use . notation

check to ensure the request key exists

Author: Dave Wong

src/Exceptions/InvalidConfigurationException.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace SoapBox\SignedRequests\Exceptions;
+
+use Exception;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\HttpExceptionInterface;
+
+class InvalidConfigurationException extends Exception implements HttpExceptionInterface
+{
+    /**
+     * The default exception message.
+     *
+     * @var string
+     */
+    const MESSAGE = 'Failed to find Signed Requests configuration key';
+
+    /**
+     * Provides a default error message for an invalid signature.
+     *
+     * @param string $message
+     *        A customizable error message.
+     */
+    public function __construct(string $message = self::MESSAGE)
+    {
+        parent::__construct($message);
+    }
+
+    /**
+     * Returns an HTTP BAD REQUEST status code.
+     *
+     * @return int
+     *         An HTTP BAD REQUEST response status code
+     */
+    public function getStatusCode()
+    {
+        return Response::HTTP_UNPROCESSABLE_ENTITY;
+    }
+
+    /**
+     * Returns response headers.
+     *
+     * @return array
+     *         Response headers
+     */
+    public function getHeaders()
+    {
+        return [];
+    }
+}

src/Middlewares/Laravel/VerifySignature.php

@@ -9,6 +9,7 @@
 use Illuminate\Contracts\Config\Repository as Configurations;
 use SoapBox\SignedRequests\Exceptions\ExpiredRequestException;
 use SoapBox\SignedRequests\Exceptions\InvalidSignatureException;
+use SoapBox\SignedRequests\Exceptions\InvalidConfigurationException;
 
 class VerifySignature
 {
@@ -53,32 +54,34 @@ public function __construct(Configurations $configurations, Cache $cache)
      *         Thrown if request replays are disabled and either the request
      *         timestamp is outside the window of tolerance, or the request has
      *         previously been served.
+     * @throws \SoapBox\SignedRequests\Exceptions\InvalidConfigurationException
+     *         Thrown if the request key is not defined in the config
      *
      * @param  \Illuminate\Http\Request $request
      *         An instance of the request.
      * @param  \Closure $next
      *         A callback function of where to go next.
-     * @param  mixed $prefix
+     * @param  mixed $requestKey
      *
      * @return mixed
      */
-    public function handle(Request $request, Closure $next, $prefix = '')
+    public function handle(Request $request, Closure $next, $requestKey = 'default')
     {
-        if (!empty($prefix)) {
-            $prefix .= '-';
+        if (!array_key_exists($requestKey, $this->configurations->get('signed-requests'))) {
+            throw new InvalidConfigurationException();
         }
 
         $signed = new Verifier($request);
 
         $key = sprintf(
             '%s.%s',
-            $this->configurations->get($prefix . 'signed-requests.cache-prefix'),
+            $this->configurations->get("signed-requests.$requestKey.cache-prefix"),
             $signed->getId()
         );
 
-        $tolerance = $this->configurations->get($prefix . 'signed-requests.request-replay.tolerance');
+        $tolerance = $this->configurations->get("signed-requests.$requestKey.request-replay.tolerance");
 
-        if (true !== $this->configurations->get($prefix . 'signed-requests.request-replay.allow')) {
+        if (true !== $this->configurations->get("signed-requests.$requestKey.request-replay.allow")) {
             $isExpired = $signed->isExpired($tolerance);
 
             if ($isExpired || $this->cache->has($key)) {
@@ -87,10 +90,10 @@ public function handle(Request $request, Closure $next, $prefix = '')
         }
 
         $signed
-            ->setSignatureHeader($this->configurations->get($prefix . 'signed-requests.headers.signature'))
-            ->setAlgorithmHeader($this->configurations->get($prefix . 'signed-requests.headers.algorithm'));
+            ->setSignatureHeader($this->configurations->get("signed-requests.$requestKey.headers.signature"))
+            ->setAlgorithmHeader($this->configurations->get("signed-requests.$requestKey.headers.algorithm"));
 
-        if (!$signed->isValid($this->configurations->get($prefix . 'signed-requests.key'))) {
+        if (!$signed->isValid($this->configurations->get("signed-requests.$requestKey.key"))) {
             throw new InvalidSignatureException();
         }