wix-apps 0.0.3 → 1.0.0

data/lib/wix-apps/version.rb

@@ -1,5 +1,5 @@
 module Wix
   module Apps
-    VERSION = "0.0.3"
+    VERSION = '1.0.0'
   end
 end

data/spec/lib/wix-apps/signed_instance_middleware_spec.rb

@@ -1,108 +1,174 @@
 require 'spec_helper'
 
+def in_middleware
+  expect(app).to receive(:call) do |env|
+    yield(env)
+    [200, {}, []]
+  end
+
+  response
+end
+
 describe Wix::Apps::SignedInstanceMiddleware do
   include Rack::Test::Methods
 
   let(:app) { lambda { |env| [200, {}, []] } }
   let(:secret) { 'd245bbf8-57eb-49d6-aeff-beff6d82cd39' }
-
-  let(:middleware) { Wix::Apps::SignedInstanceMiddleware.new(app, secured_paths: ['/wix'],
-                      secret_key: secret) }
+  let(:middleware) { Wix::Apps::SignedInstanceMiddleware.new(
+    app,
+    secured_paths: ['/wix', %r{\A/secured_paths_\d+\z}],
+    paths: ['/wix_path', %r{\A/paths_\d+\z}],
+    secret_key: secret)
+  }
   let(:mock_request) { Rack::MockRequest.new(middleware) }
+  let(:instance) { sign(params_required) }
 
-  let(:instance) { 'HottEZ2jPjqsqS8sFWwngJDZAc5L6BBv5j5N9WAN0Go.eyJpbnN0YW5jZUlkIjoiYjgxNDBlNGQtNDc1ZC00OGVkLTgxOWYtYmFkMGRlNDQ3MDY5Iiwic2lnbkRhdGUiOiIyMDEyLTA4LTExVDEzOjU2OjQ0LjYzNVoiLCJ1aWQiOm51bGwsInBlcm1pc3Npb25zIjpudWxsfQ' }
-  let(:response) { mock_request.get('/wix', params: { 'instance' => instance }) }
-
-  describe "Unsecured paths" do
+  describe 'a request to an unsecured path' do
     let(:response) { mock_request.get('/') }
-    it("returns a 200") { response.status.should == 200 }
+    it('returns a 200') do
+      expect(response.status).to eq 200
+    end
   end
 
-  describe "Secured Paths" do
-    describe "without instanse" do
-      let(:response) { mock_request.get('/wix') }
-      it("returns a 401") { response.status.should == 401 }
-    end
+  describe 'a request to' do
 
-    describe "with invalid instanse" do
-      let(:instance) { 'invalid.instance' }
-      it("returns a 403") { response.status.should == 403 }
-    end
+    shared_examples_for 'a request to a path' do
+      describe 'without an instance' do
+        let(:response) { mock_request.get(path) }
+
+        it('returns a 200') do
+          expect(response.status).to eq 200
+        end
+
+        it 'contains the instance key in the env' do
+          in_middleware { |env| expect(env.has_key?('wix.instance')).to eq true }
+        end
 
-    describe "with valid instalnse" do
-      it("returns a 200") { response.status.should == 200 }
+        it 'contains a nil instance in env' do
+          in_middleware { |env| expect(env['wix.instance']).to be_nil }
+        end
+
+      end
+
+      let(:response) { mock_request.get('/wix_path', params: {'instance' => instance}) }
+
+      describe 'with an empty instance' do
+        let(:instance) { nil }
+
+        it('returns a 403') do
+          expect(response.status).to eq 403
+        end
+
+      end
 
-      describe "instance parsing" do
-        it "have instance_id" do
-          app.should_receive(:call) do |arg|
-            arg['rack.request.query_hash']['parsed_instance']['instance_id']
-              .should eq('b8140e4d-475d-48ed-819f-bad0de447069')
+      describe 'with a valid anonymous instance' do
 
-            [200, {}, []]
-          end
+        let(:instance) { sign(params_required) }
 
-          response
+        it('returns a 200') do
+          expect(response.status).to eq 200
         end
 
