lyrebird 2.0.0 → 2.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6b9457c5f260c26c5adf43de4262d67077e1f5729b4506ff0efa92ec61519346
-  data.tar.gz: 16a5dbf97973cd9c3673c26212fa0be146955ef9ddaf877768d40120416d6e54
+  metadata.gz: 54582bda5673179b49a58b405ee52668486162eb785d728cfd98b6dcaed7f1cf
+  data.tar.gz: f6e2048c4adb1a6b3690f2517c781cd431f9cc0271217df6effb8944e808fee0
 SHA512:
-  metadata.gz: fc83af3b91fb52553dc96733c2a8ea0e89c561fe124bddc1b769cb39f681e03c1e18ff78ec2c83ffe886114b369e4a1630e637e56a1cf2dcee2137a5fe88680b
-  data.tar.gz: 138bd3e26e223c69dc10e435b21c12e0e1fcf3322e64df65d1775695d8920e6a274caf0d1323c5722244d73a47a09296d4d2a1d2037f2761084f470fcff6202c
+  metadata.gz: 5998bda9158b2d8d3f64f6260fcfb9b3b06c62469c923e86776bac8ab541f955945621f799b23ab69cc4388e561d403ab15d8adc763b018f5fad9411409668c8
+  data.tar.gz: 9aebec46c7f33d74c5274073dea1a93a347fb363b603bbf3cd8a8dc7ba26f0fbe2c9e5f34ba6fc4afcb67bfe850e8c963d485a2adca3539bd3137173d4675bba

data/lib/lyrebird/assertion.rb

@@ -28,112 +28,80 @@ module Lyrebird
     end
 
     def document
-      @document ||= Nokogiri::XML::Document.new.tap do |doc|
-        doc.root = root(doc)
-      end
+      @document ||= Nokogiri::XML::Builder.new { |xml| root(xml) }.doc
     end
 
     private
 
-    def root(doc)
-      doc.create_element("Assertion").tap do |a|
-        ns = a.add_namespace_definition("saml", SAML_ASSERTION_NS)
-
-        a.namespace = ns
-        a["ID"] = ID.generate
-        a["Version"] = "2.0"
-        a["IssueInstant"] = @issue_instant.iso8601
-
-        a.add_child(doc.create_element("Issuer")).tap do |i|
-          i.namespace = ns
-          i.content = @issuer
-        end
-
-        a.add_child(subject(doc, ns))
-        a.add_child(conditions(doc, ns))
-        a.add_child(authn_statement(doc, ns))
-        a.add_child(attribute_statement(doc, ns)) if @attributes.any?
+    def root(xml)
+      attrs = {
+        "xmlns:saml" => SAML_ASSERTION_NS,
+        ID: ID.generate,
+        Version: "2.0",
+        IssueInstant: @issue_instant.iso8601
+      }
+
+      xml["saml"].Assertion(attrs) do
+        xml["saml"].Issuer(@issuer.to_s)
+        subject(xml)
+        conditions(xml)
+        authn_statement(xml)
+        attribute_statement(xml) if @attributes.any?
       end
     end
 
-    def subject(doc, ns)
-      doc.create_element("Subject").tap do |s|
-        s.namespace = ns
-
-        s.add_child(doc.create_element("NameID")).tap do |nid|
-          nid.namespace = ns
-          nid["Format"] = @name_id_format
-          nid.content = @name_id
-        end
-
-        s.add_child(subject_confirmation(doc, ns))
+    def subject(xml)
+      xml["saml"].Subject do
+        xml["saml"].NameID(@name_id.to_s, Format: @name_id_format)
+        subject_confirmation(xml)
       end
     end
 
-    def subject_confirmation(doc, ns)
-      doc.create_element("SubjectConfirmation").tap do |sc|
-        sc.namespace = ns
-        sc["Method"] = CM_BEARER
+    def subject_confirmation(xml)
+      attrs = {
+        NotOnOrAfter: @not_on_or_after.iso8601,
+        Recipient: @recipient,
+        InResponseTo: @in_response_to
+      }.compact
 
