rubygems-update 3.4.17 → 3.4.19

data/test/rubygems/test_webauthn_poller.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require_relative "helper"
+require "rubygems/gemcutter_utilities/webauthn_poller"
+require "rubygems/gemcutter_utilities"
+
+class WebauthnPollerTest < Gem::TestCase
+  def setup
+    super
+
+    @host = Gem.host
+    @webauthn_url = "#{@host}/api/v1/webauthn_verification/odow34b93t6aPCdY"
+    @fetcher = Gem::FakeFetcher.new
+    Gem::RemoteFetcher.fetcher = @fetcher
+    @credentials = {
+      email: "email@example.com",
+      password: "password",
+    }
+  end
+
+  def test_poll_thread_success
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"success\",\"code\":\"Uvh6T57tkWuUnWYo\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    thread = Gem::GemcutterUtilities::WebauthnPoller.poll_thread({}, @host, @webauthn_url, @credentials)
+    thread.join
+
+    assert_equal thread[:otp], "Uvh6T57tkWuUnWYo"
+  end
+
+  def test_poll_thread_webauthn_verification_error
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "HTTP Basic: Access denied.",
+      code: 401,
+      msg: "Unauthorized"
+    )
+
+    thread = Gem::GemcutterUtilities::WebauthnPoller.poll_thread({}, @host, @webauthn_url, @credentials)
+    thread.join
+
+    assert_equal thread[:error].message, "Security device verification failed: Unauthorized"
+  end
+
+  def test_poll_thread_timeout_error
+    raise_error = ->(*_args) { raise Timeout::Error, "execution expired" }
+    Timeout.stub(:timeout, raise_error) do
+      thread = Gem::GemcutterUtilities::WebauthnPoller.poll_thread({}, @host, @webauthn_url, @credentials)
+      thread.join
+      assert_equal thread[:error].message, "execution expired"
+    end
+  end
+
+  def test_poll_for_otp_success
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"success\",\"code\":\"Uvh6T57tkWuUnWYo\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    otp = Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+
+    assert_equal otp, "Uvh6T57tkWuUnWYo"
+  end
+
+  def test_poll_for_otp_pending_sleeps
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"pending\",\"message\":\"Security device authentication is still pending.\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    assert_raise Timeout::Error do
+      Timeout.timeout(0.1) do
+        Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+      end
+    end
+  end
+
+  def test_poll_for_otp_not_http_success
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "HTTP Basic: Access denied.",
+      code: 401,
+      msg: "Unauthorized"
+    )
+
+    error = assert_raise Gem::WebauthnVerificationError do
+      Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+    end
+
+    assert_equal error.message, "Security device verification failed: Unauthorized"
+  end
+
+  def test_poll_for_otp_invalid_format
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{}",
+      code: 200,
+      msg: "OK"
+    )
+
+    error = assert_raise Gem::WebauthnVerificationError do
+      Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+    end
+
+    assert_equal error.message, "Security device verification failed: Invalid response from server"
+  end
+
+  def test_poll_for_otp_invalid_status
+    @fetcher.data["#{@webauthn_url}/status.json"] = Gem::HTTPResponseFactory.create(
+      body: "{\"status\":\"expired\",\"message\":\"The token in the link you used has either expired or been used already.\"}",
+      code: 200,
+      msg: "OK"
+    )
+
+    error = assert_raise Gem::WebauthnVerificationError do
+      Gem::GemcutterUtilities::WebauthnPoller.new({}, @host).poll_for_otp(@webauthn_url, @credentials)
+    end
+
+    assert_equal error.message,
+      "Security device verification failed: The token in the link you used has either expired or been used already."
+  end
+end

data/test/rubygems/utilities.rb

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 require "tempfile"
 require "rubygems"
 require "rubygems/remote_fetcher"

data/test/test_changelog_generator.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative "../util/changelog"
+require_relative "../tool/changelog"
 require "rubygems/commands/setup_command"
 require_relative "rubygems/helper"
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubygems-update
 version: !ruby/object:Gem::Version
-  version: 3.4.17
+  version: 3.4.19
 platform: ruby
 authors:
 - Jim Weirich
@@ -14,9 +14,9 @@ authors:
 - Evan Phoenix
 - Hiroshi SHIBATA
 autorequire:
-bindir: bin
+bindir: exe
 cert_chain: []
-date: 2023-07-14 00:00:00.000000000 Z
+date: 2023-08-17 00:00:00.000000000 Z
 dependencies: []
 description: |-
   A package (also known as a library) contains a set of functionality
@@ -39,7 +39,6 @@ executables:
 - update_rubygems
 extensions: []
 extra_rdoc_files:
-- CHANGELOG.md
 - LICENSE.txt
 - MAINTAINERS.txt
 - MIT.txt
@@ -49,10 +48,37 @@ extra_rdoc_files:
 - POLICIES.md
 - CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
-- bundler/CHANGELOG.md
 - bundler/LICENSE.md
 - bundler/README.md
 - hide_lib_for_update/note.txt
+- bundler/lib/bundler/man/bundle-add.1
+- bundler/lib/bundler/man/bundle-binstubs.1
+- bundler/lib/bundler/man/bundle-cache.1
+- bundler/lib/bundler/man/bundle-check.1
+- bundler/lib/bundler/man/bundle-clean.1
+- bundler/lib/bundler/man/bundle-config.1
+- bundler/lib/bundler/man/bundle-console.1
+- bundler/lib/bundler/man/bundle-doctor.1
+- bundler/lib/bundler/man/bundle-exec.1
+- bundler/lib/bundler/man/bundle-gem.1
+- bundler/lib/bundler/man/bundle-help.1
+- bundler/lib/bundler/man/bundle-info.1
+- bundler/lib/bundler/man/bundle-init.1
+- bundler/lib/bundler/man/bundle-inject.1
+- bundler/lib/bundler/man/bundle-install.1
+- bundler/lib/bundler/man/bundle-list.1
+- bundler/lib/bundler/man/bundle-lock.1
+- bundler/lib/bundler/man/bundle-open.1
+- bundler/lib/bundler/man/bundle-outdated.1
+- bundler/lib/bundler/man/bundle-platform.1
+- bundler/lib/bundler/man/bundle-plugin.1
+- bundler/lib/bundler/man/bundle-pristine.1
+- bundler/lib/bundler/man/bundle-remove.1
+- bundler/lib/bundler/man/bundle-show.1
+- bundler/lib/bundler/man/bundle-update.1
+- bundler/lib/bundler/man/bundle-version.1
+- bundler/lib/bundler/man/bundle-viz.1
+- bundler/lib/bundler/man/bundle.1
 files:
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
@@ -64,8 +90,6 @@ files:
 - POLICIES.md
 - README.md
 - UPGRADING.md
-- bin/gem
-- bin/update_rubygems
 - bundler/CHANGELOG.md
 - bundler/LICENSE.md
 - bundler/README.md
@@ -391,6 +415,8 @@ files:
 - bundler/lib/bundler/vlad.rb
 - bundler/lib/bundler/worker.rb
 - bundler/lib/bundler/yaml_serializer.rb
+- exe/gem
+- exe/update_rubygems
 - hide_lib_for_update/note.txt
 - lib/rubygems.rb
 - lib/rubygems/available_set.rb
@@ -459,6 +485,9 @@ files:
 - lib/rubygems/ext/rake_builder.rb
 - lib/rubygems/gem_runner.rb
 - lib/rubygems/gemcutter_utilities.rb
+- lib/rubygems/gemcutter_utilities/webauthn_listener.rb
+- lib/rubygems/gemcutter_utilities/webauthn_listener/response.rb
+- lib/rubygems/gemcutter_utilities/webauthn_poller.rb
 - lib/rubygems/indexer.rb
 - lib/rubygems/install_default_message.rb
 - lib/rubygems/install_message.rb
@@ -598,8 +627,6 @@ files:
 - lib/rubygems/validator.rb
 - lib/rubygems/version.rb
 - lib/rubygems/version_option.rb
-- lib/rubygems/webauthn_listener.rb
-- lib/rubygems/webauthn_listener/response.rb
 - rubygems-update.gemspec
 - setup.rb
 - test/rubygems/alternate_cert.pem
@@ -639,6 +666,7 @@ files:
 - test/rubygems/invalidchild_cert.pem
 - test/rubygems/invalidchild_cert_32.pem
 - test/rubygems/invalidchild_key.pem
+- test/rubygems/multifactor_auth_utilities.rb
 - test/rubygems/package/tar_test_case.rb
 - test/rubygems/packages/Bluebie-legs-0.6.2.gem
 - test/rubygems/packages/ascii_binder-0.1.10.1.gem
@@ -815,6 +843,7 @@ files:
 - test/rubygems/test_rubygems.rb
 - test/rubygems/test_webauthn_listener.rb
 - test/rubygems/test_webauthn_listener_response.rb
+- test/rubygems/test_webauthn_poller.rb
 - test/rubygems/utilities.rb
 - test/rubygems/wrong_key_cert.pem
 - test/rubygems/wrong_key_cert_32.pem
@@ -843,7 +872,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.17
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: RubyGems is a package management framework for Ruby. This gem is downloaded

data/lib/rubygems/webauthn_listener/response.rb

@@ -1,161 +0,0 @@
-# frozen_string_literal: true
-
-##
-# The WebauthnListener Response class is used by the WebauthnListener to create
-# responses to be sent to the Gem host. It creates a Net::HTTPResponse instance
-# when initialized and can be converted to the appropriate format to be sent by a socket using `to_s`.
-# Net::HTTPResponse instances cannot be directly sent over a socket.
-#
-# Types of response classes:
-#   - OkResponse
-#   - NoContentResponse
-#   - BadRequestResponse
-#   - NotFoundResponse
-#   - MethodNotAllowedResponse
-#
-# Example usage:
-#
-#   server = TCPServer.new(0)
-#   socket = server.accept
-#
-#   response = OkResponse.for("https://rubygems.example")
-#   socket.print response.to_s
-#   socket.close
-#
-
-class Gem::WebauthnListener
-  class Response
-    attr_reader :http_response
-
-    def self.for(host)
-      new(host)
-    end
-
-    def initialize(host)
-      @host = host
-
-      build_http_response
-    end
-
-    def to_s
-      status_line = "HTTP/#{@http_response.http_version} #{@http_response.code} #{@http_response.message}\r\n"
-      headers = @http_response.to_hash.map {|header, value| "#{header}: #{value.join(", ")}\r\n" }.join + "\r\n"
-      body = @http_response.body ? "#{@http_response.body}\n" : ""
-
-      status_line + headers + body
-    end
-
-    private
-
-    # Must be implemented in subclasses
-    def code
-      raise NotImplementedError
-    end
-
-    def reason_phrase
-      raise NotImplementedError
-    end
-
-    def body; end
-
-    def build_http_response
-      response_class = Net::HTTPResponse::CODE_TO_OBJ[code.to_s]
-      @http_response = response_class.new("1.1", code, reason_phrase)
-      @http_response.instance_variable_set(:@read, true)
-
-      add_connection_header
-      add_access_control_headers
-      add_body
-    end
-
-    def add_connection_header
-      @http_response["connection"] = "close"
-    end
-
-    def add_access_control_headers
-      @http_response["access-control-allow-origin"] = @host
-      @http_response["access-control-allow-methods"] = "POST"
-      @http_response["access-control-allow-headers"] = %w[Content-Type Authorization x-csrf-token]
-    end
-
-    def add_body
-      return unless body
-      @http_response["content-type"] = "text/plain"
-      @http_response["content-length"] = body.bytesize
-      @http_response.instance_variable_set(:@body, body)
-    end
-  end
-
-  class OkResponse < Response
-    private
-
-    def code
-      200
-    end
-
-    def reason_phrase
-      "OK"
-    end
-
-    def body
-      "success"
-    end
-  end
-
-  class NoContentResponse < Response
-    private
-
-    def code
-      204
-    end
-
-    def reason_phrase
-      "No Content"
-    end
-  end
-
-  class BadRequestResponse < Response
-    private
-
-    def code
-      400
-    end
-
-    def reason_phrase
-      "Bad Request"
-    end
-
-    def body
-      "missing code parameter"
-    end
-  end
-
-  class NotFoundResponse < Response
-    private
-
-    def code
-      404
-    end
-
-    def reason_phrase
-      "Not Found"
-    end
-  end
-
-  class MethodNotAllowedResponse < Response
-    private
-
-    def code
-      405
-    end
-
-    def reason_phrase
-      "Method Not Allowed"
-    end
-
-    def add_access_control_headers
-      super
-      @http_response["allow"] = %w[GET OPTIONS]
-    end
-  end
-end

data/lib/rubygems/webauthn_listener.rb

@@ -1,92 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "webauthn_listener/response"
-
-##
-# The WebauthnListener class retrieves an OTP after a user successfully WebAuthns with the Gem host.
-# An instance opens a socket using the TCPServer instance given and listens for a request from the Gem host.
-# The request should be a GET request to the root path and contains the OTP code in the form
-# of a query parameter `code`. The listener will return the code which will be used as the OTP for
-# API requests.
-#
-# Types of responses sent by the listener after receiving a request:
-#   - 200 OK: OTP code was successfully retrieved
-#   - 204 No Content: If the request was an OPTIONS request
-#   - 400 Bad Request: If the request did not contain a query parameter `code`
-#   - 404 Not Found: The request was not to the root path
-#   - 405 Method Not Allowed: OTP code was not retrieved because the request was not a GET/OPTIONS request
-#
-# Example usage:
-#
-#   server = TCPServer.new(0)
-#   otp = Gem::WebauthnListener.wait_for_otp_code("https://rubygems.example", server)
-#
-
-class Gem::WebauthnListener
-  attr_reader :host
-
-  def initialize(host)
-    @host = host
-  end
-
-  def self.wait_for_otp_code(host, server)
-    new(host).fetch_otp_from_connection(server)
-  end
-
-  def fetch_otp_from_connection(server)
-    loop do
-      socket = server.accept
-      request_line = socket.gets
-
-      method, req_uri, _protocol = request_line.split(" ")
-      req_uri = URI.parse(req_uri)
-
-      responder = SocketResponder.new(socket)
-
-      unless root_path?(req_uri)
-        responder.send(NotFoundResponse.for(host))
-        raise Gem::WebauthnVerificationError, "Page at #{req_uri.path} not found."
-      end
-
-      case method.upcase
-      when "OPTIONS"
-        responder.send(NoContentResponse.for(host))
-        next # will be GET
-      when "GET"
-        if otp = parse_otp_from_uri(req_uri)
-          responder.send(OkResponse.for(host))
-          return otp
-        end
-        responder.send(BadRequestResponse.for(host))
-        raise Gem::WebauthnVerificationError, "Did not receive OTP from #{host}."
-      else
-        responder.send(MethodNotAllowedResponse.for(host))
-        raise Gem::WebauthnVerificationError, "Invalid HTTP method #{method.upcase} received."
-      end
-    end
-  end
-
-  private
-
-  def root_path?(uri)
-    uri.path == "/"
-  end
-
-  def parse_otp_from_uri(uri)
-    require "cgi"
-
-    return if uri.query.nil?
-    CGI.parse(uri.query).dig("code", 0)
-  end
-
-  class SocketResponder
-    def initialize(socket)
-      @socket = socket
-    end
-
-    def send(response)
-      @socket.print response.to_s
-      @socket.close
-    end
-  end
-end