-        it "have sign_date" do
-          app.should_receive(:call) do |arg|
-            arg['rack.request.query_hash']['parsed_instance']['sign_date']
-              .should eq(DateTime.parse("2012-08-11T13:56:44.635Z"))
-            [200, {}, []]
-          end
+        it 'contains the instance key in the env' do
+          in_middleware { |env| expect(env.has_key?('wix.instance')).to eq true }
+        end
 
-          response
+        it 'has an instance_id' do
+          in_middleware { |env| expect(env['wix.instance'].instance_id).to eq params_required[:instanceId] }
         end
+
       end
+    end
 
-      describe "logined user" do
-        let(:instance) { '0jepzq2Gi8zFxLdS_LhTuXIkmFR41H1QOstEtn1v4w0.eyJpbnN0YW5jZUlkIjoiOWY5YzVjMTYtNTljOC00NzA4LThjMjUtODU1NTA1ZGFhOTU0Iiwic2lnbkRhdGUiOiIyMDEyLTA4LTEyVDEwOjA0OjE3Ljg1MloiLCJ1aWQiOiIyOWQ4MjA0YS0zYjgyLTRhOTgtOGQ4Ni0yNDY0YTZiODM2ZGEiLCJwZXJtaXNzaW9ucyI6bnVsbH0' }
+    describe 'a path matched statically' do
+      let(:path) { '/wix_path' }
+      it_behaves_like 'a request to a path'
+    end
+
+    describe 'a path matched by regex' do
+      let(:path) { '/paths_9' }
+      it_behaves_like 'a request to a path'
+    end
+
+    shared_examples_for 'a request to a secured path' do
+      describe 'without an instance' do
+        let(:response) { mock_request.get(path) }
+        it('returns a 401') do
+          expect(response.status).to eq 401
+        end
+      end
 
-        it "have user_id" do
-          app.should_receive(:call) do |arg|
-            arg['rack.request.query_hash']['parsed_instance']['user_id']
-              .should eq('29d8204a-3b82-4a98-8d86-2464a6b836da')
-            [200, {}, []]
-          end
+      describe 'with an invalid instance' do
+        let(:instance) { 'invalid.instance' }
+        it('returns a 403') do
+          expect(response.status).to eq 403
+        end
+      end
 
-          response
+      describe 'with an empty instance' do
+        let(:instance) { nil }
+        it('returns a 403') do
+          expect(response.status).to eq 403
         end
+      end
 
-        it "don't have permissions" do
-          app.should_receive(:call) do |arg|
-            arg['rack.request.query_hash']['parsed_instance']['permissions']
-              .should be_nil
-            [200, {}, []]
-          end
+      let(:response) { mock_request.get(path, params: {'instance' => instance}) }
 
-          response
+      describe 'with a valid anonymous instance' do
+        it('returns a 200') do
+          expect(response.status).to eq 200
         end
+
+        it 'has an instance_id' do
+          in_middleware { |env| expect(env['wix.instance'].instance_id).to eq params_required[:instanceId] }
+        end
+
       end
 
+      describe 'with a valid logged in instance' do
+        let(:params_with_user) {
+          params_required.merge(uid: 'c713982b-9161-49bc-9ff5-67502e4b705b')
+        }
 
-      describe "owner" do
-        let(:instance) { 'zPsXLAaMznRbzXUiBo51bNzjKhVRo-GU5U4wSqyxzIg.eyJpbnN0YW5jZUlkIjoiOWY5YzVjMTYtNTljOC00NzA4LThjMjUtODU1NTA1ZGFhOTU0Iiwic2lnbkRhdGUiOiIyMDEyLTA4LTEyVDEwOjExOjIyLjkzNFoiLCJ1aWQiOiIyOWQ4MjA0YS0zYjgyLTRhOTgtOGQ4Ni0yNDY0YTZiODM2ZGEiLCJwZXJtaXNzaW9ucyI6Ik9XTkVSIn0' }
+        let(:instance) { sign(params_with_user) }
 
