oauth2_hmac_sign 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 8b826b56d00266887e8fd5fbd2bd9123a3207192
+  data.tar.gz: 69b9552baa89bf622d3fb655a1d6d8125f72d9e4
+SHA512:
+  metadata.gz: 774ecf670b4cde116f5f18bb633487e454ca31bf19bdbc2c9c4f41eccec92e47960f513ce5dd5badbecc6bb82077b96359b82e09d583376655f1d3168b43336d
+  data.tar.gz: 2a37e951394438c7a9cf29a8db14eae07c140beb4e7abab3e13841cdeb2b93533718689cbe2c0e5509f8df3fd5931d4979e1951a48f6b22155ed7ad2b0950c51

data/.gitignore

@@ -0,0 +1,9 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/

data/.rspec

@@ -0,0 +1,2 @@
+--format documentation
+--color

data/.travis.yml

@@ -0,0 +1,6 @@
+language: ruby
+rvm:
+  - 2.2.2
+  - 2.1.0
+  - 2.0.0-p643
+  - 1.9.3-p551

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in oauth2_hmac_sign.gemspec
+gemspec

data/README.md

@@ -0,0 +1,69 @@
+# Oauth2HmacSign
+[![Build Status](https://travis-ci.org/mustafaturan/oauth2_hmac_sign.png)](https://travis-ci.org/mustafaturan/oauth2_hmac_sign) [![Code Climate](https://codeclimate.com/github/mustafaturan/oauth2_hmac_sign.png)](https://codeclimate.com/github/mustafaturan/oauth2_hmac_sign)
+
+A single signature generator and validator Oauth v2 HTTP message authentication code(MAC) authentication. It simply generates and verify signatures for Oauth v2 HTTP MAC authentication for 'SHA1' and 'SHA256' algorithms. Please visit https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01 for spec specifications.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'oauth2_hmac_sign'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install oauth2_hmac_sign
+
+## Usage
+
+### For generating
+```ruby
+    algorithm = 'hmac-sha-256' # 'hmac-sha-256' or 'hmac-sha-1'
+    key = 'demo_key' # your key
+    method = 'post' # http method for request -> get, post, head, patch, ...
+    uri = '/request?b5=%3D%253D&a3=a&c%40=&a2=r%20b&c2&a3=2+q' # request uri
+    host = 'example.com' # server host name
+    port = 443 # default is 443
+    ext = 'a,b,c' # can be nil
+    ts, nonce, ext, mac  = Oauth2HmacSign::Signature.generate(
+      algorithm, key, method, uri, host, port, ext
+    )
+       
+    # returns multiple information
+    # ts = timestamp
+    # nonce = unique string
+    # ext = if nil send as input than returns empty string else returns the same string as input
+    # mac = mac signature for the given parameters
+```
+
+### For verifying
+```ruby
+    Oauth2HmacSign::Signature.is_valid?(
+      mac,
+      algorithm,
+      key,
+      ts,
+      nonce,
+      method,
+      uri,
+      host,
+      port,
+      ext
+    )
+
+    # returns 
+    # true for valid
+    # false for invalid
+```
+## Contributing
+
+1. Fork it ( https://github.com/mustafaturan/oauth2_hmac_sign/fork )
+2. Create your feature branch (`git checkout -b my-new-feature`)
+3. Commit your changes (`git commit -am 'Add some feature'`)
+4. Push to the branch (`git push origin my-new-feature`)
+5. Create a new Pull Request

data/Rakefile

@@ -0,0 +1,17 @@
+require 'bundler/gem_tasks'
+require 'rake'
+require 'rspec/core/rake_task'
+
+desc "Default Task"
+task :default => :spec
+
+# Make a console for testing purposes
+desc "Generate a test console"
+task :console do
+   verbose( false ) { sh "irb -I lib/ -r 'oauth2_hmac_sign'" }
+end
+
+RSpec::Core::RakeTask.new('spec') do |t|
+  t.rspec_opts = ['-c', '-r ./spec/spec_helper.rb']
+  t.pattern = 'spec/**/*_spec.rb'
+end

data/bin/console

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+
+require "bundler/setup"
+require "oauth2_hmac_sign"
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require "pry"
+# Pry.start
+
+require "irb"
+IRB.start

data/bin/setup

@@ -0,0 +1,7 @@
+#!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/lib/oauth2_hmac_sign.rb

@@ -0,0 +1,6 @@
+require File.dirname(__FILE__) + '/oauth2_hmac_sign/version'
+require File.dirname(__FILE__) + '/oauth2_hmac_sign/signature'
+
+module Oauth2HmacSign
+  # Your code goes here...
+end

