integral-yandex-money-notification_validator 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: e238282eda4f0f0fc91bc297336234aebf561fd734536fbe0860e71ad41a2fb2
+  data.tar.gz: be0f816d1e311364d19f8b0bc02e7a724eb98a0a49dcf27297795128e29481f8
+SHA512:
+  metadata.gz: 23e1e258224cd3e91bb52422dcea93ec90917e7a35e191b0ad3d21f1ceffd1fef6590289998955ae91244f4f74dcc742b320a75bf61ced542d7834d544bc562f
+  data.tar.gz: d9dd652e80ccc2a156e7272adb7aaa9c333aeac3f6884cead87e10e52372fc4582e1ac50bb079029c6e7126c10114957f489ab7f903ec0abaad127529bf78f95

data/LICENSE.md

@@ -0,0 +1,20 @@
+Copyright 2018 [Integral Design](http://integral-design.ru).
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,75 @@
+# Yandex.Money notification validator
+
+[![Gem Version](https://badge.fury.io/rb/integral-yandex-money-notification_validator.svg)](http://badge.fury.io/rb/integral-yandex-money-notification_validator)
+[![Maintainability](https://api.codeclimate.com/v1/badges/5b7ba150248e751ccbc9/maintainability)](https://codeclimate.com/github/sergeypedan/integral-yandex-money-notification_validator/maintainability)
+[![Test Coverage](https://api.codeclimate.com/v1/badges/5b7ba150248e751ccbc9/test_coverage)](https://codeclimate.com/github/sergeypedan/integral-yandex-money-notification_validator/test_coverage)
+
+<!-- Tocer[start]: Auto-generated, don't remove. -->
+
+## Table of Contents
+
+  - [Features](#features)
+  - [Requirements](#requirements)
+  - [Setup](#setup)
+  - [Usage](#usage)
+  - [Tests](#tests)
+  - [Credits](#credits)
+
+<!-- Tocer[finish]: Auto-generated, don't remove. -->
+
+## Features
+
+Checks integrity of Yandex.Money payment notification by comparing SHA of strigified params including a secret shared with Yandex.
+
+Here are the official docs for the [notification service](https://tech.yandex.ru/money/doc/dg/reference/notification-p2p-incoming-docpage/) and [validating notifications specifically](https://tech.yandex.ru/money/doc/dg/reference/notification-p2p-incoming-docpage/#notification-p2p-incoming__verify-notification).
+
+## Requirements
+
+[Ruby 2.5.0](https://www.ruby-lang.org) or higher.
+
+## Setup
+
+Add the following to your Gemfile:
+
+```ruby
+gem "integral-yandex-money-notification_validator"
+```
+
+## Usage
+
+Intended to use in a Rails controller like so:
+
+```ruby
+class YandexMoneyReceiptsController < ApplicationController
+
+  def create
+    secret    = "YOUR_YANDEX_MONEY_NOTIFICATIONS_SHARED_SECRET"
+    validator = Integral::Yandex::Money::NotificationValidator.new(params: params, secret: secret)
+
+    if validator.valid?
+      # Do your thing here, for example create a new `YandexMoneyReceipt` record in DB
+    else
+      render text: validator.errors.join(". "), status: :bad_request and return
+    end
+  end
+
+end
+```
+
+`params` are supposed to be an `ActionController::Parameters` or just a `Hash`.
+
+`validator.errors` returns an Array of message strings — most often only 1 message, but who knows.
+
+`secret` is obtained from Yandex.Money [somewehre in the settings](https://money.yandex.ru/myservices/online.xml). Recommended to keep in Rails credentials, ENV variable or elsewhere secure.
+
+## Tests
+
+To test, run:
+
+```sh
+bundle exec rake
+```
+
+## Credits
+
+Developed by [Sergey Pedan](http://sergeypedan.ru) at [Integral Design](http://integral-design.ru).

