash containing
|
34
|
+
# * enforce_ttl - whether to enforce TTL in this verification
|
35
|
+
# * ttl - number of seconds token is valid
|
36
36
|
#
|
37
37
|
# Both enforce_ttl and ttl can be configured globally via Configuration
|
38
38
|
#
|
39
|
-
# Returns a verifier object, which responds to valid? and message
|
40
|
-
#
|
41
39
|
# Raises Fernet::Token::InvalidToken if token is invalid and message
|
42
40
|
# is attempted to be extracted
|
43
41
|
#
|
44
42
|
# Examples
|
45
43
|
#
|
46
|
-
#
|
47
|
-
#
|
48
|
-
#
|
49
|
-
#
|
50
|
-
#
|
51
|
-
#
|
44
|
+
# secret = ...
|
45
|
+
# token = ...
|
46
|
+
# verifier = Fernet.verifier(secret, old_token, enforce_ttl: false)
|
47
|
+
# if verifier.valid?
|
48
|
+
# verifier.message # original message in plain text
|
49
|
+
# end
|
50
|
+
#
|
51
|
+
# verifier = Fernet.verifier(secret, old_token)
|
52
|
+
# if verifier.valid?
|
53
|
+
# verifier.message
|
54
|
+
# else
|
55
|
+
# verifier.errors
|
56
|
+
# # => { issued_timestamp: "is too far in the past: token expired" }
|
57
|
+
# verifier.error_messages
|
58
|
+
# # => ["issued_timestamp is too far in the past: token expired"]
|
59
|
+
# end
|
52
60
|
#
|
53
|
-
#
|
54
|
-
# if verifier.valid?
|
61
|
+
# verifier = Fernet.verifier(secret, old_token)
|
55
62
|
# verifier.message
|
56
|
-
#
|
57
|
-
# verifier.errors
|
58
|
-
# # -> { issued_timestamp: "is too far in the past: token expired" }
|
59
|
-
# verifier.error_messages
|
60
|
-
# # -> ["issued_timestamp is too far in the past: token expired"]
|
61
|
-
# end
|
63
|
+
# # => raises Fernet::Token::InvalidToken if token too old or invalid
|
62
64
|
#
|
65
|
+
# Returns a verifier object, which responds to `#valid?` and `#message`
|
63
66
|
def self.verifier(secret, token, opts = {})
|
64
67
|
Verifier.new(opts.merge({secret: secret, token: token}))
|
65
68
|
end
|
data/lib/fernet/configuration.rb
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
require 'singleton'
|
2
2
|
module Fernet
|
3
|
-
# Public
|
4
|
-
#
|
3
|
+
# Public: singleton class used to globally set various
|
4
|
+
# configuration defaults
|
5
5
|
class Configuration
|
6
6
|
include Singleton
|
7
7
|
|
@@ -24,9 +24,9 @@ module Fernet
|
|
24
24
|
#
|
25
25
|
# Examples
|
26
26
|
#
|
27
|
-
#
|
28
|
-
#
|
29
|
-
#
|
27
|
+
# Fernet::Configuration.run do |config|
|
28
|
+
# config.enforce_ttl = false
|
29
|
+
# end
|
30
30
|
def self.run
|
31
31
|
self.instance.enforce_ttl = true
|
32
32
|
self.instance.ttl = 60
|
data/lib/fernet/encryption.rb
CHANGED
@@ -9,17 +9,17 @@ module Fernet
|
|
9
9
|
# random IV and the provided encryption key
|
10
10
|
#
|
11
11
|
# opts - a hash containing
|
12
|
-
#
|
13
|
-
#
|
14
|
-
#
|
15
|
-
#
|
16
|
-
# Returns a two-element array containing the ciphertext and the random IV
|
12
|
+
# * message - the message to encrypt
|
13
|
+
# * key - the encryption key
|
14
|
+
# * iv - override for the random IV, only used for testing
|
17
15
|
#
|
18
16
|
# Examples
|
19
17
|
#
|
20
|
-
#
|
21
|
-
#
|
22
|
-
#
|
18
|
+
# ciphertext, iv = Fernet::Encryption.encrypt(
|
19
|
+
# message: 'this is a secret', key: encryption_key
|
20
|
+
# )
|
21
|
+
#
|
22
|
+
# Returns a two-element array containing the ciphertext and the random IV
|
23
23
|
def self.encrypt(opts)
|
24
24
|
cipher = OpenSSL::Cipher.new('AES-128-CBC')
|
25
25
|
cipher.encrypt
|
@@ -33,17 +33,17 @@ module Fernet
|
|
33
33
|
# the provided IV and encryption key
|
34
34
|
#
|
35
35
|
# opts - a hash containing
|
36
|
-
#
|
37
|
-
#
|
38
|
-
#
|
39
|
-
#
|
40
|
-
# Returns a two-element array containing the ciphertext and the random IV
|
36
|
+
# * ciphertext - encrypted message
|
37
|
+
# * key - encryption key used to encrypt the message
|
38
|
+
# * iv - initialization vector used in the ciphertext's cipher
|
41
39
|
#
|
42
40
|
# Examples
|
43
41
|
#
|
44
|
-
#
|
45
|
-
#
|
46
|
-
#
|
42
|
+
# ciphertext, iv = Fernet::Encryption.encrypt(
|
43
|
+
# message: 'this is a secret', key: encryption_key
|
44
|
+
# )
|
45
|
+
#
|
46
|
+
# Returns a two-element array containing the ciphertext and the random IV
|
47
47
|
def self.decrypt(opts)
|
48
48
|
decipher = OpenSSL::Cipher.new('AES-128-CBC')
|
49
49
|
decipher.decrypt
|
@@ -55,7 +55,7 @@ module Fernet
|
|
55
55
|
# Internal: Creates an HMAC signature (sha356 hashing) of the given bytes
|
56
56
|
# with the provided signing key
|
57
57
|
#
|
58
|
-
# key
|
58
|
+
# key - the signing key
|
59
59
|
# bytes - blob of bytes to sign
|
60
60
|
#
|
61
61
|
# Returns the HMAC signature as a string
|
data/lib/fernet/generator.rb
CHANGED
@@ -6,14 +6,14 @@ require 'date'
|
|
6
6
|
module Fernet
|
7
7
|
# Internal: Generates Fernet tokens
|
8
8
|
class Generator
|
9
|
-
# Returns the token's message
|
9
|
+
# Internal: Returns the token's message
|
10
10
|
attr_accessor :message
|
11
11
|
|
12
12
|
# Internal: Initializes a generator
|
13
13
|
#
|
14
14
|
# opts - a hash containing the following keys:
|
15
|
-
#
|
16
|
-
#
|
15
|
+
# * secret - a string containing a secret, optionally Base64 encoded
|
16
|
+
# * message - the message
|
17
17
|
def initialize(opts)
|
18
18
|
@secret = opts.fetch(:secret)
|
19
19
|
@message = opts[:message]
|
@@ -25,17 +25,18 @@ module Fernet
|
|
25
25
|
#
|
26
26
|
# Yields itself, useful for setting or overriding the message
|
27
27
|
#
|
28
|
-
# Returns the token as a string
|
29
|
-
#
|
30
28
|
# Examples
|
31
|
-
# generator = Generator.new(secret: some_secret)
|
32
|
-
# token = generator.generate do |g|
|
33
|
-
# g.message = 'this is my message'
|
34
|
-
# end
|
35
29
|
#
|
36
|
-
#
|
37
|
-
#
|
38
|
-
#
|
30
|
+
# generator = Generator.new(secret: some_secret)
|
31
|
+
# token = generator.generate do |g|
|
32
|
+
# g.message = 'this is my message'
|
33
|
+
# end
|
34
|
+
#
|
35
|
+
# generator = Generator.new(secret: some_secret,
|
36
|
+
# message: 'this is my message')
|
37
|
+
# token = generator.generate
|
38
|
+
#
|
39
|
+
# Returns the token as a string
|
39
40
|
def generate
|
40
41
|
yield self if block_given?
