Class: OAuth::OAuthProxy::OAuthRequest

Inherits:
RequestProxy::Base
  • Object
show all
Defined in:
lib/lti2_commons/lib/lti2_commons/oauth_request.rb

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Instance Attribute Details

#accept ⇒ Object

Returns the value of attribute accept.



30
31
32
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 30

def accept
  @accept
end

#body ⇒ Object

Returns the value of attribute body.



30
31
32
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 30

def body
  @body
end

#content_type ⇒ Object

Returns the value of attribute content_type.



30
31
32
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 30

def content_type
  @content_type
end

Class Method Details

.collect_rack_parameters(rack_request) ⇒ Object 



32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 32

def self.collect_rack_parameters(rack_request)
  parameters = HashWithIndifferentAccess.new
  parameters.merge!(rack_request.query_parameters)
  parameters.merge!(self.parse_authorization_header(rack_request.headers['HTTP_AUTHORIZATION']))
  @content_type = rack_request.headers['CONTENT_TYPE']
  @accept = rack_request.headers['ACCEPT']
  if @content_type == 'application/x-www-form-urlencoded'
    parameters.merge!(rack_request.request_parameters)
  end
  parameters
end

.create_from_rack_request(rack_request) ⇒ Object 



44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 44

def self.create_from_rack_request(rack_request)
  parameters = self.collect_rack_parameters(rack_request)
  result = OAuth::OAuthProxy::OAuthRequest.new(
    'method' => rack_request.method,
    'uri' => rack_request.url,
    'parameters' => parameters
  )
  rack_request.body.rewind
  result.body = rack_request.body.read
  rack_request.body.rewind
  result
end

.parse_authorization_header(authorization_header) ⇒ Object 



57
58
59
60
61
62
63
64
65
66
67
68
69
70
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 57

def self.parse_authorization_header(authorization_header)
  result = {}
  if authorization_header =~ /^OAuth/
    authorization_header[6..-1].split(',').inject({}) do |_h, part|
      parts = part.split('=')
      name = parts[0].strip.intern
      value = parts[1..-1].join('=').strip
      value.gsub!(/\A['"]+|['"]+\Z/, '')
      result[name] = Rack::Utils.unescape(value) unless name == :realm
    end
  end
  Rails.logger.info "AuthHdr_Parms: #{result.inspect}"
  result
end

Instance Method Details

#compute_oauth_body_hash(content) ⇒ String

Creates the value of an OAuth body hash

Parameters:

  • launch_url (String) —

    Content to be body signed

Returns:

  • (String) —

    Signature base string (useful for debugging signature problems)



105
106
107
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 105

def compute_oauth_body_hash(content)
  Base64.encode64(Digest::SHA1.digest(content.chomp)).gsub(/\n/, '')
end

#copy ⇒ Object

A shallow+1 copy



111
112
113
114
115
116
117
118
119
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 111

def copy
  result = OAuth::OAuthProxy::OAuthRequest.new(
    'method' => self.method.dup,
    'uri' => self.uri.dup,
    'parameters' => self.parameters.dup
  )
  result.body = self.body.dup if self.body
  result
end

#final_uri ⇒ Object 



72
73
74
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 72

def final_uri
  @request['final_uri']
end

#is_timestamp_expired?(timestampString) ⇒ Boolean

Returns:

  • (Boolean) 


121
122
123
124
125
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 121

def is_timestamp_expired?(timestampString)
  timestamp = Time.at(timestampString.to_i)
  now = Time.now
  (now - timestamp).abs > CLOCK_SKEW_ALLOWANCE_IN_SECS
end

#log(msg) ⇒ Object 



76
77
78
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 76

def log(msg)
  Rails.logger.info(msg)
end

#method ⇒ Object 



84
85
86
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 84

def method
  @request['method']
end

#normalized_uri ⇒ Object 



88
89
90
91
92
93
94
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 88

def normalized_uri
  super
rescue
  # if this is a non-standard URI, it may not parse properly
  # in that case, assume that it's already been normalized
  uri
end

#parameters ⇒ Object 



80
81
82
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 80

def parameters
  @request['parameters']
end

#uri ⇒ Object 



96
97
98
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 96

def uri
  @request['uri']
end

#verify_signature?(secret, nonce_cache, is_handle_error_not_raise_exception = true, ignore_timestamp_and_nonce = false) ⇒ Bool

Validates an OAuth request using the OAuth Gem - github.com/oauth/oauth-ruby

Returns:

  • (Bool) —

    Whether the request was valid



130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 130

def verify_signature?(secret, nonce_cache, is_handle_error_not_raise_exception = true, ignore_timestamp_and_nonce = false)
  log 'in verify_signature'
  test_request = self.copy
  test_signature = test_request.sign(consumer_secret: secret)
  # log "DEBUG: signed"
  begin
    unless self.oauth_signature == test_signature
      log "Secret: #{secret}"
      log "Verify_signature--send_signature: #{self.oauth_signature}  test_signature: #{test_signature}"
      log "Verify signature_base_string: #{self.signature_base_string}"
      fail 'Invalid signature'
    end
    unless ignore_timestamp_and_nonce
      fail 'Timestamp expired' if is_timestamp_expired? self.oauth_timestamp
      fail 'Duplicate nonce to one already received' if nonce_cache.fetch(self.oauth_nonce)
    end
    nonce_cache.store(self.oauth_nonce, '<who-cares>')

    # check body-signing if oauth_body_signature
    if self.body && self.parameters.key?('oauth_body_hash')
      fail 'Invalid signature of message body' unless compute_oauth_body_hash(self.body) == self.parameters['oauth_body_hash']
    end
    [true, test_request.signature_base_string]
  rescue Exception => e
    log(e.message)
    if is_handle_error_not_raise_exception
      [false, test_request.signature_base_string]
    else
      raise e.message
    end
  end
end

#verify_signature_always?(secret, nonce_cache, is_handle_error_not_raise_exception = true, ignore_timestamp_and_nonce = false) ⇒ Bool

Runs validation logic but always returns true

Returns:

  • (Bool) —

    Whether the request was valid



167
168
169
170
171
172
173
174
175
176
 
# File 'lib/lti2_commons/lib/lti2_commons/oauth_request.rb', line 167

def verify_signature_always?(secret, nonce_cache, is_handle_error_not_raise_exception = true,
    ignore_timestamp_and_nonce = false)
  test_request = self.copy
  test_signature = test_request.sign(consumer_secret: secret)
  log "TC Signature: #{test_signature}"
  log "TP Signature: #{self.oauth_signature}"
  log "Signature_Base_String: #{test_request.signature_base_string}"
  # log "Authorization_Header: #{request.headers['Authorization']}"
  [self.oauth_signature == test_signature, test_request.signature_base_string]
end