rack-simple_auth 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 --- 
 SHA1: 
-  metadata.gz: 391baa3938d8f51b5501b0064c25100dfaf8941c
-  data.tar.gz: f785d92ba75ad9b0b968202460b384da9c36f489
+  metadata.gz: 4d1332c61244522343025971bc83670b33abec89
+  data.tar.gz: 5dd72b9648fd2a736b6c7c578e1a012bec201650
 SHA512: 
-  metadata.gz: ec4dbc9f92f9625b28c355d0745f4d6648c7d06f79b98a2078133124a6648de7e7b926f21c75604385b2e5f57e2e99151d628f16aafb7d5fba715e4bb6df6a5b
-  data.tar.gz: 217410019be2f9157251c14f7eb35ca7af23e652b5394f09cbcd9d189f5ee5f594df56eea976a32dc36bba5ce842cb35626c4151a33610ba6bac63e6f77099eb
+  metadata.gz: 29fdfd05f22c0fa6a9987c9a02c486ce7ff622d2c149398ae3483b9fa45cf59b6ee62a72ca7a4343985494184727894ae21b8dd1a9e32bb3aa919d69a54c199a
+  data.tar.gz: 490235fb4734189062125bbd42c868ceebec5355aeba21d0837f27bd05d796a924992701afe28b660e894bd25149cb7721d814939ff9e336cf433072101f04d9

data/README.md

@@ -1,6 +1,8 @@
 # Rack::SimpleAuth
 
-Rack Middleware for HMAC Authentication
+Rack::SimpleAuth will contain different Authentication Class Middlewares
+
+Until now only HMAC is implemented...
 
 ## Installation
 
@@ -20,30 +22,62 @@ Or install it yourself as:
 
 [![Build Status](https://travis-ci.org/Benny1992/rack-simple_auth.png?branch=master)](https://travis-ci.org/Benny1992/rack-simple_auth)
 [![Coverage Status](https://coveralls.io/repos/Benny1992/rack-simple_auth/badge.png?branch=master)](https://coveralls.io/r/Benny1992/rack-simple_auth?branch=master)
-[![GitHub version](https://badge.fury.io/gh/benny1992%2Frack-simple_auth.png)](http://badge.fury.io/gh/benny1992%2Frack-simple_auth)
+[![Gem Version](https://badge.fury.io/rb/rack-simple_auth.png)](http://badge.fury.io/rb/rack-simple_auth)
+[![Dependency Status](https://gemnasium.com/Benny1992/rack-simple_auth.png)](https://gemnasium.com/Benny1992/rack-simple_auth)
 
 ## Usage
 
+### HMAC Authorization
+
 Uses Authorization HTTP Header, example:
-```Authorization: ContentHash:Signature```
+```Authorization: MessageHash:Signature```
 
-Signature is the "Public Key"
+- Signature is the "Public Key"
+- MessageHash is the HMAC encrypted Message
 
-ContentHash is the HMAC encrypted Message
+#### Basic Usage:
 
 ```ruby
+config = {
+  'GET' => 'path',
+  'POST' => 'params',
+  'DELETE' => 'path',
+  'PUT' => 'path',
+  'PATCH' => 'path'
+}
+
 map '/' do
-  use Rack::SimpleAuth::HMAC, 'signature', 'private_key'
+  use Rack::SimpleAuth::HMAC, 'signature', 'private_key', config
   run MyApplication
 end
 ```
 
-Private Key and Signature should be served by a file which is not checked into git version control.
+Note: Private Key and Signature should be served by a file which is not checked into git version control.
+
+#### Config Hash
+
+Via the config hash you are able to define the 'data' for each request method.<br />
+This data + HTTP Methodname is your Message what will be encrypted.<br />
+
+For example ```GET '/get/user?name=rack'```:
+```ruby
+config = { 'GET => 'path' }
+```
+
+The Message what will be HMAC encrypted is:
+```ruby
+message = { 'method' => 'GET', 'data' => '/get/user?name=rack' }.to_json
+```
+
 
 ## Contributing
 
-1. Fork it ( http://github.com/<my-github-username>/rack-simple_auth/fork )
+1. Fork it ( http://github.com/benny1992/rack-simple_auth/fork )
 2. Create your feature branch (`git checkout -b my-new-feature`)
 3. Commit your changes (`git commit -am 'Add some feature'`)
 4. Push to the branch (`git push origin my-new-feature`)
 5. Create new Pull Request
+
+
+
+

data/lib/rack/simple_auth/hmac.rb

@@ -7,10 +7,11 @@ module Rack
       # @param [Rack Application] app [next middleware or rack app which gets called]
       # @param [String] signature [Public Signature]
       # @param [String] secret [Secret used for Message Encryption]
-      def initialize(app, signature, secret)
+      def initialize(app, signature, secret, config)
         @app = app
         @signature = signature
         @secret = secret
+        @config = config
       end
 
