spyri-api 0.1.6 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17344ba07c89a16273c0bff7ba9044ef1e48c9547d8bc81ab21c38e53b8dd7b5
-  data.tar.gz: 8083e38bf58b89956d98b1d3b53db5fbe631cc79a21c578ca0c0e422000b2ce2
+  metadata.gz: d8b61342fbeb952c4028674008db95f09e8eac633393250cb97c81755c61362d
+  data.tar.gz: 52900c1d81f36ccb3ffce84f5218bdd57cc3fe595d855fdda4dcc2bb9ccff856
 SHA512:
-  metadata.gz: 5a5da8d6539bbff3995bf8c91a5a2ce36773d877c5474958fdbf2225683347fdcb0b7cb8803103e2c89076cbbdd3c0417b835ed804639ec3c0dcee929a6591e9
-  data.tar.gz: f75bcef9e223862a1be4f24282dbc1b9d90113cbf9e286bd2d58fccfe58570b5c8dfe7238ba69259a9b0548fcb5eac034668f0e2dfe87d6c4954aa0ec530d575
+  metadata.gz: a4ee8a79feb0527a78e5b689f6c3cc2a384c39f18db9e20571d31686413da24d223e761873c4d746c8f20f1dcf8c52c68f0c7f7ca4ad2056d136fdcea76dd34b
+  data.tar.gz: d70111dd756ac295911276224452d076206c001be00a143b7167a7449262a7345141ed287d8daab54c060963765088d19d070dc103e06322511b79a5541055c5

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## [0.2.0] - 2026-10-27
+
+- Sign requests with HMAC-SHA256 when `access_uuid` and `secret` are configured (bearer `access_token` still supported)
+- Build the query string in the client instead of Excon, so that the signed path is the one sent
+
 ## [0.1.6] - 2025-07-08
 
 - Add modules & definitions endpoints

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    spyri-api (0.1.6)
+    spyri-api (0.2.0)
       excon
 
 GEM
@@ -54,7 +54,7 @@ GEM
     ruby-progressbar (1.13.0)
     unicode-display_width (3.1.4)
       unicode-emoji (~> 4.0, >= 4.0.4)
-    unicode-emoji (4.0.4)
+    unicode-emoji (4.3.0)
 
 PLATFORMS
   ruby

data/README.md

@@ -30,11 +30,12 @@ Or install it yourself as:
 
 ### Quickstart
 
+Requests are signed with HMAC-SHA256:  
 ```ruby
 begin
-  client = SpyriApi::Client.new
-  client.set_config({
-    access_token: 'YOUR_SPYRI_API_TOKEN', 
+  client = SpyriApi::Client.new({
+    access_uuid: 'YOUR_ACCESS_UUID',
+    secret: 'YOUR_SECRET',
     host: 'YOUR_SPYRI_API_URL'
   })
   users_endpoint = SpyriApi::Users.new(client)

data/lib/spyri_api/client.rb

@@ -1,14 +1,23 @@
 # frozen_string_literal: true
 
+require "json"
+require "openssl"
+require "uri"
+
 module SpyriApi
   class Client
 
+    SIGNATURE_SCHEME = "HMAC-SHA256"
+
     def initialize(config = {})
       set_config(config)
     end
 
     def set_config(config = {})
       @access_token = config[:access_token] || ''
+      # HMAC credentials: when both are given, requests are signed and the access token is not used
+      @access_uuid = config[:access_uuid]
+      @secret = config[:secret]
       @host = config[:host] || ''
 
       timeout = config[:timeout] || 120
@@ -18,17 +27,24 @@ module SpyriApi
     end
 
     def call_api(http_method, path, opts = {})
+      method = http_method.to_s.upcase
+      # The query string is built here rather than by Excon, so that the signed path is exactly the one sent
+      url = @host + path
+      query = URI.encode_www_form(opts[:query_params] || {})
+      url += "?#{query}" unless query.empty?
+      body = method == "GET" ? "" : opts[:body].to_json
+
       headers = {'Content-Type' => "application/json"}
-      headers[:Authorization] = "Bearer #{@access_token}"
+      headers.merge!(authentication_headers(method, URI(url).request_uri, body))
 
-      conn = Excon.new(@host + path, headers: headers, read_timeout: @read_timeout, write_timeout: @write_timeout, connect_timeout: @connect_timeout)
+      conn = Excon.new(url, headers: headers, read_timeout: @read_timeout, write_timeout: @write_timeout, connect_timeout: @connect_timeout)
 
       res = nil
-      case http_method.to_sym.downcase
-      when :post, :put, :patch, :delete
-        res = conn.request(method: http_method, query: opts[:query_params], body: opts[:body].to_json)
-      when :get
-        res = conn.get(query: opts[:query_params])
+      case method
+      when "POST", "PUT", "PATCH", "DELETE"
+        res = conn.request(method: method, body: body)
+      when "GET"
+        res = conn.get
       end
 
       data = nil
@@ -41,5 +57,21 @@ module SpyriApi
       return data
     end
 
+    private
+
+    def hmac?
+      !@access_uuid.to_s.empty? && !@secret.to_s.empty?
+    end
+
+    def authentication_headers(method, request_uri, body)
+      # Legacy authentication: use Bearer token if HMAC credentials are not provided
+      return { 'Authorization' => "Bearer #{@access_token}" } unless hmac?
+
+      timestamp = Time.now.to_i.to_s
+      string_to_sign = [method, request_uri, timestamp, OpenSSL::Digest::SHA256.hexdigest(body)].join("\n")
+      signature = OpenSSL::HMAC.hexdigest('SHA256', @secret, string_to_sign)
+      { 'Authorization' => "#{SIGNATURE_SCHEME} access_uuid=#{@access_uuid};time=#{timestamp};signature=#{signature}" }
+    end
+
   end
-end
+end

data/lib/spyri_api/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module SpyriApi
-  VERSION = "0.1.6"
+  VERSION = "0.2.0"
 end

data/spyri-api.gemspec

@@ -28,4 +28,6 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "excon"
 
+  spec.post_install_message = "From version 0.2.0, signature is made using an access_uuid and a secret, instead of the previous token (the token still works as a fallback)"
+
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: spyri-api
 version: !ruby/object:Gem::Version
-  version: 0.1.6
+  version: 0.2.0
 platform: ruby
 authors:
 - pabois
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-07-08 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: excon
@@ -24,7 +23,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
-description:
 email:
 - pierreandre.boissinot@noesya.coop
 executables: []
@@ -59,7 +57,8 @@ metadata:
   homepage_uri: https://github.com/letemps-ch/spyri-api
   source_code_uri: https://github.com/letemps-ch/spyri-api
   changelog_uri: https://github.com/letemps-ch/spyri-api/CHANGELOG.md
-post_install_message:
+post_install_message: From version 0.2.0, signature is made using an access_uuid and
+  a secret, instead of the previous token (the token still works as a fallback)
 rdoc_options: []
 require_paths:
 - lib
@@ -74,8 +73,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
-signing_key:
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Ruby client library for the Spyri API
 test_files: []