glogin 0.3.1 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 63e189fe6aa0a2beabdf350b2a2961d2574c8a56
-  data.tar.gz: a85fc1af68481b0d09b9ea51b6fb7d142bf00b29
+  metadata.gz: 3c119e131499ee21da88734113b234d547954e07
+  data.tar.gz: 1f8d5998346047a3c5d818b4d76510c1d23b5ef5
 SHA512:
-  metadata.gz: 06feacc9f00908e1bc6a236becc270e81a15131fe721873fba3106d3ff74dc1ccff7b60c1c0f61fece548d910cf6fb686e4c81cbb29dbb2f2fe74fc5da3acd1b
-  data.tar.gz: 144553e5e4d3ccdd9fe21e75f3eabd9aa124f7c51b172669540a81d95489b5d5582d4778009fb051722e32f8d2e02349af6ad8213a99335f0be1bfd6398fceae
+  metadata.gz: d49f67f6d1469db13a608e22c01bf3dda74065b5e9d95ef0c695fd321e79d81213b574a678d6f13c2894086aea3d2028c3221bd3a0a75017989866b058a85544
+  data.tar.gz: 64ebc43231b37ef27f359384fef145ad4b6aac34f07c3003c183bb4a743fa7c724474583470cec6d8a9791f874579d9afc5fa10f7a0cf67f74d64041442232cb

data/lib/glogin/codec.rb

@@ -0,0 +1,76 @@
+#
+# Copyright (c) 2017-2018 Yegor Bugayenko
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the 'Software'), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require 'securerandom'
+require 'openssl'
+require 'digest/sha1'
+require 'base64'
+
+# Codec.
+# Author:: Yegor Bugayenko (yegor256@gmail.com)
+# Copyright:: Copyright (c) 2017-2018 Yegor Bugayenko
+# License:: MIT
+module GLogin
+  #
+  # Codec
+  #
+  class Codec
+    def initialize(secret)
+      raise 'Secret can\'t be nil' if secret.nil?
+      @secret = secret
+    end
+
+    def decrypt(text)
+      if @secret.empty?
+        text
+      else
+        cpr = cipher
+        cpr.decrypt
+        cpr.key = digest
+        plain = Base64.decode64(text)
+        raise OpenSSL::Cipher::CipherError if plain.empty?
+        decrypted = cpr.update(plain)
+        decrypted << cpr.final
+        salt, body = decrypted.to_s.force_encoding('UTF-8').split(' ', 2)
+        raise OpenSSL::Cipher::CipherError if salt.empty?
+        body
+      end
+    end
+
+    def encrypt(text)
+      cpr = cipher
+      cpr.encrypt
+      cpr.key = digest
+      salt = SecureRandom.base64(Random.rand(8..32))
+      encrypted = cpr.update(salt + ' ' + text)
+      encrypted << cpr.final
+      Base64.encode64(encrypted.to_s)
+    end
+
+    def digest
+      Digest::SHA1.hexdigest(@secret)[0..31]
+    end
+
+    def cipher
+      OpenSSL::Cipher.new('aes-256-cbc')
+    end
+  end
+end

data/lib/glogin/cookie.rb

@@ -48,25 +48,15 @@ module GLogin
       # OpenSSL::Cipher::CipherError will be raised, which you have
       # to catch in your applicaiton and ignore the login attempt.
       def to_user
-        plain =
-          if @secret.empty?
-            @text
-          else
-            cpr = Cookie.cipher
-            cpr.decrypt
-            cpr.key = Cookie.digest(@secret)
-            decrypted = cpr.update(Base64.decode64(@text))
-            decrypted << cpr.final
-            decrypted.to_s
-          end
-        parts = plain.split('|', 3)
-        if !@secret.empty? && parts[2].to_s != @context
+        plain = Codec.new(@secret).decrypt(@text)
+        login, avatar, ctx = plain.split('|', 3)
+        if !@secret.empty? && ctx.to_s != @context
           raise(
             OpenSSL::Cipher::CipherError,
-            "Context '#{@context}' expected, but '#{parts[2]}' found"
+            "Context '#{@context}' expected, but '#{ctx}' found"
           )
         end
-        { login: parts[0], avatar: parts[1] }
+        { login: login, avatar: avatar }
       end
     end
 
@@ -83,23 +73,14 @@ module GLogin
 
       # Returns the text you should drop back to the user as a cookie.
       def to_s
-        cpr = Cookie.cipher
-        cpr.encrypt
-        cpr.key = Cookie.digest(@secret)
-        encrypted = cpr.update(
-          "#{@json['login']}|#{@json['avatar_url']}|#{@context}"
+        Codec.new(@secret).encrypt(
+          [
+            @json['login'],
+            @json['avatar_url'],
+            @context
+          ].join('|')
         )
-        encrypted << cpr.final
-        Base64.encode64(encrypted.to_s)
       end
     end
-
-    def self.digest(secret)
-      Digest::SHA1.hexdigest(secret)[0..31]
-    end
-
-    def self.cipher
-      OpenSSL::Cipher.new('aes-256-cbc')
-    end
   end
 end

data/lib/glogin/version.rb

@@ -24,5 +24,5 @@
 # Copyright:: Copyright (c) 2017-2018 Yegor Bugayenko
 # License:: MIT
 module GLogin
-  VERSION = '0.3.1'.freeze
+  VERSION = '0.4.0'.freeze
 end

data/test/glogin/test_codec.rb

@@ -0,0 +1,53 @@
+#
+# Copyright (c) 2017-2018 Yegor Bugayenko
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the 'Software'), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in all
+# copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+# SOFTWARE.
+
+require 'minitest/autorun'
+require_relative '../../lib/glogin/codec'
+
+class TestCodec < Minitest::Test
+  def test_encodes_and_decodes
+    text = 'This is the text, дорогой товарищ'
+    assert_equal(
+      text,
+      Base64.decode64(Base64.encode64(text)).force_encoding('UTF-8')
+    )
+  end
+
+  def test_encrypts_and_decrypts
+    crypt = GLogin::Codec.new('this is the secret key!')
+    text = 'This is the text, товарищ'
+    assert_equal(text, crypt.decrypt(crypt.encrypt(text)))
+  end
+
+  def test_decrypts_with_invalid_password
+    assert_raises OpenSSL::Cipher::CipherError do
+      GLogin::Codec.new('the wrong key').decrypt(
+        GLogin::Codec.new('the right key').encrypt('the text')
+      )
+    end
+  end
+
+  def test_decrypts_broken_text
+    assert_raises OpenSSL::Cipher::CipherError do
+      GLogin::Codec.new('the key').decrypt('этот текст не был зашифрован')
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: glogin
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.4.0
 platform: ruby
 authors:
 - Yegor Bugayenko
@@ -131,9 +131,11 @@ files:
 - glogin.gemspec
 - lib/glogin.rb
 - lib/glogin/auth.rb
+- lib/glogin/codec.rb
 - lib/glogin/cookie.rb
 - lib/glogin/version.rb
 - test/glogin/test_auth.rb
+- test/glogin/test_codec.rb
 - test/glogin/test_cookie.rb
 - test/test__helper.rb
 - test/test_glogin.rb
@@ -164,6 +166,7 @@ specification_version: 2
 summary: Login/logout via GitHub OAuth for your web app
 test_files:
 - test/glogin/test_auth.rb
+- test/glogin/test_codec.rb
 - test/glogin/test_cookie.rb
 - test/test__helper.rb
 - test/test_glogin.rb