pedicel 0.0.5 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 67d155d5766564d4ca2580589ca57cacb94415eb7b7b3bfa9eefe01d6b30e270
-  data.tar.gz: a384e5e0b28d9aaa8d51fbe80dfe532efd4adfaa27ce44995306385ae0b7363f
+  metadata.gz: 3217e14dfecc55bab0f78ee4590da4b12d560d829720ec44f78469a5b78180df
+  data.tar.gz: f1ac8712d339aa2767187034376cb119b740b3f0b0535612be9cd6f40cce85a9
 SHA512:
-  metadata.gz: fda0a0d5b14ddf620e42523352b5ced7c6725d03b1a6d6af12677220e42ca979188fd3049602bc0946d2f456572f8e8c92681a42b8a28cd353834e397f06192f
-  data.tar.gz: 40b85a602bd41992fb8ddf8e147dac5668422b9148319ff4d8885eb7a825498a0ef638a73655453a08079f2d66426be3b13333cfa7721c0bd1e8bd3241b5bbf8
+  metadata.gz: 74e8d791583b565e80d44a568f58596f1abc6cdea864745830140dae532b42fe48047a0a7d03422acbc54aba74145e1fd83079fc0d9a01e22b4832bc8157f8f9
+  data.tar.gz: 571f62bc7861c87e6299bc35b6497b0273cec76a9dc7152e0c31b7a3ce96530f0120afcbfe9385af95caa9b89d4f7562d350e27917f5af0dc414778f30e94279

data/lib/pedicel/base.rb

@@ -196,30 +196,21 @@ module Pedicel
     end
 
     def self.verify_x509_chain(root:, intermediate:, leaf:)
-      store = OpenSSL::X509::Store.new.add_cert(root)
+      # Specifically, ensure that the signature was created using the private
+      # key corresponding to the leaf certificate, that the leaf certificate is
+      # signed by the intermediate CA, and that the intermediate CA is signed by
+      # the Apple Root CA - G3.
 
-      unless store.verify(root)
-        raise SignatureError, "invalid chain due to root: #{store.error_string}"
+      unless root.verify(root.public_key)
+        raise SignatureError, 'invalid chain due to root'
       end
 
-      unless store.verify(intermediate)
-        raise SignatureError, "invalid chain due to intermediate: #{store.error_string}"
+      unless intermediate.verify(root.public_key)
+        raise SignatureError, 'invalid chain due to intermediate'
       end
 
-      begin
-        store.add_cert(intermediate)
-      rescue OpenSSL::X509::StoreError
-        raise SignatureError, "invalid chain due to intermediate"
-      end
-
-      begin
-        store.add_cert(leaf)
-      rescue OpenSSL::X509::StoreError
-        raise SignatureError, "invalid chain due to leaf"
-      end
-
-      unless store.verify(leaf)
-        raise SignatureError, "invalid chain due to leaf: #{store.error_string}"
+      unless leaf.verify(intermediate.public_key)
+        raise SignatureError, 'invalid chain due to leaf'
       end
 
       true

data/lib/pedicel/ec.rb

@@ -3,6 +3,8 @@ require 'pedicel/base'
 module Pedicel
   class EC < Base
     def ephemeral_public_key
+      @token[:header].transform_keys!(&:to_sym)
+
       Base64.decode64(@token[:header][:ephemeralPublicKey])
     end
 

data/lib/pedicel/validator.rb

@@ -1,4 +1,6 @@
-require 'dry-validation'
+require 'dry/validation'
+require 'dry/schema'
+require 'dry/logic'
 require 'base64'
 require 'openssl'
 
