weixin_rails_middleware 1.0.5 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 7f65d96d4e58350a83ec0fba14b711b4250e79c3
-  data.tar.gz: 21999d40da51005a1ad025473a6fd987a3e77af5
+  metadata.gz: c106f4f5b4f9a69155ebed8496650fea9e818c5e
+  data.tar.gz: 5e14b1dcb4fb846396a93d2e243fd1591310f645
 SHA512:
-  metadata.gz: f7178de0133a47bf05e75c1bbc9d11bcab4a1b9b86b5bfad3cecb255f206c7b6638d5c2daa5dd09edae8bf1bb8fcda83068b91bb9ac126e6464a937f82b37ef6
-  data.tar.gz: 20d4da31eb5d6fce51b72f40bd7ce1ffc672d1e82c4d408efdd2f574091a1fda836239e39b2692546bcae5d5bdcbf817b05e2b821c14de83ca2919335898da06
+  metadata.gz: 7cf5f89774e7659dffe2b12be128348b0fb34e12afd73cf9cb9db80c230ced3996ec37033cd62a492969f727aefed648a29b86be905043f0237cddac07adf349
+  data.tar.gz: 140ce490d0704183158f44112cb2cb9460a99628a0e462507ae820cefc49ac4c95794b45f50a12a58d0a2820f01c7a4422c44e179af19fb094bd5aae361fd49c

data/app/controllers/weixin_rails_middleware/weixin_controller.rb

@@ -4,9 +4,9 @@ module WeixinRailsMiddleware
     include ConfigurationHelpers
     include WeixinAuthorizeHelper
 
-    skip_before_action :verify_authenticity_token
-    before_action :check_weixin_params, only: [:index, :reply]
-    before_action :set_weixin_public_account, :set_weixin_message, only: :reply
+    skip_before_filter :verify_authenticity_token
+    before_filter :check_weixin_params, only: [:index, :reply]
+    before_filter :set_weixin_public_account, :set_weixin_message, only: :reply
 
     def index
       render text: params[:echostr]
@@ -20,8 +20,8 @@ module WeixinRailsMiddleware
       ## Callback
       # e.g. will generate +@weixin_public_account+
       def set_weixin_public_account
-        return nil if token_string.present?
-        @weixin_public_account ||= token_model_instance
+        return nil if weixin_token_string.present?
+        @weixin_public_account ||= current_weixin_public_account
       end
 
       def set_weixin_message

data/config/routes.rb

@@ -1,4 +1,4 @@
 WeixinRailsMiddleware::Engine.routes.draw do
-  get  'weixin/:weixin_token', to: 'weixin#index', as: :weixin_index
-  post 'weixin/:weixin_token', to: 'weixin#reply', as: :weixin_reply
+  get  'weixin/:weixin_secret_key', to: 'weixin#index', as: :weixin_index
+  post 'weixin/:weixin_secret_key', to: 'weixin#reply', as: :weixin_reply
 end

data/lib/generators/templates/add_weixin_secret_key_and_weixin_token_migration.rb

@@ -0,0 +1,16 @@
+class AddWeixinSecretKeyAndWeixinTokenTo<%= table_name.camelize %> < ActiveRecord::Migration
+  def self.up
+    change_table(:<%= table_name %>) do |t|
+      t.string :weixin_secret_key
+      t.string :weixin_token
+    end
+    add_index :<%= table_name %>, :weixin_secret_key
+    add_index :<%= table_name %>, :weixin_token
+  end
+
+  def self.down
+    # By default, we don't want to make any assumption about how to roll back a migration when your
+    # model already existed. Please edit below which fields you would like to remove in this migration.
+    raise ActiveRecord::IrreversibleMigration
+  end
+end

data/lib/generators/templates/install_weixin_rails_middleware.rb

@@ -0,0 +1,23 @@
+# Use this hook to configure WeixinRailsMiddleware bahaviors.
+WeixinRailsMiddleware.configure do |config|
+
+  ## NOTE:
+  ## If you config all them, it will use `weixin_token_string` default
+
+  ## Config public_account_class if you SAVE public_account into database ##
+  # Th first configure is fit for your weixin public_account is saved in database.
+  # +public_account_class+ The class name that to save your public_account
+  # config.public_account_class = ""
+
+  ## Here configure is for you DON'T WANT TO SAVE your public account into database ##
+  # Or the other configure is fit for only one weixin public_account
+  # If you config `weixin_token_string`, so it will directly use it
+  # config.weixin_token_string = '<%= SecureRandom.hex(12) %>'
+  # using to weixin server url to validate the token can be trusted.
+  # config.weixin_secret_string = '<%= WeiXinUniqueToken.generate(generator: :urlsafe_base64, size: 24) %>'
+
+  ## Router configure ##
+  # Default is "/", and recommend you use default directly.
+  # config.engine_path = "/"
+
+end