-        sc.add_child(doc.create_element("SubjectConfirmationData")).tap do |d|
-          d.namespace = ns
-          d["NotOnOrAfter"] = @not_on_or_after.iso8601
-          d["Recipient"] = @recipient
-          d["InResponseTo"] = @in_response_to if @in_response_to
-        end
+      xml["saml"].SubjectConfirmation(Method: CM_BEARER) do
+        xml["saml"].SubjectConfirmationData(attrs)
       end
     end
 
-    def conditions(doc, ns)
-      doc.create_element("Conditions").tap do |c|
-        c.namespace = ns
-        c["NotBefore"] = @not_before.iso8601
-        c["NotOnOrAfter"] = @not_on_or_after.iso8601
+    def conditions(xml)
+      attrs = {
+        NotBefore: @not_before.iso8601,
+        NotOnOrAfter: @not_on_or_after.iso8601
+      }
 
-        c.add_child(doc.create_element("AudienceRestriction")).tap do |ar|
-          ar.namespace = ns
-          ar.add_child(doc.create_element("Audience")).tap do |a|
-            a.namespace = ns
-            a.content = @audience
-          end
+      xml["saml"].Conditions(attrs) do
+        xml["saml"].AudienceRestriction do
+          xml["saml"].Audience(@audience.to_s)
         end
       end
     end
 
-    def authn_statement(doc, ns)
-      doc.create_element("AuthnStatement").tap do |as|
-        as.namespace = ns
-        as["AuthnInstant"] = @issue_instant.iso8601
-        as["SessionIndex"] = ID.generate
+    def authn_statement(xml)
+      attrs = {
+        AuthnInstant: @issue_instant.iso8601,
+        SessionIndex: ID.generate
+      }
 
-        as.add_child(doc.create_element("AuthnContext")).tap do |ac|
-          ac.namespace = ns
-          ac.add_child(doc.create_element("AuthnContextClassRef")).tap do |cr|
-            cr.namespace = ns
-            cr.content = @authn_context
-          end
+      xml["saml"].AuthnStatement(attrs) do
+        xml["saml"].AuthnContext do
+          xml["saml"].AuthnContextClassRef(@authn_context.to_s)
         end
       end
     end
 
-    def attribute_statement(doc, ns)
-      doc.create_element("AttributeStatement").tap do |as|
-        as.namespace = ns
-
+    def attribute_statement(xml)
+      xml["saml"].AttributeStatement do
         @attributes.each do |name, values|
           list = values.is_a?(Enumerable) ? values.to_a : [values].compact
 
-          as.add_child(doc.create_element("Attribute")).tap do |a|
-            a.namespace = ns
-            a["Name"] = name
-            a["NameFormat"] = ATTR_NAME_FORMAT
-
-            list.each do |value|
-              a.add_child(doc.create_element("AttributeValue")).tap do |av|
-                av.namespace = ns
-                av.content = value
-              end
-            end
+          xml["saml"].Attribute(Name: name, NameFormat: ATTR_NAME_FORMAT) do
+            list.each { |value| xml["saml"].AttributeValue(value.to_s) }
           end
         end
       end

data/lib/lyrebird/certificate.rb

@@ -9,6 +9,9 @@ module Lyrebird
       "keyUsage" => "digitalSignature,keyEncipherment"
     }.freeze
 
+    private_constant :LOCK
+    private_constant :EXTENSIONS
+
     attr_reader :key, :x509
 
     def self.default
@@ -16,7 +19,7 @@ module Lyrebird
     end
 
     def self.build(**kwargs)
-      config = OpenStruct.new(kwargs)
+      config = Options.new(kwargs)
       yield config if block_given?
       new(**config.to_h)
     end
@@ -58,7 +61,7 @@ module Lyrebird
     end
 
     def base64
-      Base64.strict_encode64(@x509.to_der)
+      [@x509.to_der].pack("m0")
     end
 
     private
@@ -79,7 +82,7 @@ module Lyrebird
           c.add_extension(OpenSSL::X509::Extension.new(oid, value, true))
         end
 
-        c.sign(@key, OpenSSL::Digest::SHA256.new)
+        c.sign(@key, OpenSSL::Digest.new("SHA256"))
       end
     end
 

data/lib/lyrebird/{namespaces.rb → constants.rb}

@@ -3,14 +3,25 @@
 module Lyrebird
   SAML_ASSERTION_NS = "urn:oasis:names:tc:SAML:2.0:assertion"
   SAML_PROTOCOL_NS = "urn:oasis:names:tc:SAML:2.0:protocol"
+
+  NAMEID_EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
+  NAMEID_PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
+  NAMEID_TRANSIENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
+  NAMEID_UNSPECIFIED = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
+
+  ppt = "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
+  AUTHN_PASSWORD_PROTECTED_TRANSPORT = ppt
+
+  CM_BEARER = "urn:oasis:names:tc:SAML:2.0:cm:bearer"
+  ATTR_NAME_FORMAT = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
+  STATUS_SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success"
+
   XMLDSIG_NS = "http://www.w3.org/2000/09/xmldsig#"
   ENVELOPED_SIG = "http://www.w3.org/2000/09/xmldsig#enveloped-signature"
   EXC_C14N = "http://www.w3.org/2001/10/xml-exc-c14n#"
   SHA256_DIGEST = "http://www.w3.org/2001/04/xmlenc#sha256"
   RSA_SHA256 = "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
-  CM_BEARER = "urn:oasis:names:tc:SAML:2.0:cm:bearer"
-  ATTR_NAME_FORMAT = "urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"
-  STATUS_SUCCESS = "urn:oasis:names:tc:SAML:2.0:status:Success"
+
   XMLENC_NS = "http://www.w3.org/2001/04/xmlenc#"
   AES256_CBC = "http://www.w3.org/2001/04/xmlenc#aes256-cbc"
   RSA_OAEP = "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"

data/lib/lyrebird/defaults.rb

@@ -1,11 +1,6 @@
 # frozen_string_literal: true
 
 module Lyrebird
-  NAMEID_EMAIL = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
-  NAMEID_PERSISTENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
-  NAMEID_TRANSIENT = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient"
-  NAMEID_UNSPECIFIED = "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"
-
   class Defaults
     attr_accessor :issuer
     attr_accessor :name_id
@@ -26,13 +21,11 @@ module Lyrebird
       @valid_for = 300 # 5 minutes
       @audience = "https://sp.example.com"
 
-      @authn_context =
-        "urn:oasis:names:tc:SAML:2.0:ac:classes:" \
-        "PasswordProtectedTransport"
+      @authn_context = AUTHN_PASSWORD_PROTECTED_TRANSPORT
 
       @attributes = {
         first_name: "Test",
-        last_name: "User",
+        last_name: "User"
       }.freeze
     end
   end

data/lib/lyrebird/encryption.rb

@@ -5,92 +5,60 @@ module Lyrebird
     def initialize(element, certificate)
       @element = element
       @certificate = certificate
-      @doc = element.document
       @aes_key = SecureRandom.random_bytes(32)
     end
 
     def encrypt
-      build_encrypted_assertion
+      Nokogiri::XML::Builder.new do |xml|
+        xml["saml"].EncryptedAssertion("xmlns:saml" => SAML_ASSERTION_NS) do
+          encrypted_data(xml)
+        end
+      end.doc.root
     end
 
     private
 
-    def build_encrypted_assertion
-      @doc.create_element("EncryptedAssertion").tap do |ea|
-        @saml = ea.add_namespace_definition("saml", SAML_ASSERTION_NS)
-        ea.namespace = @saml
-        ea.add_child(build_encrypted_data)
-      end
-    end
+    def encrypted_data(xml)
+      attrs = {
+        "xmlns:xenc" => XMLENC_NS,
+        Type: "#{XMLENC_NS}Element"
+      }
 
