lib/cerner/oauth1a/access_token.rb
# Internal: Used by #authenticate to verify the request signature.
Used by #authenticate to verify the request signature.
Used by #authenticate to verify the request signature .
def verify_signature(keys:, hmac_secrets:, http_method:, fully_qualified_url:, request_params:)
        unless @signature
          raise OAuthError.new('missing signature', nil, 'parameter_absent', 'oauth_signature', @realm)
        end
        unless hmac_secrets
          raise OAuthError.new('missing HMACSecrets', nil, 'parameter_rejected', 'oauth_token', @realm)
        end
        begin
          secrets = keys.decrypt_hmac_secrets(hmac_secrets)
        rescue ArgumentError, OpenSSL::PKey::RSAError => e
          raise OAuthError.new(
            "unable to decrypt HMACSecrets: #{e.message}",
            nil,
            'parameter_rejected',
            'oauth_token',
            @realm
          )
        end
        secrets_parts = Protocol.parse_url_query_string(secrets)
        if @signature_method == 'PLAINTEXT'
          expected_signature =
            Signature.sign_via_plaintext(
              client_shared_secret: secrets_parts[:ConsumerSecret], token_shared_secret: secrets_parts[:TokenSecret]
            )
        elsif @signature_method == 'HMAC-SHA1'
          http_method ||= 'GET' 
          request_params ||= {} 
          oauth_params = {
            oauth_version: '1.0', 
            oauth_signature_method: 'HMAC-SHA1',
            oauth_consumer_key: @consumer_key,
            oauth_nonce: @nonce,
            oauth_timestamp: @timestamp.to_i,
            oauth_token: @token
          }
          begin
            fully_qualified_url = Internal.convert_to_http_uri(url: fully_qualified_url, name: 'fully_qualified_url')
          rescue ArgumentError => ae
            raise OAuthError.new(ae.message, nil, 'parameter_absent', nil, @realm)
          end
          query_params = fully_qualified_url.query ? Protocol.parse_url_query_string(fully_qualified_url.query) : {}
          request_params = query_params.merge(request_params)
          params = request_params.merge(oauth_params)
          signature_base_string =
            Signature.build_signature_base_string(
              http_method: http_method, fully_qualified_url: fully_qualified_url, params: params
            )
          expected_signature =
            Signature.sign_via_hmacsha1(
              client_shared_secret: secrets_parts[:ConsumerSecret],
              token_shared_secret: secrets_parts[:TokenSecret],
              signature_base_string: signature_base_string
            )
        else
          raise OAuthError.new(
            'signature_method must be PLAINTEXT or HMAC-SHA1',
            nil,
            'signature_method_rejected',
            nil,
            @realm
          )
        end
        return if Internal.constant_time_compare(@signature, expected_signature)
        raise OAuthError.new('signature is not valid', nil, 'signature_invalid', nil, @realm)
      end
def verify_signature ( keys : , hmac_secrets : , http_method : , fully_qualified_url : , request_params : ) unless @signature raise OAuthError . new ( 'missing signature' , nil , 'parameter_absent' , 'oauth_signature' , @realm ) end unless hmac_secrets raise OAuthError . new ( 'missing HMACSecrets' , nil , 'parameter_rejected' , 'oauth_token' , @realm ) end begin secrets = keys . decrypt_hmac_secrets ( hmac_secrets ) rescue ArgumentError , OpenSSL :: PKey :: RSAError => e raise OAuthError . new ( "unable to decrypt HMACSecrets: #{e.message}" , nil , 'parameter_rejected' , 'oauth_token' , @realm ) end secrets_parts = Protocol . parse_url_query_string ( secrets ) if @signature_method == 'PLAINTEXT' expected_signature = Signature . sign_via_plaintext ( client_shared_secret : secrets_parts [ :ConsumerSecret ] , token_shared_secret : secrets_parts [ :TokenSecret ] ) elsif @signature_method == 'HMAC-SHA1' http_method ||= 'GET' request_params ||= { } oauth_params = { oauth_version : '1.0' , oauth_signature_method : 'HMAC-SHA1' , oauth_consumer_key : @consumer_key , oauth_nonce : @nonce , oauth_timestamp : @timestamp . to_i , oauth_token : @token } begin fully_qualified_url = Internal . convert_to_http_uri ( url : fully_qualified_url , name : 'fully_qualified_url' ) rescue ArgumentError => ae raise OAuthError . new ( ae . message , nil , 'parameter_absent' , nil , @realm ) end query_params = fully_qualified_url . query ? Protocol . parse_url_query_string ( fully_qualified_url . query ) : { } request_params = query_params . merge ( request_params ) params = request_params . merge ( oauth_params ) signature_base_string = Signature . build_signature_base_string ( http_method : http_method , fully_qualified_url : fully_qualified_url , params : params ) expected_signature = Signature . sign_via_hmacsha1 ( client_shared_secret : secrets_parts [ :ConsumerSecret ] , token_shared_secret : secrets_parts [ :TokenSecret ] , signature_base_string : signature_base_string ) else raise OAuthError . new ( 'signature_method must be PLAINTEXT or HMAC-SHA1' , nil , 'signature_method_rejected' , nil , @realm ) end return if Internal . constant_time_compare ( @signature , expected_signature ) raise OAuthError . new ( 'signature is not valid' , nil , 'signature_invalid' , nil , @realm ) end
Internal: Used by #authenticate to verify the request signature.
Internal : Used by #authenticate to verify the request signature .
# default to HTTP GET # default to no request params # assumes version is present
keys
hmac_secrets
http_method
fully_qualified_url
request_params