gcs-signer 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: d9da9710c3ec0d2781bb3d0002fc104a9f898ad9
+  data.tar.gz: 8027a48a1276f076f9d0a46a5bd9aa0841da712e
+SHA512:
+  metadata.gz: 3b1303e21df8a93d2cd23a8ef1636a30d79ff3238643524adfc52efa7b082df53fdcb2d5fbdaa85e6a89b2ef06323d31d481a906106a895ca42bc6b7fb4687d5
+  data.tar.gz: 8e37da7d200265cdeb64ae82a0395a6c66a26ae92b1f9bb7d1e25698b30a349be783d372114cacb2605a3238e9afcb99fa8909fd8f4586421dbe7edb77edda6f

data/README.md

@@ -0,0 +1,57 @@
+# gcs-signer
+
+Simple signed URL generator for Google Cloud Storage.
+
+## Features
+
+* No additional gems required.
+* No network connection required to generate signed URL.
+* Can read JSON service_account credentials from environment variables. So it can be used with [google-cloud-ruby](https://github.com/GoogleCloudPlatform/google-cloud-ruby) without additional configurations.
+
+## Installation
+
+```shell
+gem install gcs-signer
+```
+
+## Usage
+
+If you already configured `GOOGLE_CLOUD_KEYFILE` or `GOOGLE_CLOUD_KEYFILE_JSON` for google-cloud-ruby gem, just
+
+```ruby
+signer = GcsSigner.new
+```
+
+or you can give path of the service_account json file, or contents of it.
+
+```ruby
+signer = GcsSigner.new path: "/home/leo/path/to/service_account.json"
+
+signer = GcsSigner.new json_string: '{ "type": "service_account", ...'
+```
+
+then `#sign_url` to generate signed URL.
+
+```ruby
+# The signed URL is valid for 5 minutes by default.
+signer.sign_url "bucket-name", "path/to/object"
+
+# You can specify timestamps or how many seconds the signed URL is valid for.
+signer.sign_url "bucket-name", "object-name",
+                expires: Time.new(2016, 12, 26, 14, 31, 48)
+
+signer.sign_url "bucket-name", "object_name", valid_for: 600
+
+# If you use AcriveSupport in your project, you can also do some magic like:
+signer.sign_url "buekct", "object", valid_for: 45.minutes
+
+# See https://cloud.google.com/storage/docs/access-control/signed-urls
+# for other avaliable options.
+signer.sign_url "buekct", "object", google_access_id: "sangwon@sha.kr",
+                method: "PUT", content_type: "text/plain",
+                md5: "beefbeef..."
+```
+
+## License
+
+gcs-signer is distributed under the MIT License.

data/lib/gcs_signer.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+require "uri"
+require "openssl"
+require "base64"
+require "json"
+
+# Creates signed_url for a file on Google Cloud Storage.
+#
+#  signer = GcsSigner.new(path: "/Users/leo/private/service_account.json")
+#  signer.sign "your-bucket", "object/name"
+#  # => "https://storage.googleapis.com/your-bucket/object/name?..."
+class GcsSigner
+  VERSION = "0.1.0"
+
+  # gcs-signer requires credential that can access to GCS.
+  # [path] the path of the service_account json file.
+  # [json_string] ...or the content of the service_account json file.
+  #
+  # or if you also use \+google-cloud+ gem. you can authenticate
+  # using environment variable that uses.
+  def initialize(path: nil, json_string: nil)
+    json_string ||= File.read(path) unless path.nil?
+    json_string = look_for_environment_variables if json_string.nil?
+
+    fail AuthError, "No credentials given." if json_string.nil?
+    @credentials = JSON.parse(json_string)
+    @key = OpenSSL::PKey::RSA.new(@credentials["private_key"])
+  end
+
+  # @return [String] Signed url
+  # Generates signed url.
+  # [bucket] the name of the Cloud Storage bucket that contains the object.
+  # [object_name] the name of the object for signed url..
+  # Variable options are available:
+  # [expires] Time(stamp in UTC) when the signed url expires.
+  # [valid_for] ...or how much seconds is the signed url available.
+  # If you don't set those values, it will set to 300 seconds by default.
+  #
+  #  # default is 5 minutes
+  #  signer.sign_url("bucket-name", "path/to/file")
+  #
+  #  # You can give Time object.
+  #  signer.sign_url("bucket-name", "path/to/file",
+  #                   expires: Time.new(2016, 12, 26, 14, 31, 48, "+09:00"))
+  #
+  #  # You can give how much seconds is the signed url valid.
+  #  signer.sign_url("bucket", "path/to/file", valid_for: 30 * 60)
+  #
+  #  # If you use ActiveSupport, you can also do some magic.
+  #  signer.sign_url("bucket", "path/to/file", valid_for: 40.minutes)
+  #
+  # For details information of another options,
+  # like \+method+, \+md5+, and \+content_type+. See:
+  # https://cloud.google.com/storage/docs/access-control/signed-urls
+  #
+  # Just in case if you want to change \+GoogleAccessId+ in the signed url,
+  # You can set \+google_access_id+ as an option.
+  def sign_url(bucket, object_name, options = {})
+    options = apply_default_options(options)
+
+    url = URI.join "https://storage.googleapis.com",
+                   URI.escape("/#{bucket}/"), URI.escape(object_name)
+    signature = sign string_that_will_be_signed(url, options)
+    url.query = query_for_signed_url(signature, options)
+    url.to_s
+  end
+
+  # @return [String] contains \+project_id+ and \+client_email+
+  # Prevents confidential information (like private key) from exposing
+  # when used with interactive shell such as \+pry+ and \+irb+.
+  def inspect
+    "#<GcsSigner " \
+    "project_id: #{@credentials['project_id']} " \
+    "client_email: #{@credentials['client_email']}>"
+  end
+
+  private
+
+  # Look for environment variable which stores service_account.
+  def look_for_environment_variables
+    unless ENV["GOOGLE_CLOUD_KEYFILE"].nil?
+      return File.read(ENV["GOOGLE_CLOUD_KEYFILE"])
+    end
+
+    ENV["GOOGLE_CLOUD_KEYFILE_JSON"]
+  end
+
+  # Signs the string with the given private key.
+  def sign(string)
+    @key.sign OpenSSL::Digest::SHA256.new, string
+  end
+
+  def apply_default_options(options)
+    {
+      method: "GET", content_md5: nil,
+      content_type: nil,
+      expires: Time.now.utc.to_i + (options[:valid_for] || 300).to_i,
+      google_access_id: @credentials["client_email"]
+    }.merge(options)
+  end
+
+  def string_that_will_be_signed(url, options)
+    [
+      options[:method],
+      options[:content_md5],
+      options[:content_type],
+      options[:expires].to_i,
+      url.path
+    ].join "\n"
+  end
+
+  # Escapes and generates query string for actual result.
+  def query_for_signed_url(signature, options)
+    URI.encode_www_form GoogleAccessId: options[:google_access_id],
+                        Expires: options[:expires].to_i,
+                        Signature: Base64.strict_encode64(signature)
+  end
+
+  # raised When GcsSigner could not find service_account JSON file.
+  class AuthError < StandardError
+  end
+end

metadata

@@ -0,0 +1,90 @@
+--- !ruby/object:Gem::Specification
+name: gcs-signer
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Sangwon Yi
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2016-12-27 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.0'
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.9'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.40.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 0.40.0
+description: |2
+    Simple signed URL generator for Google Cloud Storage.
+    No additional gems and API requests required to generate signed URL.
+email:
+- sangwon@sha.kr
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- README.md
+- lib/gcs_signer.rb
+homepage: https://github.com/shakrmedia/gcs-signer
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - "~>"
+    - !ruby/object:Gem::Version
+      version: '2.2'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.5.2
+signing_key: 
+specification_version: 4
+summary: Simple signed URL generator for Google Cloud Storage.
+test_files: []