       # call Method for Rack Middleware/Application
@@ -32,29 +33,48 @@ module Rack
         return false if request.env['HTTP_AUTHORIZATION'].nil?
 
         auth_array = request.env['HTTP_AUTHORIZATION'].split(':')
-        content_hash = auth_array[0]
+        message_hash = auth_array[0]
         signature = auth_array[1]
 
+        hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, message(request))
+        # puts request.request_method
+        # puts "Hash to Check: #{hash}"
+        # puts "Message Hash: #{message_hash}"
+
+        if signature == @signature && hash == message_hash
+          true
+        else
+          false
+        end
+      end
+
+      # Get Message for current Request
+      # @param [Rack::Request] request [current Request]
+      # @return [Hash] message [message which will be encrypted]
+      def message(request)
         case request.request_method
         when 'GET'
-          content = { 'method' => request.request_method, 'data' => request.path }.to_json
+          return { 'method' => request.request_method, 'data' => request_data(request, @config) }.to_json
         when 'POST'
-          content = { 'method' => request.request_method, 'data' => request.POST }.to_json
+          return { 'method' => request.request_method, 'data' => request_data(request, @config) }.to_json
         when 'DELETE'
-          content = { 'method' => request.request_method, 'data' => request.path }.to_json
+          return { 'method' => request.request_method, 'data' => request_data(request, @config) }.to_json
         when 'PUT'
-          content = { 'method' => request.request_method, 'data' => request.POST }.to_json
+          return { 'method' => request.request_method, 'data' => request_data(request, @config) }.to_json
+        when 'PATCH'
+          return { 'method' => request.request_method, 'data' => request_data(request, @config) }.to_json
         end
+      end
 
-        hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, content)
-        # puts content
-        # puts "Hash to Check: #{hash}"
-        # puts "Content Hash: #{content_hash}"
-
-        if signature == @signature && hash == content_hash
-          true
+      # Get Request Data specified by Config
+      # @param [Rack::Request] request [current Request]
+      # @param [Hash] config [Config Hash containing what type of info is data for each request]
+      # @return [String|Hash] data [Data for each request]
+      def request_data(request, config)
+        if config[request.request_method] == 'path' || config[request.request_method] == 'params'
+          request.send(config[request.request_method].to_sym)
         else
-          false
+          fail "Not a valid option #{config[request.request_method]} - Use either params or path"
         end
       end
     end

data/lib/rack/simple_auth/version.rb

@@ -2,6 +2,6 @@ module Rack
   # Module which Contains different Authorization / Authentication Classes (HMAC, ..)
   module SimpleAuth
     # Current Gem Version
-    VERSION = '0.0.1'
+    VERSION = '0.0.2'
   end
 end

data/test/config.ru

@@ -1,5 +1,13 @@
 require 'rack/lobster'
 require 'rack/simple_auth'
 
-use Rack::SimpleAuth::HMAC, 'test_signature', 'test_secret'
+config = {
+  'GET' => 'path',
+  'POST' => 'params',
+  'DELETE' => 'path',
+  'PUT' => 'path',
+  'PATCH' => 'path'
+}
+
+use Rack::SimpleAuth::HMAC, 'test_signature', 'test_secret', config
 run Rack::Lobster.new

data/test/config_fail.ru

@@ -0,0 +1,13 @@
+require 'rack/lobster'
+require 'rack/simple_auth'
+
+config = {
+  'GET' => 'pathasdf',
+  'POST' => 'paramas',
+  'DELETE' => 'path',
+  'PUT' => 'path',
+  'PATCH' => 'path'
+}
+
+use Rack::SimpleAuth::HMAC, 'test_signature', 'test_secret', config
+run Rack::Lobster.new

data/test/rack/simple_auth/hmac_fail_test.rb

@@ -0,0 +1,26 @@
+require 'test_helper.rb'
+
+# Test HMAC Authorization Method
+class HMACFailTest < MiniTest::Unit::TestCase
+  include Rack::Test::Methods
+
+  def setup
+  	@secret = 'test_secret'
+    @signature = 'test_signature'
+  end
+
+  def app
+    Rack::SimpleAuth.failapp
+  end
+
+  def test_fail
+  	uri = '/'
+    content = { 'method' => 'GET', 'data' => uri }.to_json
+    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, content)
+
+    assert_raises(RuntimeError) { get uri, {}, 'HTTP_AUTHORIZATION' => "#{hash}:#{@signature}" }
+  end
+
+  def teardown
+  end
+end

data/test/rack/simple_auth/hmac_test.rb

@@ -25,8 +25,8 @@ class HMACTest < MiniTest::Unit::TestCase
 
   def test_get_with_right_auth_header
     uri = '/'
-    content = { 'method' => 'GET', 'data' => uri }.to_json
-    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, content)
+    message = { 'method' => 'GET', 'data' => uri }.to_json
+    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, message)
 
     get uri, {}, 'HTTP_AUTHORIZATION' => "#{hash}:#{@signature}"
 
