truelayer-signing 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7675d871fb8de41624e5f92fb6b0252fac90900f2f52c6bd9b182ea0f80cde44
-  data.tar.gz: 2345bf7cfc1619ef8c5e1bb20ed56f966ec9a71263798bde713aca0ba92b0811
+  metadata.gz: 751c6c37cee7adedf204491894146d577e70b310d9cd50504c01c29836743271
+  data.tar.gz: d2b7de41a966d0e114dd368320f35578714a674da1d76121d500944f0c33596b
 SHA512:
-  metadata.gz: df411a9c02a97ab165f5a47063ec0ca3fae67fe437f96af20b1f71eab4f88105bd8259a3c9685056c91210c3dca0134721f5c3b94e9cc39691756f6b64c17279
-  data.tar.gz: a39b865f5c4a1a3226cc8071f3c5971ff8c32c536d4b7b88ddab8cf7ffcc71fa2e36c3d3409b5fa7f3d25647f8ea8fb202ef6f74ac51661e85c2b089f6a4e2c4
+  metadata.gz: 88a7bc727e82df06eccb1992036730e49f6de45a6d38d6df7d2cf8d749441a8d1f5be031e59410e45778da20d84fac03bb07f7bf11103387893baebd4d86af2b
+  data.tar.gz: 249a44e6a94171f89f69f1e53aff377bee6ac6de33a3f2383a6c7f4ed94b517e216cd81da450caf1f363f21e1a8f60edcb6dfc71481af0c7fc70336d028ea0de

data/CHANGELOG.md

@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - ...
 
+## [0.2.1] – 2023-07-14
+
+- Disable expiration verification
+- Add missing header discovery
+
 ## [0.2.0] – 2023-06-13
 
 - Add support for signature verification using a JWKS: `TrueLayerSigning.verify_with_jwks(jwks)`

data/lib/truelayer-signing/jwt.rb

@@ -29,7 +29,7 @@ module JWT
     ).segments
   end
 
-  def truelayer_decode(jwt, key, verify, options, &keyfinder)
+  def truelayer_decode(jwt, key, verify = true, options, &keyfinder)
     TrueLayerDecode.new(
       jwt,
       key,

data/lib/truelayer-signing/signer.rb

@@ -7,7 +7,9 @@ module TrueLayerSigning
 
       private_key = OpenSSL::PKey.read(TrueLayerSigning.private_key)
       jws_header_args = { tl_headers: headers }
+
       jws_header_args[:jku] = jws_jku if jws_jku
+
       jws_header = TrueLayerSigning::JwsHeader.new(jws_header_args).to_h
       jwt = JWT.truelayer_encode(build_signing_payload, private_key, TrueLayerSigning.algorithm,
         jws_header)
@@ -18,6 +20,7 @@ module TrueLayerSigning
 
     def set_jku(jku)
       @jws_jku = jku
+
       self
     end
 

data/lib/truelayer-signing/utils.rb

@@ -16,18 +16,20 @@ module TrueLayerSigning
 
     def to_h
       hash = instance_variables.map { |var| [var[1..-1].to_sym, instance_variable_get(var)] }.to_h
+
       hash.reject { |key, _value| hash[key].nil? }
     end
 
     def filter_headers(headers)
       required_header_keys = tl_headers.split(",").reject { |key| key.empty? }
       normalised_headers = {}
+
       headers.to_a.each { |header| normalised_headers[header.first.downcase] = header.last }
 
       ordered_headers = required_header_keys.map do |key|
         value = normalised_headers[key.downcase]
 
-        raise(Error, "Missing header(s) declared in signature") unless value
+        raise(Error, "Missing header declared in signature: #{key.downcase}") unless value
 
         [key, value]
       end
@@ -50,6 +52,7 @@ module TrueLayerSigning
 
     def set_method(method)
       @method = method.to_s.upcase
+
       self
     end
 
@@ -57,21 +60,25 @@ module TrueLayerSigning
       raise(Error, "Path must start with '/'") unless path.start_with?("/")
 
       @path = path
+
       self
     end
 
     def add_header(name, value)
       @headers[name.to_s] = value
+
       self
     end
 
     def set_headers(headers)
       headers.each { |name, value| @headers[name.to_s] = value }
+
       self
     end
 
     def set_body(body)
       @body = body
+
       self
     end
 

data/lib/truelayer-signing/verifier.rb

@@ -1,11 +1,12 @@
 module TrueLayerSigning
   class Verifier < JwsBase
-    EXPECTED_COORDS_LENGTH = 66.freeze
+    EXPECTED_EC_KEY_COORDS_LENGTH = 66.freeze
 
     attr_reader :required_headers, :key_type, :key_value
 
     def initialize(args)
       super
+
       @key_type = args[:key_type]
       @key_value = args[:key_value]
     end
@@ -19,6 +20,7 @@ module TrueLayerSigning
 
       ordered_headers = jws_header.filter_headers(headers)
       normalised_headers = {}
+
       ordered_headers.to_a.each { |header| normalised_headers[header.first.downcase] = header.last }
 
       raise(Error, "Signature missing required header(s)") if required_headers &&
@@ -30,11 +32,13 @@ module TrueLayerSigning
     def require_header(name)
       @required_headers ||= []
       @required_headers.push(name)
+
       self
     end
 
     def require_headers(names)
       @required_headers = names
+
       self
     end
 
