mauth-client 5.0.2 → 5.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f5fc7f62399a4835be8f3f8b8158c6cdac97e9cba3b6103aa4d714755a7b876
-  data.tar.gz: e8c7414fff883d6d20a946b7486e7dc729435ef3ded2773db88a3be73ef137a3
+  metadata.gz: 73a877135a7440cd3137c471873a1ac760304a31cac524189045448c122dc2a8
+  data.tar.gz: e817da8c2d7de3e5d2629de33ded9f8e5985cbc6923dca057de49738460d6ea1
 SHA512:
-  metadata.gz: 89ba02ee21708b2c9db961ab1388282e1d0ebb5255360e12a02d64fa77c1b5aa39949a21da3e55c2c5f34e4fe74e0beb86231a138db6b308284ace48f254a2ca
-  data.tar.gz: a6b343856370bec0e8e2a32dedc274209070262336ac23d7cf9cbaee7ae99a97741dfcfae4148825601b09e9381369aa0d825e801428aae1bdfc7ed5a0c2f9bb
+  metadata.gz: ca1e092bbfbc376f1dac96da7198fdc94b234ccd9086a373de69d4ee7e638971e964ab5a549330beeacbf811b2b3990fbef6d7672b498a42d07c6d5518f7e6ad
+  data.tar.gz: 230c42bd030c4bac0dab46c365acda69d8011ab06060156a7244c9f1319ca9248630f2ba29c5c35732d456be8d0734260580c8c1cda0ee40bd8f0182970dadec

data/CHANGELOG.md

@@ -1,3 +1,6 @@
+## v5.1.0
+- Fall back to V1 when V2 authentication fails.
+
 ## v5.0.2
 - Fix to not raise FrozenError when string to sign contains frozen value.
 

data/doc/mauth.yml.md

@@ -29,6 +29,8 @@ common: &common
     SIY2exfsy7Y8NoOnBPlGiXKhgaF21T8kqV9C7R6OAuP0U6CgMJnINx/UjozvBENH
     Ux45QdvRd6vai8nHp7AgV7rr55SxXAZVgATll84uBUpfpmC6YK/j
     -----END RSA PRIVATE KEY-----
+  v2_only_authenticate: false
+  v2_only_sign_requests: false
 
 production:
   <<: *common
@@ -46,6 +48,8 @@ common: &common
   mauth_api_version: v1
   app_uuid: 123we997-0333-44d8-8fCf-5dd555c5bd51
   private_key_file: config/my_mauth_private.key
+  v2_only_authenticate: false
+  v2_only_sign_requests: false
 
 production:
   <<: *common
@@ -62,6 +66,8 @@ test:
 - `app_uuid` - Required in the same circumstances where a `private_key` is required.
 - `mauth_baseurl` - Required for authentication but not for signing. Needed for local authentication to retrieve public keys and for remote authentication. Usually this is `https://mauth.imedidata.com` for production.
 - `mauth_api_version` - Required for authentication but not for signing. only `v1` exists as of this writing.
+- `v2_only_authenticate` - If true, all outgoing requests will be signed with only the V2 protocol.
+- `v2_only_sign_requests` - If true, any incoming request or incoming response that does not use the V2 protocol will be rejected.
 
 ## Usage in your application
 

data/lib/mauth/client/authenticator_base.rb

@@ -19,10 +19,21 @@ module MAuth
 
       # raises InauthenticError unless the given object is authentic. Will only
       # authenticate with v2 if the environment variable V2_ONLY_AUTHENTICATE
-      # is set. Otherwise will authenticate with only the highest protocol version present
+      # is set. Otherwise will fallback to v1 when v2 authentication fails
       def authenticate!(object)
         if object.protocol_version == 2
-          authenticate_v2!(object)
+          begin
+            authenticate_v2!(object)
+          rescue InauthenticError => e
+            raise e if v2_only_authenticate?
+
+            object.fall_back_to_mws_signature_info
+            raise e unless object.signature
+
+            log_authentication_request(object)
+            authenticate_v1!(object)
+            logger.warn("Completed successful authentication attempt after fallback to v1")
+          end
         elsif object.protocol_version == 1
           if v2_only_authenticate?
             # If v2 is required but not present and v1 is present we raise MissingV2Error

data/lib/mauth/request_and_response.rb

@@ -59,9 +59,9 @@ module MAuth
 
       # memoization of body_digest to avoid hashing three times when we call
       # string_to_sign_v2 three times in client#signature_valid_v2!
-      # note that if :body is nil we hash an empty string ("")
-      attrs_with_overrides[:body_digest] ||= Digest::SHA512.hexdigest(attrs_with_overrides[:body].to_s)
-      attrs_with_overrides[:encoded_query_params] = encode_query_string(attrs_with_overrides[:query_string].to_s)
+      # note that if :body is nil we hash an empty string ('')
+      attrs_with_overrides[:body_digest] ||= Digest::SHA512.hexdigest(attrs_with_overrides[:body] || '')
+      attrs_with_overrides[:encoded_query_params] = encode_query_string(attrs_with_overrides[:query_string] || '')
 
       missing_attributes = self.class::SIGNATURE_COMPONENTS_V2.reject do |key|
         attrs_with_overrides.dig(key)
@@ -115,23 +115,17 @@ module MAuth
   # - #x_mws_authentication which returns that header's value
   # - #x_mws_time
   module Signed
-    # mauth_client will authenticate with the highest protocol version present and ignore other
-    # protocol versions.
+    # mauth_client will authenticate with the highest protocol version present and if authentication fails,
+    # will fallback to lower protocol versions (if provided).
     # returns a hash with keys :token, :app_uuid, and :signature parsed from the MCC-Authentication header
     # if it is present and if not then the X-MWS-Authentication header if it is present.
     # Note MWSV2 protocol no longer allows more than one space between the token and app uuid.
     def signature_info
-      @signature_info ||= begin
-        match = if mcc_authentication
-          mcc_authentication.match(
-            /\A(#{MAuth::Client::MWSV2_TOKEN}) ([^:]+):([^:]+)#{MAuth::Client::AUTH_HEADER_DELIMITER}\z/
-          )
-        elsif x_mws_authentication
-          x_mws_authentication.match(/\A([^ ]+) *([^:]+):([^:]+)\z/)
-        end
-
-        match ? { token: match[1], app_uuid: match[2], signature: match[3] } : {}
-      end
+      @signature_info ||= build_signature_info(mcc_data || x_mws_data)
+    end
+
+    def fall_back_to_mws_signature_info
+      @signature_info = build_signature_info(x_mws_data)
     end
 
     def signature_app_uuid
@@ -153,6 +147,22 @@ module MAuth
         1
       end
     end
+
+    private
+
+    def build_signature_info(match_data)
+      match_data ? { token: match_data[1], app_uuid: match_data[2], signature: match_data[3] } : {}
+    end
+
+    def mcc_data
+      mcc_authentication&.match(
+        /\A(#{MAuth::Client::MWSV2_TOKEN}) ([^:]+):([^:]+)#{MAuth::Client::AUTH_HEADER_DELIMITER}\z/
+      )
+    end
+
+    def x_mws_data
+      x_mws_authentication&.match(/\A([^ ]+) *([^:]+):([^:]+)\z/)
+    end
   end
 
   # virtual base class for signable requests

data/lib/mauth/version.rb

@@ -1,3 +1,3 @@
 module MAuth
-  VERSION = '5.0.2'.freeze
+  VERSION = '5.1.0'.freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mauth-client
 version: !ruby/object:Gem::Version
-  version: 5.0.2
+  version: 5.1.0
 platform: ruby
 authors:
 - Matthew Szenher
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-08-21 00:00:00.000000000 Z
+date: 2020-01-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday