stellar-sdk 0.25.0 → 0.26.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14f9e7a13e44b5eb83bce5faee3918a49c03cfd9d36f00b49cdec501131702bc
-  data.tar.gz: cbf8145d6a546359ba66f74bc868cc1f5c6bf82a0e1c077d6073ef242f3989ef
+  metadata.gz: 1aeddb0019aa2152cb8f2112664943cf897288eca35a0ca3695ef2e5a7de72e1
+  data.tar.gz: bb08abb87f75f176105075d0b47bd85138a0692779cf9612d212227c7aca72c5
 SHA512:
-  metadata.gz: a1a999329ba74c3a0448c59c4d249c4fecdc1b0961dbc82ba985f8b3fb792b993825a1eabd2df8918566ac1b7f1ca847572a381d61c0194aa8f48cc50fdea6e4
-  data.tar.gz: b4c7f193cd7fef55798e4788476e30898c2b8517981ad4d05da2c9ac7a1ab4758e5287700cd017b1c62cd97e995b6f645dc15ef9cff22d0cc061aeb85375dfe7
+  metadata.gz: 951727a0f57f612b86cf58f9fbcf8f801202279a33ee33d6d152f9c0e9b05a45a67330113b844f0538563f491becc7a05b9a1086be303bc3f98e2b337a01cf6c
+  data.tar.gz: c0247f20caeb1f6247cd7c9c558b8e4fc03aeb7db7723ccc592650628db5adccef6548ae254a185a4eb30b8a1f2c7edc6f411eab4196202c6395281ad1a9d7c7

data/CHANGELOG.md

@@ -4,9 +4,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
-## [Unreleased](https://github.com/stellar/ruby-stellar-sdk/compare/v0.25.0...master)
+## [Unreleased](https://github.com/stellar/ruby-stellar-sdk/compare/v0.26.0...master)
 
-## [0.25.0](https://github.com/stellar/ruby-stellar-sdk/compare/v0.24.0...0.25.0)
+## [0.26.0](https://github.com/stellar/ruby-stellar-sdk/compare/v0.25.0...v0.26.0) - 2021-02-05
+### Changed
+- `Stellar::SEP10` is updated to comply with SEP10 v3.0.0 and v3.1.0
+  - `read_challenge_tx`` now verifies `domain` in challenge auth operation, as per SEP10 v3.0.0
+  - it is now possible to provide `auth_domain` parameter to enforce auth server domain verification:
+    - `build_challenge_tx` will encode the extra auth domain operation into the challenge tx
+    - `read_challenge_tx` will verify that the challenge includes the correct auth domain operation
+
+## [0.25.0](https://github.com/stellar/ruby-stellar-sdk/compare/v0.24.0...v0.25.0) - 2020-10-30
 ### Changed
 - `Stellar::SEP10` is updated to comply with SEP10 v2.1.0
   - `build_challenge_tx` now accepts `domain` instead of `anchor_name`, using the

data/lib/stellar/sdk/version.rb

@@ -1,5 +1,5 @@
 module Stellar
   module SDK
-    VERSION = "0.25.0"
+    VERSION = "0.26.0"
   end
 end

data/lib/stellar/sep10.rb

@@ -30,10 +30,6 @@ module Stellar
         MSG
         domain = options[:anchor_name]
       end
-      # The value must be 64 bytes long. It contains a 48 byte
-      # cryptographic-quality random string encoded using base64 (for a total of
-      # 64 bytes after encoding).
-      value = SecureRandom.base64(48)
 
       now = Time.now.to_i
       time_bounds = Stellar::TimeBounds.new(
@@ -41,19 +37,34 @@ module Stellar
         max_time: now + timeout
       )
 
-      tx = Stellar::TransactionBuilder.new(
+      tb = Stellar::TransactionBuilder.new(
         source_account: server,
         sequence_number: 0,
         time_bounds: time_bounds
-      ).add_operation(
+      )
+
+      # The value must be 64 bytes long. It contains a 48 byte
+      # cryptographic-quality random string encoded using base64 (for a total of
+      # 64 bytes after encoding).
+      tb.add_operation(
         Stellar::Operation.manage_data(
           name: "#{domain} auth",
-          value: value,
+          value: SecureRandom.base64(48),
           source_account: client
         )
-      ).build
+      )
+
+      if options.key?(:auth_domain)
+        tb.add_operation(
+          Stellar::Operation.manage_data(
+            name: "web_auth_domain",
+            value: options[:auth_domain],
+            source_account: server
+          )
+        )
+      end
 
-      tx.to_envelope(server).to_xdr(:base64)
+      tb.build.to_envelope(server).to_xdr(:base64)
     end
 
     # Reads a SEP 10 challenge transaction and returns the decoded transaction envelope and client account ID contained within.
@@ -68,8 +79,8 @@ module Stellar
     # @example
     #   sep10 = Stellar::SEP10
     #   server = Stellar::KeyPair.random # this should be the SIGNING_KEY from your stellar.toml
-    #   challenge = sep10.build_challenge_tx(server: server, client: user, home_domain: domain, timeout: timeout)
-    #   envelope, client_address = sep10.read_challenge_tx(server: server, challenge: challenge)
+    #   challenge = sep10.build_challenge_tx(server: server, client: user, domain: domain, timeout: timeout)
+    #   envelope, client_address = sep10.read_challenge_tx(server: server, challenge_xdr: challenge)
     #
     # @param challenge_xdr [String] SEP0010 transaction challenge in base64.
     # @param server [Stellar::KeyPair] keypair for server where the challenge was generated.
@@ -94,7 +105,9 @@ module Stellar
       auth_op, *rest_ops = transaction.operations
       client_account_id = auth_op.source_account
 
-      if client_account_id.nil?
+      auth_op_body = auth_op.body.value
+
+      if client_account_id.blank?
         raise InvalidSep10ChallengeError, "The transaction's operation should contain a source account"
       end
 
@@ -102,15 +115,26 @@ module Stellar
         raise InvalidSep10ChallengeError, "The transaction's first operation should be manageData"
       end
 
-      if auth_op.body.value.data_value.unpack1("m").size != 48
+      if options.key?(:domain) && auth_op_body.data_name != "#{options[:domain]} auth"
+        raise InvalidSep10ChallengeError, "The transaction's operation data name is invalid"
+      end
+
+      if auth_op_body.data_value.unpack1("m").size != 48
         raise InvalidSep10ChallengeError, "The transaction's operation value should be a 64 bytes base64 random string"
       end
 
       rest_ops.each do |op|
-        if op.body.arm != :manage_data_op
+        body = op.body
+
+        if body.arm != :manage_data_op
           raise InvalidSep10ChallengeError, "The transaction has operations that are not of type 'manageData'"
         elsif op.source_account != server.muxed_account
           raise InvalidSep10ChallengeError, "The transaction has operations that are unrecognized"
+        else
+          op_params = body.value
+          if op_params.data_name == "web_auth_domain" && options.key?(:auth_domain) && op_params.data_value != options[:auth_domain]
+            raise InvalidSep10ChallengeError, "The transaction has 'manageData' operation with 'web_auth_domain' key and invalid value"
+          end
         end
       end
 
@@ -121,7 +145,7 @@ module Stellar
       time_bounds = transaction.time_bounds
       now = Time.now.to_i
 
-      if time_bounds.nil? || !now.between?(time_bounds.min_time, time_bounds.max_time)
+      if time_bounds.blank? || !now.between?(time_bounds.min_time, time_bounds.max_time)
         raise InvalidSep10ChallengeError, "The transaction has expired"
       end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: stellar-sdk
 version: !ruby/object:Gem::Version
-  version: 0.25.0
+  version: 0.26.0
 platform: ruby
 authors:
 - Scott Fleckenstein
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2020-10-30 00:00:00.000000000 Z
+date: 2021-02-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: stellar-base
@@ -18,14 +18,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.25.0
+        version: 0.26.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 0.25.0
+        version: 0.26.0
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -173,9 +173,9 @@ licenses:
 - Apache-2.0
 metadata:
   github_repo: ssh://github.com/astroband/ruby-stellar-sdk
-  documentation_uri: https://rubydoc.info/gems/stellar-sdk/0.25.0/
-  changelog_uri: https://github.com/astroband/ruby-stellar-sdk/blob/v0.25.0/sdk/CHANGELOG.md
-  source_code_uri: https://github.com/astroband/ruby-stellar-sdk/tree/v0.25.0/sdk
+  documentation_uri: https://rubydoc.info/gems/stellar-sdk/0.26.0/
+  changelog_uri: https://github.com/astroband/ruby-stellar-sdk/blob/v0.26.0/sdk/CHANGELOG.md
+  source_code_uri: https://github.com/astroband/ruby-stellar-sdk/tree/v0.26.0/sdk
 post_install_message:
 rdoc_options: []
 require_paths: