messagebird-rest 2.0.0 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dd213489a7f5a7e70a7418ab2e3be5c4aa8cedfa61042121edb1c03dddd6d56a
-  data.tar.gz: 9eca63a90298b50cc4d07fb0b7ff6abc7d1ae292155e7f456df18256ae7f64e3
+  metadata.gz: f31ec7bbc1d49554a915dde71c24245246453df62bfd7ab7a4b912727990de5b
+  data.tar.gz: 9dcdd828d54250134e2d4cd95a3ccd418d799e7f1e387324885faa8b2d23e385
 SHA512:
-  metadata.gz: 373dae967d6e226cccb6f775666369b1cdc07491593cc1f5ed4fb6e7950c887723475360d4b3d04e50f00b609542190980a99ac3c09bbca5974f636791b86755
-  data.tar.gz: 8bc8ca63f00b5b77731ca3082497ea9cf9f8ae4738878e15d49361438adf5aa03baa2a35bc3bebec4e46a5b7c30e42cbc17be109fefee47543e0f3c3ac7410c0
+  metadata.gz: e6c773c63307706d30dd415dae6860714575a0ed4ce217abec279acc1030120899b38871c4e62d7b7cd6d207ac16049c519d2c81a05d6a9cbdae60b69436a5c1
+  data.tar.gz: 1595298d447d97acfb71ee8dfd3cef0e9facab22935bb30abe7d000fed73919c34b548340b93d087cea98393ec4ebafe2d3d2c7f529fb72f01b0b62d2e498663

data/README.md

@@ -2,7 +2,7 @@ MessageBird's REST API for Ruby
 ===============================
 This repository contains the open source Ruby client for MessageBird's REST API. Documentation can be found at: https://developers.messagebird.com/
 
-[![Build Status](https://travis-ci.org/messagebird/ruby-rest-api.svg?branch=master)](https://travis-ci.org/messagebird/ruby-rest-api)
+[![Build Status](https://github.com/messagebird/ruby-rest-api/actions/workflows/ruby_ci.yml/badge.svg)](https://github.com/messagebird/ruby-rest-api/actions)
 
 Requirements
 ------------

data/lib/messagebird/client.rb

@@ -20,6 +20,7 @@ require 'messagebird/message'
 require 'messagebird/number'
 require 'messagebird/number_client'
 require 'messagebird/verify'
+require 'messagebird/verify_email_message'
 require 'messagebird/voice/client'
 require 'messagebird/voice/list'
 require 'messagebird/voice/webhook'
@@ -77,7 +78,7 @@ module MessageBird
 
     def request(method, path, params = {})
       response_body = @http_client.request(method, path, params)
-      return if response_body.empty?
+      return if response_body.nil? || response_body.empty?
 
       parse_body(response_body)
     end
@@ -207,6 +208,11 @@ module MessageBird
       Verify.new(request(:get, "verify/#{id}"))
     end
 
+    # Retrieve the information of specific Verify email message
+    def verify_email_message(id)
+      VerifyEmailMessage.new(request(:get, "verify/messages/email/#{id}"))
+    end
+
     # Generate a new One-Time-Password message.
     def verify_create(recipient, params = {})
       Verify.new(request(
@@ -221,9 +227,9 @@ module MessageBird
       Verify.new(request(:get, "verify/#{id}?token=#{token}"))
     end
 
-    # Delete a Verify
+    # Delete a Verify, response is empty
     def verify_delete(id)
-      Verify.new(request(:delete, "verify/#{id}"))
+      request(:delete, "verify/#{id}")
     end
 
     # Retrieve the information of specific message.
@@ -232,16 +238,10 @@ module MessageBird
     end
 
     # Retrieve messages with optional paging and status filter.
-    def message_list(filter = {})
-      limit = filter[:limit] || 10
-      offset = filter[:offset] || 0
-      status = filter[:status] || ''
-
-      params = { limit: limit, offset: offset }
-      if status != ''
-        params['status'] = status
-      end
-      query = 'messages?' + URI.encode_www_form(params)
+    def message_list(filters = {})
+      params = { limit: 10, offset: 0 }.merge(filters).compact
+      query = "messages?#{URI.encode_www_form(params)}"
+
       List.new(Message, request(:get, query))
     end
 

data/lib/messagebird/request_validator.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'digest'
+require 'time'
+require 'jwt'
+
+module MessageBird
+  class ValidationError < StandardError
+  end
+
+  ##
+  # RequestValidator validates request signature signed by MessageBird services.
+  #
+  # @see https://developers.messagebird.com/docs/verify-http-requests
+  class RequestValidator
+    ALLOWED_ALGOS = %w[HS256 HS384 HS512].freeze
+
+    ##
+    #
+    # @param [string] signature_key customer signature key. Can be retrieved through <a href="https://dashboard.messagebird.com/developers/settings">Developer Settings</a>. This is NOT your API key.
+    # @param [bool] skip_url_validation whether url_hash claim validation should be skipped. Note that when true, no query parameters should be trusted.
+    def initialize(signature_key, skip_url_validation = false)
+      @signature_key = signature_key
+      @skip_url_validation = skip_url_validation
+    end
+
+    ##
+    # This method validates provided request signature, which is a JWT token.
+    # This JWT is signed with a MessageBird account unique secret key, ensuring the request is from MessageBird and a specific account.
+    # The JWT contains the following claims:
+    #      *   "url_hash" - the raw URL hashed with SHA256 ensuring the URL wasn't altered.
+    #      *    "payload_hash" - the raw payload hashed with SHA256 ensuring the payload wasn't altered.
+    #      *    "jti" - a unique token ID to implement an optional non-replay check (NOT validated by default).
+    #      *    "nbf" - the not before timestamp.
+    #      *    "exp" - the expiration timestamp is ensuring that a request isn't captured and used at a later time.
+    #      *    "iss" - the issuer name, always MessageBird.
+    # @param [String] signature the actual signature taken from request header "MessageBird-Signature-JWT".
+    # @param [String] url the raw url including the protocol, hostname and query string, e.g. "https://example.com/?example=42".
+    # @param [Array] request_body the raw request body.
+    # @return [Array] raw signature payload
+    # @raise [ValidationError] if signature is invalid
+    # @see https://developers.messagebird.com/docs/verify-http-requests
+    def validate_signature(signature, url, request_body)
+      raise ValidationError, 'Signature can not be empty' if signature.to_s.empty?
+      raise ValidationError, 'URL can not be empty' if !@skip_url_validation && url.to_s.empty?
+
+      claims = decode_signature signature
+      validate_url(url, claims['url_hash']) unless @skip_url_validation
+      validate_payload(request_body, claims['payload_hash'])
+
+      claims
+    end
+
+    private # Applies to every method below this line
+
+    def decode_signature(signature)
+      begin
+        claims, * = JWT.decode signature, @signature_key, true,
+                               algorithm: ALLOWED_ALGOS,
+                               iss: 'MessageBird',
+                               required_claims: %w[iss nbf exp],
+                               verify_iss: true,
+                               leeway: 1
+      rescue JWT::DecodeError => e
+        raise ValidationError, e
+      end
+
+      claims
+    end
+
+    def validate_url(url, url_hash)
+      expected_url_hash = Digest::SHA256.hexdigest url
+      unless JWT::SecurityUtils.secure_compare(expected_url_hash, url_hash)
+        raise ValidationError, 'invalid jwt: claim url_hash is invalid'
+      end
+    end
+
+    def validate_payload(body, payload_hash)
+      if !body.to_s.empty? && !payload_hash.to_s.empty?
+        unless JWT::SecurityUtils.secure_compare(Digest::SHA256.hexdigest(body), payload_hash)
+          raise ValidationError, 'invalid jwt: claim payload_hash is invalid'
+        end
+      elsif !body.to_s.empty?
+        raise ValidationError, 'invalid jwt: claim payload_hash is not set but payload is present'
+      elsif !payload_hash.to_s.empty?
+        raise ValidationError, 'invalid jwt: claim payload_hash is set but actual payload is missing'
+      end
+    end
+  end
+end

data/lib/messagebird/signed_request.rb

@@ -5,10 +5,16 @@ require 'digest'
 require 'time'
 
 module MessageBird
+  ##
+  # @deprecated Use {MessageBird::RequestValidator::ValidationError} instead.
   class ValidationException < TypeError
   end
 