data/lib/generators/weixin_rails_middleware/install_generator.rb

@@ -5,14 +5,14 @@ module WeixinRailsMiddleware
     class InstallGenerator < Rails::Generators::Base
       source_root File.expand_path('../../templates', __FILE__)
 
-      desc 'Creates a Dashing initializer for your application.'
+      desc 'Creates a WeixinRailsMiddleware initializer for your application.'
 
       def install
         route 'mount WeixinRailsMiddleware::Engine, at: WeixinRailsMiddleware.config.engine_path'
       end
 
       def copy_initializer
-        template 'initializer.rb', 'config/initializers/weixin_rails_middleware.rb'
+        template 'install_weixin_rails_middleware.rb', 'config/initializers/weixin_rails_middleware.rb'
       end
 
       def configure_application
@@ -32,4 +32,4 @@ module WeixinRailsMiddleware
 
     end
   end
-end
+end

data/lib/generators/weixin_rails_middleware/migration_generator.rb

@@ -0,0 +1,15 @@
+require 'rails/generators/active_record'
+
+module WeixinRailsMiddleware
+  module Generators
+    class MigrationGenerator < ActiveRecord::Generators::Base
+      source_root File.expand_path('../../templates', __FILE__)
+
+      desc 'Adds a Wexin Secret Key for your application.'
+      def create_migration_file
+        migration_template "add_weixin_secret_key_and_weixin_token_migration.rb", "db/migrate/add_weixin_secret_key_and_weixin_token_to_#{plural_name}.rb"
+      end
+
+    end
+  end
+end

data/lib/weixin_rails_middleware.rb

@@ -3,7 +3,6 @@ require "weixin_rails_middleware/engine"
 require "weixin_rails_middleware/models/message"
 require "weixin_rails_middleware/models/reply_message"
 require "weixin_rails_middleware/helpers/reply_weixin_message_helper"
-require "weixin_rails_middleware/helpers/weixin_token_form_helper"
 require "weixin_rails_middleware/helpers/unique_token_helper"
 require "weixin_rails_middleware/helpers/weixin_authorize_helper"
 
@@ -11,20 +10,7 @@ module WeixinRailsMiddleware
 
   DEFAULT_TOKEN_COLUMN_NAME = "weixin_token".freeze
   DEFAULT_ENGINE_PATH       = "/".freeze
-
-  class << self
-
-    attr_accessor :configuration
-
-    def config
-      self.configuration ||= Configuration.new
-    end
-
-    def configure
-      yield config if block_given?
-    end
-
-  end
+  DEFAULT_WEIXIN_SECRET_KEY = "weixin_secret_key".freeze
 
 end
 

data/lib/weixin_rails_middleware/configuration.rb

@@ -1,12 +1,27 @@
 module WeixinRailsMiddleware
+
+  class << self
+
+    attr_accessor :configuration
+
+    def config
+      self.configuration ||= Configuration.new
+    end
+
+    def configure
+      yield config if block_given?
+    end
+
+  end
+
   class Configuration
-    # use 'token_model': if the token is saved in SomeModel, then find token by it
-    # use 'token_string': if the token is a String, just use it,
-    attr_accessor :token_model, :token_column, :token_string, :engine_path
+    # use 'public_account_class': if the token is saved in SomeModel, then find token by it
+    # use 'weixin_token': if the token is a String, just use it,
+    attr_accessor :public_account_class, :weixin_token_string, :weixin_secret_string
+    attr_accessor :engine_path
 
     def initialize
-      @engine_path  = DEFAULT_ENGINE_PATH
-      @token_column = DEFAULT_TOKEN_COLUMN_NAME
+      @engine_path = DEFAULT_ENGINE_PATH
     end
 
   end
@@ -18,16 +33,16 @@ module WeixinRailsMiddleware
       @engine_path ||= WeixinRailsMiddleware.config.engine_path
     end
 
