manifoldco_signature 0.0.0 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 5a3ff3aafe5057d737179dba27c7d91b6fdbbd5b
-  data.tar.gz: 7927ce286d4f39f3a83ebc71d658f32d103d85d5
+  metadata.gz: a7bf5031e1176e57479f88d88d776e2d72dd0f2c
+  data.tar.gz: 60da3f571ac3c93b442b80693caa651746450988
 SHA512:
-  metadata.gz: 62645710aa36c657705573ee46477ac4628c440d167c113e3a22fa7160926830d9a60393f2a442173329843046c2c54ab3a22d6428f990b9632daf70a4d634a0
-  data.tar.gz: ff52fcf5524d69a37a06e9f75791db423da40311b052be18234a758e75874372cf2b1df1d34b6a430bc6e82e48e4a1f652629ed2f648b74f92799728059792bb
+  metadata.gz: 6d60f1a6c0d81953a011bf0735116acbcea9943d9cce53190279a25014c4e36040083b337daf81fdd235ad7945878782bea50019f51dcc3c68d262e68d561b05
+  data.tar.gz: 244eade1babf9cdf8fc9e6fea81dd4ff6562a77063a678b7e1213ae7bd708ec70e878ad0840843329fbb7b36e532e2148f2959595af9d78284bded01b990ccf0

data/.gitignore

@@ -7,3 +7,6 @@
 /pkg/
 /spec/reports/
 /tmp/
+
+coverage
+vendor

data/README.md

@@ -18,3 +18,14 @@ Or install it yourself as:
 
     $ gem install manifoldco_signature
 
+## Usage
+
+```ruby
+require 'manifoldco_signature'
+
+# initialize once per application
+verifier = ManifoldcoSignature::Verifier.new
+
+# verify a Rack::Request. returns a boolean.
+verifier.valid? request
+```

data/lib/manifoldco_signature.rb

@@ -1,5 +1,6 @@
+require "manifoldco_signature/signature"
+require "manifoldco_signature/verifier"
 require "manifoldco_signature/version"
 
 module ManifoldcoSignature
-  # Your code goes here...
 end

data/lib/manifoldco_signature/constants.rb

@@ -0,0 +1,4 @@
+module ManifoldcoSignature
+  MASTER_KEY = "PtISNzqQmQPBxNlUw3CdxsWczXbIwyExxlkRqZ7E690"
+  PERMITTED_SKEW_IN_MINUTES = 5
+end

data/lib/manifoldco_signature/signature.rb

@@ -0,0 +1,69 @@
+require 'base64url'
+require 'date'
+require 'rbnacl/libsodium'
+require 'manifoldco_signature/constants'
+
+module ManifoldcoSignature
+
+  class Signature
+
+    def initialize(req)
+      sig = req.env['HTTP_X_SIGNATURE'].split
+      @signature = Base64URL.decode(sig[0])
+      @public_key_raw = Base64URL.decode(sig[1])
+      @public_key = RbNaCl::VerifyKey.new @public_key_raw
+      @endorsement = Base64URL.decode(sig[2])
+
+      @message = canonize(req)
+      @req_time = DateTime.rfc3339(req.env['HTTP_DATE'])
+    end
+
+    def valid?(master_key)
+      good_signature?(master_key) && valid_time?
+    end
+
+    def good_signature?(master_key)
+      begin
+        master_key.verify(@endorsement, @public_key_raw) &&
+          @public_key.verify(@signature, @message)
+      rescue
+        false
+      end
+    end
+
+    def valid_time?
+      now = DateTime.now()
+      ((now - @req_time) * 24 * 60).abs <= PERMITTED_SKEW_IN_MINUTES
+    end
+
+    protected
+    def canonize(req)
+
+      msg = "#{req.request_method.downcase} #{req.path_info}"
+
+      if !req.query_string.empty?
+        msg += '?' + req.query_string.split('&').sort!.join('&')
+      end
+      msg += "\n"
+
+      headers = req.env['HTTP_X_SIGNED_HEADERS'].split
+      headers << 'x-signed-headers'
+      headers.each do |header|
+        if header.downcase == 'content-type'
+          value = req.content_type
+        elsif header.downcase == 'content-length'
+          value = req.content_length
+        else
+          value = req.env["HTTP_#{header.upcase.gsub(/-/, '_')}"]
+        end
+        msg += "#{header.downcase}: #{value}\n"
+      end
+
+      msg += req.body.read
+      req.body.rewind
+
+      msg
+    end
+  end
+
+end

data/lib/manifoldco_signature/verifier.rb

@@ -0,0 +1,25 @@
+require 'base64url'
+require 'rbnacl/libsodium'
+require 'manifoldco_signature/constants'
+
+module ManifoldcoSignature
+  class Verifier
+
+    def initialize(master_key=MASTER_KEY)
+      dec = Base64URL.decode(master_key)
+      @master_key = RbNaCl::VerifyKey.new dec
+    end
+
+    def valid?(req)
+      begin
+        Signature.new(req).valid?(@master_key)
+      rescue
+        false
+      end
+    end
+
+    def valid_signature?(signature)
+      signature.valid?(@master_key)
+    end
+  end
+end

data/lib/manifoldco_signature/version.rb

@@ -1,3 +1,3 @@
 module ManifoldcoSignature
-  VERSION = "0.0.0"
+  VERSION = "0.1.0"
 end

data/manifoldco_signature.gemspec

@@ -10,7 +10,7 @@ Gem::Specification.new do |spec|
   spec.email         = ["jbowes@repl.ca"]
 
   spec.summary       = "Verify signed HTTP requests from Manifold"
-  spec.homepage      = "https://github.com/manifoldco/ruby-manifoldco-signaturek"
+  spec.homepage      = "https://github.com/manifoldco/ruby-manifoldco-signature"
 
   spec.files         = `git ls-files -z`.split("\x0").reject do |f|
     f.match(%r{^(test|spec|features)/})
@@ -19,7 +19,13 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
+  spec.add_dependency "base64url", "~> 1.0.1"
+  spec.add_dependency "rbnacl-libsodium", "~> 1.0.11"
+
   spec.add_development_dependency "bundler", "~> 1.14"
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "minitest", "~> 5.0"
+  spec.add_development_dependency "simplecov", "~> 0.13.0"
+  spec.add_development_dependency "rack", "~> 1.6.5"
+  spec.add_development_dependency "timecop", "~> 0.8.1"
 end

metadata

@@ -1,15 +1,43 @@
 --- !ruby/object:Gem::Specification
 name: manifoldco_signature
 version: !ruby/object:Gem::Version
-  version: 0.0.0
+  version: 0.1.0
 platform: ruby
 authors:
 - James Bowes
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2017-03-05 00:00:00.000000000 Z
+date: 2017-03-06 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64url
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.0.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.0.1
+- !ruby/object:Gem::Dependency
+  name: rbnacl-libsodium
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.0.11
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.0.11
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -52,6 +80,48 @@ dependencies:
     - - ~>
       - !ruby/object:Gem::Version
         version: '5.0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.13.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.13.0
+- !ruby/object:Gem::Dependency
+  name: rack
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.6.5
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 1.6.5
+- !ruby/object:Gem::Dependency
+  name: timecop
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.8.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.8.1
 description: 
 email:
 - jbowes@repl.ca
@@ -70,9 +140,12 @@ files:
 - bin/console
 - bin/setup
 - lib/manifoldco_signature.rb
+- lib/manifoldco_signature/constants.rb
+- lib/manifoldco_signature/signature.rb
+- lib/manifoldco_signature/verifier.rb
 - lib/manifoldco_signature/version.rb
 - manifoldco_signature.gemspec
-homepage: https://github.com/manifoldco/ruby-manifoldco-signaturek
+homepage: https://github.com/manifoldco/ruby-manifoldco-signature
 licenses: []
 metadata: {}
 post_install_message: