nexmo_rack 0.2.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/LICENSE.txt +21 -0
- data/README.md +79 -0
- data/lib/nexmo_rack.rb +5 -0
- data/lib/nexmo_rack/verify_signature.rb +57 -0
- data/lib/version.rb +7 -0
- metadata +130 -0
checksums.yaml
ADDED
@@ -0,0 +1,7 @@
|
|
1
|
+
---
|
2
|
+
SHA256:
|
3
|
+
metadata.gz: af7837e8eb97283dd4b51c9d837a35756567ef6ae98ca0c1468598cc3e12a967
|
4
|
+
data.tar.gz: 51c6f8f57108cbb6904bc99802f16995a6760b3619a60e9d43348eed1cb553ea
|
5
|
+
SHA512:
|
6
|
+
metadata.gz: 90bc63db59d70e2cdd7496a584a14f0e1774565c0449e95e0fa5e46f108dfc52c6426c8bb87fbfbf38256d1788262230fecaf9cb0f355846c47e0f90ef1496d3
|
7
|
+
data.tar.gz: e091ffaa0f43123753cc709932a5831b5d24b4926b52de0ac6799293e27abe9176bf1e743163b81a49ce5ccc3a09aab95e0fae6eba49c2c1e0a8ced3dcbc5264
|
data/LICENSE.txt
ADDED
@@ -0,0 +1,21 @@
|
|
1
|
+
The MIT License (MIT)
|
2
|
+
|
3
|
+
Copyright (c) 2019 Nexmo Inc
|
4
|
+
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
7
|
+
in the Software without restriction, including without limitation the rights
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
10
|
+
furnished to do so, subject to the following conditions:
|
11
|
+
|
12
|
+
The above copyright notice and this permission notice shall be included in
|
13
|
+
all copies or substantial portions of the Software.
|
14
|
+
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
21
|
+
THE SOFTWARE.
|
data/README.md
ADDED
@@ -0,0 +1,79 @@
|
|
1
|
+
# Nexmo Rack Middleware
|
2
|
+
|
3
|
+
This repo contains Rack middleware that can be used to help integrate Nexmo in to your Rack-based application. It currently contains the following middleware:
|
4
|
+
|
5
|
+
* Verify [Nexmo signatures](https://developer.nexmo.com/concepts/guides/signing-messages).
|
6
|
+
* Plus more to be added
|
7
|
+
|
8
|
+
* [Installation and Usage](#installation-and-usage)
|
9
|
+
* [As a standalone application](#as-a-standalone-application)
|
10
|
+
* [Mounted into a Rails application](#mounted-into-a-rails-application)
|
11
|
+
* [Contributing](#contributing)
|
12
|
+
* [License](#license)
|
13
|
+
|
14
|
+
## Installation and Usage
|
15
|
+
|
16
|
+
The verify signature middleware can be used standalone or integrated into a Ruby application. The middleware will return a `403` HTTP status code if the signature is not valid, and will continue the application if it is valid.
|
17
|
+
|
18
|
+
### Configuration
|
19
|
+
|
20
|
+
You'll need to provide a Nexmo signature secret and signature method using either `ENV` variables or the Rails credentials system.
|
21
|
+
|
22
|
+
`.env` example:
|
23
|
+
|
24
|
+
```
|
25
|
+
NEXMO_SIGNATURE_SECRET = 'your_secret_key'
|
26
|
+
NEXMO_SIGNATURE_METHOD = 'md5hash'
|
27
|
+
```
|
28
|
+
|
29
|
+
Alternatively, you can specify them in the Rails credentials system
|
30
|
+
|
31
|
+
```
|
32
|
+
EDITOR="code --wait" rails credentials:edit
|
33
|
+
```
|
34
|
+
|
35
|
+
You can replace the EDITOR variable with your preferred editor. Once the credentials file is open, you are able to add the Nexmo credentials with the following namespacing:
|
36
|
+
|
37
|
+
```yaml
|
38
|
+
nexmo:
|
39
|
+
signature_secret: your_secret_key
|
40
|
+
signature_method: md5hash
|
41
|
+
```
|
42
|
+
|
43
|
+
Finally, this middleware will ignore any requests that do not contain a `sig` key. To enforce all requests to be validated, set `NEXMO_SIGNATURE_REQUIRED` to `true` in the environment.
|
44
|
+
|
45
|
+
### As a standalone application
|
46
|
+
|
47
|
+
Install the gem on your system:
|
48
|
+
|
49
|
+
``` shell
|
50
|
+
$ gem install nexmo_rack
|
51
|
+
```
|
52
|
+
|
53
|
+
Then require it from within your `config.ru` Rack configuration:
|
54
|
+
|
55
|
+
``` ruby
|
56
|
+
use Nexmo::Rack::VerifySignature
|
57
|
+
```
|
58
|
+
|
59
|
+
An example [config.ru](examples/config.ru.example) can be found in the examples folder. More information on getting up and running with Rack can be found at the [Rack GitHub repository](https://github.com/rack/rack/wiki/(tutorial)-rackup-howto#with-a-ru-config-file).
|
60
|
+
|
61
|
+
### Mounted into a Rails Application
|
62
|
+
|
63
|
+
Require it in your `Gemfile`:
|
64
|
+
|
65
|
+
```ruby
|
66
|
+
gem nexmo_rack
|
67
|
+
```
|
68
|
+
|
69
|
+
And then add the middleware to your `config/application.rb` file to initialize it with your application:
|
70
|
+
|
71
|
+
```ruby
|
72
|
+
config.middleware.use Nexmo::Rack::VerifySignature
|
73
|
+
```
|
74
|
+
|
75
|
+
## Contributing
|
76
|
+
We ❤️ contributions from everyone! [Bug reports](https://github.com/Nexmo/nexmo_rack/issues), [bug fixes](https://github.com/Nexmo/nexmo_rack/pulls) and feedback on the library is always appreciated. Look at the [Contributor Guidelines](https://github.com/Nexmo/nexmo_rack/blob/master/CONTRIBUTING.md) for more information.
|
77
|
+
|
78
|
+
## License
|
79
|
+
This project is under the [MIT LICENSE](https://github.com/Nexmo/nexmo_rack/blob/master/LICENSE).
|
data/lib/nexmo_rack.rb
ADDED
@@ -0,0 +1,57 @@
|
|
1
|
+
# Verify Nexmo Signatures
|
2
|
+
module Nexmo
|
3
|
+
module Rack
|
4
|
+
class VerifySignature
|
5
|
+
def initialize(app)
|
6
|
+
@app = app
|
7
|
+
@nexmo = Nexmo::Client.new(
|
8
|
+
signature_secret: signature_secret,
|
9
|
+
signature_method: signature_method
|
10
|
+
)
|
11
|
+
end
|
12
|
+
|
13
|
+
def call(env)
|
14
|
+
req = ::Rack::Request.new(env)
|
15
|
+
|
16
|
+
# Duplicate the request params in case nexmo_client.check() modifies them
|
17
|
+
params = req.params.dup
|
18
|
+
|
19
|
+
# If there is no `sig` field, ignore this middleware unless we explicitly
|
20
|
+
# require it to be present
|
21
|
+
unless ENV['NEXMO_SIGNATURE_REQUIRED']
|
22
|
+
return @app.call(env) unless req.params['sig']
|
23
|
+
end
|
24
|
+
|
25
|
+
# Otherwise calculate the signature and check that it matches
|
26
|
+
if req.params['sig'] && @nexmo.signature.check(params)
|
27
|
+
@app.call(env)
|
28
|
+
else
|
29
|
+
[403, {}, ['']]
|
30
|
+
end
|
31
|
+
end
|
32
|
+
|
33
|
+
private
|
34
|
+
|
35
|
+
def signature_secret
|
36
|
+
if ENV['NEXMO_SIGNATURE_SECRET']
|
37
|
+
ENV['NEXMO_SIGNATURE_SECRET']
|
38
|
+
elsif defined?(Rails) && Rails.application.credentials.nexmo
|
39
|
+
Rails.application.credentials.nexmo[:signature_secret]
|
40
|
+
else
|
41
|
+
raise "No signature credentials found for Nexmo::Rack::VerifySignature"
|
42
|
+
end
|
43
|
+
end
|
44
|
+
|
45
|
+
def signature_method
|
46
|
+
if ENV['NEXMO_SIGNATURE_METHOD']
|
47
|
+
ENV['NEXMO_SIGNATURE_METHOD']
|
48
|
+
elsif defined?(Rails) && Rails.application.credentials.nexmo
|
49
|
+
Rails.application.credentials.nexmo[:signature_method]
|
50
|
+
else
|
51
|
+
raise "No signature method found for Nexmo::Rack::VerifySignature"
|
52
|
+
end
|
53
|
+
end
|
54
|
+
|
55
|
+
end
|
56
|
+
end
|
57
|
+
end
|
data/lib/version.rb
ADDED
metadata
ADDED
@@ -0,0 +1,130 @@
|
|
1
|
+
--- !ruby/object:Gem::Specification
|
2
|
+
name: nexmo_rack
|
3
|
+
version: !ruby/object:Gem::Version
|
4
|
+
version: 0.2.0
|
5
|
+
platform: ruby
|
6
|
+
authors:
|
7
|
+
- Nexmo
|
8
|
+
autorequire:
|
9
|
+
bindir: bin
|
10
|
+
cert_chain: []
|
11
|
+
date: 2019-11-18 00:00:00.000000000 Z
|
12
|
+
dependencies:
|
13
|
+
- !ruby/object:Gem::Dependency
|
14
|
+
name: nexmo
|
15
|
+
requirement: !ruby/object:Gem::Requirement
|
16
|
+
requirements:
|
17
|
+
- - "~>"
|
18
|
+
- !ruby/object:Gem::Version
|
19
|
+
version: '6.1'
|
20
|
+
type: :runtime
|
21
|
+
prerelease: false
|
22
|
+
version_requirements: !ruby/object:Gem::Requirement
|
23
|
+
requirements:
|
24
|
+
- - "~>"
|
25
|
+
