stellar_base-rails 0.2.1 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ecd5d5fc63b0d3fc23adafd92a5e330c1ae47949bc410898565a9efdb4f6726f
-  data.tar.gz: 3d7f60859d18ab5376070d7ec7fbc1281ddc4ff8708927221f146978fe2c96e4
+  metadata.gz: a83410d8dc46aa9b3e3a7501ff339f620e4bb16073a5156b935a942249204fcd
+  data.tar.gz: b76ff40be0ee4f471c37198856157f152ef041d14736e2fdf0eebfaf42f3a770
 SHA512:
-  metadata.gz: 9fc6a3115718edb85a4a9e43ff75141d96720514e49c2f41a9dae261b29d2f1a1ddc8979d8ef80cf0c871185fefb469c9ac38f23a279997f7b3105890a8b3ad8
-  data.tar.gz: 9d8ed4542c4f85231f68ada991cecbe6e5895d3f2f2590dadf4bba0102822b061d50906f8124531199e405712c5334b63e45e52b433628fb60c97aa7f5041763
+  metadata.gz: 2db9224965d1e88f9f6f8b1deba1e50bcf6ac32c7226da4ba8cbaee737c6d9834b0d663861597cabb65eb9e601e13d6e695b7097d44c73df34ca2e6419f3e7f6
+  data.tar.gz: 1bf1a4bd010321297c05638303b681756d1c16089d006e8acdc3e4a50fc438d45ef9a35cd5404d0b73c5f9105ef2a1af505d246a9ea243ae32d09d7401e98224

data/README.md

@@ -21,8 +21,10 @@ StellarBase.configure do |c|
   c.modules = %i(bridge_callbacks)
   c.horizon_url = "https://horizon.stellar.org"
 