-        it "it have user_id" do
-          app.should_receive(:call) do |arg|
-            arg['rack.request.query_hash']['parsed_instance']['user_id']
-              .should eq('29d8204a-3b82-4a98-8d86-2464a6b836da')
-            [200, {}, []]
-          end
+        it 'has a user_id' do
+          in_middleware { |env| expect(env['wix.instance'].uid).to eq params_with_user[:uid] }
+        end
 
-          response
+        it 'does not have permissions' do
+          in_middleware { |env| expect(env['wix.instance'].permissions).to eq '' }
         end
+      end
+
+      describe 'with a valid owner instance' do
 
-        it "have permissions" do
-          app.should_receive(:call) do |arg|
-            arg['rack.request.query_hash']['parsed_instance']['permissions']
-              .should eq('OWNER')
-            [200, {}, []]
-          end
+        let(:params_with_owner) {
+          params_required.merge(uid: '92771668-366f-4ec6-be21-b32c78e7b734', permissions: 'OWNER')
+        }
+
+        let(:instance) { sign(params_with_owner) }
+
+        it 'have a user_id' do
+          in_middleware { |env| expect(env['wix.instance'].uid).to eq params_with_owner[:uid] }
+        end
 
-          response
+        it 'have permissions' do
+          in_middleware { |env| expect(env['wix.instance'].permissions).to eq params_with_owner[:permissions] }
         end
       end
     end
+
+    describe 'a secured path matched staically' do
+      let(:path) { '/wix' }
+      it_behaves_like 'a request to a secured path'
+    end
+
+    describe 'a secured path matched by regex' do
+      let(:path) { '/secured_paths_10' }
+      it_behaves_like 'a request to a secured path'
+    end
+
   end
-end
+
+end

data/spec/lib/wix-apps/signed_instance_spec.rb

@@ -1,104 +1,169 @@
 require 'spec_helper'
 
+describe 'signing test method' do
 
-describe Wix::Apps::SignedInstance do
   let(:raw_signed_instance) { 'naQKltLRVJwLVN90qQYpmmyzkVqFIH0hpvETYuivA1U.eyJpbnN0YW5jZUlkIjoiOWY5YzVjMTYtNTljOC00NzA4LThjMjUtODU1NTA1ZGFhOTU0Iiwic2lnbkRhdGUiOiIyMDEyLTA4LTA4VDE5OjQ3OjMxLjYyNFoiLCJ1aWQiOm51bGwsInBlcm1pc3Npb25zIjpudWxsfQ' }
-  let(:invalid_raw_signed_instance) {'Incorect Raw Signed Instance'}
   let(:raw_signed_instance_with_user_id) { 'K78r2uwAQbvA68u-bXxn2cdIUFMZIp8v9XfA_hd-iyo.eyJpbnN0YW5jZUlkIjoiOWY5YzVjMTYtNTljOC00NzA4LThjMjUtODU1NTA1ZGFhOTU0Iiwic2lnbkRhdGUiOiIyMDEyLTA4LTA4VDIyOjEwOjU2Ljg3NVoiLCJ1aWQiOiIyOWQ4MjA0YS0zYjgyLTRhOTgtOGQ4Ni0yNDY0YTZiODM2ZGEiLCJwZXJtaXNzaW9ucyI6bnVsbH0' }
   let(:raw_signed_in_owner_mode) { 'AjQ3BniGXfSOjKw4ej_V0kh4-WF5eB2IRnbvsak9kwc.eyJpbnN0YW5jZUlkIjoiOWY5YzVjMTYtNTljOC00NzA4LThjMjUtODU1NTA1ZGFhOTU0Iiwic2lnbkRhdGUiOiIyMDEyLTA4LTA4VDIyOjEyOjE2LjU4OVoiLCJ1aWQiOiIyOWQ4MjA0YS0zYjgyLTRhOTgtOGQ4Ni0yNDY0YTZiODM2ZGEiLCJwZXJtaXNzaW9ucyI6Ik9XTkVSIn0' }
 