@@ -40,8 +40,8 @@ class HMACTest < MiniTest::Unit::TestCase
 
   def test_post_with_right_auth_header
     params = { 'name' => 'Bensn' }
-    content = { 'method' => 'POST', 'data' => params }.to_json
-    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, content)
+    message = { 'method' => 'POST', 'data' => params }.to_json
+    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, message)
 
     post '/', params, 'HTTP_AUTHORIZATION' => "#{hash}:#{@signature}"
 
@@ -55,8 +55,8 @@ class HMACTest < MiniTest::Unit::TestCase
 
   def test_delete_with_right_auth_header
     uri = '/'
-    content = { 'method' => 'DELETE', 'data' => uri }.to_json
-    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, content)
+    message = { 'method' => 'DELETE', 'data' => uri }.to_json
+    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, message)
 
     delete uri, {}, 'HTTP_AUTHORIZATION' => "#{hash}:#{@signature}"
 
@@ -64,16 +64,31 @@ class HMACTest < MiniTest::Unit::TestCase
   end
 
   def test_put_with_wrong_auth_header
-    put '/', { 'name' => 'Bensn' }, 'HTTP_AUTHORIZATION' => 'wrong_header'
+    put '/', {}, 'HTTP_AUTHORIZATION' => 'wrong_header'
     assert_equal(401, last_response.status, 'Wrong HTTP_AUTHORIZATION Header should receive 401')
   end
 
-  def test_post_with_right_auth_header
-    params = { 'name' => 'Bensn' }
-    content = { 'method' => 'PUT', 'data' => params }.to_json
-    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, content)
+  def test_put_with_right_auth_header
+    uri = '/'
+    message = { 'method' => 'PUT', 'data' => uri }.to_json
+    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, message)
+
+    put uri, {}, 'HTTP_AUTHORIZATION' => "#{hash}:#{@signature}"
+
+    assert_equal(200, last_response.status, 'Authorized Request should receive 200')
+  end
+
+  def test_patch_with_wrong_auth_header
+    patch '/', {}, 'HTTP_AUTHORIZATION' => 'wrong_header'
+    assert_equal(401, last_response.status, 'Wrong HTTP_AUTHORIZATION Header should receive 401')
+  end
+
+  def test_patch_with_right_auth_header
+    uri = '/'
+    message = { 'method' => 'PATCH', 'data' => uri }.to_json
+    hash = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('sha256'), @secret, message)
 
-    put '/', params, 'HTTP_AUTHORIZATION' => "#{hash}:#{@signature}"
+    patch uri, {}, 'HTTP_AUTHORIZATION' => "#{hash}:#{@signature}"
 
     assert_equal(200, last_response.status, 'Authorized Request should receive 200')
   end

data/test/test_helper.rb

@@ -32,9 +32,10 @@ module Rack
   # Module which Contains different Authorization / Authentication Classes (HMAC, ..)
   module SimpleAuth
     class << self
-      attr_accessor :testapp
+      attr_accessor :testapp, :failapp
     end
   end
 end
 
 Rack::SimpleAuth.testapp = Rack::Builder.parse_file("#{Rack::SimpleAuth.root}/test/config.ru").first
+Rack::SimpleAuth.failapp = Rack::Builder.parse_file("#{Rack::SimpleAuth.root}/test/config_fail.ru").first

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: rack-simple_auth
 version: !ruby/object:Gem::Version 
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors: 
 - Benny1992
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2014-03-09 00:00:00 Z
+date: 2014-03-10 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   requirement: &id001 !ruby/object:Gem::Requirement 
@@ -83,6 +83,8 @@ files:
 - tasks/test.rake
 - tasks/travis.rake
 - test/config.ru
+- test/config_fail.ru
+- test/rack/simple_auth/hmac_fail_test.rb
 - test/rack/simple_auth/hmac_test.rb
 - test/test_helper.rb
 homepage: http://www.bennyklotz.at
@@ -110,5 +112,7 @@ specification_version: 4
 summary: SimpleAuth HMAC authentication
 test_files: 
 - test/config.ru
+- test/config_fail.ru
+- test/rack/simple_auth/hmac_fail_test.rb
 - test/rack/simple_auth/hmac_test.rb
 - test/test_helper.rb