@@ -8,140 +10,275 @@ module Pedicel
   # https://developer.apple.com/library/content/documentation/PassKit/Reference/PaymentTokenJSON/PaymentTokenJSON.html
   # This purposefully only does syntactic validation (as opposed to semantic).
   module Validator
+    CUSTOM_ERRORS = {
+      is_base64:          'must be Base64',
+      is_hex:             'must be hex',
+      is_pan:             'must be a pan',
+      is_yymmdd:          'must be formatted YYMMDD',
+      is_ec_public_key:   'must be an EC public key',
+      is_pkcs7_signature: 'must be a PKCS7 Signature',
+      is_eci:             'must be an ECI',
+      is_hex_sha256:      'must be a hex-encoded SHA-256',
+      is_base64_sha256:   'must be a Base64-encoded SHA-256',
+      is_iso4217_numeric: 'must be an ISO 4217 numeric code',
+    }.freeze
+
+    Dry::Validation.register_macro(:is_hex) do
+      if key?
+        unless /\A[a-f0-9]*\z/i.match?(value)
+          key.failure(CUSTOM_ERRORS[:is_hex])
+        end
+      end
+    end
 
-    module Predicates
-      include Dry::Logic::Predicates
-
-      CUSTOM_PREDICATE_ERRORS = {
-        base64?:          'must be Base64',
-        hex?:             'must be hex',
-        pan?:             'must be a pan',
-        yymmdd?:          'must be formatted YYMMDD',
-        ec_public_key?:   'must be an EC public key',
-        pkcs7_signature?: 'must be a PKCS7 Signature',
-        eci?:             'must be an ECI',
-        hex_sha256?:      'must be a hex-encoded SHA-256',
-        base64_sha256?:   'must be a Base64-encoded SHA-256',
-        iso4217_numeric?: 'must be an ISO 4217 numeric code',
-      }.freeze
+    Dry::Validation.register_macro(:is_hex_sha256) do
+      if key?
+        unless :is_hex && value.length == 64
+          key.failure(CUSTOM_ERRORS[:is_hex_sha256])
+        end
+      end
+    end
 
-      # Support Ruby 2.3, but use the faster #match? when available.
-      match_b = String.new.respond_to?(:match?) ? ->(s, re) { s.match?(re) } : ->(s, re) { !!(s =~ re) }
+    Dry::Validation.register_macro(:is_base64) do
+      if key?
+        unless /\A[=A-Za-z0-9+\/]*\z/.match?(value) &&
+               value.length.remainder(4).zero? &&
+               !/=[^$=]/.match?(value) &&
+               !/===/.match?(value)
+          key.failure(CUSTOM_ERRORS[:is_base64])
+        end
+      end
+    end
 
-      predicate(:base64?) do |x|
-        str?(x) &&
-          match_b.(x, /\A[=A-Za-z0-9+\/]*\z/) && # allowable chars
-          x.length.remainder(4).zero? && # multiple of 4
-          !match_b.(x, /=[^$=]/) && # may only end with ='s
-          !match_b.(x, /===/) # at most 2 ='s
+    Dry::Validation.register_macro(:is_base64_sha256) do
+      if key?
+        unless :is_base64 && Base64.decode64(value).length == 32
+          key.failure(CUSTOM_ERRORS[:is_base64_sha256])
+        end
       end
+    end
 
-      # We should figure out how strict we should be. Hopefully we can discard
-      # the above Base64? predicate and use the following simpler one:
-      #predicate(:strict_base64?) { |x| !!Base64.strict_decode64(x) rescue false }
+    Dry::Validation.register_macro(:is_ec_public_key) do
+      if key?
+        ec = lambda {OpenSSL::PKey::EC.new(Base64.decode64(value)).check_key rescue false}.()
+        unless :is_base64 && ec
+          key.failure(CUSTOM_ERRORS[:is_ec_public_key])
+        end
+      end
+    end
 
-      predicate(:base64_sha256?) { |x| base64?(x) && Base64.decode64(x).length == 32 }
+    Dry::Validation.register_macro(:is_pkcs7_signature) do
+      if key?
+        pkcs7 = lambda {!!OpenSSL::PKCS7.new(Base64.decode64(value)) rescue false}.()
+        unless :is_base64 && pkcs7
+          key.failure(CUSTOM_ERRORS[:is_pkcs7_signature])
+        end
+      end
+    end
 
