Module: Foil::Server::SealedToken

Defined in:
lib/foil/server/sealed_token.rb

Constant Summary collapse

LEGACY_VERSION = 
0x01
MULTI_RECIPIENT_VERSION = 
0x02
NONCE_BYTES = 
12
TAG_BYTES = 
16
CONTENT_KEY_BYTES = 
32
RECIPIENT_ID_BYTES = 
32
MAX_RECIPIENTS = 
256
V2_HEADER_BYTES = 
1 + 2 + NONCE_BYTES + 4
V2_RECIPIENT_BYTES = 
RECIPIENT_ID_BYTES + NONCE_BYTES + CONTENT_KEY_BYTES + TAG_BYTES
V2_PAYLOAD_AAD_PREFIX = 
"foil-sealed-results-v2\0payload\0".b
V2_WRAP_AAD_PREFIX = 
"foil-sealed-results-v2\0recipient\0".b

Class Method Summary collapse

Class Method Details

.safe_verify_foil_token(sealed_token, secret_key = nil) ⇒ Object 



41
42
43
44
45
 
# File 'lib/foil/server/sealed_token.rb', line 41

def safe_verify_foil_token(sealed_token, secret_key = nil)
  { ok: true, data: verify_foil_token(sealed_token, secret_key) }
rescue ConfigurationError, TokenVerificationError => error
  { ok: false, error: error }
end

.verify_foil_token(sealed_token, secret_key = nil) ⇒ Object 



24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/foil/server/sealed_token.rb', line 24

def verify_foil_token(sealed_token, secret_key = nil)
  CryptoSupport.ensure_supported_runtime!
  resolved_secret = secret_key || ENV["FOIL_SECRET_KEY"]
  raise ConfigurationError, "Missing Foil secret key. Pass secret_key explicitly or set FOIL_SECRET_KEY." if resolved_secret.nil? || resolved_secret.empty?

  raw = Base64.decode64(sealed_token)
  raise TokenVerificationError, "Foil token is too short." if raw.bytesize < 29

  compressed = decrypt_payload(raw, resolved_secret)
  payload = JSON.parse(Zlib::Inflate.inflate(compressed))
  deep_symbolize(payload)
rescue ConfigurationError, TokenVerificationError
  raise
rescue StandardError => error
  raise TokenVerificationError, "Failed to verify Foil token: #{error.message}"
end