ibanity 1.4 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 81118d7e11ae925cc6430b6c8bd2ffd2afa948ee5c867c433f39c382522221b8
-  data.tar.gz: 97ddaeb532907a37de4fcede16e0365eca040ca0400b3f3062b6f951e276c1b2
+  metadata.gz: 8764b1c890efb8ca4d619b84264ba4fcd0a10cdbd6d1fd505da2b733662d329c
+  data.tar.gz: a44447ecf5aec8045ade36f08702f8a134f98d5eff010843ba730902dfd0552e
 SHA512:
-  metadata.gz: 11bd6d234f2aa23f685fc8628fc95b66aef1d668e888f83a12adfbc92882ed0e3a1f75943af66dfdc9014b867ea503afd423f7bb70cef47194f1a1c928e6fc78
-  data.tar.gz: 783515919ad0436aa0e851999b86a288b8e73b1a240465f21e39606a422bb903eb61356b2641188c9558d88ad8517c2493f0013e882df22939b073f0e68bbcf5
+  metadata.gz: 8a30ada191b9256e197c851ff8c09dd9cfc89c3b72ac28c0c726da288dd925868c944f7f461cd40af55a28499ae7581718e2ef4a471dd36531e312b776c7fca1
+  data.tar.gz: 94d709de117a166321a587cf5db08b2fea8657547fc4a3dd1cf2844c68db4d9fa63d72ed3a2d56f43639c31400831ab611ac6081d545835af2146bfd09f60248

data/.gitignore

@@ -16,3 +16,6 @@ mkmf.log
 .ruby*
 *.gem
 *.env
+/.idea
+/bin
+.rakeTasks

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.5
+
+* Proper release of previous enhancements
+
+## 1.4
+
+*Don't use this version as it was not properly released !*
+
 ## 1.3
 
 ### Enhancements
@@ -10,6 +18,7 @@
 
 ### Enhancements
 
+* Default signature algorithm is now ["hs2019"](https://tools.ietf.org/html/draft-cavage-http-signatures-12#appendix-E.2) 
 * Add support for periodic and bulk payments
 * Add snake-case transformation for deeply nested data structures
 

data/lib/ibanity/http_signature.rb

@@ -2,6 +2,9 @@ require "base64"
 
 module Ibanity
   class HttpSignature
+    PSS_DIGEST_ALGORITHM = "SHA256"
+    SIGNATURE_ALGORITHM  = "hs2019"
+
     def initialize(certificate:, certificate_id:, key:, method:, uri:, query_params:, headers:, payload:)
       @certificate    = certificate
       @certificate_id = certificate_id
@@ -13,6 +16,21 @@ module Ibanity
       @query_params   = query_params
     end
 
+    def signature_headers
+      {
+        "Digest"    => payload_digest,
+        "Signature" => [
+          %(keyId="#{@certificate_id}"),
+          %(created="#{date}"),
+          %(algorithm="#{SIGNATURE_ALGORITHM}"),
+          %(headers="#{headers_to_sign.join(" ")}"),
+          %(signature="#{base64_signature}"),
+        ].join(",")
+      }
+    end
+
+    private
+
     def payload_digest
       digest         = OpenSSL::Digest::SHA512.new
       string_payload = @payload.nil? ? "" : @payload
@@ -21,12 +39,8 @@ module Ibanity
       "SHA-512=#{base64}"
     end
 
-    def signature_algorithm
-      @certificate.signature_algorithm.match("sha256") ? "rsa-sha256" : "rsa-sha512"
-    end
-
     def headers_to_sign
-      result = ["(request-target)", "host", "digest", "date"]
+      result = ["(request-target)", "host", "digest", "(created)"]
       result << "authorization" unless @headers["Authorization"].nil?
       @headers.keys.each do |header|
         result << header.to_s.downcase if header.to_s.match(/ibanity/i)
@@ -40,8 +54,7 @@ module Ibanity
     end
 
     def base64_signature
-      digest = signature_algorithm == "rsa-sha256" ?  OpenSSL::Digest::SHA256.new :  OpenSSL::Digest::SHA512.new
-      signature = @key.sign(digest, signing_string)
+      signature = @key.sign_pss(PSS_DIGEST_ALGORITHM, signing_string, salt_length: :digest, mgf1_hash: PSS_DIGEST_ALGORITHM)
       Base64.urlsafe_encode64(signature)
     end
 
@@ -50,13 +63,13 @@ module Ibanity
     end
 
     def date
-      @date ||= Time.now.utc.iso8601
+      @date ||= Time.now.to_i
     end
 
     def signing_string
       result = []
       headers_to_sign.each do |header_to_sign|
-        value   = header_value(header_to_sign)
+        value = header_value(header_to_sign)
         result << "#{header_to_sign}: #{value}"
       end
       result.join("\n")
@@ -70,20 +83,12 @@ module Ibanity
         host
       when "digest"
         payload_digest
-      when "date"
+      when "(created)"
         date
       else
         camelized_header = header.split("-").collect(&:capitalize).join("-")
         @headers[camelized_header]
       end
     end
-
-    def signature_headers
-      {
-        "Date"      => date,
-        "Digest"    => payload_digest,
-        "Signature" => "keyId=\"#{@certificate_id}\" algorithm=\"#{signature_algorithm}\" headers=\"#{headers_to_sign.join(" ")}\" signature=\"#{base64_signature}\""
-      }
-    end
   end
 end

data/lib/ibanity/version.rb

@@ -1,3 +1,3 @@
 module Ibanity
-  VERSION = "1.4"
+  VERSION = "1.5.0"
 end

data/spec/lib/ibanity/http_signature_spec.rb

@@ -0,0 +1,39 @@
+require "ibanity/http_signature"
+
+RSpec.describe Ibanity::HttpSignature do
+
+  describe ".signature_headers" do
+    let(:signature) do
+      Ibanity::HttpSignature.new(
+        certificate: CryptoHelper.load_certificate("test"),
+        certificate_id: "ec0c29ef-3b39-4b6f-93ff-866bed032399",
+        key: CryptoHelper.load_private_key("test"),
+        method: "post",
+        uri: "https://api.ibanity.com/xs2a/customer-access-tokens",
+        headers: {"ibanity-idempotency-key" => "cf17b515-5f6f-4213-a8fe-e4cd40653d00"},
+        payload: "{\"foo\": \"bar\"}",
+        query_params: {}
+      )
+    end
+
+    let(:parts_regex) do
+      /keyId="(?<keyId>.*)",\s?created="(?<created>.*)?",?\s?algorithm="(?<algorithm>.*)",\s?headers="(?<headers>.*)",?\s?signature="(?<signature>.*)"/
+    end
+
+    let(:signature_parts) do
+      signature.signature_headers["Signature"].match(parts_regex).named_captures
+    end
+
+    ["Digest", "Signature"].each do |header|
+      it "contains the '#{header}' header" do
+        expect(signature.signature_headers).to include(header)
+      end
+    end
+
+    ["keyId", "algorithm", "headers", "signature", "created"].each do |part|
+      it "has a signature containing the part '#{part}'" do
+        expect(signature_parts).to include(part)
+      end
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -13,6 +13,8 @@
 # it.
 #
 # See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
+Dir["#{File.dirname(__FILE__)}/support/**/*.rb"].each { |f| require f }
+
 RSpec.configure do |config|
   # rspec-expectations config goes here. You can use an alternate
   # assertion/expectation library such as wrong or the stdlib/minitest

data/spec/support/crypto_helper.rb

@@ -0,0 +1,21 @@
+require "pathname"
+require "openssl"
+
+module CryptoHelper
+  FIXTURE_DIRECTORY = Pathname.getwd().join("spec", "support", "fixtures", "signature")
+
+  def self.load_certificate(name)
+    pem = File.read(FIXTURE_DIRECTORY.join("#{name}-certificate.pem"))
+    ::OpenSSL::X509::Certificate.new(pem)
+  end
+
+  def self.load_public_key(name)
+    pem = File.read(FIXTURE_DIRECTORY.join("#{name}-public_key.pem"))
+    ::OpenSSL::PKey::RSA.new(pem)
+  end
+
+  def self.load_private_key(name)
+    pem = File.read(FIXTURE_DIRECTORY.join("#{name}-private_key.pem"))
+    ::OpenSSL::PKey::RSA.new(pem)
+  end
+end

