github-webhook-auth 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: b04bcb3f2bd7cae9a3638465b7dbeda3b8c6e9bd
+  data.tar.gz: cd4f878908b8f0b38bcace8078624d2bf27dad8e
+SHA512:
+  metadata.gz: ac11b519d36906776084593d58b618fc5997a4f7fe279da8c841fc599122e315c5ea61ab488cabfc370853d7f54a7cfe7be28bbb09e9c275206342e7810b66e7
+  data.tar.gz: ec02cbba417c239fd3c0ea331c077621dcbb537bef51f9d26bf846fea79c545dc696a60f134a0fdc5ef40c853f232bfc1c9a10b690e781b30b752fe1a6ecb47d

data/.gitignore

@@ -0,0 +1 @@
+Gemfile.lock

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in your gemspec
+gemspec

data/LICENSE.txt

@@ -0,0 +1,22 @@
+Copyright (c) 2014 Jon Rowe
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,32 @@
+# Github::Webhook::Auth
+
+Simple gem / Rack middleware for forcing a valid Github Webhook
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+    gem 'github-webhook-auth'
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install github-webhook-auth
+
+## Usage
+
+Set ENV['GITHUB_WEBHOOK_TOKEN'] to a secure value and then in your preferred
+Rack configuration location for your webhook endpoint add:
+
+    use Github::Webhook::Auth
+
+## Contributing
+
+1. Fork it
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create new Pull Request

data/Rakefile

@@ -0,0 +1,12 @@
+require 'bundler'
+Bundler::GemHelper.install_tasks
+
+require 'rspec'
+require 'rspec/core/rake_task'
+
+desc "Run specs"
+RSpec::Core::RakeTask.new :spec do |task|
+  task.pattern = 'spec/**/*_spec.rb'
+end
+
+task :default => [:spec]

data/github-webhook-auth.gemspec

@@ -0,0 +1,25 @@
+# -*- encoding: utf-8 -*-
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'github/webhook/auth/version'
+
+Gem::Specification.new do |gem|
+  gem.name          = "github-webhook-auth"
+  gem.version       = Github::Webhook::Auth::VERSION
+  gem.authors       = ["Jon Rowe"]
+  gem.email         = ["hello@jonrowe.co.uk"]
+  gem.description   = %q{Simple gem for forcing a valid Github Webhook}
+  gem.summary       = %q{Simple gem for forcing a valid Github Webhook}
+  gem.homepage      = "https://github.com/JonRowe/github-webhook-auth.git"
+
+  gem.files         = `git ls-files`.split($/)
+  gem.executables   = gem.files.grep(%r{^bin/}).map{ |f| File.basename(f) }
+  gem.test_files    = gem.files.grep(%r{^(spec)/})
+  gem.require_paths = ["lib"]
+
+  gem.add_dependency 'rack'
+
+  gem.add_development_dependency 'rake'
+  gem.add_development_dependency 'rspec'
+
+end

data/lib/github-webhook-auth.rb

@@ -0,0 +1 @@
+require 'github/webhook/auth'

data/lib/github/webhook/auth.rb

@@ -0,0 +1,36 @@
+require 'rack/utils'
+
+module Github
+  module Webhook
+    class Auth
+      def initialize app
+        @app = app
+      end
+
+      def call env
+        return [401, {}, ''] unless verify_signature(env.dup)
+        @app.call env
+      end
+
+    private
+
+      def verify_signature env
+        Rack::Utils.secure_compare signature(body env), env.fetch('HTTP_X_HUB_SIGNATURE','')
+      end
+
+      def body env
+        env['rack.input'].rewind
+        env['rack.input'].read
+      end
+
+      def signature body
+        'sha1=' + OpenSSL::HMAC.hexdigest(digest, ENV['SECRET_TOKEN'], body)
+      end
+
+      def digest
+        OpenSSL::Digest.new('sha1')
+      end
+
+    end
+  end
+end

data/lib/github/webhook/auth/version.rb

@@ -0,0 +1,7 @@
+module Github
+  module Webhook
+    class Auth
+      VERSION = '0.0.1'
+    end
+  end
+end

data/spec/github/webhook/auth_spec.rb

@@ -0,0 +1,52 @@
+require 'github-webhook-auth'
+
+describe 'protecting a webhook api endpoint' do
+
+  let(:app)        { double 'rack stack', :call => result }
+  let(:result)     { double 'result' }
+  let(:middleware) { Github::Webhook::Auth.new(app) }
+  let(:secret)     { 'S0m3Key' }
+
+  before do
+    stub_const("ENV", 'SECRET_TOKEN' => secret)
+  end
+
+  context 'when a valid auth token is provided' do
+    let(:env)       { { 'HTTP_X_HUB_SIGNATURE' => signature, 'rack.input' => body } }
+    let(:body)      { StringIO.new }
+    let(:hexdigest) { OpenSSL::Digest::Digest.new('sha1') }
+    let(:signature) { 'sha1='+OpenSSL::HMAC.hexdigest(hexdigest, secret, body.read) }
+
+    it 'calls the app and returns its response' do
+      expect(app).to receive(:call).with(env)
+      expect(middleware.call(env)).to eq result
+    end
+  end
+
+  context 'when an invalid auth token is provided' do
+    let(:env) { { 'HTTP_X_HUB_SIGNATURE' => 'notatoken', 'rack.input' => StringIO.new } }
+
+    it 'short circuits the app' do
+      expect(app).to_not receive(:call).with(env)
+      middleware.call(env)
+    end
+
+    it 'returns a 401 status' do
+      expect(middleware.call(env)[0]).to eq 401
+    end
+  end
+
+  context 'when no auth token is provided' do
+    let(:env) { { 'rack.input' => StringIO.new } }
+
+    it 'short circuits the app' do
+      expect(app).to_not receive(:call).with(env)
+      middleware.call(env)
+    end
+
+    it 'returns a 401 status' do
+      expect(middleware.call(env)[0]).to eq 401
+    end
+  end
+
+end

metadata

@@ -0,0 +1,96 @@
+--- !ruby/object:Gem::Specification
+name: github-webhook-auth
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Jon Rowe
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2014-11-16 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Simple gem for forcing a valid Github Webhook
+email:
+- hello@jonrowe.co.uk
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- Gemfile
+- LICENSE.txt
+- README.md
+- Rakefile
+- github-webhook-auth.gemspec
+- lib/github-webhook-auth.rb
+- lib/github/webhook/auth.rb
+- lib/github/webhook/auth/version.rb
+- spec/github/webhook/auth_spec.rb
+homepage: https://github.com/JonRowe/github-webhook-auth.git
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.3
+signing_key: 
+specification_version: 4
+summary: Simple gem for forcing a valid Github Webhook
+test_files:
+- spec/github/webhook/auth_spec.rb