-  c.check_bridge_callbacks_authenticity = true
   c.on_bridge_callback = "StellarBridgeReceive::SaveTxn"
+  c.check_bridge_callbacks_authenticity = true
+  c.check_bridge_callbacks_mac_payload = false
+  c.bridge_callbacks_mac_key = "test"
 end
 ```
 
@@ -34,6 +36,11 @@ end
 - You can supply what endpoints you want to activate with the gem
 - `bridge_callbacks` - this will mount a HTTP/S POST endpoint that acts as callback receiver for bridge server payments on the path. It will call your `.on_bridge_callback` class.
 
+#### c.horizon_url
+- Value(s): String, url to horizon
+- Default: https://horizon.stellar.org
+- This is where the engine will check bridge callbacks if `c.check_bridge_callbacks_authenticity` is turned on
+
 #### c.on_bridge_callback
 - Value(s): Class
 - Default: None
@@ -48,10 +55,15 @@ end
 - Default: `false`
 - This secures the `/bridge_callbacks` endpoint from fake transactions by checking the transaction ID and it's contents against the Stellar Blockchain. If it doesn't add up, `/bridge_callbacks` endpoint will respond with a 422
 
-#### c.horizon_url
-- Value(s): String, url to horizon
-- Default: https://horizon.stellar.org
-- This is where the engine will check bridge callbacks if `c.cross_reference_bridge_callback` is turned on
+#### c.check_bridge_callbacks_mac_payload
+- Value(s): `true` or `false`
+- Default: `false`
+- This secures the `/bridge_callbacks` endpoint from fake transactions by checking the `X_PAYLOAD_MAC` header for 1.) existence and 2.) if it matches the HMAC-SH256 encoded raw request body
+
+#### c.bridge_callbacks_mac_key
+- Value(s): Any Stellar Private Key, it should be the same as the mac_key configured in your bridge server
+- Default: None
+- This is used to verify the contents of `X_PAYLOAD_MAC` by encoding the raw request body with the decoded `bridge_callback_mac_key` as the key
 
 ## Installation
 Add this line to your application's Gemfile:

data/app/controllers/stellar_base/bridge_callbacks_controller.rb

@@ -1,6 +1,7 @@
 module StellarBase
   class BridgeCallbacksController < ApplicationController
     skip_before_action :verify_authenticity_token
+    before_action :verify_mac_payload, if: :check_mac_payload?
 
     def create
       op = BridgeCallbacks::Operations::Process.(bridge_callback: callback_params)
@@ -10,7 +11,9 @@ module StellarBase
           if op.success?
             head :ok
           else
-            log_unsuccessful_callback(op)
+            contract = op["contract.default"]
+            log_unsuccessful_callback(contract.errors.full_messages)
+
             head :unprocessable_entity
           end
         end
@@ -19,11 +22,13 @@ module StellarBase
 
     private
 
-    def log_unsuccessful_callback(op)
-      Rails.logger.warn("Unsuccessful bridge callback #{callback_params.to_s}")
+    def check_mac_payload?
+      StellarBase.configuration.check_bridge_callbacks_mac_payload
+    end
 
-      error_messages = op["contract.default"].errors.full_messages
-      Rails.logger.warn("Details: #{error_messages}")
+    def log_unsuccessful_callback(error_message)
+      Rails.logger.warn("Unsuccessful bridge callback #{callback_params.to_s}")
+      Rails.logger.warn("Details: #{error_message}")
     end
 
     def callback_params
@@ -40,5 +45,20 @@ module StellarBase
         :transaction_id,
       )
     end
+
+    def verify_mac_payload
+      callback_mac_payload = request.headers["HTTP_X_PAYLOAD_MAC"]
+
+      result = BridgeCallbacks::VerifyMacPayload.(
+        callback_params: callback_params,
+        callback_mac_payload: callback_mac_payload,
+      )
+
+      if result.failure?
+        log_unsuccessful_callback result.message
+        head :bad_request
+      end
+    end
+
   end
 end

data/app/services/stellar_base/bridge_callbacks/mac_payloads/check_payload.rb

@@ -0,0 +1,17 @@
+module StellarBase
+  module BridgeCallbacks
+    module MacPayloads
+      class CheckPayload
+
+        extend LightService::Action
+        expects :callback_mac_payload
+
+        executed do |c|
+          unless c.callback_mac_payload.present?
+            c.fail_and_return! "HTTP_X_PAYLOAD_MAC not present"
+          end
+        end
+      end
+    end
+  end
+end

data/app/services/stellar_base/bridge_callbacks/mac_payloads/compare.rb

@@ -0,0 +1,21 @@
+module StellarBase
+  module BridgeCallbacks
+    module MacPayloads
+      class Compare
+
+        extend LightService::Action
+        expects :encoded_params, :decoded_payload
+
+        executed do |c|
+          unless c.decoded_payload == c.encoded_params
+            message = "HTTP_X_PAYLOAD_MAC and encoded raw POST doesn't match"
+            c.fail_and_return! message
+          end
+
+          c.succeed!
+        end
+      end
+    end
+  end
+end
+

data/app/services/stellar_base/bridge_callbacks/mac_payloads/decode_mac_key.rb

@@ -0,0 +1,19 @@
+module StellarBase
+  module BridgeCallbacks
+    module MacPayloads
+      class DecodeMacKey
+
+        extend LightService::Action
+        promises :decoded_mac_key
+
+        executed do |c|
+          c.decoded_mac_key = Stellar::Util::StrKey.check_decode(
+            :seed,
+            StellarBase.configuration.bridge_callbacks_mac_key,
+          )
+        end
+      end
+    end
+  end
+end
+

data/app/services/stellar_base/bridge_callbacks/mac_payloads/decode_payload.rb

@@ -0,0 +1,17 @@
+module StellarBase
+  module BridgeCallbacks
+    module MacPayloads
+      class DecodePayload
+
+        extend LightService::Action
+        expects :callback_mac_payload
+        promises :decoded_payload
+
+        executed do |c|
+          c.decoded_payload = Base64.decode64(c.callback_mac_payload)
+        end
+      end
+    end
+  end
+end
+

data/app/services/stellar_base/bridge_callbacks/mac_payloads/encode_params.rb

@@ -0,0 +1,21 @@
+module StellarBase
+  module BridgeCallbacks
+    module MacPayloads
+      class EncodeParams
+
+        extend LightService::Action
+        expects :callback_params, :decoded_mac_key
+        promises :encoded_params
+
+        executed do |c|
+          c.encoded_params = OpenSSL::HMAC.digest(
+            "SHA256",
+            c.decoded_mac_key,
+            c.callback_params.to_query,
+          )
+        end
+      end
+    end
+  end
+end
+

data/app/services/stellar_base/bridge_callbacks/verify_mac_payload.rb

@@ -0,0 +1,21 @@
+module StellarBase
+  module BridgeCallbacks
+    class VerifyMacPayload
+      extend LightService::Organizer
+
+      def self.call(callback_mac_payload:, callback_params:)
+        with(
+          callback_mac_payload: callback_mac_payload,
+          callback_params: callback_params,
+        ).reduce(
+          MacPayloads::CheckPayload,
+          MacPayloads::DecodePayload,
+          MacPayloads::DecodeMacKey,
+          MacPayloads::EncodeParams,
+          MacPayloads::Compare
+        )
+      end
+    end
+  end
+end
+

data/lib/stellar_base.rb

@@ -1,4 +1,5 @@
 require "gem_config"
+require "stellar-base"
 require "light-service"
 require "virtus"
 require "httparty"
@@ -15,8 +16,11 @@ module StellarBase
   with_configuration do
     has :horizon_url, default: "https://horizon.stellar.org"
     has :modules, default: [:bridge_callbacks]
-    has :check_bridge_callbacks_authenticity, default: false
+
     has :on_bridge_callback
+    has :check_bridge_callbacks_authenticity, default: false
+    has :check_bridge_callbacks_mac_payload, default: false
+    has :bridge_callbacks_mac_key, default: false
   end
 
   def self.included_module?(module_name)

data/lib/stellar_base/version.rb

@@ -1,3 +1,3 @@
 module StellarBase
-  VERSION = '0.2.1'
+  VERSION = '0.3.0'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stellar_base-rails
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Ace Subido
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-05-07 00:00:00.000000000 Z
+date: 2018-05-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: virtus
@@ -80,6 +80,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: stellar-base
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.14.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 0.14.0
 - !ruby/object:Gem::Dependency
   name: trailblazer
   requirement: !ruby/object:Gem::Requirement
@@ -207,7 +221,13 @@ files:
 - app/services/stellar_base/bridge_callbacks/get_operation.rb
 - app/services/stellar_base/bridge_callbacks/get_transaction.rb
 - app/services/stellar_base/bridge_callbacks/initialize_horizon_client.rb
+- app/services/stellar_base/bridge_callbacks/mac_payloads/check_payload.rb
+- app/services/stellar_base/bridge_callbacks/mac_payloads/compare.rb
+- app/services/stellar_base/bridge_callbacks/mac_payloads/decode_mac_key.rb
+- app/services/stellar_base/bridge_callbacks/mac_payloads/decode_payload.rb
+- app/services/stellar_base/bridge_callbacks/mac_payloads/encode_params.rb
 - app/services/stellar_base/bridge_callbacks/process.rb
+- app/services/stellar_base/bridge_callbacks/verify_mac_payload.rb
 - app/views/layouts/stellar_base/application.html.erb
 - config/routes.rb
 - lib/stellar_base-rails.rb