mauth-client 5.1.0 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 73a877135a7440cd3137c471873a1ac760304a31cac524189045448c122dc2a8
-  data.tar.gz: e817da8c2d7de3e5d2629de33ded9f8e5985cbc6923dca057de49738460d6ea1
+  metadata.gz: 0ac6251a66453ac4fe6f1f449d407173851a6c34e3dd17bf3b80d816e619e045
+  data.tar.gz: bf6f603408e51a6af3965e458f736ee3ed07763a7f0a662f1af0bd67a1cbeab3
 SHA512:
-  metadata.gz: ca1e092bbfbc376f1dac96da7198fdc94b234ccd9086a373de69d4ee7e638971e964ab5a549330beeacbf811b2b3990fbef6d7672b498a42d07c6d5518f7e6ad
-  data.tar.gz: 230c42bd030c4bac0dab46c365acda69d8011ab06060156a7244c9f1319ca9248630f2ba29c5c35732d456be8d0734260580c8c1cda0ee40bd8f0182970dadec
+  metadata.gz: e4faea9d5bcf10c64b3c3bc10dded82d14b68bce39312b87140e38ba5410ba9d67b993f94e2e96036d7d88550837a6088d43deb75d7e4fed8164b51ed81b296c
+  data.tar.gz: a7a71824118eb6b4ca88a7f8a7afdb85719613997754392147dfa348eae7c04faf4ba7458eb28375d8b596c6b609ecbe6e8c42d5caed4931b9427c843bbf9448

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--tag ~protocol_suite

data/CHANGELOG.md

@@ -1,3 +1,11 @@
+## v.6.0.0
+- Added parsing code to test with mauth-protocol-test-suite.
+- Added unescape step in query_string encoding in order to remove 'double encoding'.
+- Added normalization of paths.
+- Added flag to sign only with V1.
+- Changed V2 to V1 fallback to be configurable.
+- Fixed bug in sorting query parameters.
+
 ## v5.1.0
 - Fall back to V1 when V2 authentication fails.
 