-    def build_encrypted_data
-      @doc.create_element("EncryptedData").tap do |ed|
-        @xenc = ed.add_namespace_definition("xenc", XMLENC_NS)
-        ed.namespace = @xenc
-        ed["Type"] = "#{XMLENC_NS}Element"
-
-        ed.add_child(@doc.create_element("EncryptionMethod")).tap do |em|
-          em.namespace = @xenc
-          em["Algorithm"] = AES256_CBC
-        end
-
-        ed.add_child(build_key_info)
-        ed.add_child(build_cipher_data)
+      xml["xenc"].EncryptedData(attrs) do
+        xml["xenc"].EncryptionMethod(Algorithm: AES256_CBC)
+        key_info(xml)
+        cipher_data(xml, ciphertext)
       end
     end
 
-    def build_key_info
-      @doc.create_element("KeyInfo").tap do |ki|
-        @ds = ki.add_namespace_definition("ds", XMLDSIG_NS)
-        ki.namespace = @ds
-        ki.add_child(build_encrypted_key)
+    def key_info(xml)
+      xml["ds"].KeyInfo("xmlns:ds" => XMLDSIG_NS) do
+        xml["xenc"].EncryptedKey do
+          xml["xenc"].EncryptionMethod(Algorithm: RSA_OAEP)
+          cipher_data(xml, wrapped_key)
+        end
       end
     end
 
-    def build_encrypted_key
-      @doc.create_element("EncryptedKey").tap do |ek|
-        ek.namespace = @xenc
-
-        ek.add_child(@doc.create_element("EncryptionMethod")).tap do |em|
-          em.namespace = @xenc
-          em["Algorithm"] = RSA_OAEP
-        end
-
-        ek.add_child(build_encrypted_key_cipher_data)
+    def cipher_data(xml, value)
+      xml["xenc"].CipherData do
+        xml["xenc"].CipherValue(value)
       end
     end
 
-    def build_encrypted_key_cipher_data
+    def wrapped_key
       public_key = @certificate.x509.public_key
       padding = OpenSSL::PKey::RSA::PKCS1_OAEP_PADDING
-      encrypted_aes_key = public_key.public_encrypt(@aes_key, padding)
-
-      @doc.create_element("CipherData").tap do |cd|
-        cd.namespace = @xenc
-
-        cd.add_child(@doc.create_element("CipherValue")).tap do |cv|
-          cv.namespace = @xenc
-          cv.content = Base64.strict_encode64(encrypted_aes_key)
-        end
-      end
+      [public_key.public_encrypt(@aes_key, padding)].pack("m0")
     end
 
-    def build_cipher_data
+    def ciphertext
       cipher = OpenSSL::Cipher.new("AES-256-CBC")
       cipher.encrypt
       cipher.key = @aes_key
       iv = cipher.random_iv
       plaintext = @element.to_xml(save_with: 0)
-      ciphertext = cipher.update(plaintext) + cipher.final
-
-      @doc.create_element("CipherData").tap do |cd|
-        cd.namespace = @xenc
-
-        cd.add_child(@doc.create_element("CipherValue")).tap do |cv|
-          cv.namespace = @xenc
-          cv.content = Base64.strict_encode64(iv + ciphertext)
-        end
-      end
+      [iv + cipher.update(plaintext) + cipher.final].pack("m0")
     end
   end
 end

data/lib/lyrebird/options.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Lyrebird
+  class Options
+    def initialize(values = {})
+      @values = values.transform_keys(&:to_sym)
+    end
+
+    def to_h
+      @values
+    end
+
+    def [](key)
+      @values[key.to_sym]
+    end
+
+    def []=(key, value)
+      @values[key.to_sym] = value
+    end
+
+    private
+
+    def method_missing(name, *args)
+      key = name.to_s
+
+      if key.end_with?("=")
+        @values[key.chomp("=").to_sym] = args.first
+      elsif @values.key?(name)
+        @values[name]
+      else
+        super
+      end
+    end
+
+    def respond_to_missing?(name, include_private = false)
+      name.to_s.end_with?("=") || @values.key?(name) || super
+    end
+  end
+end

data/lib/lyrebird/response.rb

@@ -2,17 +2,18 @@
 
 module Lyrebird
   class Response
-    def self.build(**kwargs)
-      config = OpenStruct.new(kwargs)
-
-      config.define_singleton_method(:attributes) do |&block|
+    class Config < Options
+      def attributes(&block)
         current = self[:attributes] || {}
         return current unless block
 
-        fresh = OpenStruct.new.tap(&block).to_h
+        fresh = Options.new.tap(&block).to_h
         self[:attributes] = current.transform_keys(&:to_sym).merge(fresh)
       end
+    end
 
+    def self.build(**kwargs)
+      config = Config.new(kwargs)
       yield config if block_given?
       new(**config.to_h)
     end
@@ -39,7 +40,7 @@ module Lyrebird
     end
 
     def mimic
-      Base64.strict_encode64(to_xml)
+      [to_xml].pack("m0")
     end
 
     def to_xml
@@ -47,67 +48,42 @@ module Lyrebird
     end
 
     def document
-      @document ||= Nokogiri::XML::Document.new.tap do |doc|
-        doc.root = build_response(doc)
-        sign_assertion(doc) if @sign_with && !@encrypt_with
-        sign_response(doc) if @sign_with
+      @document ||= build_response.doc.tap do |doc|
+        Signature.new(doc.root, @sign_with).sign! if @sign_with
       end
     end
 
     private
 
-    def build_response(doc)
-      doc.create_element("Response").tap do |r|
-        @samlp = r.add_namespace_definition("samlp", SAML_PROTOCOL_NS)
-        @saml = r.add_namespace_definition("saml", SAML_ASSERTION_NS)
-
-        r.namespace = @samlp
-        r["ID"] = ID.generate
-        r["Version"] = "2.0"
-        r["IssueInstant"] = Time.now.utc.iso8601
-        r["Destination"] = @destination if @destination
-        r["InResponseTo"] = @in_response_to if @in_response_to
-
-        r.add_child(doc.create_element("Issuer")).tap do |i|
-          i.namespace = @saml
-          i.content = @issuer
+    def build_response
+      attrs = {
+        "xmlns:samlp" => SAML_PROTOCOL_NS,
+        "xmlns:saml" => SAML_ASSERTION_NS,
+        ID: ID.generate,
+        Version: "2.0",
+        IssueInstant: Time.now.utc.iso8601,
+        Destination: @destination,
+        InResponseTo: @in_response_to
+      }.compact
+
+      Nokogiri::XML::Builder.new do |xml|
+        xml["samlp"].Response(attrs) do
+          xml["saml"].Issuer(@issuer.to_s)
+
+          xml["samlp"].Status do
+            xml["samlp"].StatusCode(Value: STATUS_SUCCESS)
+          end
+
+          xml.parent << build_assertion_element
         end
-
-        r.add_child(build_status(doc))
-        r.add_child(build_assertion_element)
       end
     end
 
     def build_assertion_element
       element = @assertion.document.root
-
-      if @encrypt_with
-        Signature.new(element, @sign_with).sign! if @sign_with
-        Encryption.new(element, @encrypt_with).encrypt
-      else
-        element
-      end
-    end
-
-    def sign_assertion(doc)
-      ns = { "saml" => SAML_ASSERTION_NS }
-      assertion = doc.at_xpath("//saml:Assertion", ns)
-      Signature.new(assertion, @sign_with).sign!
-    end
-
-    def sign_response(doc)
-      Signature.new(doc.root, @sign_with).sign!
-    end
-
-    def build_status(doc)
-      doc.create_element("Status").tap do |s|
-        s.namespace = @samlp
-
-        s.add_child(doc.create_element("StatusCode")).tap do |sc|
-          sc.namespace = @samlp
-          sc["Value"] = STATUS_SUCCESS
-        end
-      end
+      Signature.new(element, @sign_with).sign! if @sign_with
+      element = Encryption.new(element, @encrypt_with).encrypt if @encrypt_with
+      element
     end
   end
 end

data/lib/lyrebird/signature.rb

@@ -4,120 +4,76 @@ module Lyrebird
   class Signature
     C14N_EXCLUSIVE = Nokogiri::XML::XML_C14N_EXCLUSIVE_1_0
 
+    private_constant :C14N_EXCLUSIVE
+
     def initialize(element, certificate)
       @element = element
       @certificate = certificate
-      @doc = element.document
     end
 
     def sign!
       ns = { "saml" => SAML_ASSERTION_NS, "ds" => XMLDSIG_NS }
       @element.at_xpath("ds:Signature", ns)&.remove
+      signature = build_signature
       issuer = @element.at_xpath("saml:Issuer", ns)
-      issuer.add_next_sibling(build_signature)
-      populate_signature_value
+      issuer.add_next_sibling(signature)
+      populate_signature_value(signature)
       self
     end
 
     private
 
     def build_signature
-      @doc.create_element("Signature").tap do |sig|
-        @ds = sig.add_namespace_definition("ds", XMLDSIG_NS)
-        sig.namespace = @ds
-
-        sig.add_child(build_signed_info)
-        sig.add_child(build_signature_value)
-        sig.add_child(build_key_info)
-      end
-    end
-
-    def build_signed_info
-      @doc.create_element("SignedInfo").tap do |si|
-        @signed_info = si
-        si.namespace = @ds
-
-        si.add_child(@doc.create_element("CanonicalizationMethod")).tap do |cm|
-          cm.namespace = @ds
-          cm["Algorithm"] = EXC_C14N
+      Nokogiri::XML::Builder.new do |xml|
+        xml["ds"].Signature("xmlns:ds" => XMLDSIG_NS) do
+          signed_info(xml)
+          xml["ds"].SignatureValue
+          key_info(xml)
         end
-
-        si.add_child(@doc.create_element("SignatureMethod")).tap do |sm|
-          sm.namespace = @ds
-          sm["Algorithm"] = RSA_SHA256
-        end
-
-        si.add_child(build_reference)
-      end
-    end
-
-    def build_signature_value
-      @doc.create_element("SignatureValue").tap do |sv|
-        sv.namespace = @ds
-        @signature_value = sv
-      end
+      end.doc.root
     end
 
-    def populate_signature_value
-      canonical = @signed_info.canonicalize(C14N_EXCLUSIVE)
-      sig = @certificate.key.sign("SHA256", canonical)
-      @signature_value.content = Base64.strict_encode64(sig)
-    end
-
-    def build_key_info
-      @doc.create_element("KeyInfo").tap do |ki|
-        ki.namespace = @ds
-
-        ki.add_child(@doc.create_element("X509Data")).tap do |xd|
-          xd.namespace = @ds
-
-          xd.add_child(@doc.create_element("X509Certificate")).tap do |xc|
-            xc.namespace = @ds
-            xc.content = @certificate.base64
-          end
-        end
+    def signed_info(xml)
+      xml["ds"].SignedInfo do
+        xml["ds"].CanonicalizationMethod(Algorithm: EXC_C14N)
+        xml["ds"].SignatureMethod(Algorithm: RSA_SHA256)
+        reference(xml)
       end
     end
 
-    def build_reference
-      @doc.create_element("Reference").tap do |ref|
-        ref.namespace = @ds
-        ref["URI"] = "##{@element["ID"]}"
-
-        ref.add_child(build_transforms)
-
-        ref.add_child(@doc.create_element("DigestMethod")).tap do |dm|
-          dm.namespace = @ds
-          dm["Algorithm"] = SHA256_DIGEST
+    def reference(xml)
+      xml["ds"].Reference(URI: "##{@element["ID"]}") do
+        xml["ds"].Transforms do
+          xml["ds"].Transform(Algorithm: ENVELOPED_SIG)
+          xml["ds"].Transform(Algorithm: EXC_C14N)
         end
 