-      predicate(:hex?) { |x| str?(x) && match_b.(x, /\A[a-f0-9]*\z/i) }
+    Dry::Validation.register_macro(:is_eci) do
+      if key?
+        unless  /\A\d{1,2}\z/.match?(value)
+          key.failure(CUSTOM_ERRORS[:is_eci])
+        end
+      end
+    end
 
-      predicate(:hex_sha256?) { |x| hex?(x) && x.length == 64 }
+    Dry::Validation.register_macro(:is_pan) do
+      if key?
+        unless  /\A[1-9][0-9]{11,18}\z/.match?(value)
+          key.failure(CUSTOM_ERRORS[:is_pan])
+        end
+      end
+    end
 
-      predicate(:pan?) { |x| str?(x) && match_b.(x, /\A[1-9][0-9]{11,18}\z/) }
+    Dry::Validation.register_macro(:is_yymmdd) do
+      if key?
+        unless  /\A\d{6}\z/.match?(value)
+          key.failure(CUSTOM_ERRORS[:is_yymmdd])
+        end
+      end
+    end
 
-      predicate(:yymmdd?) { |x| str?(x) && match_b.(x, /\A\d{6}\z/) }
+    Dry::Validation.register_macro(:is_iso4217_numeric) do
+      if key?
+        unless  /\A[0-9]{3}\z/.match?(value)
+          key.failure(CUSTOM_ERRORS[:is_iso4217_numeric])
+        end
+      end
+    end
 
-      predicate(:eci?) { |x| str?(x) && match_b.(x, /\A\d{2}\z/) }
+    class TokenHeaderContract < Dry::Validation::Contract
+      json do
+        optional(:applicationData).filled(:str?)
 
-      predicate(:ec_public_key?) { |x| base64?(x) && OpenSSL::PKey::EC.new(Base64.decode64(x)).check_key rescue false }
+        optional(:ephemeralPublicKey).filled(:str?)
 
-      predicate(:pkcs7_signature?) { |x| base64?(x) && !!OpenSSL::PKCS7.new(Base64.decode64(x)) rescue false }
+        optional(:wrappedKey).filled(:str?)
 
-      predicate(:iso4217_numeric?) { |x| match_b.(x, /\A[0-9]{3}\z/) }
-    end
 
-    class BaseSchema < Dry::Validation::Schema::JSON
-      predicates(Predicates)
-      def self.messages
-        super.merge(en: { errors: Predicates::CUSTOM_PREDICATE_ERRORS })
+        required(:publicKeyHash).filled(:str?)
+        required(:transactionId).filled(:str?)
+      end
+      rule(:applicationData).validate(:is_hex, :is_hex_sha256)
+
+      rule(:ephemeralPublicKey).validate(:is_base64, :is_ec_public_key)
+      rule(:publicKeyHash).validate(:is_base64, :is_base64_sha256)
+      rule(:wrappedKey).validate(:is_base64)
+      rule(:transactionId).validate(:is_hex)
+      rule(:ephemeralPublicKey, :wrappedKey) do
+        key.failure('ephemeralPublicKey xor wrappedKey') unless values[:ephemeralPublicKey].nil? ^ values[:wrappedKey].nil?
       end
     end
 
-    TokenHeaderSchema = Dry::Validation.Schema(BaseSchema) do
-      optional(:applicationData).filled(:str?, :hex?, :hex_sha256?)
+    TokenHeaderSchema = TokenHeaderContract.new
 
-      optional(:ephemeralPublicKey).filled(:str?, :base64?, :ec_public_key?)
+    class TokenContract < Dry::Validation::Contract
+      json do
+        required(:data).filled(:str?)
 