data/CONTRIBUTING.md

@@ -19,6 +19,14 @@ Next, run the tests:
 bundle exec rspec
 ```
 
+# Running mauth-protocol-test-suite
+
+To run the mauth-protocol-test-suite clone the latest test suite onto your machine and place it in the same parent directory as this repo (or supply the ENV var `TEST_SUITE_RELATIVE_PATH` with the path to the test suite relative to this repo). Then run:
+
+```
+bundle exec rspec --tag protocol_suite
+```
+
 ## Running Benchmark
 
 If you make changes which could affect performance, please run the benchmark before and after the change as a sanity check.

data/doc/mauth.yml.md

@@ -31,6 +31,7 @@ common: &common
     -----END RSA PRIVATE KEY-----
   v2_only_authenticate: false
   v2_only_sign_requests: false
+  disable_fallback_to_v1_on_v2_failure: true
 
 production:
   <<: *common
@@ -50,6 +51,8 @@ common: &common
   private_key_file: config/my_mauth_private.key
   v2_only_authenticate: false
   v2_only_sign_requests: false
+  disable_fallback_to_v1_on_v2_failure: true
+  v1_only_sign_requests: false
 
 production:
   <<: *common
@@ -66,8 +69,10 @@ test:
 - `app_uuid` - Required in the same circumstances where a `private_key` is required.
 - `mauth_baseurl` - Required for authentication but not for signing. Needed for local authentication to retrieve public keys and for remote authentication. Usually this is `https://mauth.imedidata.com` for production.
 - `mauth_api_version` - Required for authentication but not for signing. only `v1` exists as of this writing.
-- `v2_only_authenticate` - If true, all outgoing requests will be signed with only the V2 protocol.
-- `v2_only_sign_requests` - If true, any incoming request or incoming response that does not use the V2 protocol will be rejected.
+- `v2_only_sign_requests` - If true, all outgoing requests will be signed with only the V2 protocol. Defaults to false.
+- `v2_only_authenticate` - If true, any incoming request or incoming response that does not use the V2 protocol will be rejected. Defaults to false.
+- `disable_fallback_to_v1_on_v2_failure` - If true, any incoming V2 requests that fail authentication will not fall back to V1 authentication. Defaults to false.
+- `v1_only_sign_requests` - If true, all outgoing requests will be signed with only the V1 protocol. Defaults to true. Note, cannot be `true` if `v2_only_sign_requests` is also `true`.
 
 ## Usage in your application
 

data/lib/mauth/client.rb

@@ -153,6 +153,12 @@ module MAuth
       @config['ssl_certs_path'] = given_config['ssl_certs_path'] if given_config['ssl_certs_path']
       @config['v2_only_authenticate'] = given_config['v2_only_authenticate'].to_s.downcase == 'true'
       @config['v2_only_sign_requests'] = given_config['v2_only_sign_requests'].to_s.downcase == 'true'
+      @config['disable_fallback_to_v1_on_v2_failure'] = given_config['disable_fallback_to_v1_on_v2_failure'].to_s.downcase == 'true'
+      @config['v1_only_sign_requests'] = given_config['v1_only_sign_requests'].to_s.downcase == 'true'
+
+      if @config['v2_only_sign_requests'] && @config['v1_only_sign_requests']
+        raise MAuth::Client::ConfigurationError, "v2_only_sign_requests and v1_only_sign_requests may not both be true"
+      end
 
       # if 'authenticator' was given, don't override that - including if it was given as nil / false
       if given_config.key?('authenticator')
@@ -205,6 +211,14 @@ module MAuth
       @config['v2_only_authenticate']
     end
 
+    def disable_fallback_to_v1_on_v2_failure?
+      @config['disable_fallback_to_v1_on_v2_failure']
+    end
+
+    def v1_only_sign_requests?
+      @config['v1_only_sign_requests']
+    end
+
     def assert_private_key(err)
       raise err unless private_key
     end

data/lib/mauth/client/authenticator_base.rb

@@ -19,13 +19,14 @@ module MAuth
 
       # raises InauthenticError unless the given object is authentic. Will only
       # authenticate with v2 if the environment variable V2_ONLY_AUTHENTICATE
-      # is set. Otherwise will fallback to v1 when v2 authentication fails
+      # is set. Otherwise will fall back to v1 when v2 authentication fails
       def authenticate!(object)
         if object.protocol_version == 2
           begin
             authenticate_v2!(object)
           rescue InauthenticError => e
             raise e if v2_only_authenticate?
+            raise e if disable_fallback_to_v1_on_v2_failure?
 
             object.fall_back_to_mws_signature_info
             raise e unless object.signature

data/lib/mauth/client/signer.rb

@@ -30,6 +30,8 @@ module MAuth