+  ##
+  # @deprecated Use {MessageBird::RequestValidator} instead.
   class SignedRequest
+    ##
+    # @deprecated Use {MessageBird::RequestValidator} instead.
     def initialize(query_parameters, signature, request_timestamp, body)
       unless query_parameters.is_a? Hash
         raise ValidationException, 'The "query_parameters" value is invalid.'
@@ -29,12 +35,16 @@ module MessageBird
       @body = body
     end
 
+    ##
+    # @deprecated Use {MessageBird::RequestValidator::validateSignature} instead.
     def verify(signing_key)
       calculated_signature = OpenSSL::HMAC.digest(OpenSSL::Digest.new('sha256'), signing_key, build_payload)
       expected_signature = Base64.decode64(@signature)
       calculated_signature.bytes == expected_signature.bytes
     end
 
+    ##
+    # @deprecated Use {MessageBird::RequestValidator} instead.
     def build_payload
       parts = []
       parts.push(@request_timestamp)
@@ -43,6 +53,8 @@ module MessageBird
       parts.join("\n")
     end
 
+    ##
+    # @deprecated Use {MessageBird::RequestValidator} instead.
     def recent?(offset = 10)
       (Time.now.getutc.to_i - @request_timestamp) < offset
     end

data/lib/messagebird/verify.rb

@@ -1,20 +1,25 @@
 # frozen_string_literal: true
 
 require 'time'
-
 require 'messagebird/base'
 
 module MessageBird
   class Verify < MessageBird::Base
-    attr_accessor :id, :recipient, :reference, :status, :href
-    attr_reader :created_datetime, :valid_until_date_time
+    attr_accessor :id,
+                  :href,
+                  :recipient,
+                  :reference,
+                  :messages,
+                  :status
+    attr_reader   :created_datetime,
+                  :valid_until_datetime
 
     def created_datetime=(value)
       @created_datetime = value_to_time(value)
     end
 
-    def valid_until_date_time=(value)
-      @valid_until_date_time = value_to_time(value)
+    def valid_until_datetime=(value)
+      @valid_until_datetime = value_to_time(value)
     end
   end
 end

data/lib/messagebird/verify_email_message.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require 'messagebird/base'
+
+module MessageBird
+  class VerifyEmailMessage < MessageBird::Base
+    attr_accessor :id, :status
+  end
+end

data/lib/messagebird/version.rb

@@ -2,6 +2,6 @@
 
 module MessageBird
   module Version
-    STRING = '2.0.0'
+    STRING = '3.1.0'
   end
 end

data/lib/messagebird.rb

@@ -12,7 +12,8 @@ require 'messagebird/group_reference'
 require 'messagebird/hlr'
 require 'messagebird/http_client'
 require 'messagebird/message_reference'
-require 'messagebird/signed_request'
+require 'messagebird/signed_request' # @deprecated
+require 'messagebird/request_validator'
 require 'messagebird/verify'
 require 'messagebird/message'
 require 'messagebird/voicemessage'

metadata

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: messagebird-rest
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 3.1.0
 platform: ruby
 authors:
 - Maurice Nonnekes
-autorequire:
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-05-14 00:00:00.000000000 Z
+date: 2022-03-30 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.2.3
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 2.2.3
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -87,8 +101,10 @@ files:
 - lib/messagebird/number.rb
 - lib/messagebird/number_client.rb
 - lib/messagebird/recipient.rb
+- lib/messagebird/request_validator.rb
 - lib/messagebird/signed_request.rb
 - lib/messagebird/verify.rb
+- lib/messagebird/verify_email_message.rb
 - lib/messagebird/version.rb
 - lib/messagebird/voice/base.rb
 - lib/messagebird/voice/call.rb
@@ -104,7 +120,7 @@ homepage: https://github.com/messagebird/ruby-rest-api
 licenses:
 - BSD-2-Clause
 metadata: {}
-post_install_message:
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -112,15 +128,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 1.9.3
+      version: '2.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.15
-signing_key:
+rubygems_version: 3.1.2
+signing_key: 
 specification_version: 4
 summary: MessageBird's REST API
 test_files: []