truelayer-signing 0.2.3 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2bd92901150104b3d2212252852071a8c3a1ed2e0a8f48ce72cb934686931bb9
-  data.tar.gz: 6ca20861d24c36d2380e070ad9d2cc47d55614cdafbf3f0ba77505b64984ec7c
+  metadata.gz: a85a356c6af43716627f510dc07d9fb08e400dab2ff005dc1bdd55d32d074012
+  data.tar.gz: 5f3ad1c1b8402e2fbfa39323f5c8a95682285284030e675ea94c3c66034ddf6d
 SHA512:
-  metadata.gz: b1b988b8a58ba51af8f6f4462e1de6871a0d79fa3d12bba9f7d12bb6ee6e14e22acc9c09268b11d622d2a6848f6ba070cc2704e6baa4b501dc89c59eb5870206
-  data.tar.gz: c4afccedb9a1f9b3676b1b69238ce0b9b4016fc883a947a44d9945f2c27944ba97373e4bd01c111cfc23ad5f4120c1075e12e4c25ed6714b1718576a6711dc62
+  metadata.gz: 79c0a907ed21bfd4987c3ce74bdb4bf07fe1a7c5be6560e6766c7d6a5a34f9f2b5f6c91a14765c4bac799813e7174be3f200aef10ef1f894fa8b52ab015cce5d
+  data.tar.gz: 9cddb3eeda2211d0409430639b0a62fb603290500b2b5a6d4f6d2b078db5f4c79ed2fada5f9bd5a1bb0e66c073e084be57e8a96ad982b81b1ee49db2e1eb7534

data/CHANGELOG.md

@@ -9,6 +9,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - ...
 
+## [0.3.0] – 2026-06-16
+
+- Require Ruby `>= 3.2`
+- Update pinned version for `jwt` from `~> 2.7.0` to `~> 3.2.0`
+
 ## [0.2.3] – 2024-07-29
 
 - Fix `Gemspec/AddRuntimeDependency` linter error
@@ -26,7 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [0.2.0] – 2023-06-13
 
 - Add support for signature verification using a JWKS: `TrueLayerSigning.verify_with_jwks(jwks)`
-    and `TrueLayerSigning.extract_jws_header(signature)`.
+  and `TrueLayerSigning.extract_jws_header(signature)`.
 
 ## [0.1.2] – 2023-05-19
 

data/Gemfile

@@ -2,4 +2,5 @@
 
 source "https://rubygems.org"
 
-gem "rubocop", "~> 1.57", require: false
+gem "rake", "~> 13.4", require: false
+gem "rubocop", "~> 1.88", require: false

data/lib/truelayer-signing/jwt.rb

@@ -6,23 +6,52 @@
 module JWT
   module_function
 
+  class TrueLayerToken < Token
+    # See https://github.com/jwt/ruby-jwt/blob/main/lib/jwt/token.rb#L61-L63
+    def encoded_payload
+      @encoded_payload ||= ::JWT::Base64.url_encode(payload)
+    end
+  end
+
   class TrueLayerEncode < Encode
+    # See https://github.com/jwt/ruby-jwt/blob/main/lib/jwt/encode.rb#L15-L19
+    def initialize(options)
+      super
+
+      @token     = TrueLayerToken.new(payload: options[:payload], header: options[:headers])
+      @key       = options[:key]
+      @algorithm = options[:algorithm]
+    end
+  end
+
+  class TrueLayerEncodedToken < EncodedToken
     private
 
-    # See https://github.com/jwt/ruby-jwt/blob/main/lib/jwt/encode.rb#L53-L55
-    def encode_payload
-      ::JWT::Base64.url_encode(@payload)
+    # See https://github.com/jwt/ruby-jwt/blob/main/lib/jwt/encoded_token.rb#L189-L198
+    def decode_payload
+      raise JWT::DecodeError, "Encoded payload is empty" if encoded_payload == ""
+
+      if unencoded_payload?
+        verify_claims!(crit: ["b64"])
+        return parse_unencoded(encoded_payload)
+      end
+
+      ::JWT::Base64.url_decode(encoded_payload || "")
     end
   end
 
   class TrueLayerDecode < Decode
-    private
+    # See https://github.com/jwt/ruby-jwt/blob/main/lib/jwt/decode.rb#L22-L30
+    def initialize(jwt, key, verify, options, &keyfinder)
+      super
 
