reattract 0.4.1 → 0.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d788029cfabbe3aa6a894388ea0dac86ccba0891deb9b5eecd8366d3e931c412
-  data.tar.gz: b83d5843485a28165e9e1c5d5cb1eb3d97018861ab8dd8463854229d6962060e
+  metadata.gz: bf5cfc801f5c995cff77779a49585f2777dec7034be5cb25d42cc972fa42ac9e
+  data.tar.gz: e5aa74ecdeeda05a7d2c98b0f6d83497efcb6b37f16f52736ea18db4ce849dcf
 SHA512:
-  metadata.gz: f4f36d5e427823a146c68f43b9f5b7c0b356f142ae4b9ce08c293138a0acc6654d1c7cc92805773e075426e845850d958ca971608a6c6c1cf2bfb96b02d01637
-  data.tar.gz: 5298603faf71b6c7dd81fe9d347dfc06cedcdf56d7c4108e8e3dd17e0eda69b9cc5faced3ebceb0df255c9bbce885d1534f960c8ca19edb64a53521a030ff724
+  metadata.gz: aec4a441a83025aad75c7b94d12b2e56dc75b8b552fb65661eb4be7d8b0591524269f37440110626f7e40b64c083e64c25e6f9ca8218bef187a51ea8342ac046
+  data.tar.gz: 326847fc5d71033e425802520d9a81e23bfa5dcf154af97b9bddc42bcd86cc710dd8b00225808500e64286c6adee2bbdc204e408a2ca61fa9f706efeb31b3a45

data/.rubocop.yml

@@ -10,6 +10,9 @@ AllCops:
     - 'Guardfile'
     - 'reattract.gemspec'
     - 'bin/**/*'
+    - 'spec/reattract/webhoook_spec.rb' # rebranded
+    - 'lib/reattract/webhook.rb' # rebranded
+    - 'lib/reattract/active_support_include.rb' # rebranded
 
 Layout/LineLength:
   Max: 120

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    reattract (0.4.1)
+    reattract (0.4.3)
       jwt (~> 2.7.0)
 
 GEM

data/README.md

@@ -1,18 +1,16 @@
-# Reattract
+# Reattract Ruby SDK
 
-Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/reattract/api`. To experiment with that code, run `bin/console` for an interactive prompt.
-
-TODO: Delete this and the text above, and describe your gem
+Reattract's ruby API
 
 ## Installation
 
 Install the gem and add to the application's Gemfile by executing:
 
-    $ bundle add reattract_api
+    $ bundle add reattract
 
 If bundler is not being used to manage dependencies, install the gem by executing:
 
-    $ gem install reattract_api
+    $ gem install reattract
 
 ## Usage
 
@@ -26,7 +24,7 @@ To install this gem onto your local machine, run `bundle exec rake install`. To
 
 ## Contributing
 
-Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/reattract.
+Bug reports and pull requests are welcome on GitHub at https://github.com/reattract/sdk-platform.
 
 ## License
 

data/lib/reattract/active_support_include.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# Constant time string comparison, for fixed length strings.
+# Code borrowed from ActiveSupport
+# https://github.com/rails/rails/blob/75ac626c4e21129d8296d4206a1960563cc3d4aa/activesupport/lib/active_support/security_utils.rb#L33
+#
+# The values compared should be of fixed length, such as strings
+# that have already been processed by HMAC. Raises in case of length mismatch.
+module Reattract
+  if defined?(OpenSSL.fixed_length_secure_compare)
+    def fixed_length_secure_compare(a, b)
+      OpenSSL.fixed_length_secure_compare(a, b)
+    end
+  else
+    def fixed_length_secure_compare(a, b)
+      raise ArgumentError, "string length mismatch." unless a.bytesize == b.bytesize
+
+      l = a.unpack "C#{a.bytesize}"
+
+      res = 0
+      b.each_byte { |byte| res |= byte ^ l.shift }
+      res == 0
+    end
+  end
+  module_function :fixed_length_secure_compare
+
+  # Secure string comparison for strings of variable length.
+  #
+  # While a timing attack would not be able to discern the content of
+  # a secret compared via secure_compare, it is possible to determine
+  # the secret length. This should be considered when using secure_compare
+  # to compare weak, short secrets to user input.
+  def secure_compare(a, b)
+    a.length == b.length && fixed_length_secure_compare(a, b)
+  end
+  module_function :secure_compare
+end

