homeaway-api 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 03191fa72b667f0ea2cfbbfb7898e8314888e572
-  data.tar.gz: 358c23be39110cde5a6c91a86d6513e9f91f6a86
+  metadata.gz: ae07b41c5a30e8aeaa52452b030387757671c384
+  data.tar.gz: e623705ba17d366361fb316aa33b6d44a6691bea
 SHA512:
-  metadata.gz: fa63f013b0c56621c4fdd1e0f017213087cfedbcac22f59f1ae95e9de04bc0c012a13d3207d23e9f4a8684ea62f9182ff8be6a8549df920e835dde2c992a7bca
-  data.tar.gz: 4fab671b70eae3d34f52a808487f4141a7509dda0ecfc90e3a1ce99f2c674ee31ae9aa24ef8e68d549aa06b987438290734c5a72993f97c07931cc0848d19876
+  metadata.gz: 6a9aeb236d4d8cd2b1df1ef77c0d70a62543452523abe6dc5014c5eecc623044cd5e3440f85209ac58c7adef2f21067ae19d6975525712b05f83506e77e3e7d6
+  data.tar.gz: 4a1af1d23b854653bc45010535834c6b66574742b2480cfc1573e5f8236220eb257793fc394f9b506e9876f6807444fd879e1f29cb2c6729549c4265222f69a1

data/README.md

@@ -39,13 +39,27 @@ This will automatically have your client authenticate with HomeAway. If you wish
 client.auth_url
 ```
 
-which will return back a URL as a String that the user of your application must be sent to. It is up to you to define how that takes place. Once your user goes to that url they will prompted to login with their HomeAway credentials. As soon as they do that and authorize your application to access their HomeAway data, the client's web browser will be redirected back to the redirect url that you specified when you created your client above. This url will have a code appended to it as a parameter named code. Once you are able to grab that code, you can use it with this gem:
+which will return back a URL as a String that the user of your application must be sent to. It is up to you to define how that takes place.
+
+_Note: You are recommended to save the `client.state` value. It is used to prevent your application from CSRF attacks ([http://homakov.blogspot.pt/2012/07/saferweb-most-common-oauth2.html](more details)). Saving it in the session is one way to achieve this, you will need to access this value again once the user is redirected back to your application and to ensure it's identicity with the one given then._
+
+Example with a RubyOnRails controller:
+
+```ruby
+session["homeaway-api.state"] = client.state
+```
+
+Once your user goes to that url they will be prompted to login with their HomeAway credentials. As soon as they do that and authorize your application to access their HomeAway data, the client's web browser will be redirected back to the redirect url that you specified when you created your client above. This url will have the `code` and `state` parameters appended to it.
+
+It's now time to ensure that this `state` parameter is present and identical to the previously saved `state` value. If this value have changed, it as then been tempered and certainly the reason of a CSRF attack, and should not perform the next step.
+
+Once the `state` validated and you are able to grab that code, you can use it with this gem:
 
 ```ruby
 client.oauth_code = code_received_from_redirect_url
 ```
 
-As soon as you make that assignment, the client will contact HomeAway and obtain a token that can be used for interacting with the HomeAway for that user for that particular session. By default, this token has a 6 month expiration time.
+As soon as you make that assignment, the client will contact HomeAway and obtain a token that can be used for interacting with the HomeAway account of that user. By default, this token has a 6 month expiration time.
 
 ### Using an existing token
 
@@ -85,10 +99,10 @@ Each of the operations is detailed in the generated Yard documentation for this
 ```ruby
 require 'homeaway_api'
 client = HomeAway::API::Client.new(client_id: your_client_id, client_secret: your_client_secret)
-response = @client.get_listing '123456', ['AVAILABILITY', 'RATES']
+response = @client.listing '123456', ['AVAILABILITY', 'RATES']
 paginator = @client.search '4 bathrooms new york'
 paginator.each do |search_result|
-  listing =  @client.get_listing search_result.listing_id, ['DETAILS', 'RATES', 'LOCATION']
+  listing =  @client.listing search_result.listing_id, ['DETAILS', 'RATES', 'LOCATION']
   puts listing
 end
 ```

data/lib/homeaway/api/domain/listing.rb

@@ -26,7 +26,7 @@ module HomeAway
         # * X-HomeAway-DisplayLocale: If a locale is not specified in a query param, it will be searched for in the X-HomeAway-DisplayLocale Header. If it is not supplied in either area the default locale of the user will be selected if it exists. Otherwise the Accept-Language Header will be used.
         #
         # @param id [String] The id of the listing.
-        # @option opts [String] :q Use the q parameter to fetch specific listing details.Valid options are AVAILABILITY, DETAILS, LOCATIONS, PHOTOS, RATES, REVIEWS If no value is given, the listing is returned with minimal content., can be an array of multiple values
+        # @option opts [String] :q Use the q parameter to fetch specific listing details. Valid options are AVAILABILITY, DETAILS, LOCATIONS, PHOTOS, RATES, REVIEWS. If no value is given, the listing is returned with minimal content. Can be an array of multiple values.
         # @return [HomeAway::API::Response] the result of the call to the API
         def listing(id, q=nil)
           params = {'id' => id.to_s}

data/lib/homeaway/api/util/oauth.rb

@@ -25,9 +25,16 @@ module HomeAway
           Base64.strict_encode64 "#{@configuration.client_id}:#{@configuration.client_secret}"
         end
 
-        # @private
+        # @return [String] the authorization URL you need to redirect a HomeAway user
+        #                  to grant you access to their account.
         def auth_url
-          oauth_client_strategy.authorize_url
+          oauth_client_strategy.authorize_url(state: state)
+        end
+
+        # @return [String] a 48 characters long, securely random string, used to mitigate
+        #                  CSRF attacks during the authorization process.
+        def state
+          @_state ||= SecureRandom.hex(24)
         end
 
         # completes the oauth flow
@@ -42,7 +49,11 @@ module HomeAway
             @refresh_token = token.refresh_token
             @mode = :three_legged
             return true
-          rescue => _
+          rescue => e
+            if e.is_a? OAuth2::Error
+              error_class = HomeAway::API::Errors.for_http_code e.response.status
+              raise error_class.new(JSON.parse(e.response.response.body))
+            end
             raise HomeAway::API::Errors::UnauthorizedError.new
           end
         end
@@ -57,7 +68,7 @@ module HomeAway
           OAuth2::Client.new(@configuration.client_id,
                              @configuration.client_secret,
                              :site => oauth_site,
-                             :raise_errors => false
+                             :raise_errors => true
           )
         end
 
@@ -76,22 +87,34 @@ module HomeAway
             @refresh_token = token.refresh_token
             @mode = :two_legged
             return true
-          rescue => _
+          rescue => e
+            if e.is_a? OAuth2::Error
+              error_class = HomeAway::API::Errors.for_http_code e.response.status
+              raise error_class.new(JSON.parse(e.response.response.body))
+            end
             raise HomeAway::API::Errors::UnauthorizedError.new
           end
         end
 
         def refresh
-          token = OAuth2::AccessToken.new(oauth_client, nil, {:refresh_token => @refresh_token})
-          params = {
-              :headers => {'Authorization' => "Basic #{credentials}"}
-          }
-          token = token.refresh!(params)
-          @token = token.token
-          @token_expires = Time.at token.expires_at
-          @refresh_token = token.refresh_token
-          @mode = :three_legged
-          true
+          begin
+            token = OAuth2::AccessToken.new(oauth_client, nil, {:refresh_token => @refresh_token})
+            params = {
+                :headers => {'Authorization' => "Basic #{credentials}"}
+            }
+            token = token.refresh!(params)
+            @token = token.token
+            @token_expires = Time.at token.expires_at
+            @refresh_token = token.refresh_token
+            @mode = :three_legged
+            return true
+          rescue => e
+            if e.is_a? OAuth2::Error
+              error_class = HomeAway::API::Errors.for_http_code e.response.status
+              raise error_class.new(JSON.parse(e.response.response.body))
+            end
+            raise HomeAway::API::Errors::UnauthorizedError.new
+          end
         end
       end
     end

data/lib/homeaway/api/version.rb

@@ -15,6 +15,6 @@
 
 module HomeAway
   module API
-    VERSION = '1.2.0'
+    VERSION = '1.3.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: homeaway-api
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Charlie Meyer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-05-10 00:00:00.000000000 Z
+date: 2016-05-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: hashie