signed_request 1.0.0 → 1.0.2

data/README.rdoc

@@ -20,7 +20,7 @@ user of this library.
                'param2' => 'bar' }
     signature = SignedRequest.sign(params, key)
     
-    params['signature'] = key
+    params['signature'] = signature
 
     # post it to the receiver.
     req = Net::HTTP::Get.new('/secret/url')

data/VERSION

@@ -1 +1 @@
-1.0.0
+1.0.2

data/lib/signed_request.rb

@@ -3,10 +3,19 @@ require 'openssl'
 require 'openssl/digest'
 
 module SignedRequest
-  STRIP_PARAMS = ['action', 'controller'] 
+  STRIP_PARAMS = ['action', 'controller', 'format'] 
 
   # Sign a request on the sending end.
   def self.sign(params, secret_key)
+    params = params.dup
+
+    # Flatten any sub-hashes to a single string.
+    params.keys.each do |key|
+      if params[key].is_a?(Hash)
+        params[key] = params[key].sort_by { |k, v| k.to_s.downcase }.to_s
+      end
+    end
+
     query   = params.sort_by { |k,v| k.to_s.downcase }
     digest  = OpenSSL::Digest::Digest.new('sha1')
     hmac    = OpenSSL::HMAC.digest(digest, secret_key, query.to_s)

data/signed_request.gemspec

@@ -2,11 +2,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{signed_request}
-  s.version = "1.0.0"
+  s.version = "1.0.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["David Balatero"]
-  s.date = %q{2009-06-22}
+  s.date = %q{2009-06-30}
   s.email = %q{dbalatero@evri.com}
   s.extra_rdoc_files = [
     "LICENSE",

data/spec/signed_request_spec.rb

@@ -17,8 +17,23 @@ describe SignedRequest do
       result = SignedRequest.sign(params, @test_key)
       result.should == "uoOmSftU4gnUMK6Q1ylyGnr5hEw="
     end
-  end
 
+    it "should handle params with hashes as values deterministically" do
+      params = {
+        :user => {
+          :username => 'dbalatero',
+          :password => 'password',
+          :password_confirmation => 'password',
+          :token => 'z883481299kxkldksjkfdsalfdasfdas'
+        }
+      }
+
+      sig = SignedRequest.sign(params, @test_key)
+      20.times do
+        SignedRequest.sign(params.dup, @test_key).should == sig
+      end
+    end
+  end
 
   describe "validate" do
     it "should return true given a correct request" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: signed_request
 version: !ruby/object:Gem::Version 
-  version: 1.0.0
+  version: 1.0.2
 platform: ruby
 authors: 
 - David Balatero
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-06-22 00:00:00 -07:00
+date: 2009-06-30 00:00:00 -07:00
 default_executable: 
 dependencies: []