gds-api-adapters 103.3.1 → 103.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a46ff92814cc4c552d487bf3f1601b70596a9f4382acf227d91189a0674b690f
-  data.tar.gz: a3f09b390e4a0ad83b2959dce31bd119681bec91838b694930fbd77f27677053
+  metadata.gz: 1ca9e25a98342ad51743aced3a94571ed70c52900baeb8ba602b3aac79508d03
+  data.tar.gz: bfa1de8257d71af66eaeb07e3bd250ff023f4e9cc7d75effd5c02e037222010e
 SHA512:
-  metadata.gz: c17e7759aebce22b1f80171a3488db204249251830033513a6cc2255a3a6c31972c6349824319bdd495dd75b4492b22c61ca73527098e91c735c894cf8218115
-  data.tar.gz: c8770755230be1e322b17aaa8d891860da839278aff40a87e38f7de9a6d573ac0084437ceacbd3d1cb3969b79bcfabcd50cf661eaae2134d9132ea9652b7fc97
+  metadata.gz: 302d8fddfb383f2d314bcfa5f9802cafbf908a9fa4c3848c838e3fc5adc9868f6b38a8b9e2024aa055c54d9fdadc4c015272893e8ddca5eb068686497ae569b2
+  data.tar.gz: 4cf72e311880119cbba79bc117261f30ce3d7dd3faf563bd838966bc5a989fe0103781696ae2461445f556d4c9d46fa02ed0276976ad84e6a9e6db98a29f5428

data/lib/gds_api/test_helpers/asset_manager.rb

@@ -24,9 +24,16 @@ module GdsApi
       def stub_asset_manager_has_an_asset(id, atts, filename = "")
         response = atts.merge("_response_info" => { "status" => "ok" })
 
+        stub_asset_manager_request_to_get_asset(id, response)
+        stub_asset_manager_request_to_asset_media(id, filename)
+      end
+
+      def stub_asset_manager_request_to_get_asset(id, response)
         stub_request(:get, "#{ASSET_MANAGER_ENDPOINT}/assets/#{id}")
           .to_return(body: response.to_json, status: 200)
+      end
 
+      def stub_asset_manager_request_to_asset_media(id, filename)
         stub_request(:get, "#{ASSET_MANAGER_ENDPOINT}/media/#{id}/#{filename}")
           .to_return(body: "Some file content", status: 200)
       end
@@ -45,20 +52,24 @@ module GdsApi
           .to_return(body: response.to_json, status: 404)
       end
 
+      def stub_asset_manager_get_asset_forbidden(id)
+        stub_request(:get, "#{ASSET_MANAGER_ENDPOINT}/assets/#{id}").to_return(status: 403)
+      end
+
       # This can take a string of an exact url or a hash of options
       #
       # with a string:
-      # `stub_asset_manager_receives_an_asset("https://asset-manager/media/619ce797-b415-42e5-b2b1-2ffa0df52302/file.jpg")`
+      # `stub_asset_manager_create_asset("https://asset-manager/media/619ce797-b415-42e5-b2b1-2ffa0df52302/file.jpg")`
       #
       # with a hash:
-      # `stub_asset_manager_receives_an_asset(id: "20d04259-e3ae-4f71-8157-e6c843096e96", filename: "file.jpg")`
+      # `stub_asset_manager_create_asset(id: "20d04259-e3ae-4f71-8157-e6c843096e96", filename: "file.jpg")`
       # which would return a file url of "https://asset-manager/media/20d04259-e3ae-4f71-8157-e6c843096e96/file.jpg"
       #
       # with no argument
       #
-      # `stub_asset_manager_receives_an_asset`
+      # `stub_asset_manager_create_asset`
       # which would return a file url of "https://asset-manager/media/0053adbf-0737-4923-9d8a-8180f2c723af/0d19136c4a94f07"
-      def stub_asset_manager_receives_an_asset(response_url = {})
+      def stub_asset_manager_create_asset(response_url = {}, response_body = {})
         stub_request(:post, "#{ASSET_MANAGER_ENDPOINT}/assets").to_return do
           if response_url.is_a?(String)
             file_url = response_url
@@ -70,10 +81,28 @@ module GdsApi
 
             file_url = "#{ASSET_MANAGER_ENDPOINT}/media/#{options[:id]}/#{options[:filename]}"
           end
-          { body: { file_url: }.to_json, status: 200 }
+          { body: response_body.merge(file_url:).to_json, status: 200 }
         end
       end
 
+      def stub_asset_manager_receives_an_asset(response_url = {})
+        warn <<~WARNING
+          stub_asset_manager_receives_an_asset is deprecated and will be removed
+          in a future version of gds-api-adapters. Replace calls to this method with
+          stub_asset_manager_create_asset.
+        WARNING
+
+        stub_asset_manager_create_asset(response_url)
+      end
+
+      def stub_asset_manager_create_asset_too_large
+        stub_request(:post, "#{ASSET_MANAGER_ENDPOINT}/assets").to_return(status: 413)
+      end
+
+      def stub_asset_manager_create_asset_unprocessable(body = "")
+        stub_request(:post, "#{ASSET_MANAGER_ENDPOINT}/assets").to_return(body:, status: 422)
+      end
+
       def stub_asset_manager_upload_failure
         stub_request(:post, "#{ASSET_MANAGER_ENDPOINT}/assets").to_return(status: 500)
       end
@@ -83,6 +112,14 @@ module GdsApi
           .to_return(body: body.to_json, status: 200)
       end
 
+      def stub_asset_manager_update_asset_forbidden(asset_id)
+        stub_request(:put, "#{ASSET_MANAGER_ENDPOINT}/assets/#{asset_id}").to_return(status: 403)
+      end
+
+      def stub_asset_manager_update_asset_not_found(asset_id)
+        stub_request(:put, "#{ASSET_MANAGER_ENDPOINT}/assets/#{asset_id}").to_return(status: 404)
+      end
+
       def stub_asset_manager_update_asset_failure(asset_id)
         stub_request(:put, "#{ASSET_MANAGER_ENDPOINT}/assets/#{asset_id}").to_return(status: 500)
       end

data/lib/gds_api/validators/base_path_validator.rb

@@ -0,0 +1,55 @@
+module GdsApi
+  module Validators
+    class BasePathValidator
+      MAX_PATH_LENGTH = 512
+
+      attr_reader :base_path
+
+      def initialize(base_path)
+        @base_path = base_path
+      end
+
+      def valid?
+        !(base_path.nil? || no_leading_slash? || too_long? || potential_path_traversal? || ends_with_a_period? || invalid_chars?)
+      end
+
+      def errors
+        return { base_path_invalid: ["must not be nil"] } if base_path.nil?
+
+        errors = []
+        errors << [:base_path_invalid, "must start with a /"] if no_leading_slash?
+        errors << [:base_path_too_long, "must not be longer than #{MAX_PATH_LENGTH} bytes"] if too_long?
+        errors << [:base_path_invalid, "must not include runs of . and or / characters, which could be penetration attempts"] if potential_path_traversal?
+        errors << [:base_path_invalid, "must not end with a ."] if ends_with_a_period?
+        errors << [:base_path_invalid, "must not include characters that are not lowercase letters, numbers, -, ., or /"] if invalid_chars?
+
+        errors.each_with_object({}) do |err, memo|
+          memo[err[0]] ||= []
+          memo[err[0]] << err[1]
+        end
+      end
+
+    private
+
+      def no_leading_slash?
+        base_path[0] != "/"
+      end
+
+      def too_long?
+        base_path.length > MAX_PATH_LENGTH
+      end
+
+      def potential_path_traversal?
+        base_path =~ /([\/.]{2,})/
+      end
+
+      def ends_with_a_period?
+        base_path[-1] == "."
+      end
+
+      def invalid_chars?
+        base_path !~ /^([\/a-z0-9.-])+$/
+      end
+    end
+  end
+end

data/lib/gds_api/version.rb

@@ -1,3 +1,3 @@
 module GdsApi
-  VERSION = "103.3.1".freeze
+  VERSION = "103.4.1".freeze
 end

data/lib/gds_api.rb

@@ -1,6 +1,7 @@
 require "addressable"
 require "plek"
 require "time"
+require "gds_api/validators/base_path_validator"
 require "gds_api/account_api"
 require "gds_api/asset_manager"
 require "gds_api/calendars"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gds-api-adapters
 version: !ruby/object:Gem::Version
-  version: 103.3.1
+  version: 103.4.1
 platform: ruby
 authors:
 - GOV.UK Dev
@@ -141,14 +141,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.19'
+        version: '6.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '5.19'
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: minitest-around
   requirement: !ruby/object:Gem::Requirement
@@ -295,14 +295,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.21'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: timecop
   requirement: !ruby/object:Gem::Requirement
@@ -386,6 +386,7 @@ files:
 - lib/gds_api/test_helpers/search.rb
 - lib/gds_api/test_helpers/support_api.rb
 - lib/gds_api/test_helpers/worldwide.rb
+- lib/gds_api/validators/base_path_validator.rb
 - lib/gds_api/version.rb
 - lib/gds_api/worldwide.rb
 - test/fixtures/finder_api/cma-case-schema.json
@@ -411,7 +412,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.10
+rubygems_version: 4.0.19
 specification_version: 4
 summary: Adapters to work with GDS APIs
 test_files: []