       def signed_headers(object, attributes = {})
         if v2_only_sign_requests?
           signed_headers_v2(object, attributes)
+        elsif v1_only_sign_requests?
+          signed_headers_v1(object, attributes)
         else # by default sign with both the v1 and v2 protocol
           signed_headers_v1(object, attributes).merge(signed_headers_v2(object, attributes))
         end

data/lib/mauth/dice_bag/mauth.yml.dice

@@ -7,6 +7,8 @@ common: &common
   private_key_file: config/mauth_key
   v2_only_authenticate: <%= configured.v2_only_authenticate || 'false' %>
   v2_only_sign_requests: <%= configured.v2_only_sign_requests || 'false' %>
+  disable_fallback_to_v1_on_v2_failure: <%= configured.disable_fallback_to_v1_on_v2_failure || 'false' %>
+  v1_only_sign_requests: <%= configured.v1_only_sign_requests || 'true' %>
 
 production:
   <<: *common

data/lib/mauth/request_and_response.rb

@@ -1,4 +1,5 @@
 require 'digest'
+require 'addressable'
 
 module MAuth
   # module which composes a string to sign.
@@ -61,7 +62,8 @@ module MAuth
       # string_to_sign_v2 three times in client#signature_valid_v2!
       # note that if :body is nil we hash an empty string ('')
       attrs_with_overrides[:body_digest] ||= Digest::SHA512.hexdigest(attrs_with_overrides[:body] || '')
-      attrs_with_overrides[:encoded_query_params] = encode_query_string(attrs_with_overrides[:query_string] || '')
+      attrs_with_overrides[:encoded_query_params] = unescape_encode_query_string(attrs_with_overrides[:query_string] || '')
+      attrs_with_overrides[:request_url] = normalize_path(attrs_with_overrides[:request_url])
 
       missing_attributes = self.class::SIGNATURE_COMPONENTS_V2.reject do |key|
         attrs_with_overrides.dig(key)
@@ -78,12 +80,26 @@ module MAuth
       end.join("\n")
     end
 
+    # Addressable::URI.parse(path).normalize.to_s.squeeze('/')
+    def normalize_path(path)
+      return if path.nil?
+
+      # Addressable::URI.normalize_path normalizes `.` and `..` in path
+      #   i.e. /./example => /example ; /example/.. => /
+      # String#squeeze removes duplicated slahes i.e. /// => /
+      # String#gsub normalizes percent encoding to uppercase i.e. %cf%80 => %CF%80
+      Addressable::URI.normalize_path(path).squeeze('/').
+        gsub(/%[a-f0-9]{2}/, &:upcase)
+    end
+
     # sorts query string parameters by codepoint, uri encodes keys and values,
     # and rejoins parameters into a query string
-    def encode_query_string(q_string)
-      q_string.split('&').sort.map do |part|
-        k, e, v = part.partition('=')
-        uri_escape(k) + e + uri_escape(v)
+    def unescape_encode_query_string(q_string)
+      fir = q_string.split('&').map do |part|
+        k, _eq, v = part.partition('=')
+        [CGI.unescape(k), CGI.unescape(v)]
+      end.sort.map do |k, v|
+        "#{uri_escape(k)}=#{uri_escape(v)}"
       end.join('&')
     end
 
@@ -116,7 +132,7 @@ module MAuth
   # - #x_mws_time
   module Signed
     # mauth_client will authenticate with the highest protocol version present and if authentication fails,
-    # will fallback to lower protocol versions (if provided).
+    # will fall back to lower protocol versions (if provided).
     # returns a hash with keys :token, :app_uuid, and :signature parsed from the MCC-Authentication header
     # if it is present and if not then the X-MWS-Authentication header if it is present.
     # Note MWSV2 protocol no longer allows more than one space between the token and app uuid.

data/lib/mauth/version.rb

@@ -1,3 +1,3 @@
 module MAuth
-  VERSION = '5.1.0'.freeze
+  VERSION = '6.0.0'.freeze
 end

data/mauth-client.gemspec

@@ -24,6 +24,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'coderay', '~> 1.0'
   spec.add_dependency 'rack'
   spec.add_dependency 'dice_bag', '>= 0.9', '< 2.0'
+  spec.add_dependency 'addressable', '~> 2.0'
 
   spec.add_development_dependency 'bundler', '>= 1.17'
   spec.add_development_dependency 'byebug'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mauth-client
 version: !ruby/object:Gem::Version
-  version: 5.1.0
+  version: 6.0.0
 platform: ruby
 authors:
 - Matthew Szenher
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-01-15 00:00:00.000000000 Z
+date: 2020-05-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -103,6 +103,20 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: addressable
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -228,6 +242,7 @@ extra_rdoc_files: []
 files:
 - ".fossa.yml"
 - ".gitignore"
+- ".rspec"
 - ".travis.yml"
 - ".yardopts"
 - CHANGELOG.md