|
41
42
|
|
data/lib/fernet/token.rb
CHANGED
@@ -18,10 +18,11 @@ module Fernet
|
|
18
18
|
#
|
19
19
|
# token - the string representation of this token
|
20
20
|
# opts - a has containing
|
21
|
-
#
|
22
|
-
#
|
23
|
-
#
|
24
|
-
#
|
21
|
+
# * secret - the secret, optionally base 64 encoded (required)
|
22
|
+
# * enforce_ttl - whether to enforce TTL upon validation. Defaults to
|
23
|
+
# value set in Configuration.enforce_ttl
|
24
|
+
# * ttl - number of seconds token is valid, defaults to
|
25
|
+
# Configuration.ttl
|
25
26
|
def initialize(token, opts = {})
|
26
27
|
@token = token
|
27
28
|
@secret = Secret.new(opts.fetch(:secret))
|
@@ -65,16 +66,18 @@ module Fernet
|
|
65
66
|
# Internal: generates a Fernet Token
|
66
67
|
#
|
67
68
|
# opts - a hash containing
|
68
|
-
#
|
69
|
-
#
|
69
|
+
# * secret - a string containing the secret, optionally base64 encoded
|
70
|
+
# * message - the message in plain text
|
70
71
|
def self.generate(opts)
|
71
72
|
unless opts[:secret]
|
72
73
|
raise ArgumentError, 'Secret not provided'
|
73
74
|
end
|
74
75
|
secret = Secret.new(opts.fetch(:secret))
|
75
|
-
encrypted_message, iv = Encryption.encrypt(
|
76
|
-
|
77
|
-
|
76
|
+
encrypted_message, iv = Encryption.encrypt(
|
77
|
+
key: secret.encryption_key,
|
78
|
+
message: opts[:message],
|
79
|
+
iv: opts[:iv]
|
80
|
+
)
|
78
81
|
issued_timestamp = (opts[:now] || Time.now).to_i
|
79
82
|
|
80
83
|
payload = [DEFAULT_VERSION].pack("C") +
|
data/lib/fernet/verifier.rb
CHANGED
@@ -14,10 +14,10 @@ module Fernet
|
|
14
14
|
# Internal: initializes a Verifier
|
15
15
|
#
|
16
16
|
# opts - a hash containing
|
17
|
-
#
|
18
|
-
#
|
19
|
-
#
|
20
|
-
#
|
17
|
+
# * secret - the secret used to create the token (required)
|
18
|
+
# * token - the fernet token string (required)
|
19
|
+
# * enforce_ttl - whether to enforce TTL, defaults to Configuration.enforce_ttl
|
20
|
+
# * ttl - number of seconds the token is valid
|
21
21
|
def initialize(opts = {})
|
22
22
|
enforce_ttl = opts.has_key?(:enforce_ttl) ? opts[:enforce_ttl] : Configuration.enforce_ttl
|
23
23
|
@token = Token.new(opts.fetch(:token),
|
@@ -46,7 +46,8 @@ module Fernet
|
|
46
46
|
message
|
47
47
|
end
|
48
48
|
|
49
|
-
# Public: String representation of this verifier, masks the secret to avoid
|
49
|
+
# Public: String representation of this verifier, masks the secret to avoid
|
50
|
+
# leaks
|
50
51
|
def inspect
|
51
52
|
"#<Fernet::Verifier @secret=[masked] @token=#{@token} @message=#{@message.inspect} @ttl=#{@ttl} @enforce_ttl=#{@enforce_ttl}>"
|
52
53
|
end
|
data/lib/fernet/version.rb
CHANGED
metadata
CHANGED
@@ -1,15 +1,15 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: fernet
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 2.0
|
5
|
-
prerelease:
|
4
|
+
version: '2.0'
|
5
|
+
prerelease:
|
6
6
|
platform: ruby
|
7
7
|
authors:
|
8
8
|
- Harold Giménez
|
9
9
|
autorequire:
|
10
10
|
bindir: bin
|
11
11
|
cert_chain: []
|
12
|
-
date: 2013-
|
12
|
+
date: 2013-12-16 00:00:00.000000000 Z
|
13
13
|
dependencies:
|
14
14
|
- !ruby/object:Gem::Dependency
|
15
15
|
name: valcro
|
@@ -91,9 +91,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
|
|
91
91
|
required_rubygems_version: !ruby/object:Gem::Requirement
|
92
92
|
none: false
|
93
93
|
requirements:
|
94
|
-
- - ! '
|
94
|
+
- - ! '>='
|
95
95
|
- !ruby/object:Gem::Version
|
96
|
-
version:
|
96
|
+
version: '0'
|
97
97
|
requirements: []
|
98
98
|
rubyforge_project:
|
99
99
|
rubygems_version: 1.8.23
|