raims 0.1.1

data/lib/raims/webhook.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+module Raims
+  class Webhook
+    ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
+
+    def self.verify_signature(payload, headers, secret, tolerance: 300, now: nil)
+      raise ArgumentError, 'Webhook tolerance must be a non-negative integer.' unless tolerance.is_a?(Integer) && tolerance >= 0
+      current = now.nil? ? Time.now.to_i : now
+      raise ArgumentError, 'Webhook now must be a non-negative integer.' unless current.is_a?(Integer) && current >= 0
+      raise SignatureVerificationError, 'The webhook body must contain the original HTTP bytes.' unless payload.is_a?(String)
+      delivery = header(headers, 'webhook-id')
+      timestamp = header(headers, 'webhook-timestamp')
+      signatures = header(headers, 'webhook-signature')
+      unless delivery.match?(/\A[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}\z/)
+        raise SignatureVerificationError, 'The webhook delivery ID is invalid.'
+      end
+      unless timestamp.match?(/\A[0-9]{1,12}\z/) && (timestamp.to_i - current).abs <= tolerance
+        raise SignatureVerificationError, 'The webhook timestamp is invalid or outside tolerance.'
+      end
+      key = decode_secret(secret)
+      expected = OpenSSL::HMAC.digest('SHA256', key, "#{delivery}.#{timestamp}.".b + payload.b)
+      matched = false
+      signatures.split(',').each do |candidate|
+        match = candidate.strip.match(/\Av1=([0-9a-fA-F]{64})\z/i)
+        next unless match
+        valid = OpenSSL.fixed_length_secure_compare(expected, [match[1]].pack('H*'))
+        matched = true if valid
+      end
+      raise SignatureVerificationError, 'No webhook signature matches the configured secret.' unless matched
+      nil
+    end
+
+    def self.construct_event(payload, headers, secret, tolerance: 300, now: nil)
+      verify_signature(payload, headers, secret, tolerance: tolerance, now: now)
+      begin
+        event = Util.parse_json(payload)
+      rescue JSON::ParserError, ArgumentError
+        raise SignatureVerificationError, 'The authenticated webhook body is not valid JSON.', cause: nil
+      end
+      raise SignatureVerificationError, 'The authenticated webhook body must be a JSON object.' unless event.is_a?(Hash)
+      event
+    end
+
+    def self.header(headers, name)
+      raise SignatureVerificationError, 'Webhook headers must be a Hash.' unless headers.is_a?(Hash)
+      values = headers.select { |key, _value| key.is_a?(String) && key.downcase == name }.values
+      raise SignatureVerificationError, 'A webhook signing header is missing or duplicated.' unless values.length == 1
+      value = values.first
+      value = value.first if value.is_a?(Array) && value.length == 1
+      unless value.is_a?(String) && value.ascii_only? && !value.empty? && !value.match?(/[\x00-\x08\x0a-\x1f\x7f]/)
+        raise SignatureVerificationError, 'A webhook signing header is invalid.'
+      end
+      value
+    end
+    private_class_method :header
+
+    def self.decode_secret(secret)
+      unless secret.is_a?(String) && secret.ascii_only? && secret.match?(/\Awhsec_[0-9A-Za-z]{1,43}\z/)
+        raise SignatureVerificationError, 'The webhook signing secret is invalid.'
+      end
+      encoded = secret.delete_prefix('whsec_')
+      raise SignatureVerificationError, 'The webhook signing secret is invalid.' if encoded.length > 1 && encoded.start_with?('0')
+      number = encoded.each_char.reduce(0) { |value, char| value * 62 + ALPHABET.index(char) }
+      raise SignatureVerificationError, 'The webhook signing secret is invalid.' if number >= (1 << 256)
+      Array.new(32) { |index| (number >> (index * 8)) & 255 }.pack('C*')
+    end
+    private_class_method :decode_secret
+  end
+end

data/lib/raims.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require_relative 'raims/version'
+require_relative 'raims/util'
+require_relative 'raims/api_response'
+require_relative 'raims/errors'
+require_relative 'raims/request_options'
+require_relative 'raims/api_resource'
+require_relative 'raims/models'
+require_relative 'raims/enum_values'
+require_relative 'raims/schema'
+require_relative 'raims/api_list'
+require_relative 'raims/http_client'
+require_relative 'raims/services'
+require_relative 'raims/raims_client'
+require_relative 'raims/webhook'

metadata

@@ -0,0 +1,143 @@
+--- !ruby/object:Gem::Specification
+name: raims
+version: !ruby/object:Gem::Version
+  version: 0.1.1
+platform: ruby
+authors:
+- Raims
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: net-http
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '1'
+- !ruby/object:Gem::Dependency
+  name: json
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.19.9
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.19.9
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3'
+- !ruby/object:Gem::Dependency
+  name: bigdecimal
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5'
+- !ruby/object:Gem::Dependency
+  name: openssl
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '3.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5'
+description: Use the Raims public API from Ruby applications with resource services,
+  cursor pagination, structured errors, and webhook signature verification.
+email:
+- security@raims.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/raims.rb
+- lib/raims/api_list.rb
+- lib/raims/api_resource.rb
+- lib/raims/api_response.rb
+- lib/raims/enum_values.rb
+- lib/raims/errors.rb
+- lib/raims/generated/contract.json
+- lib/raims/http_client.rb
+- lib/raims/models.rb
+- lib/raims/raims_client.rb
+- lib/raims/request_options.rb
+- lib/raims/schema.rb
+- lib/raims/services.rb
+- lib/raims/util.rb
+- lib/raims/version.rb
+- lib/raims/webhook.rb
+homepage: https://docs.raims.com/en/integracoes/sdk-ruby
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/raimshq/raims-ruby
+  documentation_uri: https://docs.raims.com/en/integracoes/sdk-ruby
+  bug_tracker_uri: https://github.com/raimshq/raims-ruby/issues
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.3'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.20
+specification_version: 4
+summary: Official Ruby SDK for the Raims public API.
+test_files: []