-  subject { Wix::Apps::SignedInstance.new(raw_signed_instance, :secret => SECRET_KEY) }
+  it 'encodes correctly 1/3' do
+    decoded_json = decode(raw_signed_instance)
+    expect(sign_string(decoded_json)).to eq raw_signed_instance
+  end
 
-  describe "Initialization" do
-    describe "invalid format" do
-      subject { Wix::Apps::SignedInstance.new(invalid_raw_signed_instance, :secret => SECRET_KEY) }
+  it 'encodes correctly 2/3' do
+    decoded_json = decode(raw_signed_instance_with_user_id)
+    expect(sign_string(decoded_json)).to eq raw_signed_instance_with_user_id
+  end
 
-      it "raise SignedInstance::ParseError" do
-        expect { subject }.to raise_error Wix::Apps::SignedInstanceParseError
-      end
+  it 'encodes correctly 3/3' do
+    decoded_json = decode(raw_signed_in_owner_mode)
+    expect(sign_string(decoded_json)).to eq raw_signed_in_owner_mode
+  end
+
+end
+
+describe Wix::Apps::SignedInstance do
+
+  let(:params_with_user) {
+    params_required.merge(uid: 'c713982b-9161-49bc-9ff5-67502e4b705b')
+  }
+
+  let(:params_with_owner) {
+    params_required.merge(uid: '92771668-366f-4ec6-be21-b32c78e7b734', permissions: 'OWNER')
+  }
+
+  let(:invalid_raw_signed_instance) { 'Invalid signature format' }
+
+  describe 'Initialization' do
+
+    subject { Wix::Apps::SignedInstance.new(sign(params_required), secret_key: SECRET_KEY) }
+
+    it 'parses instanceId' do
+      expect(subject.instance_id).to eq params_required[:instanceId]
     end
 
-    it "parse instance_id" do
-      subject.instance_id.should == '9f9c5c16-59c8-4708-8c25-855505daa954'
+    it 'parses sign_date as DateTime' do
+      expect(subject.sign_date).to be_kind_of DateTime
     end
 
-    it "parse sign_date as Date" do
-      subject.sign_date.should be_kind_of(DateTime)
+    it 'parses sign_date' do
+      expect(subject.sign_date.rfc3339).to eq params_required[:signDate]
     end
 
-    it "parse sign_date" do
-      subject.sign_date.should == DateTime.rfc3339('2012-08-08T19:47:31.624Z')
+    it 'returns nil as user id' do
+      expect(subject.uid).to be_nil
     end
 
-    it "return nil as user id" do
-      subject.uid.should be_nil
+    it 'parses permissions' do
+      expect(subject.permissions).to eq params_required[:permissions]
     end
 
-    describe "With user id" do
-      subject { Wix::Apps::SignedInstance.new(raw_signed_instance_with_user_id, :secret => SECRET_KEY) }
+    it 'parses ipAndPort' do
+      expect(subject.ip_and_port).to eq params_required[:ipAndPort]
+    end
 
-      it "parse user id" do
-        subject.uid.should == '29d8204a-3b82-4a98-8d86-2464a6b836da'
-      end
+    it 'parses vendorProductId' do
+      expect(subject.vendor_product_id).to eq params_required[:vendorProductId]
+    end
+
+    it 'parses aid' do
+      expect(subject.aid).to eq params_required[:aid]
+    end
+
+    it 'parses siteOwnerId' do
+      expect(subject.site_owner_id).to eq params_required[:siteOwnerId]
+    end
 
+    it 'has owner not logged in' do
+      expect(subject.owner_logged_in?).to eq false
     end
 
-    describe "Owner Mode" do
-      subject { Wix::Apps::SignedInstance.new(raw_signed_in_owner_mode, :secret => SECRET_KEY) }
-      it "parse user id" do
-        subject.uid.should == '29d8204a-3b82-4a98-8d86-2464a6b836da'
+    describe 'With a user id' do
+      subject { Wix::Apps::SignedInstance.new(sign(params_with_user), secret_key: SECRET_KEY) }
+
+      it 'parses user id' do
+        expect(subject.uid).to eq params_with_user[:uid]
       end
 