-    # See https://github.com/jwt/ruby-jwt/blob/main/lib/jwt/decode.rb#L154-L156
-    def payload
-      @payload ||= ::JWT::Base64.url_decode(@segments[1])
-    rescue ::JSON::ParserError
-      raise JWT::DecodeError, "Invalid segment encoding"
+      raise JWT::DecodeError, "Nil JSON web token" unless jwt
+
+      @token = TrueLayerEncodedToken.new(jwt)
+      @key = key
+      @options = options
+      @verify = verify
+      @keyfinder = keyfinder
     end
   end
 
@@ -35,8 +64,16 @@ module JWT
     ).segments
   end
 
-  # rubocop:disable Style/OptionalArguments, Style/OptionalBooleanParameter
-  def truelayer_decode(jwt, key, verify = true, options, &keyfinder)
+  # rubocop:disable Style/OptionalBooleanParameter, Naming/BlockForwarding
+  def truelayer_decode(jwt, key, verify = true, options = {}, &keyfinder)
+    # Support both `truelayer_decode(jwt, key, options)` and
+    # `truelayer_decode(jwt, key, verify, options)` call styles by treating a
+    # Hash in the `verify` position as the `options` argument.
+    if verify.is_a?(Hash)
+      options = verify
+      verify = true
+    end
+
     TrueLayerDecode.new(
       jwt,
       key,
@@ -45,5 +82,5 @@ module JWT
       &keyfinder
     ).decode_segments
   end
-  # rubocop:enable Style/OptionalArguments, Style/OptionalBooleanParameter
+  # rubocop:enable Style/OptionalBooleanParameter, Naming/BlockForwarding
 end

data/lib/truelayer-signing/verifier.rb

@@ -2,8 +2,6 @@
 
 module TrueLayerSigning
   class Verifier < JwsBase
-    EXPECTED_EC_KEY_COORDS_LENGTH = 66
-
     attr_reader :required_headers, :key_type, :key_value
 
     def initialize(args)
@@ -109,27 +107,12 @@ module TrueLayerSigning
 
         raise(Error, "JWKS does not include given `kid` value") unless jwk
 
-        valid_jwk = apply_zero_padding_as_needed(jwk)
-
-        JWT::JWK::EC.import(valid_jwk).public_key
+        JWT::JWK::EC.import(jwk).public_key
       else
         raise(Error, "Type of public key not recognised")
       end
     end
 
-    def apply_zero_padding_as_needed(jwk)
-      valid_jwk = jwk.clone
-
-      %i(x y).each do |elem|
-        coords = Base64.urlsafe_decode64(valid_jwk[elem])
-        diff = EXPECTED_EC_KEY_COORDS_LENGTH - coords.length
-
-        valid_jwk[elem] = Base64.urlsafe_encode64(("\x00" * diff) + coords) if diff.positive?
-      end
-
-      valid_jwk
-    end
-
     def validate_required_headers!(headers)
       raise(Error, "Signature missing required header(s)") if required_headers&.any? do |key|
         !headers.key?(key.downcase)

data/test/test-truelayer-signing.rb

@@ -123,7 +123,7 @@ class TrueLayerSigningTest < Minitest::Test
     body = { currency: "GBP", max_amount_in_minor: 50_000_00, name: "Foo???" }.to_json
     idempotency_key = "idemp-2076717c-9005-4811-a321-9e0787fa0382"
     path = "/merchant_accounts/a61acaef-ee05-4077-92f3-25543a11bd8d/sweeping"
-    tl_signature = read_file("../../test-resources/tl-signature.txt")
+    tl_signature = read_file("../../test-resources/tl-signature.txt").strip
 
     result = TrueLayerSigning.verify_with_pem(PUBLIC_KEY)
       .set_method(:post)
@@ -403,7 +403,7 @@ class TrueLayerSigningTest < Minitest::Test
   end
 
   def test_verify_with_jwks_should_succeed
-    hook_signature = read_file("../../test-resources/webhook-signature.txt")
+    hook_signature = read_file("../../test-resources/webhook-signature.txt").strip
     jwks = read_file("../../test-resources/jwks.json")
     body = { event_type: "example", event_id: "18b2842b-a57b-4887-a0a6-d3c7c36f1020" }.to_json
 
