linzer 0.5.2 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0befd6a2ae7ba008f6b2a343a24845be1941b6645615d8a029e698c083cd4481
-  data.tar.gz: ebd92e2c6b0991067753079c8b1bac87a6dfe644caa6380dedc63f88e74877e4
+  metadata.gz: d2ec6a2a846f2bb066bdd658c2e50a869ceff52f65f3e5f8670cc5509af6069c
+  data.tar.gz: 5401df5ea61c39290b61a21cf19c4eaddc537abe908067a47688c1f209c982e3
 SHA512:
-  metadata.gz: c7c5b9d9568402b2b4894ef8180c321281b420a156e7386abf12f069780a6ba7e2bc79d58bd0b7c97372058f974a25a1a138e9306434c28025e39f3267562b81
-  data.tar.gz: 7b997d06b2764171d5375baf1b889f4d98231961b86f89bea321155766932ffcd6913462df080f7edf09731d6d78332b474cda381ea4d0d8bdafba3dee76e6b3
+  metadata.gz: 53c504c5c0f886d3e73332d7d8bf7072137519a218ca6a005824f8ad073fb589dd91f2e7980aa02b232c17dd80a87923141e57b094087fb4f412dddbf5588a9f
+  data.tar.gz: 0a99fc9611e6b26ae820fecfe09e10a6c610be20bdf8f9c3fd7c6fab031f82f6f7fa109359470a2a65b7d7cd9817c21259e59fe6f99e50a1c6326d965b0df944

data/.standard.yml

@@ -3,9 +3,8 @@
 ruby_version: 2.6
 
 ignore:
-  - 'lib/**/*':
-    - Layout/ExtraSpacing
-    - Layout/HashAlignment
-  - 'spec/**/*':
+  - '**/*':
     - Layout/ExtraSpacing
     - Layout/HashAlignment
+    - Layout/ArgumentAlignment
+    - Style/EmptyCaseCondition

data/CHANGELOG.md

@@ -1,5 +1,21 @@
 ## [Unreleased]
 
+## [0.6.1] - 2024-12-02
+
+- Add more validation checks on HTTP field component identifiers and parameters.
+
+- Relax rack version requirements.
+
+- Update uri dependency to the latest version.
+
+## [0.6.0] - 2024-04-06
+
+- Support parameters on HTTP field component identifiers.
+
+- Add a work-around for failed unit-tests in ruby HEAD CI jobs.
+
+- Set up simplecov and improve unit-tests coverage.
+
 ## [0.5.2] - 2024-04-02
 
 - Make all unit tests pass on Ruby 3.0:

data/README.md

@@ -159,6 +159,9 @@ Please note that is still early days and extensive testing is still ongoing. For
 I'll be expanding the library to cover more functionality specified in the RFC
 in subsequent releases.
 
+## Ruby version compatibility
+
+linzer is built in [Continuous Integration](https://github.com/nomadium/linzer/actions/workflows/main.yml) on Ruby 3.0+.
 
 ## Development
 

data/lib/linzer/common.rb

@@ -18,10 +18,29 @@ module Linzer
       if components.include?("@signature-params")
         raise Error.new "Invalid component in signature input"
       end
+
       msg = "Cannot verify signature. Missing component in message: %s"
-      components.each { |c| raise Error.new msg % "\"#{c}\"" unless message.field?(c)  }
+      components.each do |c|
+        raise Error.new msg % "\"#{c}\"" unless message.field?(c)
+      end
+
+      validate_uniqueness components
+    end
+
+    def validate_uniqueness(components)
       msg = "Invalid signature. Duplicated component in signature input."
-      raise Error.new msg if components.size != components.uniq.size
+
+      uniq_components =
+        components
+          .partition { |c| c.start_with?("@") }
+          .flat_map
+          .with_index do |group, idx|
+            group
+              .map  { |comp| Starry.parse_item(idx.zero? ? comp[1..] : comp) }
+              .uniq { |comp| [comp.value, comp.parameters] }
+          end
+
+      raise Error.new msg if components.count != uniq_components.count
     end
   end
 end

data/lib/linzer/message.rb

@@ -2,8 +2,10 @@
 
 module Linzer
   class Message
-    def initialize(operation)
+    def initialize(operation, attached_request: nil)
       @operation = operation
+      validate
+      @attached_request = attached_request ? Message.new(attached_request) : nil
       freeze
     end
 
@@ -15,6 +17,10 @@ module Linzer
       @operation.is_a?(Rack::Response) || @operation.respond_to?(:status)
     end
 
+    def attached_request?
+      !!@attached_request
+    end
+
     def headers
       return @operation.headers if response? || @operation.respond_to?(:headers)
 
