wsaa-ruby 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 398c92ee7bbeb19908d73033e371a8ee15c20e981eb377b26eccfa260d51c410
+  data.tar.gz: 7396411b2096967bd3113d77357b91c92bf64c41cc673993aa74bf2b1843ffd1
+SHA512:
+  metadata.gz: 0335726e838104a2738869286ff3da6e5ec5fc128d8ea3f23094c624b9ccbcf95363cdb09502097210fa970fbe1fc86b618058be773e780c84afff45e57dbec0
+  data.tar.gz: 79beb07a9f78bc8ff61ae4e8f2d6508417de9903e02c92c835e998710035b7a36a09d3e00a5d0a88b6fac9cb05c7e64fec1e1877369edf00b34658810451ad44

data/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+### Added
+- Initial gem structure

data/Gemfile

@@ -0,0 +1,6 @@
+source 'https://rubygems.org'
+
+gemspec
+
+# Pin rack to 2.x for httpi compatibility
+gem 'rack', '~> 2.0'

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Leandro Marcucci
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,61 @@
+# WSAA Ruby
+
+Ruby client for AFIP's WSAA (Web Service de Autenticación y Autorización).
+
+WSAA is the authentication service required to access AFIP's web services in Argentina. This gem handles the login process to obtain TOKEN and SIGN credentials needed to call other AFIP services like WSFE (electronic invoicing).
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'wsaa-ruby'
+```
+
+And then execute:
+
+```bash
+bundle install
+```
+
+Or install it yourself as:
+
+```bash
+gem install wsaa-ruby
+```
+
+## Usage
+
+```ruby
+require 'wsaa'
+
+# Configure the client
+Wsaa.configure do |config|
+  config.pkey = '/path/to/private_key.pem'
+  config.cert = '/path/to/certificate.crt'
+  config.environment = :production  # or :testing for homologation
+  config.service = 'wsfe'           # the service you want to access
+end
+
+# Get authentication credentials
+credentials = Wsaa.authenticate
+
+credentials.token  # => "PD94bWwg..."
+credentials.sign   # => "dGhpcyBp..."
+```
+
+## Documentation
+
+- [WSAA Technical Specification (PDF)](https://www.afip.gov.ar/ws/WSAA/Especificacion_Tecnica_WSAA_1.2.0.pdf)
+
+## Development
+
+After checking out the repo, run `bundle install` to install dependencies. Then, run `rake spec` to run the tests.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](LICENSE).

data/Rakefile

@@ -0,0 +1,6 @@
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+task default: :spec

data/lib/wsaa/client.rb

@@ -0,0 +1,93 @@
+require 'savon'
+require 'rexml/document'
+
+module Wsaa
+  class Client
+    attr_reader :configuration
+
+    def initialize(configuration)
+      @configuration = configuration
+    end
+
+    def authenticate
+      configuration.validate!
+
+      cached = credential_store.read
+      return cached if cached
+
+      authenticate!
+    end
+
+    def authenticate!
+      configuration.validate!
+
+      tra = build_tra
+      signed_tra = sign_tra(tra.to_xml)
+      response = call_wsaa(signed_tra)
+      credentials = parse_response(response, tra.expiration_time)
+
+      credential_store.write(credentials)
+      credentials
+    end
+
+    private
+
+    def build_tra
+      Tra.new(service: configuration.service)
+    end
+
+    def sign_tra(tra_xml)
+      signer = CmsSigner.new(
+        cert_path: configuration.cert,
+        pkey_path: configuration.pkey
+      )
+      signer.sign(tra_xml)
+    end
+
+    def call_wsaa(signed_tra)
+      client = Savon.client(
+        wsdl: "#{configuration.endpoint}?WSDL",
+        endpoint: configuration.endpoint,
+        ssl_verify_mode: :none,
+        log: false
+      )
+
+      client.call(:login_cms, message: { in0: signed_tra })
+    rescue Savon::SOAPFault => e
+      raise AuthenticationError.new(
+        "WSAA authentication failed: #{e.message}",
+        fault_code: e.to_hash.dig(:fault, :faultcode),
+        fault_string: e.to_hash.dig(:fault, :faultstring)
+      )
+    rescue Savon::Error => e
+      raise AuthenticationError, "WSAA request failed: #{e.message}"
+    end
+
+    def parse_response(response, expiration_time)
+      login_cms_return = response.body.dig(:login_cms_response, :login_cms_return)
+
+      raise AuthenticationError, "Empty response from WSAA" if login_cms_return.nil?
+
+      doc = REXML::Document.new(login_cms_return)
+      token = doc.get_text('//token')&.to_s
+      sign = doc.get_text('//sign')&.to_s
+
+      if token.nil? || token.empty? || sign.nil? || sign.empty?
+        raise AuthenticationError, "Invalid response: missing token or sign"
+      end
+
+      Credentials.new(
+        token: token,
+        sign: sign,
+        expiration_time: expiration_time
+      )
+    end
+
+    def credential_store
+      @credential_store ||= CredentialStore.new(
+        cache_dir: configuration.cache_dir,
+        service: configuration.service
+      )
+    end
+  end
+end

