Class: Shugoi::TokenSigner

Inherits:
Object
  • Object
show all
Defined in:
lib/shugoi/token_signer.rb

Overview

Signature des tokens render + vérification des render-grants. Parité exacte avec le module Node :

token :  siteKey:timestamp:nonce:sig        (sig = HMAC(secret, "siteKey:ts:nonce"))
grant :  base36(ts):HMAC(secret, "render-grant:siteKey:mid:token:ip:ts")

Constant Summary collapse

GRANT_TTL_MS = 
120_000

Instance Method Summary collapse

Constructor Details

#initialize(secret) ⇒ TokenSigner

Returns a new instance of TokenSigner.



11
12
13
 
# File 'lib/shugoi/token_signer.rb', line 11

def initialize(secret)
  @secret = secret.to_s
end

Instance Method Details

#sign(site_key, timestamp = Utils.now_ms) ⇒ String

Returns token signé, ou "" si pas de secret.

Returns:

  • (String) —

    token signé, ou "" si pas de secret



16
17
18
19
20
21
22
 
# File 'lib/shugoi/token_signer.rb', line 16

def sign(site_key, timestamp = Utils.now_ms)
  return "" if @secret.empty?
  nonce = SecureRandom.hex(8)
  payload = [site_key, timestamp.to_i, nonce].join(":")
  sig = Utils.hmac_hex(@secret, payload)
  "#{payload}:#{sig}"
end

#verify_render_grant(mid, grant, token, ip, expected_site_key) ⇒ Object

Vérifie un render-grant émis par le wlc serveur.

Parameters:

  • mid (String) —

    machineId (64 hex)

  • grant (String) —

    grant brut "base36ts:sig"

  • token (String) —

    token render lié

  • ip (String) —

    IP du client

  • expected_site_key (String) —

    siteKey attendu (celui du middleware)



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/shugoi/token_signer.rb', line 30

def verify_render_grant(mid, grant, token, ip, expected_site_key)
  return true if @secret.empty? # fail-safe : pas de secret → pas de vérification
  return false if grant.to_s.empty? || mid.to_s.empty?
  return false unless mid.to_s.match?(/\A[a-f0-9]{64}\z/)

  ts_str, sig = grant.to_s.split(":", 2)
  return false if ts_str.nil? || sig.nil?

  ts = Utils.base36_decode(ts_str)
  return false if ts.zero? && ts_str != "0"
  return false if Utils.now_ms - (ts * 1000) > GRANT_TTL_MS
  return false if expected_site_key.to_s.empty?

  payload = "render-grant:#{[expected_site_key, mid, token.to_s, ip.to_s, ts_str].join(':')}"
  expected = Utils.hmac_hex(@secret, payload)
  Utils.secure_equals(sig, expected)
end

#verify_token(token) ⇒ Object

Vérifie un token render complet (siteKey:ts:nonce:sig).



49
50
51
52
53
54
55
56
57
58
59
60
61
62
 
# File 'lib/shugoi/token_signer.rb', line 49

def verify_token(token)
  parts = token.to_s.split(":")
  return false unless parts.length == 4 && parts[3].length == 64
  return false if @secret.empty?

  site_key, timestamp, nonce, sig = parts
  ts = timestamp.to_i
  return false if ts.zero?
  return false if Utils.now_ms - ts > 120_000 # TOKEN_TTL

  payload = [site_key, timestamp, nonce].join(":")
  expected = Utils.hmac_hex(@secret, payload)
  Utils.secure_equals(sig, expected)
end