-      it "parse permissions" do
-        subject.permissions == 'OWNER'
+      it 'has owner not logged in' do
+        expect(subject.owner_logged_in?).to eq false
       end
+
     end
-  end
 
-  describe "signature validation" do
+    describe 'with an owner' do
+      subject { Wix::Apps::SignedInstance.new(sign(params_with_owner), secret_key: SECRET_KEY) }
 
-    describe "secret is nil" do
-      subject { Wix::Apps::SignedInstance.new(raw_signed_instance) }
+      it 'has owner logged in' do
+        expect(subject.owner_logged_in?).to eq true
+      end
+
+      it 'parses permissions' do
+        expect(subject.permissions).to eq 'OWNER'
+      end
 
-      it "raise SignedInstanceNoSecretKey" do
-        expect { subject.valid? }.to raise_error Wix::Apps::SignedInstanceNoSecretKey
+      it 'has owner permissions' do
+        expect(subject.owner_permissions?).to eq true
       end
     end
 
-    describe "incorect signature" do
-      subject { Wix::Apps::SignedInstance.new(raw_signed_instance, :secret => 'another-secret') }
+    describe 'with missing required params' do
 
-      it "return false on valid?" do
-        subject.valid?.should be_false
+      params_required.keys.each do |key|
+        params = params_required.reject { |k, _| k == key }
+        subject { Wix::Apps::SignedInstance.new(sign(params), secret_key: SECRET_KEY) }
+        it "raises an exception when #{key} is missing" do
+          expect { subject }.to raise_error Wix::Apps::SignedInstanceParseError
+        end
       end
+
     end
+  end
 
-    describe "valid signature" do
-      it "return true on valid?" do
-        subject.valid?.should be_true
-      end
+  describe 'initialization without `strict_properties`' do
+    let(:params) { {instanceId: '123456789'} }
+    subject { Wix::Apps::SignedInstance.new(sign(params), secret_key: SECRET_KEY, strict_properties: false) }
+
+    it 'has an instance_id' do
+      expect(subject.instance_id).to eq params[:instanceId]
     end
   end
 
-  describe "owner?" do
-    describe "without user id" do
-      it "return false" do
-        subject.owner?.should be_false
+  describe 'signature validation' do
+
+    describe 'with an invalid format' do
+      subject { Wix::Apps::SignedInstance.new(invalid_raw_signed_instance, secret_key: SECRET_KEY) }
+
+      it 'raise SignedInstance::ParseError' do
+        expect { subject }.to raise_error Wix::Apps::SignedInstanceParseError
       end
     end
 
-    describe "with user id" do
-      subject { Wix::Apps::SignedInstance.new(raw_signed_instance_with_user_id, :secret => SECRET_KEY) }
-      it "return false" do
-        subject.owner?.should be_false
+    describe 'without a secret' do
+      subject { Wix::Apps::SignedInstance.new(sign(params_required)) }
+
+      it 'raises SignedInstanceNoSecretKey' do
+        expect { subject }.to raise_error Wix::Apps::SignedInstanceNoSecretKey
       end
     end
 
-    describe "in owner mode" do
-      subject { Wix::Apps::SignedInstance.new(raw_signed_in_owner_mode, :secret => SECRET_KEY) }
-      it "return true" do
-        subject.owner?.should be_true
+    describe 'with an incorrect secret' do
+      subject { Wix::Apps::SignedInstance.new(sign(params_required), secret_key: 'another-secret') }
+
+      it 'raise SignedInstanceParseError' do
+        expect { subject }.to raise_error Wix::Apps::SignedInstanceParseError
       end
     end
+
+    describe 'with a valid signature' do
+      subject { Wix::Apps::SignedInstance.new(sign(params_required), secret_key: SECRET_KEY) }
+
+      it 'should instantiate' do
+        expect(subject).to be_instance_of Wix::Apps::SignedInstance
+      end
+    end
+
   end
-end
+
+end