data/lib/oauth2_hmac_sign/signature.rb

@@ -0,0 +1,148 @@
+require 'base64'
+require 'openssl'
+require 'securerandom'
+
+# A single signature generator and validator Oauth2 HTTP MAC token.
+# https://tools.ietf.org/html/rfc2616
+module Oauth2HmacSign
+  class Signature
+    attr_reader :ts, :nonce, :method, :uri, :host, :port, :ext
+    attr_reader :mac
+
+    class << self
+
+      # Generate oauth2 hmac signature with required and optional vars
+      #
+      # == Parameters:
+      # algorithm::
+      #   Name of the algorithm valid vars are hmac-sha256, hmac-sha1
+      # key::
+      #   Key for hmac algorithm
+      # method::
+      #   The HTTP request method in upper case.  For example: "HEAD", "GET", "POST", etc.
+      # uri::
+      #   The HTTP request-URI as defined by https://tools.ietf.org/html/rfc2616#section-5.1.2
+      # host::
+      #   The hostname included in the HTTP request using the "Host" request header field in lower case.
+      # port::
+      #   The port as included in the HTTP request using the "Host" request
+      #   header field.  If the header field does not include a port, the
+      #   default value for the scheme MUST be used (e.g. 80 for HTTP and
+      #   443 for HTTPS).
+      # ext:: 
+      #   The value of the "ext" "Authorization" request header field
+      #   attribute if one was included in the request, otherwise, an empty
+      #   string.
+      # 
+      # == Returns:
+      #   Returns the generated signature and required variables to verify it. 
+      # ts::
+      #   The timestamp value calculated for the signature.
+      # nonce::
+      #   The nonce value generated for the signature.
+      # ext::
+      #   The value of passed or assigned for ext
+      # mac::
+      #   The signature
+      #
+      def generate(algorithm, key, method, uri, host, port = 443, ext = '')
+        @ts = Time.now.to_i
+        @nonce = generate_nonce
+        @method = method
+        @uri = uri
+        @host = host
+        @port = port
+        @ext = ext
+        @mac = calculate(
+          algorithm_constructor(algorithm),
+          key,
+          normalized_request_string
+        )
+        return @ts, @nonce, @ext, @mac
+      end
+      
+      # Validate oauth2 hmac signature with required and optional vars
+      #
+      # == Parameters:
+      # mac::
+      #   Signature for validation
+      # algorithm::
+      #   Name of the algorithm valid vars are hmac-sha256, hmac-sha1
+      # key::
+      #   Key for hmac algorithm
+      # ts::
+      #   The timestamp value calculated for the request.
+      # nonce::
+      #   The nonce value generated for the request.
+      # method::
+      #   The HTTP request method in upper case.  For example: "HEAD", "GET", "POST", etc.
+      # uri::
+      #   The HTTP request-URI as defined by https://tools.ietf.org/html/rfc2616#section-5.1.2
+      # host::
+      #   The hostname included in the HTTP request using the "Host" request header field in lower case.
+      # port::
+      #   The port as included in the HTTP request using the "Host" request
+      #   header field.  If the header field does not include a port, the
+      #   default value for the scheme MUST be used (e.g. 80 for HTTP and
+      #   443 for HTTPS).
+      # ext:: 
+      #   The value of the "ext" "Authorization" request header field
+      #   attribute if one was included in the request, otherwise, an empty
+      #   string.
+      # 
+      # == Returns:
+      # Boolean: true for succesfully verified mac signature and false for invalid mac signature
+      #
+      def is_valid?(mac, algorithm, key, ts, nonce, method, uri, host, port, ext)
+        @ts = ts
+        @nonce = nonce
+        @method = method
+        @uri = uri
+        @host = host
+        @port = port
+        @ext = ext
+        mac.eql?(calculate(
+            algorithm_constructor(algorithm),
+            key,
+            normalized_request_string
+          )
+        )
+      end
+
+      private
+      # nodoc
+      def calculate(algorithm, key, text)
+        Base64.urlsafe_encode64(
+          OpenSSL::HMAC.digest(
+            algorithm,
+            key,
+            text
+          )
+        )
+      end
+
+      # nodoc
+      def generate_nonce
+        "#{@ts}:#{SecureRandom.hex(4)}"
+      end
+
+      # nodoc      
+      # https://tools.ietf.org/html/draft-ietf-oauth-v2-http-mac-01#section-3.2.1
+      def normalized_request_string
+        "#{@ts}\n#{@nonce}\n#{@method.to_s.upcase}\n#{@uri}\n#{@host.to_s.downcase}\n#{@port}\n#{@ext}\n"
+      end
+
+      # nodoc
+      def algorithm_constructor(algorithm)
+        case algorithm
+        when 'hmac-sha-256'
+          OpenSSL::Digest::SHA256.new
+        when 'hmac-sha-1'
+          OpenSSL::Digest::SHA1.new
+        else
+          raise 'Unregistered algorithm!'
+        end
+      end
+    end
+  end
+end

data/lib/oauth2_hmac_sign/version.rb

@@ -0,0 +1,3 @@
+module Oauth2HmacSign
+  VERSION = '0.1.0'
+end

data/oauth2_hmac_sign.gemspec

@@ -0,0 +1,24 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'oauth2_hmac_sign/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "oauth2_hmac_sign"
+  spec.version       = Oauth2HmacSign::VERSION
+  spec.authors       = ["Mustafa TURAN"]
+  spec.email         = ["mustafaturan.net@gmail.com"]
+
+  spec.summary       = %q{A single signature generator and validator Oauth v2 HTTP MAC authentication.}
+  spec.description   = %q{Generate and verify signatures for oauth v2 http mac authentication}
+  spec.homepage      = "https://github.com/mustafaturan/oauth2_hmac_sign"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject { |f| f.match(%r{^(test|spec|features)/}) }
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_development_dependency "bundler", "~> 1.7"
+  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rspec"
+end

metadata

@@ -0,0 +1,97 @@
+--- !ruby/object:Gem::Specification
+name: oauth2_hmac_sign
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Mustafa TURAN
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2015-08-01 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.7'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Generate and verify signatures for oauth v2 http mac authentication
+email:
+- mustafaturan.net@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- ".travis.yml"
+- Gemfile
+- README.md
+- Rakefile
+- bin/console
+- bin/setup
+- lib/oauth2_hmac_sign.rb
+- lib/oauth2_hmac_sign/signature.rb
+- lib/oauth2_hmac_sign/version.rb
+- oauth2_hmac_sign.gemspec
+homepage: https://github.com/mustafaturan/oauth2_hmac_sign
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.4.5
+signing_key: 
+specification_version: 4
+summary: A single signature generator and validator Oauth v2 HTTP MAC authentication.
+test_files: []