openstax_api 8.1.1 → 8.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: aeefa4b58e29cb1960801da52f27d4cfc2959c70
-  data.tar.gz: 0cbdbded9beb84362074744d95168defa1e4f000
+  metadata.gz: a3da970c8b505007a77d4c22af9f93f02598a7ac
+  data.tar.gz: 5550c22216fd6b3792b04b182995f4b97a23edfd
 SHA512:
-  metadata.gz: 0915a7de958c62ae641ff20b14381ce26781f660cc03a050da2444c2bd1ecfc3a00c41b4c105d049852c5960b381f02ddb343a1b824d0573f670b1dc12dca801
-  data.tar.gz: 28fde8f8c2a57657fa08882cca2037f28fc6ccd3618480edbbc5fa16776e45b56cafdc9df60dcc79534a0f86d69d44dbc66a0c925e567f4386df7c38541f9f43
+  metadata.gz: 3beef5dc60cc89ca7eef3af6056973ca999a24c998ac017595d4d2c6141bce3a5e7c88fa78ec368caf994dbec04a63245b915e7ab5f6942208ff59c1139221df
+  data.tar.gz: a9887c1adbdbc5bc1b66ebb244c8b1069864613bf7ed34d1e7f024fe23383fc85f43deceda938eefa1885c77abc3f31c7cdee66b7fa22cc5fa1454153aab4845

data/lib/openstax/api/engine.rb

@@ -6,6 +6,7 @@ require 'openstax_utilities'
 require 'openstax/api/roar'
 require 'openstax/api/apipie'
 require 'openstax/api/responder_with_put_patch_delete_content'
+require 'openstax/api/params'
 
 module OpenStax
   module Api

data/lib/openstax/api/params.rb

@@ -0,0 +1,92 @@
+module OpenStax
+  module Api
+    module Params
+
+      extend self
+
+      def sign(params:, secret:, algorithm: 'sha256')
+        raise "`secret` cannot be blank" if secret.blank?
+        local_params = params.merge(timestamp: Time.now.to_i)
+
+        stringified_params = normalize(local_params)
+        signature = OpenSSL::HMAC.hexdigest(algorithm, secret, stringified_params)
+
+        local_params.merge!(signature: signature)
+      end
+
+      def signature_and_timestamp_valid?(params:, secret:, algorithm: 'sha256', timestamp_window_width: 2.minutes)
+        local_params = params.dup
+        incoming_signature = local_params.delete(:signature)
+
+        return false if incoming_signature.blank?
+
+        stringified_params = normalize(local_params)
+        expected_signature = OpenSSL::HMAC.hexdigest(algorithm, secret, stringified_params)
+
+        return false if expected_signature != incoming_signature
+
+        timestamp_window = timestamp_window_width.ago..timestamp_window_width.from_now
+        return false if !timestamp_window.cover?(Time.at(params[:timestamp].to_i))
+
+        return true
+      end
+
+      # Below is borrowed from https://github.com/oauth-xx/oauth-ruby/blob/e397b3e2f540faaebd7912aeb2768835d151f795/lib/oauth/helper.rb
+      # so we can call `normalize` on some params without adding dependence on full oauth gem
+
+      RESERVED_CHARACTERS = /[^a-zA-Z0-9\-\.\_\~]/
+
+      # Escape +value+ by URL encoding all non-reserved character.
+      def escape(value)
+        _escape(value.to_s.to_str)
+      rescue ArgumentError
+        _escape(value.to_s.to_str.force_encoding(Encoding::UTF_8))
+      end
+
+      def _escape(string)
+        URI.escape(string, RESERVED_CHARACTERS)
+      end
+
+      # Normalize a +Hash+ of parameter values. Parameters are sorted by name, using lexicographical
+      # byte value ordering. If two or more parameters share the same name, they are sorted by their value.
+      # Parameters are concatenated in their sorted order into a single string. For each parameter, the name
+      # is separated from the corresponding value by an "=" character, even if the value is empty. Each
+      # name-value pair is separated by an "&" character.
+      def normalize(params)
+        params.sort.map do |k, values|
+          if values.is_a?(Array)
+            # make sure the array has an element so we don't lose the key
+            values << nil if values.empty?
+            # multiple values were provided for a single key
+            values.sort.collect do |v|
+              [escape(k),escape(v)] * "="
+            end
+          elsif values.is_a?(Hash)
+            normalize_nested_query(values, k)
+          else
+            [escape(k),escape(values)] * "="
+          end
+        end * "&"
+      end
+
+      #Returns a string representation of the Hash like in URL query string
+      # build_nested_query({:level_1 => {:level_2 => ['value_1','value_2']}}, 'prefix'))
+      #   #=> ["prefix%5Blevel_1%5D%5Blevel_2%5D%5B%5D=value_1", "prefix%5Blevel_1%5D%5Blevel_2%5D%5B%5D=value_2"]
+      def normalize_nested_query(value, prefix = nil)
+        case value
+        when Array
+          value.map do |v|
+            normalize_nested_query(v, "#{prefix}[]")
+          end.flatten.sort
+        when Hash
+          value.map do |k, v|
+            normalize_nested_query(v, prefix ? "#{prefix}[#{k}]" : k)
+          end.flatten.sort
+        else
+          [escape(prefix), escape(value)] * "="
+        end
+      end
+
+    end
+  end
+end

data/lib/openstax/api/representable_schema_printer.rb

@@ -44,7 +44,9 @@ module OpenStax
 
         representer.representable_attrs.each do |attr|
           # Handle some common attributes (as, schema_info, required)
-          name = attr[:as].blank? ? attr[:name] : attr[:as].evaluate(representer) rescue attr[:name]
+          name = attr[:as].blank? ?
+                   attr[:name] :
+                   attr[:as].evaluate(representer) rescue attr[:as].call rescue attr[:name]
           schema_info = attr[:schema_info] || {}
 
           schema[:required].push(name.to_sym) if schema_info[:required]

data/lib/openstax/api/version.rb

@@ -1,5 +1,5 @@
 module OpenStax
   module Api
-    VERSION = "8.1.1"
+    VERSION = "8.2.0"
   end
 end