-    def token_string
-      @token_string ||= WeixinRailsMiddleware.config.token_string.to_s
+    def weixin_token_string
+      @weixin_token_string ||= WeixinRailsMiddleware.config.weixin_token_string.to_s
     end
 
-    def token_column
-      @token_column ||= WeixinRailsMiddleware.config.token_column
+    def token_model
+      @public_account_class ||= WeixinRailsMiddleware.config.public_account_class
     end
 
-    def token_model
-      @token_model ||= WeixinRailsMiddleware.config.token_model
+    def weixin_secret_string
+      @weixin_secret_string ||= WeixinRailsMiddleware.config.weixin_secret_string.to_s
     end
 
     def is_default_engine_path?
@@ -36,9 +51,9 @@ module WeixinRailsMiddleware
 
     def token_model_class
       if token_model.blank?
-        raise "You need to config `token_model` in 'config/initializers/weixin_rails_middleware.rb'"
+        raise "You need to config `public_account_class` in 'config/initializers/weixin_rails_middleware.rb'"
       end
-      @token_model_c ||= token_model.constantize
+      @token_model_class_name ||= token_model.constantize
     end
   end
 end

data/lib/weixin_rails_middleware/engine.rb

@@ -1,7 +1,25 @@
 module WeixinRailsMiddleware
   class Engine < ::Rails::Engine
+    include ConfigurationHelpers
+
     isolate_namespace WeixinRailsMiddleware
     engine_name :weixin_engine
 
+    config.after_initialize do
+      token_model_callback if token_model.present?
+    end
+
+    private
+
+      def token_model_callback
+        token_model_class.class_eval do
+          before_create do
+            # TODO: refactor
+            self.weixin_secret_key = WeiXinUniqueToken.generate(generator: :urlsafe_base64, size: 24) if weixin_secret_key.blank?
+            self.weixin_token = WeiXinUniqueToken.generate if weixin_token.blank?
+          end
+        end
+      end
+
   end
 end

data/lib/weixin_rails_middleware/helpers/weixin_authorize_helper.rb

@@ -5,20 +5,20 @@ module WeixinRailsMiddleware
     protected
 
       def check_weixin_params
-        if check_weixin_token_valid? && !is_hexdigest?
+        if is_weixin_secret_key_valid? && is_signature_invalid?
           render text: "Forbidden", status: 403
         end
       end
 
       # check the token from Weixin Service is exist in local store.
-      def check_weixin_token_valid?
-        if token_string.blank?
-          if token_model_instance.blank?
+      def is_weixin_secret_key_valid?
+        if weixin_token_string.blank?
+          if current_weixin_public_account.blank?
             render text: "Forbidden", status: 403
             return false
           end
         else
-          if current_weixin_token != token_string
+          if current_weixin_secret_key != weixin_secret_string
             render text: "Forbidden", status: 403
             return false
           end
@@ -26,22 +26,27 @@ module WeixinRailsMiddleware
         true
       end
 
-      def is_hexdigest?
-        signature = params[:signature] || ''
-        timestamp = params[:timestamp] || ''
-        nonce     = params[:nonce]     || ''
-        current_signature = Digest::SHA1.hexdigest([current_weixin_token, timestamp, nonce].sort.join)
-        return true if current_signature == signature
+      def is_signature_invalid?
+        signature   = params[:signature] || ''
+        timestamp   = params[:timestamp] || ''
+        nonce       = params[:nonce]     || ''
+        sort_params = [current_weixin_token, timestamp, nonce].sort.join
+        current_signature = Digest::SHA1.hexdigest(sort_params)
+        return true if current_signature != signature
         false
       end
 
+      def current_weixin_secret_key
+        @weixin_secret_key = params[:weixin_secret_key]
+      end
+
       def current_weixin_token
-        @weixin_token = params[:weixin_token]
+        return weixin_token_string if weixin_token_string.present?
+        current_weixin_public_account.try(DEFAULT_TOKEN_COLUMN_NAME)
       end
 
-      def token_model_instance
-        token_model_instance = token_model_class.where("#{token_column}" => current_weixin_token).first
-        token_model_instance
+      def current_weixin_public_account
+        @current_weixin_public_account = token_model_class.where("#{DEFAULT_WEIXIN_SECRET_KEY}" => current_weixin_secret_key).first
       end
 
