fernet 0.0.1 → 0.0.2

data/README.md

@@ -24,11 +24,35 @@ Or install it yourself as:
 
 ## Usage
 
-For now, see [spec/fernet_spec.rb](https://github.com/hgimenez/fernet/blob/master/spec/fernet_spec.rb).
+Both server and client must share a secret.
 
-I'll flesh this out further soon. Sorry.
+You want to encode some data in the token as well, for example, an email address can be used to verify it on the other end.
+
+```ruby
+token = Fernet.generate(secret) do |generator|
+  generator.data = { email: 'harold@heroku.com' }
+end
+```
+
+On the server side, the receiver can use this token to verify wether it's legit:
+
+```ruby
+verified = Fernet.verify(secret, token) do |verifier|
+  verifier.data['email'] == 'harold@heroku.com'
+end
+```
+
+The `verified` variable will be true if:
+
+* The email encoded in the token data is `harold@heroku.com`
+* The token was generated in the last 60 seconds
+* The secret used to generate the token matches
+
+Otherwise, `verified` will be false, and you should deny the request with an HTTP 401, for example.
+
+The specs ([spec/fernet_spec.rb](https://github.com/hgimenez/fernet/blob/master/spec/fernet_spec.rb)) have more usage examples.
 
 ## License
 
-Valcro is copyright (c) Harold Giménez and is released under the terms of the
+Fernet is copyright (c) Harold Giménez and is released under the terms of the
 MIT License found in the LICENSE file.

data/lib/fernet/generator.rb

@@ -5,7 +5,6 @@ require 'date'
 
 module Fernet
   class Generator
-    attr_reader :secret
     attr_accessor :data
 
     def initialize(secret)
@@ -20,5 +19,12 @@ module Fernet
       Base64.urlsafe_encode64(JSON.dump(data.merge(signature: mac)))
     end
 
+    def inspect
+      "#<Fernet::Generator @secret=[masked] @data=#{@data.inspect}>"
+    end
+    alias to_s inspect
+
+  private
+    attr_reader :secret
   end
 end

data/lib/fernet/verifier.rb

@@ -6,23 +6,33 @@ require 'date'
 module Fernet
   class Verifier
 
-    attr_reader :secret, :token, :data
+    attr_reader :token, :data
     attr_writer :seconds_valid
 
     def initialize(secret)
-      @secret        = secret
+      @secret = secret
     end
 
     def verify_token(token)
       @token = token
       deconstruct
 
-      custom_verification = yield self
+      if block_given?
+        custom_verification = yield self
+      else
+        custom_verification = true
+      end
 
       signatures_match? && token_recent_enough? && custom_verification
     end
 
-    private
+    def inspect
+      "#<Fernet::Verifier @secret=[masked] @token=#{@token} @data=#{@data.inspect} @seconds_valid=#{@seconds_valid}>"
+    end
+    alias to_s inspect
+
+  private
+    attr_reader :secret
 
     def deconstruct
       @data               = JSON.parse(Base64.decode64(token))
@@ -35,7 +45,11 @@ module Fernet
     end
 
     def signatures_match?
-      @regenerated_mac == @received_signature
+      regenerated_bytes = @regenerated_mac.bytes.to_a
+      received_bytes    = @received_signature.bytes.to_a
+      received_bytes.inject(0) do |accum, byte|
+        accum |= byte ^ regenerated_bytes.shift
+      end.zero?
     end
   end
 end

data/lib/fernet/version.rb

@@ -1,3 +1,3 @@
 module Fernet
-  VERSION = "0.0.1"
+  VERSION = "0.0.2"
 end

data/spec/fernet_spec.rb

@@ -47,4 +47,12 @@ describe Fernet do
       verifier.seconds_valid = 0
     end.should be_false
   end
+
+  it 'verifies without a custom verification' do
+    token = Fernet.generate(secret) do |generator|
+      generator.data = token_data
+    end
+
+    Fernet.verify(secret, token).should be_true
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fernet
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
   prerelease: 
 platform: ruby
 authors:
@@ -13,7 +13,7 @@ date: 2012-07-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &70116561753260 !ruby/object:Gem::Requirement
+  requirement: &70169850711960 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,7 +21,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70116561753260
+  version_requirements: *70169850711960
 description: Delicious HMAC Digest[if] authentication
 email:
 - harold.gimenez@gmail.com