@@ -26,32 +32,25 @@ module Linzer
     end
 
     DERIVED_COMPONENT = {
-      "@method"         => :request_method,
-      "@authority"      => :authority,
-      "@path"           => :path_info,
-      "@status"         => :status,
-      "@target-uri"     => :url,
-      "@scheme"         => :scheme,
-      "@request-target" => :fullpath,
-      "@query"          => :query_string
+      method:           :request_method,
+      authority:        :authority,
+      path:             :path_info,
+      status:           :status,
+      "target-uri":     :url,
+      scheme:           :scheme,
+      "request-target": :fullpath,
+      query:            :query_string
     }.freeze
 
     def [](field_name)
-      if !field_name.start_with?("@")
-        return @operation.env[Request.rack_header_name(field_name)] if request?
-        return @operation.headers[field_name]                     # if response?
-      end
-
-      method = DERIVED_COMPONENT[field_name]
+      name = parse_field_name(field_name)
+      return nil if name.nil?
 
-      case field_name
-      when "@query"
-        return "?#{@operation.public_send(method)}"
-      when /\A(?<field>(?<prefix>@query-param)(?<rest>;name=.+)\Z)/
-        return parse_query_param Regexp.last_match
+      if field_name.start_with?("@")
+        retrieve(name, :derived)
+      else
+        retrieve(name, :field)
       end
-
-      method ? @operation.public_send(method) : nil
     end
 
     class << self
@@ -64,14 +63,146 @@ module Linzer
 
     private
 
-    def parse_query_param(match_data)
-      raw_item    = '"%s"%s' % [match_data[:prefix], match_data[:rest]]
-      parsed_item = Starry.parse_item(raw_item)
-      fail unless parsed_item.value == "@query-param"
-      param_name  = URI.decode_uri_component(parsed_item.parameters["name"])
-      URI.encode_uri_component(@operation.params.fetch(param_name))
+    def validate
+      msg = "Message instance must be an HTTP request or response"
+      raise Error.new msg if response? == request?
+    end
+
+    def parse_field_name(field_name)
+      if field_name&.start_with?("@")
+        Starry.parse_item(field_name[1..])
+      else
+        Starry.parse_item(field_name)
+      end
     rescue => _
       nil
     end
+
+    def validate_parameters(name, method)
+      has_unknown = name.parameters.any? { |p, _| !KNOWN_PARAMETERS.include?(p) }
+      return nil if has_unknown
+
+      has_name = name.parameters["name"]
+      has_req  = name.parameters["req"]
+      has_sf   = name.parameters["sf"] || name.parameters.key?("key")
+      has_bs   = name.parameters["bs"]
+      value    = name.value
+
+      # Section 2.2.8 of RFC 9421
+      return nil if has_name && value != :"query-param"
+
+      # No derived values come from trailers section
+      return nil if method == :derived && name.parameters["tr"]
+
+      # From: 2.1. HTTP Fields:
+      # The bs parameter, which requires the raw bytes of the field values
+      # from the message, is not compatible with the use of the sf or key
+      # parameters, which require the parsed data structures of the field
+      # values after combination
+      return nil if has_sf && has_bs
+
+      # req param only makes sense on responses with an associated request
+      return nil if has_req && (!response? || !attached_request?)
+
+      name
+    end
+
+    KNOWN_PARAMETERS = %w[sf key bs req tr name]
+    private_constant :KNOWN_PARAMETERS
+
+    def retrieve(name, method)
+      if !name.parameters.empty?
+        valid_params = validate_parameters(name, method)
+        return nil if !valid_params
+      end
+
+      has_req = name.parameters["req"]
+      has_sf  = name.parameters["sf"] || name.parameters.key?("key")
+      has_bs  = name.parameters["bs"]
+
+      if has_req
+        name.parameters.delete("req")
+        return req(name, method)
+      end
+
+      value = send(method, name)
+
+      case
+      when has_sf
+        key = name.parameters["key"]
+        sf(value, key)
+      when has_bs then bs(value)
+      else value
+      end
+    end
+
+    def derived(name)
+      method = DERIVED_COMPONENT[name.value]
+
+      value = case name.value
+      when :query         then derive(@operation, method)
+      when :"query-param" then query_param(name)
+      end
+
+      return nil if !method && !value
+      value || derive(@operation, method)
+    end
+
+    def field(name)
+      has_tr = name.parameters["tr"]
+      if has_tr
+        value = tr(name)
+      else
+        if request?
+          rack_header_name = Request.rack_header_name(name.value.to_s)
+          value = @operation.env[rack_header_name]
+        end
+        value = @operation.headers[name.value.to_s] if response?
+      end
+      value.dup&.strip
+    end
+
+    def derive(operation, method)
+      return nil unless operation.respond_to?(method)
+      value = operation.public_send(method)
+      return "?" + value    if method == :query_string
+      return value.downcase if %i[authority scheme].include?(method)
+      value
+    end
+
+    def query_param(name)
+      param_name = name.parameters["name"]
+      return nil if !param_name
+      decoded_param_name = URI.decode_uri_component(param_name)
+      URI.encode_uri_component(@operation.params.fetch(decoded_param_name))
+    rescue => _
+      nil
+    end
+
+    def sf(value, key = nil)
+      dict = Starry.parse_dictionary(value)
+
+      if key
+        obj = dict[key]
+        Starry.serialize(obj.is_a?(Starry::InnerList) ? [obj] : obj)
+      else
+        Starry.serialize(dict)
+      end
+    end
+
+    def bs(value)
+      Starry.serialize(value.encode(Encoding::ASCII_8BIT))
+    end
+
+    def tr(trailer)
+      @operation.body.trailers[trailer.value.to_s]
+    end
+
+    def req(field, method)
+      case method
+      when :derived then @attached_request["@#{field}"]
+      when :field   then @attached_request[field.to_s]
+      end
+    end
   end
 end