data/lib/wsaa/cms_signer.rb

@@ -0,0 +1,39 @@
+require 'openssl'
+require 'base64'
+
+module Wsaa
+  class CmsSigner
+    attr_reader :certificate, :private_key
+
+    def initialize(cert_path:, pkey_path:)
+      @certificate = load_certificate(cert_path)
+      @private_key = load_private_key(pkey_path)
+    end
+
+    def sign(data)
+      flags = OpenSSL::PKCS7::BINARY | OpenSSL::PKCS7::NOSMIMECAP
+      pkcs7 = OpenSSL::PKCS7.sign(certificate, private_key, data, [], flags)
+      Base64.strict_encode64(pkcs7.to_der)
+    rescue OpenSSL::PKCS7::PKCS7Error => e
+      raise SigningError, "Failed to sign data: #{e.message}"
+    end
+
+    private
+
+    def load_certificate(path)
+      OpenSSL::X509::Certificate.new(File.read(path))
+    rescue OpenSSL::X509::CertificateError => e
+      raise SigningError, "Invalid certificate: #{e.message}"
+    rescue Errno::ENOENT
+      raise SigningError, "Certificate file not found: #{path}"
+    end
+
+    def load_private_key(path)
+      OpenSSL::PKey::RSA.new(File.read(path))
+    rescue OpenSSL::PKey::RSAError => e
+      raise SigningError, "Invalid private key: #{e.message}"
+    rescue Errno::ENOENT
+      raise SigningError, "Private key file not found: #{path}"
+    end
+  end
+end

data/lib/wsaa/configuration.rb

@@ -0,0 +1,30 @@
+module Wsaa
+  class Configuration
+    ENDPOINTS = {
+      testing: 'https://wsaahomo.afip.gov.ar/ws/services/LoginCms',
+      production: 'https://wsaa.afip.gov.ar/ws/services/LoginCms'
+    }.freeze
+
+    attr_accessor :pkey, :cert, :service, :environment, :cache_dir
+
+    def initialize
+      @environment = :testing
+      @service = 'wsfe'
+      @cache_dir = '/tmp'
+    end
+
+    def endpoint
+      ENDPOINTS.fetch(environment) do
+        raise ConfigurationError, "Invalid environment: #{environment}. Must be :testing or :production"
+      end
+    end
+
+    def validate!
+      raise ConfigurationError, "Private key path not configured" if pkey.nil? || pkey.empty?
+      raise ConfigurationError, "Certificate path not configured" if cert.nil? || cert.empty?
+      raise ConfigurationError, "Private key file not found: #{pkey}" unless File.exist?(pkey)
+      raise ConfigurationError, "Certificate file not found: #{cert}" unless File.exist?(cert)
+      true
+    end
+  end
+end

data/lib/wsaa/credential_store.rb

@@ -0,0 +1,58 @@
+require 'yaml'
+require 'time'
+
+module Wsaa
+  class CredentialStore
+    attr_reader :cache_dir, :service
+
+    def initialize(cache_dir:, service:)
+      @cache_dir = cache_dir
+      @service = service
+    end
+
+    def read
+      return nil unless File.exist?(cache_file_path)
+
+      data = YAML.load_file(cache_file_path)
+      expiration_time = parse_expiration_time(data['expiration_time'])
+
+      credentials = Credentials.new(
+        token: data['token'],
+        sign: data['sign'],
+        expiration_time: expiration_time
+      )
+
+      credentials.valid? ? credentials : nil
+    rescue StandardError
+      nil
+    end
+
+    def write(credentials)
+      File.write(cache_file_path, YAML.dump(credentials.to_h.transform_keys(&:to_s)))
+      credentials
+    end
+
+    def clear
+      File.delete(cache_file_path) if File.exist?(cache_file_path)
+    end
+
+    def cache_file_path
+      File.join(cache_dir, cache_filename)
+    end
+
+    private
+
+    def cache_filename
+      date_str = Time.now.strftime('%d_%m_%Y')
+      "wsaa_#{service}_#{date_str}.yml"
+    end
+
+    def parse_expiration_time(value)
+      case value
+      when Time then value
+      when String then Time.parse(value)
+      else raise ArgumentError, "Invalid expiration_time: #{value}"
+      end
+    end
+  end
+end

data/lib/wsaa/credentials.rb

@@ -0,0 +1,28 @@
+module Wsaa
+  class Credentials
+    attr_reader :token, :sign, :expiration_time
+
+    def initialize(token:, sign:, expiration_time:)
+      @token = token.freeze
+      @sign = sign.freeze
+      @expiration_time = expiration_time
+      freeze
+    end
+
+    def expired?
+      Time.now > expiration_time
+    end
+
+    def valid?
+      !expired? && !token.nil? && !sign.nil?
+    end
+
+    def to_h
+      {
+        token: token,
+        sign: sign,
+        expiration_time: expiration_time.iso8601
+      }
+    end
+  end
+end

data/lib/wsaa/errors.rb

@@ -0,0 +1,17 @@
+module Wsaa
+  class Error < StandardError; end
+
+  class ConfigurationError < Error; end
+
+  class SigningError < Error; end
+
+  class AuthenticationError < Error
+    attr_reader :fault_code, :fault_string
+
+    def initialize(message, fault_code: nil, fault_string: nil)
+      @fault_code = fault_code
+      @fault_string = fault_string
+      super(message)
+    end
+  end
+end

data/lib/wsaa/tra.rb

@@ -0,0 +1,50 @@
+require 'rexml/document'
+
+module Wsaa
+  class Tra
+    TIMEZONE_OFFSET = '-03:00'
+
+    attr_reader :service, :generation_time, :expiration_time, :unique_id
+
+    def initialize(service:, generation_time: nil, expiration_time: nil, unique_id: nil)
+      @service = service
+      @unique_id = unique_id || Time.now.to_i
+      @generation_time = generation_time || default_generation_time
+      @expiration_time = expiration_time || default_expiration_time
+    end
+
+    def to_xml
+      doc = REXML::Document.new
+      doc << REXML::XMLDecl.new('1.0', 'UTF-8')
+
+      root = doc.add_element('loginTicketRequest', 'version' => '1.0')
+
+      header = root.add_element('header')
+      header.add_element('uniqueId').text = unique_id.to_s
+      header.add_element('generationTime').text = format_time(generation_time)
+      header.add_element('expirationTime').text = format_time(expiration_time)
+
+      root.add_element('service').text = service
+
+      output = String.new
+      doc.write(output)
+      output
+    end
+
+    private
+
+    def default_generation_time
+      today = Time.now
+      Time.new(today.year, today.month, today.day, 0, 0, 0, TIMEZONE_OFFSET)
+    end
+
+    def default_expiration_time
+      today = Time.now
+      Time.new(today.year, today.month, today.day, 23, 59, 59, TIMEZONE_OFFSET)
+    end
+
+    def format_time(time)
+      time.strftime('%Y-%m-%dT%H:%M:%S%:z')
+    end
+  end
+end

data/lib/wsaa/version.rb

@@ -0,0 +1,3 @@
+module Wsaa
+  VERSION = '0.1.0'
+end

data/lib/wsaa.rb

@@ -0,0 +1,39 @@
+require_relative 'wsaa/version'
+require_relative 'wsaa/errors'
+require_relative 'wsaa/configuration'
+require_relative 'wsaa/tra'
+require_relative 'wsaa/cms_signer'
+require_relative 'wsaa/credentials'
+require_relative 'wsaa/credential_store'
+require_relative 'wsaa/client'
+
+module Wsaa
+  class << self
+    def configure
+      yield(configuration)
+    end
+
+    def configuration
+      @configuration ||= Configuration.new
+    end
+
+    def authenticate
+      client.authenticate
+    end
+
+    def authenticate!
+      client.authenticate!
+    end
+
+    def reset!
+      @configuration = nil
+      @client = nil
+    end
+
+    private
+
+    def client
+      @client ||= Client.new(configuration)
+    end
+  end
+end

metadata

@@ -0,0 +1,117 @@
+--- !ruby/object:Gem::Specification
+name: wsaa-ruby
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Leandro Marcucci
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-08-18 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: savon
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '13.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: Ruby implementation of AFIP WSAA (Web Service de Autenticación y Autorización)
+  for authenticating with Argentine tax authority web services
+email:
+- leanucci@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- Gemfile
+- LICENSE
+- README.md
+- Rakefile
+- lib/wsaa.rb
+- lib/wsaa/client.rb
+- lib/wsaa/cms_signer.rb
+- lib/wsaa/configuration.rb
+- lib/wsaa/credential_store.rb
+- lib/wsaa/credentials.rb
+- lib/wsaa/errors.rb
+- lib/wsaa/tra.rb
+- lib/wsaa/version.rb
+homepage: https://github.com/leanucci/wsaa-ruby
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/leanucci/wsaa-ruby
+  source_code_uri: https://github.com/leanucci/wsaa-ruby
+  changelog_uri: https://github.com/leanucci/wsaa-ruby/blob/main/CHANGELOG.md
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.7.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.1.6
+signing_key:
+specification_version: 4
+summary: Ruby client for AFIP WSAA authentication service
+test_files: []