-      optional(:wrappedKey).filled(:str?, :base64?)
+        required(:header).hash(TokenHeaderContract.schema)
 
-      rule('ephemeralPublicKey xor wrappedKey': [:ephemeralPublicKey, :wrappedKey]) do |e, w|
-        e.filled? ^ w.filled?
-      end
+        required(:signature).filled(:str?)
 
-      required(:publicKeyHash).filled(:str?, :base64?, :base64_sha256?)
+        required(:version).filled(:str?, included_in?: %w[EC_v1 RSA_v1])
 
-      required(:transactionId).filled(:str?, :hex?)
+      end
+      rule(:data).validate(:is_base64)
+      rule(:signature).validate(:is_base64, :is_pkcs7_signature)
     end
 
-    TokenSchema = Dry::Validation.Schema(BaseSchema) do
-      required(:data).filled(:str?, :base64?)
+    TokenSchema = TokenContract.new
 
-      required(:header).schema(TokenHeaderSchema)
+    class TokenDataPaymentDataContract < Dry::Validation::Contract
+      json do
+        optional(:onlinePaymentCryptogram).filled(:str?)
+        optional(:eciIndicator).filled(:str?)
 
-      required(:signature).filled(:str?, :base64?, :pkcs7_signature?)
+        optional(:emvData).filled(:str?)
+        optional(:encryptedPINData).filled(:str?)
+      end
+      rule(:onlinePaymentCryptogram).validate(:is_base64)
+      rule(:eciIndicator).validate(:is_eci)
 
-      required(:version).filled(:str?, included_in?: %w[EC_v1 RSA_v1])
+      rule(:emvData).validate(:is_base64)
+      rule(:encryptedPINData).validate(:is_hex)
     end
 
-    TokenDataPaymentDataSchema = Dry::Validation.Schema(BaseSchema) do
-      optional(:onlinePaymentCryptogram).filled(:str?, :base64?)
-      optional(:eciIndicator).filled(:str?, :eci?)
+    TokenDataPaymentDataSchema = TokenDataPaymentDataContract.new
 
-      optional(:emvData).filled(:str?, :base64?)
-      optional(:encryptedPINData).filled(:str?, :hex?)
-    end
+    class TokenDataContract < Dry::Validation::Contract
+      json do
+        required(:applicationPrimaryAccountNumber).filled(:str?)
 
-    TokenDataSchema = Dry::Validation.Schema(BaseSchema) do
-      required(:applicationPrimaryAccountNumber).filled(:str?, :pan?)
+        required(:applicationExpirationDate).filled(:str?)
 
-      required(:applicationExpirationDate).filled(:str?, :yymmdd?)
+        required(:currencyCode).filled(:str?)
 
-      required(:currencyCode).filled(:str?, :iso4217_numeric?)
+        required(:transactionAmount).filled(:int?)
 
-      required(:transactionAmount).filled(:int?)
+        optional(:cardholderName).filled(:str?)
 
-      optional(:cardholderName).filled(:str?)
+        required(:deviceManufacturerIdentifier).filled(:str?)
 
-      required(:deviceManufacturerIdentifier).filled(:str?, :hex?)
+        required(:paymentDataType).filled(:str?, included_in?: %w[3DSecure EMV])
 
-      required(:paymentDataType).filled(:str?, included_in?: %w[3DSecure EMV])
+        required(:paymentData).hash(TokenDataPaymentDataContract.schema)
+      end
+      rule(:applicationPrimaryAccountNumber).validate(:is_pan)
 
-      required(:paymentData).schema(TokenDataPaymentDataSchema)
+      rule(:applicationExpirationDate).validate(:is_yymmdd)
 