data/lib/linzer/request.rb

@@ -11,7 +11,8 @@ module Linzer
       request_method = Rack.const_get(verb.upcase)
       args = {
         "REQUEST_METHOD" => request_method,
-        "PATH_INFO"      => uri.to_str
+        "PATH_INFO"      => uri.to_str,
+        "rack.input"     => StringIO.new
       }
 
       Rack::Request.new(build_rack_env(headers).merge(args))
@@ -84,6 +85,7 @@ module Linzer
     def build_rack_env(headers)
       headers
         .to_hash
+        .transform_values(&:to_s)
         .transform_keys { |k| k.upcase.tr("-", "_") }
         .transform_keys do |k|
           %w[CONTENT_TYPE CONTENT_LENGTH].include?(k) ? k : "HTTP_#{k}"

data/lib/linzer/response.rb

@@ -3,7 +3,7 @@
 module Linzer
   module Response
     def new_response(body = nil, status = 200, headers = {})
-      Rack::Response.new(body, status, headers)
+      Rack::Response.new(body, status, headers.transform_values(&:to_s))
     end
   end
 end

data/lib/linzer/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Linzer
-  VERSION = "0.5.2"
+  VERSION = "0.6.1"
 end

metadata

@@ -1,19 +1,22 @@
 --- !ruby/object:Gem::Specification
 name: linzer
 version: !ruby/object:Gem::Version
-  version: 0.5.2
+  version: 0.6.1
 platform: ruby
 authors:
 - Miguel Landaeta
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-04-01 00:00:00.000000000 Z
+date: 2024-12-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: openssl
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.0.0
@@ -21,6 +24,9 @@ dependencies:
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.0.0
@@ -50,42 +56,54 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '0.2'
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '3.0'
+        version: '2.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: uri
   requirement: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 1.0.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.12.0
+        version: 1.0.2
 description:
 email:
 - miguel@miguel.cc
@@ -115,7 +133,6 @@ files:
 - lib/linzer/signer.rb
 - lib/linzer/verifier.rb
 - lib/linzer/version.rb
-- linzer.gemspec
 homepage: https://github.com/nomadium/linzer
 licenses:
 - MIT

data/linzer.gemspec

@@ -1,37 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "lib/linzer/version"
-
-Gem::Specification.new do |spec|
-  spec.name = "linzer"
-  spec.version = Linzer::VERSION
-  spec.authors = ["Miguel Landaeta"]
-  spec.email = %w[miguel@miguel.cc]
-
-  spec.summary = "An implementation of HTTP Messages Signatures (RFC9421)"
-  spec.homepage = "https://github.com/nomadium/linzer"
-  spec.license = "MIT"
-  spec.required_ruby_version = ">= 2.6.0"
-
-  spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = spec.homepage
-  spec.metadata["changelog_uri"] = spec.homepage + "/blob/master/CHANGELOG.md"
-
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files = Dir.chdir(__dir__) do
-    `git ls-files -z`.split("\x0").reject do |f|
-      (File.expand_path(f) == __FILE__) ||
-        f.start_with?(*%w[bin/ test/ spec/ features/ .git .circleci appveyor Gemfile])
-    end
-  end
-  spec.bindir = "exe"
-  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
-  spec.require_paths = ["lib"]
-
-  spec.add_runtime_dependency "openssl", ">= 3.0.0"
-  spec.add_runtime_dependency "ed25519", "~> 1.3", ">= 1.3.0"
-  spec.add_runtime_dependency "starry", "~> 0.1"
-  spec.add_runtime_dependency "rack", "~> 3.0"
-  spec.add_runtime_dependency "uri", ">= 0.12.0"
-end