patchwork-rb 0.1.6 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 564b479edcfcbad47a6b170dc219eecc6a5cd633c066f10a070631dd12583860
-  data.tar.gz: 0f0768a2e84d273f34eaebb0a6bef98f280dc6ff193f8ee72ded3ab6b3b9595a
+  metadata.gz: 966c3f0f6ac7395698a0f34d355813f86af4f8e685623197c0018b9c70ad53f7
+  data.tar.gz: 7919e2bd0ea6b8be6868f8bdc8972baaa727b9722d6be784458df7b702af1c96
 SHA512:
-  metadata.gz: b4b7217e76620606f0b16b56d1e1828ebc0b36b86f2c99100ae0324adef914d772ca425017dc76a7e1c88f005c46586fd55be8ba5cb1abea895fb0dabf77e9d6
-  data.tar.gz: 71b097330f26014ec0447a8fb90afa21d67400b6314bbb3783b6399a7ce1669d91773ce9054aba74ba76370b95b833e027a73ab5fd1c38f5c1ca31c4e83658d3
+  metadata.gz: b84168c956d15378261d722a48d3de3a32df59b6176d10b3ed5d6789db6bbaf024b8bafbc89579edf2a497c5e1fbf238c7d9d894eebd22dffcbece6d500e9aa3
+  data.tar.gz: 5507f4f8baaa7c454669a3ce71b611313d78d58ba369b28969bfeada6488332122b38606e32672e12db0c0ec98baa96d12af1ca6daa728d1db8e7b55f238ee1d

data/README.md

@@ -238,7 +238,19 @@ A signature carries a label. `v1` covers the method, the path and the raw body.
 
 The gateway and the concern verify either label, and pass the query for you. If you verify with the primitives instead, pass `query:` — the raw query string, `request.query_string` in Rack and Rails. Leave it out and a `v2` value is checked against the bare path, which will not match.
 
-**A GET tool's arguments are still not protected yet.** Patchwork sends both labels while consumers upgrade, and `v1` does not cover the query, so altering a GET tool's arguments in flight still passes. That closes when Patchwork stops sending `v1`. Until then, give any tool whose arguments matter — ids, amounts, anything that writes — a `POST` binding, where the arguments travel in the signed body.
+**By default a GET tool's arguments are not protected yet.** Patchwork sends both labels while consumers upgrade, and `v1` does not cover the query, so a header carrying both verifies through `v1` even if the query changed.
+
+Two ways to close that:
+
+```ruby
+use Patchwork::Gateway,
+  resolve: ...,
+  labels: [ Patchwork::Signature::V2 ]
+```
+
+Requiring `v2` refuses any signature that does not cover the query. Patchwork sends `v2` on every tool call, the relay mint, the connection probe and webhook deliveries, so this is safe to turn on today. It will fail against a platform that has not started sending `v2`, which is why it is not the default.
+
+Or give any tool whose arguments matter — ids, amounts, anything that writes — a `POST` binding, where the arguments travel in the signed body.
 
 The signed path is the one your app sees. If a proxy rewrites paths before your app does, mount the gateway where the original path is still intact.
 

data/lib/patchwork/gateway.rb

@@ -33,7 +33,7 @@ module Patchwork
 
     def initialize(app, resolve:, subject: nil, mint_path: nil, health_check: true,
                    health_path: HealthCheck::PATH, max_body_bytes: MAX_BODY_BYTES,
-                   replay_guard: nil)
+                   replay_guard: nil, labels: Signature::LABELS)
       raise ArgumentError, "resolve must respond to #call" unless resolve.respond_to?(:call)
       raise ArgumentError, "subject must respond to #decode" if subject && !subject.respond_to?(:decode)
       raise ArgumentError, "replay_guard must respond to #call" if replay_guard && !replay_guard.respond_to?(:call)
@@ -48,6 +48,8 @@ module Patchwork
       @health_path = health_path.to_s
       @max_body_bytes = Integer(max_body_bytes)
       @replay_guard = replay_guard
+      @labels = Array(labels).map(&:to_s)
+      raise ArgumentError, "labels must name a signature version" if (@labels & Signature::LABELS).empty?
     end
 
     def call(env)
@@ -132,7 +134,8 @@ module Patchwork
         method: method,
         path: request.path,
         query: request.query_string,
-        body: body
+        body: body,
+        labels: @labels
       )
       body
     end

data/lib/patchwork/signature.rb

@@ -69,8 +69,16 @@ module Patchwork
     # Accepts either label. During the migration Patchwork sends both, so a
     # reader that understands v2 must still accept v1 from a platform that has
     # not started sending it.
-    def self.verify(secrets:, header:, method:, path:, body:, query: nil, skew: SKEW, now: Time.now.to_i)
+    # `labels:` narrows what counts. The default accepts either, which is what
+    # the migration needs. Pass [V2] to refuse a signature that does not cover
+    # the query — stronger, but it fails against a platform still sending v1
+    # alone.
+    def self.verify(secrets:, header:, method:, path:, body:, query: nil, labels: LABELS,
+                    skew: SKEW, now: Time.now.to_i)
       secrets = usable!(secrets)
+      accepted = Array(labels).map(&:to_s) & LABELS
+      raise ArgumentError, "no known label to verify against" if accepted.empty?
+
       parsed = parse(header)
       return :bad if parsed.nil?
       return :stale unless fresh?(parsed, skew: skew, now: now)
@@ -78,7 +86,7 @@ module Patchwork
       # The body is hashed once however many candidates the header carries.
       body_digest = digest(body)
 
-      matched = LABELS.any? do |label|
+      matched = accepted.any? do |label|
         candidates = parsed.signatures.fetch(label, []).select { |value| HEX_SHA256.match?(value) }
         next false if candidates.empty?
 
@@ -90,9 +98,10 @@ module Patchwork
       matched ? :ok : :bad
     end
 
-    def self.verify!(secrets:, header:, method:, path:, body:, query: nil, skew: SKEW, now: Time.now.to_i)
+    def self.verify!(secrets:, header:, method:, path:, body:, query: nil, labels: LABELS,
+                     skew: SKEW, now: Time.now.to_i)
       case verify(secrets: secrets, header: header, method: method, path: path, body: body,
-                  query: query, skew: skew, now: now)
+                  query: query, labels: labels, skew: skew, now: now)
       when :stale then raise StaleSignature, "signature timestamp outside the #{skew}s window"
       when :bad then raise InvalidSignature, "signature did not match"
       else true

data/lib/patchwork/version.rb

@@ -1,3 +1,3 @@
 module Patchwork
-  VERSION = "0.1.6".freeze
+  VERSION = "0.1.7".freeze
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: patchwork-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.1.7
 platform: ruby
 authors:
 - Chromablue Labs