-      rule('when paymentDataType is 3DSecure, onlinePaymentCryptogram': [:paymentDataType, [:paymentData, :onlinePaymentCryptogram]]) do |type, cryptogram|
-        type.eql?('3DSecure') > cryptogram.filled?
-      end
-      rule('when paymentDataType is 3DSecure, emvData': [:paymentDataType, [:paymentData, :emvData]]) do |type, emv|
-        type.eql?('3DSecure') > emv.none?
+      rule(:currencyCode).validate(:is_iso4217_numeric)
+
+      rule(:deviceManufacturerIdentifier).validate(:is_hex)
+
+      rule(:paymentDataType, paymentData: :onlinePaymentCryptogram) do
+        # rule('when paymentDataType is 3DSecure, onlinePaymentCryptogram': [:paymentDataType, [:paymentData, :onlinePaymentCryptogram]]) do |type, cryptogram|
+        #   type can only be 3DSecure if cryptogram is filled
+        #   type.eql?('3DSecure') > cryptogram.filled?
+        # end
+        if values[:paymentDataType].eql?('3DSecure')
+          key.failure('when paymentDataType is 3DSecure, onlinePaymentCryptogram must be filled') unless
+            values[:paymentData] && values[:paymentData][:onlinePaymentCryptogram]
+        end
       end
-      rule('when paymentDataType is 3DSecure, encryptedPINData': [:paymentDataType, [:paymentData, :encryptedPINData]]) do |type, pin|
-        type.eql?('3DSecure') > pin.none?
+
+      rule(:paymentDataType, paymentData: :emvData) do
+        # type can only be 3DSecure if emvData is empty
+        # old rule:
+        # rule('when paymentDataType is 3DSecure, emvData': [:paymentDataType, [:paymentData, :emvData]]) do |type, emv|
+        #   type.eql?('3DSecure') > emv.none?
+        # end
+        if values[:paymentDataType].eql?('3DSecure')
+          key.failure('when paymentDataType is 3DSecure, emvData cannot be defined') unless
+            values[:paymentData] && values[:paymentData][:emvData].nil?
+        end
       end
 
-      rule('when paymentDataType is EMV, onlinePaymentCryptogram': [:paymentDataType, [:paymentData, :onlinePaymentCryptogram]]) do |type, cryptogram|
-        type.eql?('EMV') > cryptogram.none?
+      rule(:paymentDataType, paymentData: :encryptedPINData) do
+        # type can only be 3DSecure if emvData is empty
+        # old rule:
+        # rule('when paymentDataType is 3DSecure, encryptedPINData': [:paymentDataType, [:paymentData, :encryptedPINData]]) do |type, pin|
+        #   type.eql?('3DSecure') > pin.none?
+        # end
+        if values[:paymentDataType].eql?('3DSecure')
+          key.failure('when paymentDataType is 3DSecure, encryptedPINData cannot be defined') unless
+            values[:paymentData] && values[:paymentData][:encryptedPINData].nil?
+        end
       end
-      rule('when paymentDataType is EMV, eciIndicator': [:paymentDataType, [:paymentData, :eciIndicator]]) do |type, eci|
-        type.eql?('EMV') > eci.none?
+
+      rule(:paymentDataType, paymentData: :onlinePaymentCryptogram) do
+        # type can only be 3DSecure if emvData is empty
+        # old rule:
+        # rule('when paymentDataType is EMV, onlinePaymentCryptogram': [:paymentDataType, [:paymentData, :onlinePaymentCryptogram]]) do |type, cryptogram|
+        #   type.eql?('EMV') > cryptogram.none?
+        # end
+        if values[:paymentDataType].eql?('EMV')
+          key.failure('when paymentDataType is EMV, onlinePaymentCryptogram cannot be defined') unless
+            values[:paymentData] && values[:paymentData][:onlinePaymentCryptogram].nil?
+        end
       end
-      rule('when paymentDataType is EMV, emvData': [:paymentDataType, [:paymentData, :emvData]]) do |type, emv|
-        type.eql?('EMV') > emv.filled?
+
+      rule(:paymentDataType, paymentData: :eciIndicator) do
+        # type can only be 3DSecure if emvData is empty
+        # old rule:
+        # rule('when paymentDataType is EMV, eciIndicator': [:paymentDataType, [:paymentData, :eciIndicator]]) do |type, eci|
+        #   type.eql?('EMV') > eci.none?
+        # end
+        if values[:paymentDataType].eql?('EMV')
+          key.failure('when paymentDataType is EMV, eciIndicator cannot be defined') unless
+            values[:paymentData] && values[:paymentData][:eciIndicator].nil?
+        end
       end
-      rule('when paymentDataType is EMV, encryptedPINData': [:paymentDataType, [:paymentData, :encryptedPINData]]) do |type, pin|
-        type.eql?('EMV') > pin.filled?
+
+      rule(:paymentDataType, paymentData: :emvData) do
+        # type can only be 3DSecure if emvData is empty
+        # old rule:
+        # rule('when paymentDataType is EMV, emvData': [:paymentDataType, [:paymentData, :emvData]]) do |type, emv|
+        #   type.eql?('EMV') > emv.filled?
+        # end
+        if values[:paymentDataType].eql?('EMV')
+          key.failure('when paymentDataType is EMV, emvData must be filled') unless
+            values[:paymentData] && values[:paymentData][:emvData]
+        end
       end
 