- !ruby/object:Gem::Version
|
26
|
+
version: '6.1'
|
27
|
+
- !ruby/object:Gem::Dependency
|
28
|
+
name: rack
|
29
|
+
requirement: !ruby/object:Gem::Requirement
|
30
|
+
requirements:
|
31
|
+
- - "~>"
|
32
|
+
- !ruby/object:Gem::Version
|
33
|
+
version: '2.0'
|
34
|
+
- - ">="
|
35
|
+
- !ruby/object:Gem::Version
|
36
|
+
version: 2.0.7
|
37
|
+
type: :runtime
|
38
|
+
prerelease: false
|
39
|
+
version_requirements: !ruby/object:Gem::Requirement
|
40
|
+
requirements:
|
41
|
+
- - "~>"
|
42
|
+
- !ruby/object:Gem::Version
|
43
|
+
version: '2.0'
|
44
|
+
- - ">="
|
45
|
+
- !ruby/object:Gem::Version
|
46
|
+
version: 2.0.7
|
47
|
+
- !ruby/object:Gem::Dependency
|
48
|
+
name: simplecov
|
49
|
+
requirement: !ruby/object:Gem::Requirement
|
50
|
+
requirements:
|
51
|
+
- - "~>"
|
52
|
+
- !ruby/object:Gem::Version
|
53
|
+
version: '0.16'
|
54
|
+
type: :development
|
55
|
+
prerelease: false
|
56
|
+
version_requirements: !ruby/object:Gem::Requirement
|
57
|
+
requirements:
|
58
|
+
- - "~>"
|
59
|
+
- !ruby/object:Gem::Version
|
60
|
+
version: '0.16'
|
61
|
+
- !ruby/object:Gem::Dependency
|
62
|
+
name: coveralls
|
63
|
+
requirement: !ruby/object:Gem::Requirement
|
64
|
+
requirements:
|
65
|
+
- - "~>"
|
66
|
+
- !ruby/object:Gem::Version
|
67
|
+
version: 0.8.15
|
68
|
+
type: :development
|
69
|
+
prerelease: false
|
70
|
+
version_requirements: !ruby/object:Gem::Requirement
|
71
|
+
requirements:
|
72
|
+
- - "~>"
|
73
|
+
- !ruby/object:Gem::Version
|
74
|
+
version: 0.8.15
|
75
|
+
- !ruby/object:Gem::Dependency
|
76
|
+
name: rspec
|
77
|
+
requirement: !ruby/object:Gem::Requirement
|
78
|
+
requirements:
|
79
|
+
- - "~>"
|
80
|
+
- !ruby/object:Gem::Version
|
81
|
+
version: '3.9'
|
82
|
+
type: :development
|
83
|
+
prerelease: false
|
84
|
+
version_requirements: !ruby/object:Gem::Requirement
|
85
|
+
requirements:
|
86
|
+
- - "~>"
|
87
|
+
- !ruby/object:Gem::Version
|
88
|
+
version: '3.9'
|
89
|
+
description: Nexmo related middleware to make it easier to work with Nexmo's webhooks
|
90
|
+
email:
|
91
|
+
- devrel@nexmo.com
|
92
|
+
executables: []
|
93
|
+
extensions: []
|
94
|
+
extra_rdoc_files: []
|
95
|
+
files:
|
96
|
+
- LICENSE.txt
|
97
|
+
- README.md
|
98
|
+
- lib/nexmo_rack.rb
|
99
|
+
- lib/nexmo_rack/verify_signature.rb
|
100
|
+
- lib/version.rb
|
101
|
+
homepage: https://github.com/Nexmo/nexmo_rack
|
102
|
+
licenses:
|
103
|
+
- MIT
|
104
|
+
metadata:
|
105
|
+
homepage: https://github.com/Nexmo/nexmo_rack
|
106
|
+
source_code_uri: https://github.com/Nexmo/nexmo_rack
|
107
|
+
bug_tracker_uri: https://github.com/Nexmo/nexmo_rack/issues
|
108
|
+
changelog_uri: https://github.com/Nexmo/nexmo_rack/blob/master/CHANGES.md
|
109
|
+
post_install_message:
|
110
|
+
rdoc_options: []
|
111
|
+
require_paths:
|
112
|
+
- lib
|
113
|
+
required_ruby_version: !ruby/object:Gem::Requirement
|
114
|
+
requirements:
|
115
|
+
- - ">="
|
116
|
+
- !ruby/object:Gem::Version
|
117
|
+
version: '0'
|
118
|
+
required_rubygems_version: !ruby/object:Gem::Requirement
|
119
|
+
requirements:
|
120
|
+
- - ">="
|
121
|
+
- !ruby/object:Gem::Version
|
122
|
+
version: '0'
|
123
|
+
requirements: []
|
124
|
+
rubyforge_project:
|
125
|
+
rubygems_version: 2.7.6.2
|
126
|
+
signing_key:
|
127
|
+
specification_version: 4
|
128
|
+
summary: Nexmo related middleware to make it easier to work with Nexmo's webhooks.
|
129
|
+
To use it you'll need a Nexmo account. Sign up for free at https://www.nexmo.com
|
130
|
+
test_files: []
|