@@ -85,8 +89,13 @@ module TrueLayerSigning
         public_key = retrieve_public_key(:jwks, key_value, jws_header)
       end
 
-      jwt_options = { algorithm: TrueLayerSigning.algorithm }
-      JWT.truelayer_decode(full_signature, public_key, true, jwt_options)
+      jwt_options = {
+        algorithm: TrueLayerSigning.algorithm,
+        verify_expiration: false,
+        verify_not_before: false
+      }
+
+      JWT.truelayer_decode(full_signature, public_key, jwt_options)
     end
 
     private def retrieve_public_key(key_type, key_value, jws_header)
@@ -112,8 +121,7 @@ module TrueLayerSigning
 
       %i(x y).each do |elem|
         coords = Base64.urlsafe_decode64(valid_jwk[elem])
-        length = coords.length
-        diff = EXPECTED_COORDS_LENGTH - length
+        diff = EXPECTED_EC_KEY_COORDS_LENGTH - coords.length
 
         valid_jwk[elem] = Base64.urlsafe_encode64(("\x00" * diff) + coords) if diff > 0
       end

data/test/resources/failed-payment-expired-test-payload.json

@@ -0,0 +1,12 @@
+{
+  "type": "payment_failed",
+  "event_version": 1,
+  "event_id": "6f00897f-f8c8-4ffb-93a3-cfbd311396e2",
+  "payment_id": "2c4db314-b509-4d68-b883-a34ca5fa7b72",
+  "payment_method": {
+    "type": "bank_transfer"
+  },
+  "failed_at": "2023-07-11T17:42:24.123Z",
+  "failure_stage": "authorization_required",
+  "failure_reason": "expired"
+}

data/test/test-truelayer-signing.rb

@@ -314,7 +314,7 @@ class TrueLayerSigningTest < Minitest::Test
       .set_body(body)
 
     error = assert_raises(TrueLayerSigning::Error) { verifier.verify(tl_signature) }
-    assert_equal("Missing header(s) declared in signature", error.message)
+    assert_equal("Missing header declared in signature: idempotency-key", error.message)
   end
 
   def test_full_request_signature_missing_required_header_should_fail
@@ -455,6 +455,28 @@ class TrueLayerSigningTest < Minitest::Test
     assert_equal("Signature verification failed", error.message)
   end
 
+  # This test reproduces an issue we had with an edge case
+  def test_verify_with_failed_payment_expired_webhook_should_succeed
+    path = "/tl-webhook"
+    payload = read_file("resources/failed-payment-expired-test-payload.json")
+    body = JSON.parse(payload).to_json
+
+    tl_signature = TrueLayerSigning.sign_with_pem
+      .set_method(:post)
+      .set_path(path)
+      .set_body(body)
+      .sign
+
+    result = TrueLayerSigning.verify_with_pem(PUBLIC_KEY)
+      .set_method(:post)
+      .set_path(path)
+      .set_body(body)
+      .verify(tl_signature)
+
+    assert(result.first.start_with?("POST /tl-webhook\n"))
+    assert(result.first.include?("\"failure_reason\":\"expired\""))
+  end
+
   def test_sign_with_pem_and_custom_jku_should_succeed
     body = { currency: "GBP", max_amount_in_minor: 50_000_00 }.to_json
     idempotency_key = "idemp-2076717c-9005-4811-a321-9e0787fa0382"

data/truelayer-signing.gemspec

@@ -2,7 +2,7 @@ $LOAD_PATH.unshift(::File.join(::File.dirname(__FILE__), "lib"))
 
 Gem::Specification.new do |s|
   s.name = "truelayer-signing"
-  s.version = "0.2.0"
+  s.version = "0.2.1"
   s.summary = "Ruby gem to produce and verify TrueLayer API requests signatures"
   s.description = "TrueLayer provides instant access to open banking to " \
     "easily integrate next-generation payments and financial data into any app." \

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: truelayer-signing
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Kevin Plattret
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-06-13 00:00:00.000000000 Z
+date: 2023-07-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -51,6 +51,7 @@ files:
 - "./lib/truelayer-signing/signer.rb"
 - "./lib/truelayer-signing/utils.rb"
 - "./lib/truelayer-signing/verifier.rb"
+- "./test/resources/failed-payment-expired-test-payload.json"
 - "./test/resources/missing-zero-padding-test-jwks.json"
 - "./test/resources/missing-zero-padding-test-payload.json"
 - "./test/resources/missing-zero-padding-test-signature.txt"