data/spec/support/fixtures/signature/test-certificate.pem

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDdjCCAl4CCQCxpvuEfl5slTANBgkqhkiG9w0BAQsFADB9MQswCQYDVQQGEwJC
+RTERMA8GA1UECAwIQnJ1c3NlbHMxETAPBgNVBAcMCEJydXNzZWxzMRAwDgYDVQQK
+DAdJYmFuaXR5MRMwEQYDVQQDDAppYmFuaXR5LmJlMSEwHwYJKoZIhvcNAQkBFhJj
+b21wYW55QGliYW5pdHkuYmUwHhcNMTkwNjI3MTE1NjAyWhcNMjkwNjI0MTE1NjAy
+WjB9MQswCQYDVQQGEwJCRTERMA8GA1UECAwIQnJ1c3NlbHMxETAPBgNVBAcMCEJy
+dXNzZWxzMRAwDgYDVQQKDAdJYmFuaXR5MRMwEQYDVQQDDAppYmFuaXR5LmJlMSEw
+HwYJKoZIhvcNAQkBFhJjb21wYW55QGliYW5pdHkuYmUwggEiMA0GCSqGSIb3DQEB
+AQUAA4IBDwAwggEKAoIBAQDcaDiqP4EkTYXzDqCLZGiEEQnx0iazY/f3IMZNnYVf
+BDSLl3m2x1+3ch4Pe/E35Aag1webnvDh/VVRch0+n4KV/4Toe0Oq9VP6xKqOXYtZ
+ZAVWXzs1TjdT/dk+rRXa+wnyq2KklPJ0aowzAyr3EzivW1v19uhWdqguhPEPopr/
+2sue3vloZrigamOov29iFkiFLtSqAyEZI7x48w/3X2nkZ1UivYxBRrLnulVMUJDZ
+zvydu3stlu6mSlaQ3Mpdgzyz4V41NImzNeJnW1F6riwd6hud9xokDZSvredC/XhM
+byl0LdrKABzyHnOFSBlIkIHDeQUPa9YKBESRMtOVmyrvAgMBAAEwDQYJKoZIhvcN
+AQELBQADggEBAKMwFzfoXXxasB/6ZlnAMy7aWmb8xp55E6aZZoZXhoHHA03z+Jj2
+cVy/PMgNDOk5MLf4ddpj7iVf42iLAGpgqo0oQjE11UCwYBBDIQ3vjR+MctoN2B+L
+Qpx7OGDoqSnVucVTS9KmWbJM3PAfbeexSRfqRJ3Jn2DvQDx1k32L//KtP1FRMtku
+Dqoizz7NSLjrmIkXLAuepKdfDSVKnLHD1fB6gKvDNPBNivlFqceZe0XoXdlGwZcC
+7aTdzYzZNCbg1w1bTxv7dom3ubAM1DPKUEA3afW25691ZsBf9W52hb/tOlVOw78j
++gUJtiEKTkcfmrfCgPDrcDjsm+iaQclAhK4=
+-----END CERTIFICATE-----

data/spec/support/fixtures/signature/test-private_key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDcaDiqP4EkTYXz
+DqCLZGiEEQnx0iazY/f3IMZNnYVfBDSLl3m2x1+3ch4Pe/E35Aag1webnvDh/VVR
+ch0+n4KV/4Toe0Oq9VP6xKqOXYtZZAVWXzs1TjdT/dk+rRXa+wnyq2KklPJ0aowz
+Ayr3EzivW1v19uhWdqguhPEPopr/2sue3vloZrigamOov29iFkiFLtSqAyEZI7x4
+8w/3X2nkZ1UivYxBRrLnulVMUJDZzvydu3stlu6mSlaQ3Mpdgzyz4V41NImzNeJn
+W1F6riwd6hud9xokDZSvredC/XhMbyl0LdrKABzyHnOFSBlIkIHDeQUPa9YKBESR
+MtOVmyrvAgMBAAECggEAOS3olXJIJIzgFUBUMhVob+qjs9KbK6rhp4EfMP+OnCnR
+H+26K8rpcAPw/H9hAujrN0rRtHO1dktsmOaL47UqAZP6fP2NfoqKsOHYhXqLLjOe
+ltu51ohmHioa9AGfS+IYoJYJzzy88aq6mHlX6iVYbVW8M8FMYTIDS549k5rRr1Iu
+SqGQSoIo8vGKhMyp6UbIvBhx1CRs2xeoknL0H5uEHnqB6oJTqfnbkQ1sVX4vZuHl
++WOIKQPlFKy74Lcs9ap1Dr9llD/PoVB3b2KbLRJTda352ezMLspb6CVUOFw7S0eB
+vHVFlR+V922GaMvEmxZ58ZY+DwqBGPeuiG7/kYFNAQKBgQD8e64NptLgw7Wk8mvn
+tGTB28ycUkc9wT/NdiePqlUT56ynD4oCBGcbEu6hH5ntYR93Kpi7fINTKglkVGdK
+MkU/QOV0bs7wItqmQvkMeUbypnWXeQPICs3z/synytwbDYl7/FslTPxdjAgodQZJ
+FY3Lui9bqe05VjvefEtEb9/yrwKBgQDfeimt/bVmA6Ldg4k+K72aAwP+g8l8Dyg1
+Fba2vSFoS/MyvhCqTgP6Uh2fl8qXOqGJEv0koD3yRADa5/FlHSCeLhsyYqsLd/Zm
+0Ogts7dhVm2v9jvVdmnWUQnGp/mPAGX6gB6Q1WHHEAdUNp6qAG7GatrJcttU0+7U
+9cYKyc9bwQKBgC7oi53dsLAxrD3JDGMwEMgzngAtCS9gCAqUOSVn8AaStHEVYf6d
+8soE6nDk/iQsNzxcnaO3rm51EOmjBM20KUlnNTo8nBXhY94f80VuAtByPMa3pQw1
+da4vWLaT6fDcwv5WFFkJxJlcuudJVrGdX4rKPKI7H+fXLahYT2OXpXPhAoGBAIO9
+Vli1WXw75ITFB+DYlDr4UCB3vA0gOkmg9Ucgk1MSgtmE5fofZ4TnZ4MvTkR8UcGm
+qggvVpU8tWxWkx1SYGofL/Ux6Tcnjt/pgxV9/jqpYpv6gidCWP34Y9TyLNG6IGPd
+pycmQy/AKTHhyQLaonLhhvx+cwG8texgvlCZy12BAoGAYsahYudgvuUi/IKjQvkH
+0F/kwBnd0mRHttsEMIVjrG1Y82EUh5Ja05IGpOSSMeBVhIlJ/DnwFOoSmIVzGfsA
+4GHtXmHd1xByxjW4nbr4NH7u8ElULkOPjcxSLgXhDb5KtG1XwCPEMUqvApcM6cfv
+CQn8vQRR2J42gXEcTmt0zVQ=
+-----END PRIVATE KEY-----

data/spec/support/fixtures/signature/test-public_key.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3Gg4qj+BJE2F8w6gi2Ro
+hBEJ8dIms2P39yDGTZ2FXwQ0i5d5tsdft3IeD3vxN+QGoNcHm57w4f1VUXIdPp+C
+lf+E6HtDqvVT+sSqjl2LWWQFVl87NU43U/3ZPq0V2vsJ8qtipJTydGqMMwMq9xM4
+r1tb9fboVnaoLoTxD6Ka/9rLnt75aGa4oGpjqL9vYhZIhS7UqgMhGSO8ePMP919p
+5GdVIr2MQUay57pVTFCQ2c78nbt7LZbupkpWkNzKXYM8s+FeNTSJszXiZ1tReq4s
+HeobnfcaJA2Ur63nQv14TG8pdC3aygAc8h5zhUgZSJCBw3kFD2vWCgREkTLTlZsq
+7wIDAQAB
+-----END PUBLIC KEY-----

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: ibanity
 version: !ruby/object:Gem::Version
-  version: '1.4'
+  version: 1.5.0
 platform: ruby
 authors:
 - Ibanity
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-09-24 00:00:00.000000000 Z
+date: 2020-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -101,8 +101,13 @@ files:
 - lib/ibanity/http_signature.rb
 - lib/ibanity/util.rb
 - lib/ibanity/version.rb
+- spec/lib/ibanity/http_signature_spec.rb
 - spec/lib/ibanity/util_spec.rb
 - spec/spec_helper.rb
+- spec/support/crypto_helper.rb
+- spec/support/fixtures/signature/test-certificate.pem
+- spec/support/fixtures/signature/test-private_key.pem
+- spec/support/fixtures/signature/test-public_key.pem
 homepage: https://documentation.ibanity.com/api/ruby
 licenses:
 - MIT
@@ -127,5 +132,10 @@ signing_key:
 specification_version: 4
 summary: Ibanity Ruby Client
 test_files:
+- spec/lib/ibanity/http_signature_spec.rb
 - spec/lib/ibanity/util_spec.rb
 - spec/spec_helper.rb
+- spec/support/crypto_helper.rb
+- spec/support/fixtures/signature/test-certificate.pem
+- spec/support/fixtures/signature/test-private_key.pem
+- spec/support/fixtures/signature/test-public_key.pem