-        ref.add_child(@doc.create_element("DigestValue")).tap do |dv|
-          dv.namespace = @ds
-          dv.content = compute_digest
-        end
+        xml["ds"].DigestMethod(Algorithm: SHA256_DIGEST)
+        xml["ds"].DigestValue(compute_digest)
       end
     end
 
-    def build_transforms
-      @doc.create_element("Transforms").tap do |t|
-        t.namespace = @ds
-
-        t.add_child(@doc.create_element("Transform")).tap do |tr|
-          tr.namespace = @ds
-          tr["Algorithm"] = ENVELOPED_SIG
-        end
-
-        t.add_child(@doc.create_element("Transform")).tap do |tr|
-          tr.namespace = @ds
-          tr["Algorithm"] = EXC_C14N
+    def key_info(xml)
+      xml["ds"].KeyInfo do
+        xml["ds"].X509Data do
+          xml["ds"].X509Certificate(@certificate.base64)
         end
       end
     end
 
     def compute_digest
       canonical = @element.canonicalize(C14N_EXCLUSIVE)
-      digest = OpenSSL::Digest::SHA256.digest(canonical)
-      Base64.strict_encode64(digest)
+      digest = OpenSSL::Digest.new("SHA256").digest(canonical)
+      [digest].pack("m0")
+    end
+
+    def populate_signature_value(signature)
+      ns = { "ds" => XMLDSIG_NS }
+      signed_info = signature.at_xpath("ds:SignedInfo", ns)
+      canonical = signed_info.canonicalize(C14N_EXCLUSIVE)
+      sig = @certificate.key.sign(OpenSSL::Digest.new("SHA256"), canonical)
+      value = signature.at_xpath("ds:SignatureValue", ns)
+      value.content = [sig].pack("m0")
     end
   end
 end

data/lib/lyrebird/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Lyrebird
-  VERSION = "2.0.0"
+  VERSION = "2.1.1"
 end

data/lib/lyrebird.rb

@@ -1,18 +1,17 @@
 # frozen_string_literal: true
 
-require "base64"
 require "nokogiri"
 require "openssl"
-require "ostruct"
 require "securerandom"
 require "time"
 
 require_relative "lyrebird/assertion"
 require_relative "lyrebird/certificate"
+require_relative "lyrebird/constants"
 require_relative "lyrebird/defaults"
 require_relative "lyrebird/encryption"
 require_relative "lyrebird/id"
-require_relative "lyrebird/namespaces"
+require_relative "lyrebird/options"
 require_relative "lyrebird/response"
 require_relative "lyrebird/signature"
 require_relative "lyrebird/version"

metadata

@@ -1,113 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: lyrebird
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.1
 platform: ruby
 authors:
 - Josh
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-26 00:00:00.000000000 Z
+date: 2026-08-31 00:00:00.000000000 Z
 dependencies:
-- !ruby/object:Gem::Dependency
-  name: base64
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: nokogiri
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.14'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: ostruct
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: logger
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: minitest
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: ruby-saml
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+        version: '1.14'
 description:
 email:
 executables: []
@@ -119,10 +35,11 @@ files:
 - lib/lyrebird.rb
 - lib/lyrebird/assertion.rb
 - lib/lyrebird/certificate.rb
+- lib/lyrebird/constants.rb
 - lib/lyrebird/defaults.rb
 - lib/lyrebird/encryption.rb
 - lib/lyrebird/id.rb
-- lib/lyrebird/namespaces.rb
+- lib/lyrebird/options.rb
 - lib/lyrebird/response.rb
 - lib/lyrebird/signature.rb
 - lib/lyrebird/version.rb