workato-connector-sdk 0.3.0 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b958407bc907daf631e2bd91ecb5c002f911906e3bf8a88c00aedd612fe80bbe
-  data.tar.gz: 1445969d82d648667e1de62809722625d06e40a30bb4bec565f56f1b7ce113da
+  metadata.gz: 0d849d4b677b749ece945ac694dc692e30ec1dee7d78c70e601a5e3b54d8c9ab
+  data.tar.gz: 17b87e09bee6d75ca84e8a8332effacb20350056df7995ccbce4f71f41679cc3
 SHA512:
-  metadata.gz: 4ad8b4ef4ed273ad65573acb5a4e45dd1e0772b24a4de82cc4c40a3fe0a926c8f93f067eab0df2a6f23b0f94317f2d4bcaad588d203f9323417d7a973084a1fe
-  data.tar.gz: 879463eea7f3e0b9ef01ce1a5019eafbc8af18610306541ff97f6b62520869e0db8d1de1c0a61b9bb3c233c0932dc780e1ec04fd61704350ece80e9fbf9c764d
+  metadata.gz: 0c89fc0971c2a247151bfdb08554e7479b1bb0a40e49d5da92c131ac698cdd2a6d0b7dded9d762d2fe853596e6a02a1986bcbe5127a72381d462fb9cc224caac
+  data.tar.gz: 53a8a4acbe3b23a46676327c87868682faf952a5d49ed2adb46f4b9193f7b55d5c45b1bde5d9a443ff043aa7402b5a5b4a981486e5b998d1b446b864bbc70eec

data/lib/workato/cli/exec_command.rb

@@ -85,10 +85,10 @@ module Workato
         )
         @settings = settings_store.read
 
-        Workato::Connector::Sdk::Operation.on_settings_updated = lambda do |_, _, exception, new_settings|
+        Workato::Connector::Sdk::Operation.on_settings_updated = lambda do |message, new_settings|
           $stdout.pause if verbose?
           say('')
-          say("Refresh token triggered on response \"#{exception}\"")
+          say(message)
           loop do
             answer = ask('Updated settings file with new connection attributes? (Yes or No)').to_s.downcase
             break if %w[n no].include?(answer)

data/lib/workato/connector/sdk/dsl/aws.rb

@@ -0,0 +1,225 @@
+# frozen_string_literal: true
+
+module Workato
+  module Connector
+    module Sdk
+      module Dsl
+        module AWS
+          TEMP_CREDENTIALS_REFRESH_TIMEOUT = 60 # seconds
+
+          DUMMY_AWS_IAM_EXTERNAL_ID = 'dummy-aws-iam-external-id'
+          DUMMY_AWS_WORKATO_ACCOUNT_ID = 'dummy-aws-workato-account-id'
+
+          AMAZON_ROLE_CLIENT_ID = ENV['AMAZON_ROLE_CLIENT_ID']
+          AMAZON_ROLE_CLIENT_KEY = ENV['AMAZON_ROLE_CLIENT_KEY']
+          AMAZON_ROLE_CLIENT_SECRET = ENV['AMAZON_ROLE_CLIENT_SECRET']
+
+          WWW_FORM_CONTENT_TYPE = 'application/x-www-form-urlencoded; charset=utf-8'
+
+          def aws
+            AWS
+          end
+
+          class << self
+            def generate_signature(connection:,
+                                   service:,
+                                   region:,
+                                   host: "#{service}.#{region}.amazonaws.com",
+                                   path: '/',
+                                   method: 'GET',
+                                   params: {},
+                                   headers: {},
+                                   payload: '')
+
+              credentials = if connection[:aws_assume_role].present?
+                              role_based_auth(settings: connection)
+                            else
+                              {
+                                access_key_id: connection[:aws_api_key],
+                                secret_access_key: connection[:aws_secret_key]
+                              }
+                            end
+
+              url, headers = create_signature(
+                credentials: credentials,
+                service: service,
+                host: host,
+                region: region,
+                method: method,
+                path: path,
+                params: params,
+                headers: (headers || {}).with_indifferent_access,
+                payload: payload
+              )
+
+              {
+                url: url,
+                headers: headers
+              }.with_indifferent_access
+            end
+
+            def iam_external_id
+              settings[:aws_external_id] || DUMMY_AWS_IAM_EXTERNAL_ID
+            end
+
+            def workato_account_id
+              settings[:aws_workato_account_id] || AMAZON_ROLE_CLIENT_ID || DUMMY_AWS_WORKATO_ACCOUNT_ID
+            end
+
+            private
+
+            def on_settings_updated
+              Workato::Connector::Sdk::Operation.on_settings_updated
+            end
+
+            def role_based_auth(settings:)
+              settings[:aws_external_id] ||= iam_external_id
+              temp_credentials = settings[:temp_credentials] || {}
+
+              # Refresh temp token that will expire within 60 seconds.
+              expiration = temp_credentials[:expiration]&.to_time(:utc)
+              if !expiration || expiration <= TEMP_CREDENTIALS_REFRESH_TIMEOUT.seconds.from_now
+                temp_credentials = refresh_temp_credentials(settings)
+              end
+              {
+                access_key_id: temp_credentials[:api_key],
+                secret_access_key: temp_credentials[:secret_key],
+                session_token: temp_credentials[:session_token]
+              }
+            end
+
+            def refresh_temp_credentials(settings)
+              sts_credentials = {
+                access_key_id: amazon_role_client_key(settings),
+                secret_access_key: amazon_role_client_secret(settings)
+              }
+
+              sts_params = {
+                'Version' => '2011-06-15',
+                'Action' => 'AssumeRole',
+                'RoleSessionName' => 'workato',
+                'RoleArn' => settings[:aws_assume_role],
+                'ExternalId' => settings[:aws_external_id].presence
+              }.compact
+
+              sts_auth_url, sts_auth_headers = create_signature(
+                credentials: sts_credentials,
+                params: sts_params,
+                service: 'sts',
+                host: 'sts.amazonaws.com',
+                region: 'us-east-1',
+                headers: {
+                  'Accept' => 'application/xml',
+                  'Content-Type' => WWW_FORM_CONTENT_TYPE
+                }
+              )
+
+              request_temp_credentials(url: sts_auth_url, headers: sts_auth_headers).tap do |temp_credentials|
+                update_settings(settings, temp_credentials)
+              end
+            rescue StandardError => e
+              raise e if settings[:aws_external_id].blank?
+
+              settings[:aws_external_id] = nil
+              retry
+            end
+
+            def update_settings(settings, temp_credentials)
+              settings.merge!(temp_credentials: temp_credentials)
+              Workato::Connector::Sdk::Operation.on_settings_updated&.call(
+                'Refresh AWS temporary credentials',
+                settings
+              )
+            end
+
+            def request_temp_credentials(url:, headers:)
+              response = RestClient::Request.execute(
+                url: url,
+                headers: headers,
+                method: :get
+              )
+              response = Workato::Connector::Sdk::Xml.parse_xml_to_hash(response.body)
+
+              temp_credentials = response.dig('AssumeRoleResponse', 0, 'AssumeRoleResult', 0, 'Credentials', 0)
+              {
+                session_token: temp_credentials.dig('SessionToken', 0, 'content!'),
+                api_key: temp_credentials.dig('AccessKeyId', 0, 'content!'),
+                secret_key: temp_credentials.dig('SecretAccessKey', 0, 'content!'),
+                expiration: temp_credentials.dig('Expiration', 0, 'content!')
+              }
+            end
+
+            def create_signature(credentials:,
+                                 service:,
+                                 host:,
+                                 region:,
+                                 path: '/',
+                                 method: 'GET',
+                                 params: {},
+                                 headers: {},
+                                 payload: '')
+              url = URI::HTTPS.build(host: host, path: path, query: params.presence.to_param&.gsub('+', '%20')).to_s
+              signer_options = {
+                service: service,
+                region: region,
+                access_key_id: amazon_role_client_key(credentials),
+                secret_access_key: amazon_role_client_secret(credentials),
+                session_token: credentials[:session_token]
+              }
+
+              apply_service_specific_options(service, headers, signer_options, payload)
+
+              signer = Aws::Sigv4::Signer.new(signer_options)
+              signature = signer.sign_request(http_method: method, url: url, headers: headers, body: payload)
+
+              headers_with_sig = merge_headers_with_sig_headers(headers, signature.headers)
+              headers_with_sig = headers_with_sig.transform_keys { |key| key.gsub(/\b[a-z]/, &:upcase) }
+              [url, headers_with_sig]
+            end
+
+            def apply_service_specific_options(service, headers, signer_options, payload)
+              accept_headers = headers.key?('Accept') || headers.key?('accept')
+              content_type = headers.key?('content-type') || headers.key?('Content-Type')
+
+              case service
+              when 'ec2'
+                signer_options[:apply_checksum_header] = false
+
+                headers.except!('Accept', 'Content-Type')
+              when 's3'
+                signer_options[:uri_escape_path] = false
+
+                headers['Accept'] = 'application/xml' unless accept_headers
+                headers['Content-Type'] = WWW_FORM_CONTENT_TYPE unless content_type
+                headers['X-Amz-Content-SHA256'] = 'UNSIGNED-PAYLOAD' if payload.blank?
+              when 'monitoring'
+                signer_options[:apply_checksum_header] = false
+
+                headers['Accept'] = 'application/json' unless accept_headers
+                headers['Content-Type'] = WWW_FORM_CONTENT_TYPE unless content_type
+              when 'lambda'
+                signer_options[:apply_checksum_header] = false
+
+                headers['Content-Type'] = WWW_FORM_CONTENT_TYPE unless content_type
+              end
+            end
+
+            def merge_headers_with_sig_headers(headers, sig_headers)
+              headers_keys = headers.transform_keys { |key| key.to_s.downcase }
+              sig_headers_to_merge = sig_headers.reject { |key| headers_keys.include?(key.downcase) }
+              headers.merge(sig_headers_to_merge)
+            end
+
+            def amazon_role_client_key(settings)
+              settings[:access_key_id] || AMAZON_ROLE_CLIENT_KEY
+            end
+
+            def amazon_role_client_secret(settings)
+              settings[:secret_access_key] || AMAZON_ROLE_CLIENT_SECRET
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/workato/connector/sdk/dsl/error.rb