       # return a message class with current_weixin_params

data/lib/weixin_rails_middleware/version.rb

@@ -1,3 +1,3 @@
 module WeixinRailsMiddleware
-  VERSION = "1.0.5".freeze
+  VERSION = "1.1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: weixin_rails_middleware
 version: !ruby/object:Gem::Version
-  version: 1.0.5
+  version: 1.1.0
 platform: ruby
 authors:
 - lanrion
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-03-19 00:00:00.000000000 Z
+date: 2014-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 1.7.9
+        version: 1.9.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 1.7.9
+        version: 1.9.0
 - !ruby/object:Gem::Dependency
   name: multi_xml
   requirement: !ruby/object:Gem::Requirement
@@ -105,9 +105,11 @@ files:
 - Rakefile
 - app/controllers/weixin_rails_middleware/weixin_controller.rb
 - config/routes.rb
-- lib/generators/templates/initializer.rb
+- lib/generators/templates/add_weixin_secret_key_and_weixin_token_migration.rb
+- lib/generators/templates/install_weixin_rails_middleware.rb
 - lib/generators/templates/weixin_controller.rb
 - lib/generators/weixin_rails_middleware/install_generator.rb
+- lib/generators/weixin_rails_middleware/migration_generator.rb
 - lib/tasks/weixin_rails_middleware_tasks.rake
 - lib/weixin_rails_middleware.rb
 - lib/weixin_rails_middleware/configuration.rb
@@ -115,7 +117,6 @@ files:
 - lib/weixin_rails_middleware/helpers/reply_weixin_message_helper.rb
 - lib/weixin_rails_middleware/helpers/unique_token_helper.rb
 - lib/weixin_rails_middleware/helpers/weixin_authorize_helper.rb
-- lib/weixin_rails_middleware/helpers/weixin_token_form_helper.rb
 - lib/weixin_rails_middleware/models/message.rb
 - lib/weixin_rails_middleware/models/reply_message.rb
 - lib/weixin_rails_middleware/version.rb

data/lib/generators/templates/initializer.rb

@@ -1,22 +0,0 @@
-# Use this hook to configure WeixinRailsMiddleware bahaviors.
-WeixinRailsMiddleware.configure do |config|
-
-  ## NOTE:
-  ## If you config all them, it will use `token_string` default
-  ##
-  # Th first configure is fit for your weixin public_account is saved in database.
-  # +token_model+ and +token_column+ must in the same table.
-  # +token_model+ The class name that to save your public_account
-  # +token_column+ You can config a column name Optional, but you must have a column `weixin_token` default.
-  # config.token_model  = ""
-  # config.token_column = "weixin_token"
-
-  # Or the other configure is fit for only one weixin public_account
-  # If you config `token_string`, so it will directly use it
-  # config.token_string = "token string"
-
-  # Router
-  # Default is "/", and recommend you use default directly.
-  # config.engine_path = "/"
-
-end

data/lib/weixin_rails_middleware/helpers/weixin_token_form_helper.rb

@@ -1,43 +0,0 @@
-# custom weixin_token_field
-# usage: +f.weixin_token_field: weixin_token+
-module ActionView
-  module Helpers
-    module Tags # :nodoc:
-      class WeixinTokenField < TextField # :nodoc:
-        def render
-          # custom weixin_token value
-          @options["type"]="text"
-          @options = {value: generate_weixin_token }.merge!(@options)
-          super
-        end
-
-        private
-
-          def generate_weixin_token
-            @options.fetch("value"){value_before_type_cast(object)} || WeiXinUniqueToken.generate
-          end
-      end
-    end # end of Tags
-
-    module FormHelper
-      extend ActiveSupport::Concern
-      def weixin_token_field(object_name, method, options = {})
-        Tags::WeixinTokenField.new(object_name, method, self, options).render
-      end
-    end # end of FormHelper
-
-    class FormBuilder
-      selector = :weixin_token_field
-      class_eval <<-RUBY_EVAL, __FILE__, __LINE__ + 1
-        def #{selector}(method, options = {})  # def text_field(method, options = {})
-          @template.send(                      #   @template.send(
-            #{selector.inspect},               #     "text_field",
-            @object_name,                      #     @object_name,
-            method,                            #     method,
-            objectify_options(options))        #     objectify_options(options))
-        end                                    # end
-      RUBY_EVAL
-    end # end of FormHelper
-
-  end # HELPERS
-end