Skip to content
Extraits de code Groupes Projets
  • Eugen Rochko's avatar
    1618b68b
    HTTP signatures (#4146) · 1618b68b
    Eugen Rochko a rédigé
    * Add Request class with HTTP signature generator
    
    Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06
    
    * Add HTTP signature verification concern
    
    * Add test for SignatureVerification concern
    
    * Add basic test for Request class
    
    * Make PuSH subscribe/unsubscribe requests use new Request class
    
    Accidentally fix lease_seconds not being set and sent properly, and
    change the new minimum subscription duration to 1 day
    
    * Make all PuSH workers use new Request class
    
    * Make Salmon sender use new Request class
    
    * Make FetchLinkService use new Request class
    
    * Make FetchAtomService use the new Request class
    
    * Make Remotable use the new Request class
    
    * Make ResolveRemoteAccountService use the new Request class
    
    * Add more tests
    
    * Allow +-30 seconds window for signed request to remain valid
    
    * Disable time window validation for signed requests, restore 7 days
    as PuSH subscription duration (which was previous default due to a bug)
    1618b68b
    Historique
    HTTP signatures (#4146)
    Eugen Rochko a rédigé
    * Add Request class with HTTP signature generator
    
    Spec: https://tools.ietf.org/html/draft-cavage-http-signatures-06
    
    * Add HTTP signature verification concern
    
    * Add test for SignatureVerification concern
    
    * Add basic test for Request class
    
    * Make PuSH subscribe/unsubscribe requests use new Request class
    
    Accidentally fix lease_seconds not being set and sent properly, and
    change the new minimum subscription duration to 1 day
    
    * Make all PuSH workers use new Request class
    
    * Make Salmon sender use new Request class
    
    * Make FetchLinkService use new Request class
    
    * Make FetchAtomService use the new Request class
    
    * Make Remotable use the new Request class
    
    * Make ResolveRemoteAccountService use the new Request class
    
    * Add more tests
    
    * Allow +-30 seconds window for signed request to remain valid
    
    * Disable time window validation for signed requests, restore 7 days
    as PuSH subscription duration (which was previous default due to a bug)
subscriptions_controller.rb 1,02 Kio
# frozen_string_literal: true

class Api::SubscriptionsController < Api::BaseController
  before_action :set_account
  respond_to :txt

  def show
    if subscription.valid?(params['hub.topic'])
      @account.update(subscription_expires_at: future_expires)
      render plain: encoded_challenge, status: 200
    else
      head 404
    end
  end

  def update
    if subscription.verify(body, request.headers['HTTP_X_HUB_SIGNATURE'])
      ProcessingWorker.perform_async(@account.id, body.force_encoding('UTF-8'))
    end

    head 200
  end

  private

  def subscription
    @_subscription ||= @account.subscription(
      api_subscription_url(@account.id)
    )
  end

  def body
    @_body ||= request.body.read
  end

  def encoded_challenge
    HTMLEntities.new.encode(params['hub.challenge'])
  end

  def future_expires
    Time.now.utc + lease_seconds_or_default
  end

  def lease_seconds_or_default
    (params['hub.lease_seconds'] || 1.day).to_i.seconds
  end

  def set_account
    @account = Account.find(params[:id])
  end
end