@@ -6,7 +6,7 @@ module Workato
       module Dsl
         module Error
           def error(message)
-            raise message
+            raise Sdk::RuntimeError, message
           end
         end
       end

data/lib/workato/connector/sdk/dsl/http.rb

@@ -6,6 +6,10 @@ module Workato
       module Dsl
         # https://docs.workato.com/developing-connectors/sdk/sdk-reference/http.html#http-methods
         module HTTP
+          PARALLEL_SUCCESS_INDEX = 0
+          PARALLEL_RESULTS_INDEX = 1
+          PARALLEL_ERRORS_INDEX = 2
+
           def get(url, params = {})
             http_request(url, method: 'GET').params(params).response_format_json
           end
@@ -42,6 +46,21 @@ module Workato
             http_request(url, method: 'MOVE').payload(payload).format_json
           end
 
+          def parallel(requests = [], threads: 1, rpm: nil, requests_per_period: nil, period: 1.minute.to_i) # rubocop:disable Lint/UnusedMethodArgument
+            requests.each.with_object([true, [], []]) do |request, result|
+              response = nil
+              exception = nil
+              begin
+                response = request.execute!
+              rescue RequestError, RuntimeError => e
+                exception = e.to_s
+              end
+              result[PARALLEL_SUCCESS_INDEX] &&= exception.nil?
+              result[PARALLEL_RESULTS_INDEX] << response
+              result[PARALLEL_ERRORS_INDEX] << exception
+            end
+          end
+
           private
 
           def http_request(url, method:)

data/lib/workato/connector/sdk/dsl/workato_code_lib.rb

@@ -10,6 +10,8 @@ module Workato
           JWT_ALGORITHMS = %w[RS256 RS384 RS512].freeze
           JWT_RSA_KEY_MIN_LENGTH = 2048
 
+          VERIFY_RCA_ALGORITHMS = %w[SHA SHA1 SHA224 SHA256 SHA384 SHA512].freeze
+
           def workato
             WorkatoCodeLib
           end
@@ -38,6 +40,21 @@ module Workato
               ::JWT.encode(payload, rsa_private, algorithm, header_fields)
             end
 
+            def verify_rsa(payload, certificate, signature, algorithm = 'SHA256')
+              algorithm = algorithm.to_s.upcase
+              unless VERIFY_RCA_ALGORITHMS.include?(algorithm)
+                raise "Unsupported signing method. Supports only #{VERIFY_RCA_ALGORITHMS.join(', ')}. Got: '#{algorithm}'" # rubocop:disable Layout/LineLength
+              end
+
+              cert = OpenSSL::X509::Certificate.new(certificate)
+              digest = OpenSSL::Digest.new(algorithm)
+              cert.public_key.verify(digest, signature, payload)
+            rescue OpenSSL::PKey::PKeyError
+              raise 'An error occurred during signature verification. Check arguments'
+            rescue OpenSSL::X509::CertificateError
+              raise 'Invalid certificate format'
+            end
+
             def parse_yaml(yaml)
               ::Psych.safe_load(yaml)
             rescue ::Psych::DisallowedClass => e

data/lib/workato/connector/sdk/dsl.rb

@@ -10,6 +10,7 @@ require_relative './dsl/lookup_table'
 require_relative './dsl/workato_code_lib'
 require_relative './dsl/workato_schema'
 require_relative './dsl/time'
+require_relative './dsl/aws'
 
 module Workato
   module Connector
@@ -21,6 +22,7 @@ module Workato
           include LookupTable
           include WorkatoCodeLib
           include WorkatoSchema
+          include AWS
 
           def sleep(seconds)
             ::Kernel.sleep(seconds.presence || 0)

data/lib/workato/connector/sdk/errors.rb

@@ -9,6 +9,8 @@ module Workato
 
       CustomRequestError = Class.new(StandardError)
 
+      RuntimeError = Class.new(StandardError)
+
       class RequestError < StandardError
         attr_reader :method,
                     :code,
@@ -22,7 +24,7 @@ module Workato
         end
       end
 
-      class NotImplementedError < RuntimeError
+      class NotImplementedError < StandardError
         def initialize(msg = 'This part of Connector SDK is not implemented in workato-connector-sdk yet')
           super
         end

data/lib/workato/connector/sdk/operation.rb

@@ -81,7 +81,7 @@ module Workato
 
           settings.merge!(new_settings)
 
-          on_settings_updated&.call(http_body, http_code, exception, settings)
+          on_settings_updated&.call("Refresh token triggered on response \"#{exception}\"", settings)
 
           settings
         end

data/lib/workato/connector/sdk/version.rb

@@ -3,7 +3,7 @@
 module Workato
   module Connector
     module Sdk
-      VERSION = '0.3.0'
+      VERSION = '0.4.0'
     end
   end
 end

data/lib/workato/extension/string.rb

@@ -117,6 +117,10 @@ module Workato
         ::ERB::Util.url_encode(self)
       end
 
+      def decode_url
+        CGI.unescape(self)
+      end
+
       def decode_urlsafe_base64
         Extension::Binary.new(Base64.urlsafe_decode64(self))
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: workato-connector-sdk
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Pavel Abolmasov
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2021-12-14 00:00:00.000000000 Z
+date: 2022-01-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '5.2'
+- !ruby/object:Gem::Dependency
+  name: aws-sigv4
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.2.4
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 1.2.4
 - !ruby/object:Gem::Dependency
   name: countries
   requirement: !ruby/object:Gem::Requirement
@@ -374,6 +388,7 @@ files:
 - lib/workato/connector/sdk/connector.rb
 - lib/workato/connector/sdk/dsl.rb
 - lib/workato/connector/sdk/dsl/account_property.rb
+- lib/workato/connector/sdk/dsl/aws.rb
 - lib/workato/connector/sdk/dsl/call.rb
 - lib/workato/connector/sdk/dsl/error.rb
 - lib/workato/connector/sdk/dsl/http.rb