+      rule(:paymentDataType, paymentData: :encryptedPINData) do
+        # type can only be 3DSecure if emvData is empty
+        # old rule:
+        # rule('when paymentDataType is EMV, encryptedPINData': [:paymentDataType, [:paymentData, :encryptedPINData]]) do |type, pin|
+        #   type.eql?('EMV') > pin.filled?
+        # end
+        if values[:paymentDataType].eql?('EMV')
+          key.failure('when paymentDataType is EMV, encryptedPINData must be filled') unless
+            values[:paymentData] && values[:paymentData][:encryptedPINData]
+        end
+      end
     end
 
+    TokenDataSchema = TokenDataContract.new
+
     class Error < StandardError; end
 
     module InstanceMethods
@@ -150,11 +287,11 @@ module Pedicel
       def validate
         @validation ||= @schema.call(@input)
 
-        @output = @validation.output
+        @output = @validation.to_h
 
         return true if @validation.success?
 
-        raise Error, "validation error: #{@validation.errors.keys.join(', ')}"
+        raise Error, "validation error: #{@validation.errors.to_h.keys.join(', ')}"
       end
 
       def valid?
@@ -166,7 +303,17 @@ module Pedicel
       def errors
         valid? unless @validation
 
-        @validation.errors
+        @validation.errors.to_h.sort
+      end
+
+      def errors_formatted(node = [errors])
+        node.pop.flat_map do |key, value|
+          if value.is_a?(Array)
+            value.map { |error| "#{(node + [key]).join('.')} #{error}" }
+          else
+            errors_formatted(node + [key, value])
+          end
+        end
       end
     end
 

data/lib/pedicel/version.rb

@@ -1,3 +1,3 @@
 module Pedicel
-  VERSION = '0.0.5'.freeze
+  VERSION = '1.0.0'.freeze
 end

metadata

@@ -1,31 +1,45 @@
 --- !ruby/object:Gem::Specification
 name: pedicel
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 1.0.0
 platform: ruby
 authors:
 - Clearhaus
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-06-28 00:00:00.000000000 Z
+date: 2022-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: dry-validation
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: '1.8'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: '1.8'
+- !ruby/object:Gem::Dependency
+  name: dry-schema
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.11.1
+        version: '1.9'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.11.1
+        version: '1.9'
 - !ruby/object:Gem::Dependency
-  name: aes256gcm_decrypt
+  name: dry-logic
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
@@ -80,6 +94,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.0'
+- !ruby/object:Gem::Dependency
+  name: pry
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.0'
 description: 
 email: hello@clearhaus.com
 executables: []
@@ -104,15 +132,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - "~>"
     - !ruby/object:Gem::Version
-      version: '2.3'
+      version: 2.7.4
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.4
+rubygems_version: 3.1.6
 signing_key: 
 specification_version: 4
 summary: Decryption of Apple Pay payment tokens