signed_request 1.0.3 → 1.0.4

data/CHANGELOG.markdown

@@ -0,0 +1,4 @@
+1.0.4
+-----
+* Added the ability to pass an additional path to be signed as part of the
+request.

data/Rakefile

@@ -6,7 +6,7 @@ begin
   Jeweler::Tasks.new do |gem|
     gem.name = "signed_request"
     gem.summary = %Q{A simple gem that allows you to sign HTTP requests between two parties with a shared secret key.}
-    gem.email = "dbalatero@evri.com"
+    gem.email = "dbalatero@gmail.com"
     gem.homepage = "http://github.com/dbalatero/signed_request"
     gem.authors = ["David Balatero"]
     gem.rubyforge_project = 'evrigems'

data/VERSION

@@ -1 +1 @@
-1.0.3
+1.0.4

data/lib/signed_request.rb

@@ -3,10 +3,10 @@ require 'openssl'
 require 'openssl/digest'
 
 module SignedRequest
-  STRIP_PARAMS = ['action', 'controller', 'format'] 
+  STRIP_PARAMS = ['action', 'controller', 'format']
 
   # Sign a request on the sending end.
-  def self.sign(params, secret_key)
+  def self.sign(params, secret_key, options = {})
     params = params.dup
 
     # Flatten any sub-hashes to a single string.
@@ -17,18 +17,20 @@ module SignedRequest
     end
 
     query   = params.sort_by { |k,v| k.to_s.downcase }
+    string_to_sign = options[:path].to_s + query.to_s
+
     digest  = OpenSSL::Digest::Digest.new('sha1')
-    hmac    = OpenSSL::HMAC.digest(digest, secret_key, query.to_s)
+    hmac    = OpenSSL::HMAC.digest(digest, secret_key, string_to_sign)
     encoded = Base64.encode64(hmac).chomp
   end
 
   # Validate an incoming request on the receiving end.
-  def self.validate(params, secret_key)
+  def self.validate(params, secret_key, sign_options = {})
     signature = params.delete('signature') || params.delete(:signature)
     return false if !signature
 
     strip_keys_from!(params, *STRIP_PARAMS)
-    actual_signature = sign(params, secret_key)
+    actual_signature = sign(params, secret_key, sign_options)
     actual_signature == signature
   end
 

data/signed_request.gemspec

@@ -5,12 +5,12 @@
 
 Gem::Specification.new do |s|
   s.name = %q{signed_request}
-  s.version = "1.0.3"
+  s.version = "1.0.4"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["David Balatero"]
-  s.date = %q{2010-03-05}
-  s.email = %q{dbalatero@evri.com}
+  s.date = %q{2010-07-12}
+  s.email = %q{dbalatero@gmail.com}
   s.extra_rdoc_files = [
     "LICENSE",
      "README.rdoc"
@@ -18,6 +18,7 @@ Gem::Specification.new do |s|
   s.files = [
     ".document",
      ".gitignore",
+     "CHANGELOG.markdown",
      "LICENSE",
      "README.rdoc",
      "Rakefile",
@@ -32,7 +33,7 @@ Gem::Specification.new do |s|
   s.rdoc_options = ["--charset=UTF-8"]
   s.require_paths = ["lib"]
   s.rubyforge_project = %q{evrigems}
-  s.rubygems_version = %q{1.3.5}
+  s.rubygems_version = %q{1.3.6}
   s.summary = %q{A simple gem that allows you to sign HTTP requests between two parties with a shared secret key.}
   s.test_files = [
     "spec/signed_request_spec.rb",

data/spec/signed_request_spec.rb

@@ -6,9 +6,21 @@ describe SignedRequest do
   end
 
   describe "sign" do
+    it "should sign the params and path and return the correct signed key as base64" do
+      params = {
+        "tokenID" => "N1CHGCG13NNB4JMVJN1Q1JXIKBQDO4DQ595NRSCTILAU47P7GA7JVQMMJNXRUJFM",
+        "callerReference" => "44441234567fdsa44",
+        "expiry" => "10/2014",
+        "status" => "SC"
+      }
+
+      result = SignedRequest.sign(params, @test_key, :path => '/v1/api/mypath')
+      result.should == "oT/QGLKMPAX3sI3hvFLAK5yyGE8="
+    end
+
     it "should sign the request and return the correct signed key as base64" do
       params = {
-        "tokenID" => "N1CHGCG13NNB4JMVJN1Q1JXIKBQDO4DQ595NRSCTILAU47P7GA7JVQMMJNXRUJFM", 
+        "tokenID" => "N1CHGCG13NNB4JMVJN1Q1JXIKBQDO4DQ595NRSCTILAU47P7GA7JVQMMJNXRUJFM",
         "callerReference" => "44441234567fdsa44",
         "expiry" => "10/2014",
         "status" => "SC"
@@ -56,7 +68,7 @@ describe SignedRequest do
 
     it "should return true given a correct request" do
       good_params = {
-        "tokenID" => "N1CHGCG13NNB4JMVJN1Q1JXIKBQDO4DQ595NRSCTILAU47P7GA7JVQMMJNXRUJFM", 
+        "tokenID" => "N1CHGCG13NNB4JMVJN1Q1JXIKBQDO4DQ595NRSCTILAU47P7GA7JVQMMJNXRUJFM",
         "callerReference" => "44441234567fdsa44",
         "action" => "amazon_return",
         "signature" => "uoOmSftU4gnUMK6Q1ylyGnr5hEw=",
@@ -70,7 +82,7 @@ describe SignedRequest do
 
     it "should return false if there is no signature given" do
       good_params_without_signature = {
-        "tokenID" => "N1CHGCG13NNB4JMVJN1Q1JXIKBQDO4DQ595NRSCTILAU47P7GA7JVQMMJNXRUJFM", 
+        "tokenID" => "N1CHGCG13NNB4JMVJN1Q1JXIKBQDO4DQ595NRSCTILAU47P7GA7JVQMMJNXRUJFM",
         "callerReference" => "44441234567fdsa44",
         "action" => "amazon_return",
         "controller" => "checkout",

metadata

@@ -1,7 +1,12 @@
 --- !ruby/object:Gem::Specification 
 name: signed_request
 version: !ruby/object:Gem::Version 
-  version: 1.0.3
+  prerelease: false
+  segments: 
+  - 1
+  - 0
+  - 4
+  version: 1.0.4
 platform: ruby
 authors: 
 - David Balatero
@@ -9,12 +14,12 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-03-05 00:00:00 -08:00
+date: 2010-07-12 00:00:00 -07:00
 default_executable: 
 dependencies: []
 
 description: 
-email: dbalatero@evri.com
+email: dbalatero@gmail.com
 executables: []
 
 extensions: []
@@ -25,6 +30,7 @@ extra_rdoc_files:
 files: 
 - .document
 - .gitignore
+- CHANGELOG.markdown
 - LICENSE
 - README.rdoc
 - Rakefile
@@ -47,18 +53,20 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
+      segments: 
+      - 0
       version: "0"
-  version: 
 required_rubygems_version: !ruby/object:Gem::Requirement 
   requirements: 
   - - ">="
     - !ruby/object:Gem::Version 
+      segments: 
+      - 0
       version: "0"
-  version: 
 requirements: []
 
 rubyforge_project: evrigems
-rubygems_version: 1.3.5
+rubygems_version: 1.3.6
 signing_key: 
 specification_version: 3
 summary: A simple gem that allows you to sign HTTP requests between two parties with a shared secret key.