Class: Sdkey::Client

Inherits:
Object
  • Object
show all
Defined in:
lib/sdkey/client.rb

Overview

SDKey license client (sealed session protocol + plaintext client auth).

Flow: init (session handshake) → validate(license_key, hwid=nil) (sealed). validate calls init automatically when no session exists.

Plaintext client auth: register / login / upgrade (no sealed session required).

Instance Method Summary collapse

Constructor Details

#initialize(api_base_url:, app_id:, app_version:, app_public_key_b64:, http_post: nil) ⇒ Client

Returns a new instance of Client.



23
24
25
26
27
28
29
30
31
 
# File 'lib/sdkey/client.rb', line 23

def initialize(api_base_url:, app_id:, app_version:, app_public_key_b64:, http_post: nil)
  @api_base_url = api_base_url.to_s.sub(%r{/+\z}, "")
  @app_id = app_id
  @app_version = app_version
  @app_public_key_b64 = app_public_key_b64
  @http_post = http_post || method(:default_http_post)
  @public_key = nil
  @session = nil
end

Instance Method Details

#clear_session ⇒ Object

Drop the current session (next validate will re-init).



40
41
42
 
# File 'lib/sdkey/client.rb', line 40

def clear_session
  @session = nil
end

#init ⇒ Object 



44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/sdkey/client.rb', line 44

def init
  @public_key = Crypto::Seal.import_public_key(@app_public_key_b64)
  client_nonce = SecureRandom.random_bytes(Crypto::Constants::CLIENT_NONCE_BYTES)

  begin
    status, body = @http_post.call(
      "#{@api_base_url}/api/v1/session/init",
      {
        "appId" => @app_id,
        "clientNonceB64" => Crypto::Encoding.bytes_to_base64(client_nonce),
        "clientVersion" => @app_version
      }
    )
  rescue StandardError => e
    raise Error.new("NETWORK", "session init request failed", e)
  end

  if status < 200 || status >= 300 || !body["success"]
    raise Error.new(
      (body["code"] || "INIT_FAILED").to_s,
      (body["error"] || "session init failed").to_s
    )
  end

  hello = {
    "appId" => @app_id,
    "hkdfSaltB64" => body["hkdfSaltB64"],
    "serverNonceB64" => body["serverNonceB64"],
    "sessionId" => body["sessionId"],
    "timestamp" => body["timestamp"],
    "v" => Crypto::Constants::PROTOCOL_VERSION
  }

  unless Crypto::Seal.verify_signature(@public_key, hello, body["signatureB64"])
    raise Error.new("HELLO_SIGNATURE_INVALID", "hello signature verification failed")
  end

  aes_key = Crypto::Seal.derive_session_aes_key(
    client_nonce: client_nonce,
    server_nonce: Crypto::Encoding.base64_to_bytes(body["serverNonceB64"]),
    salt_b64: body["hkdfSaltB64"],
    app_id: @app_id
  )

  @session = SessionState.new(
    session_id: body["sessionId"],
    aes_key: aes_key,
    server_nonce_b64: body["serverNonceB64"],
    hkdf_salt_b64: body["hkdfSaltB64"]
  )
  @session
end

#login(username:, password:, hwid: nil) ⇒ Object 



193
194
195
196
197
198
199
200
201
202
 
# File 'lib/sdkey/client.rb', line 193

def (username:, password:, hwid: nil)
  body = {
    "appId" => @app_id,
    "username" => username,
    "password" => password,
    "clientVersion" => @app_version
  }
  body["hwid"] = hwid unless hwid.nil?
  client_auth("login", body)
end

#register(username:, password:, email: nil, license_key: nil, hwid: nil) ⇒ Object 



180
181
182
183
184
185
186
187
188
189
190
191
 
# File 'lib/sdkey/client.rb', line 180

def register(username:, password:, email: nil, license_key: nil, hwid: nil)
  body = {
    "appId" => @app_id,
    "username" => username,
    "password" => password,
    "clientVersion" => @app_version
  }
  body["email"] = email unless email.nil?
  body["licenseKey"] = license_key unless license_key.nil?
  body["hwid"] = hwid unless hwid.nil?
  client_auth("register", body)
end

#session ⇒ Object Also known as: get_session

Active session, if any.



34
35
36
 
# File 'lib/sdkey/client.rb', line 34

def session
  @session
end

#upgrade(username:, license_key:, hwid: nil) ⇒ Object 



204
205
206
207
208
209
210
211
212
213
 
# File 'lib/sdkey/client.rb', line 204

def upgrade(username:, license_key:, hwid: nil)
  body = {
    "appId" => @app_id,
    "username" => username,
    "licenseKey" => license_key,
    "clientVersion" => @app_version
  }
  body["hwid"] = hwid unless hwid.nil?
  client_auth("upgrade", body)
end

#validate(license_key, hwid = nil) ⇒ Object

Raises:



97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
 
# File 'lib/sdkey/client.rb', line 97

def validate(license_key, hwid = nil)
  init if @session.nil? || @public_key.nil?
  session = @session
  public_key = @public_key

  inner = {
    "licenseKey" => license_key,
    "nonce" => Crypto::Encoding.bytes_to_base64(
      SecureRandom.random_bytes(Crypto::Constants::VALIDATE_NONCE_BYTES)
    ),
    "timestamp" => Time.now.to_i,
    "v" => Crypto::Constants::PROTOCOL_VERSION
  }
  if hwid
    # Keep lexicographic key order for the sealed inner JSON.
    inner = {
      "hwid" => hwid,
      "licenseKey" => inner["licenseKey"],
      "nonce" => inner["nonce"],
      "timestamp" => inner["timestamp"],
      "v" => inner["v"]
    }
  end

  sealed = Crypto::Seal.seal_aes_gcm(
    session.aes_key,
    JSON.generate(inner)
  )

  begin
    _status, envelope = @http_post.call(
      "#{@api_base_url}/api/v1/licenses/validate",
      {
        "sessionId" => session.session_id
      }.merge(sealed.as_wire)
    )
  rescue StandardError => e
    raise Error.new("NETWORK", "validate request failed", e)
  end

  unless envelope["ivB64"] && envelope["ciphertextB64"] && envelope["tagB64"] && envelope["signatureB64"]
    clear_session if envelope["code"] == "SESSION_EXPIRED"
    raise Error.new(
      (envelope["code"] || "VALIDATE_RESPONSE_INVALID").to_s,
      (envelope["error"] || "invalid validate response").to_s
    )
  end

  plain_bytes = Crypto::Seal.open_aes_gcm(
    session.aes_key,
    {
      "ivB64" => envelope["ivB64"],
      "ciphertextB64" => envelope["ciphertextB64"],
      "tagB64" => envelope["tagB64"]
    }
  )
  plaintext = JSON.parse(plain_bytes)

  unless Crypto::Seal.verify_signature(public_key, plaintext, envelope["signatureB64"])
    raise Error.new("RESPONSE_SIGNATURE_INVALID", "response signature verification failed")
  end

  raise Error.new("SESSION_MISMATCH", "sessionId mismatch") if plaintext["sessionId"] != session.session_id
  if (Time.now.to_i - plaintext["timestamp"].to_i).abs > Crypto::Constants::CLOCK_SKEW_SECONDS
    raise Error.new("CLOCK_SKEW", "response clock skew")
  end

  clear_session if plaintext["code"] == "SESSION_EXPIRED"

  tier_raw = plaintext["subscriptionTier"]
  subscription_tier = tier_raw.nil? ? nil : tier_raw.to_i

  ValidateResult.new(
    success: !!plaintext["success"],
    code: plaintext["code"].to_s,
    message: plaintext["message"].to_s,
    status: plaintext["status"],
    expires_at: plaintext["expiresAt"],
    subscription_tier: subscription_tier,
    timestamp: plaintext["timestamp"].to_i
  )
end