@@ -418,18 +418,6 @@ class TrueLayerSigningTest < Minitest::Test
 
   def test_verify_with_jwks_with_zero_padding_missing_should_succeed
     jwks = read_file("resources/missing-zero-padding-test-jwks.json")
-
-    # JWKS with EC key missing zero padded coords is not supported by `jwt` gem
-
-    jwks_as_json = JSON.parse(jwks, symbolize_names: true)
-    jwk_missing_padding = jwks_as_json[:keys].find { |e| e[:kty] == "EC" }
-    imported_jwk = JWT::JWK::EC.import(jwk_missing_padding)
-
-    error = assert_raises(OpenSSL::PKey::EC::Point::Error) { imported_jwk.public_key.check_key }
-    assert_equal("EC_POINT_bn2point: invalid encoding", error.message)
-
-    # But supported by `truelayer-signing` using zero padding (prepend)
-
     payload = read_file("resources/missing-zero-padding-test-payload.json")
     body = JSON.parse(payload).to_json
 
@@ -438,11 +426,11 @@ class TrueLayerSigningTest < Minitest::Test
       .set_path("/a147f26a-f07e-47e3-9526-d52f1f1fdd55")
       .add_header("x-tl-webhook-timestamp", "2023-06-09T15:40:30Z")
       .set_body(body)
-      .verify(read_file("resources/missing-zero-padding-test-signature.txt"))
+      .verify(read_file("resources/missing-zero-padding-test-signature.txt").strip)
   end
 
   def test_verify_with_jwks_with_wrong_timestamp_should_fail
-    hook_signature = read_file("../../test-resources/webhook-signature.txt")
+    hook_signature = read_file("../../test-resources/webhook-signature.txt").strip
     jwks = read_file("../../test-resources/jwks.json")
     body = { event_type: "example", event_id: "18b2842b-a57b-4887-a0a6-d3c7c36f1020" }.to_json
 

data/truelayer-signing.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(File.join(File.dirname(__FILE__), "lib"))
 
 Gem::Specification.new do |s|
   s.name = "truelayer-signing"
-  s.version = "0.2.3"
+  s.version = "0.3.0"
   s.summary = "Ruby gem to produce and verify TrueLayer API requests signatures"
   s.description = "TrueLayer provides instant access to open banking to " \
     "easily integrate next-generation payments and financial data into any app." \
@@ -27,10 +27,10 @@ Gem::Specification.new do |s|
     "Rakefile",
     "lib/**/*.*",
     "test/**/*.*",
-    "truelayer-signing.gemspec",
+    "truelayer-signing.gemspec"
   ]
   s.require_path = "lib"
 
-  s.required_ruby_version = ">= 2.7"
-  s.add_dependency("jwt", "~> 2.7.0")
+  s.required_ruby_version = ">= 3.2"
+  s.add_dependency("jwt", "~> 3.2.0")
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: truelayer-signing
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.3.0
 platform: ruby
 authors:
 - Kevin Plattret
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-07-29 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -16,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.7.0
+        version: 3.2.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 2.7.0
+        version: 3.2.0
 description: TrueLayer provides instant access to open banking to easily integrate
   next-generation payments and financial data into any app.This helps easily sign
   TrueLayer API requests using a JSON web signature.
@@ -58,7 +57,6 @@ licenses:
 metadata:
   bug_tracker_uri: https://github.com/TrueLayer/truelayer-signing/issues
   changelog_uri: https://github.com/TrueLayer/truelayer-signing/blob/main/ruby/CHANGELOG.md
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -66,15 +64,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '2.7'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
-signing_key: 
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Ruby gem to produce and verify TrueLayer API requests signatures
 test_files: []