data/lib/integral/yandex/money/notification_validator.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "digest"
+require "integral/yandex/money/notification_validator/identity"
+
+module Integral
+  module Yandex
+    module Money
+
+      # Validation is documented here: https://tech.yandex.ru/money/doc/dg/reference/notification-p2p-incoming-docpage/#notification-p2p-incoming__verify-notification
+      class NotificationValidator
+
+        # Order is crucial for `KEYS_FOR_DIGEST`
+        KEYS_FOR_DIGEST      = %w[notification_type operation_id amount currency datetime sender codepro notification_secret label].freeze
+        PERMITTED_HASH_TYPES = ["ActionController::Parameters", "Hash"].freeze
+        REQUIRED_KEYS        = %w[amount codepro datetime notification_type operation_id sender].freeze
+
+
+        def initialize params:, secret:
+          fail ArgumentError, "Yandex.Money notifications secret is required" if secret.to_s == ""
+          validate_params_hash!(params)
+          @secret = secret
+          @params = params
+          @errors = []
+        end
+
+        attr_reader :errors
+
+
+        def valid?
+          return false unless all_param_values_present?
+          return false unless integrity_correct?
+          true
+        end
+
+
+        private
+
+        def all_param_values_present?
+          missing_keys = REQUIRED_KEYS.select { |key| @params[key].to_s == "" }
+          return true if missing_keys.empty?
+          (@errors << "Required `params` keys missing: #{missing_keys.uniq.join(", ")}") and return false
+        end
+
+
+        def encode_sha string
+          Digest::SHA1.hexdigest string
+        end
+
+
+        def integrity_correct?
+          stringified_params = stringify_params params_with_secret(@params)
+          return true if @params["sha1_hash"] == encode_sha(stringified_params)
+          (@errors << "SHA hashes do not match") and return false
+        end
+
+
+        def params_with_secret params
+          params.merge("notification_secret" => @secret)
+        end
+
+
+        def stringify_params params
+          KEYS_FOR_DIGEST.map { |key| params[key] }.join("&")
+          # this way and not just `.to_s` is to enforce required order of params
+        end
+
+
+        def validate_params_hash! params
+          names = PERMITTED_HASH_TYPES.map { |name| "`#{name}`" }.join(" or ")
+          valid = PERMITTED_HASH_TYPES.include? params.class.to_s
+          fail ArgumentError, "`params` must be a #{names}, you passed #{params.inspect}" unless valid
+        end
+      end
+    end
+  end
+end

data/lib/integral/yandex/money/notification_validator/identity.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Integral
+  module Yandex
+    module Money
+      class NotificationValidator
+        # Gem identity information.
+        module Identity
+          def self.name
+            "integral-yandex-money-notification_validator"
+          end
+
+          def self.label
+            "Yandex.Money notification validator by Integral Design"
+          end
+
+          def self.version
+            "0.1.0"
+          end
+
+          def self.version_label
+            "#{label} #{version}"
+          end
+        end
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,193 @@
+--- !ruby/object:Gem::Specification
+name: integral-yandex-money-notification_validator
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Sergey Pedan
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2018-12-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler-audit
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.6'
+- !ruby/object:Gem::Dependency
+  name: gemsmith
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+- !ruby/object:Gem::Dependency
+  name: git-cop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.2'
+- !ruby/object:Gem::Dependency
+  name: guard-rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.7'
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.10'
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.5'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '12.3'
+- !ruby/object:Gem::Dependency
+  name: reek
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+- !ruby/object:Gem::Dependency
+  name: rubocop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.58'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.58'
+description: 
+email:
+- sergey.pedan@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files:
+- README.md
+- LICENSE.md
+files:
+- LICENSE.md
+- README.md
+- lib/integral/yandex/money/notification_validator.rb
+- lib/integral/yandex/money/notification_validator/identity.rb
+homepage: https://github.com/sergeypedan/integral-yandex-money-notification_validator
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/sergeypedan/integral-yandex-money-notification_validator
+  changelog_uri: https://github.com/sergeypedan/integral-yandex-money-notification_validator/blob/master/CHANGES.md
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - "~>"
+    - !ruby/object:Gem::Version
+      version: '2.5'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.7.7
+signing_key: 
+specification_version: 4
+summary: Checks integrity of Yandex.Money payment notification by comparing SHA of
+  strigified params including a secret shared with Yandex.
+test_files: []