data/lib/reattract/reattract_error.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Reattract
+  # Standard error message
+  class ReattractError < StandardError
+    attr_reader :message
+
+    def initialize(message = nil)
+      @message = message
+      super
+    end
+  end
+
+  class WebhookVerificationError < ReattractError
+  end
+
+  class WebhookSigningError < ReattractError
+  end
+end

data/lib/reattract/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Reattract
-  VERSION = '0.4.1'
+  VERSION = '0.4.3'
 end

data/lib/reattract/webhook.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Reattract
+  # Reattract's webhook verification class
+  class Webhook
+
+    def self.new_using_raw_bytes(secret)
+      self.new(secret.pack("C*").force_encoding("UTF-8"))
+    end
+
+    def initialize(secret)
+      if secret.start_with?(SECRET_PREFIX)
+        secret = secret[SECRET_PREFIX.length..-1]
+      end
+
+      @secret = Base64.decode64(secret)
+    end
+
+    def verify(payload, headers)
+      msgId = headers["svix-id"]
+      msgSignature = headers["svix-signature"]
+      msgTimestamp = headers["svix-timestamp"]
+      if !msgSignature || !msgId || !msgTimestamp
+        msgId = headers["webhook-id"]
+        msgSignature = headers["webhook-signature"]
+        msgTimestamp = headers["webhook-timestamp"]
+        if !msgSignature || !msgId || !msgTimestamp
+          raise WebhookVerificationError, "Missing required headers"
+        end
+      end
+
+      verify_timestamp(msgTimestamp)
+
+      _, signature = sign(msgId, msgTimestamp, payload).split(",", 2)
+
+      passedSignatures = msgSignature.split(" ")
+      passedSignatures.each do |versionedSignature|
+        version, expectedSignature = versionedSignature.split(",", 2)
+        if version != "v1"
+          next
+        end
+        if ::Reattract::secure_compare(signature, expectedSignature)
+          return JSON.parse(payload, symbolize_names: true)
+        end
+      end
+      raise WebhookVerificationError, "No matching signature found"
+    end
+
+    def sign(msgId, timestamp, payload)
+      begin
+        now = Integer(timestamp)
+      rescue
+        raise WebhookSigningError, "Invalid timestamp"
+      end
+      toSign = "#{msgId}.#{timestamp}.#{payload}"
+      signature = Base64.encode64(OpenSSL::HMAC.digest(OpenSSL::Digest.new("sha256"), @secret, toSign)).strip
+      return "v1,#{signature}"
+    end
+
+    private
+    SECRET_PREFIX = "whsec_"
+    TOLERANCE = 5 * 60
+
+    def verify_timestamp(timestampHeader)
+      begin
+        now = Integer(Time.now)
+        timestamp = Integer(timestampHeader)
+      rescue
+        raise WebhookVerificationError, "Invalid Signature Headers"
+      end
+
+      if timestamp < (now - TOLERANCE)
+        raise WebhookVerificationError, "Message timestamp too old"
+      end
+      if timestamp > (now + TOLERANCE)
+        raise WebhookVerificationError, "Message timestamp too new"
+      end
+    end
+  end
+end

data/lib/reattract.rb

@@ -2,11 +2,16 @@
 
 require 'forwardable'
 
+require_relative 'reattract/active_support_include'
+require_relative 'reattract/reattract_error'
 require_relative 'reattract/version'
 require_relative 'reattract/configuration'
 require_relative 'reattract/jwt_generator'
 require_relative 'reattract/connection'
 require_relative 'reattract/request'
+require_relative 'reattract/webhook'
+
+# resources
 require_relative 'reattract/resources/app_event'
 require_relative 'reattract/resources/campaign'
 require_relative 'reattract/resources/customer'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: reattract
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.3
 platform: ruby
 authors:
 - Justin Burris
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-04-15 00:00:00.000000000 Z
+date: 2023-04-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -41,9 +41,11 @@ files:
 - README.md
 - Rakefile
 - lib/reattract.rb
+- lib/reattract/active_support_include.rb
 - lib/reattract/configuration.rb
 - lib/reattract/connection.rb
 - lib/reattract/jwt_generator.rb
+- lib/reattract/reattract_error.rb
 - lib/reattract/request.rb
 - lib/reattract/resources/app_event.rb
 - lib/reattract/resources/campaign.rb
@@ -52,6 +54,7 @@ files:
 - lib/reattract/resources/invite_conversion.rb
 - lib/reattract/resources/invite_session.rb
 - lib/reattract/version.rb
+- lib/reattract/webhook.rb
 - sig/reattract/api.rbs
 homepage: https://docs.reattract.io
 licenses: