Skip to content

Commit e279066

Browse files
JaspaulJaspaul
authored
Merge pull request #1 from SoapBox/bugfix/laravel-will-not-provide-a-signed-object
[Bugfix] Laravel Provides Request Objects, Not Signed Objects, to Middlewares
2 parents 0485e34 + 17b490c commit e279066

File tree

4 files changed

+93
-37
lines changed

4 files changed

+93
-37
lines changed

‎src/Middlewares/VerifySignature.php‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,9 @@
33
namespace SoapBox\SignedRequests\Middlewares;
44

55
use Closure;
6+
use Illuminate\Http\Request;
67
use Illuminate\Contracts\Config\Repository;
7-
use SoapBox\SignedRequests\Requests\Signed;
8+
use SoapBox\SignedRequests\Requests\Verifier;
89
use SoapBox\SignedRequests\Exceptions\InvalidSignatureException;
910

1011
class VerifySignature
@@ -36,20 +37,22 @@ public function __construct(Repository $configurations)
3637
* @throws \SoapBox\SignedRequests\Exceptions\InvalidSignatureException
3738
* Thrown when the signature of the request is not valid.
3839
*
39-
* @param \SoapBox\SignedRequests\Requests\Signed $request
40-
* An instance of the signed request.
40+
* @param \Illuminate\Http\Request $request
41+
* An instance of the request.
4142
* @param \Closure $next
4243
* A callback function of where to go next.
4344
*
4445
* @return mixed
4546
*/
46-
public function handle(Signed $request, Closure $next)
47+
public function handle(Request $request, Closure $next)
4748
{
48-
$request
49+
$signed = new Verifier($request);
50+
51+
$signed
4952
->setSignatureHeader($this->configurations->get('signed-requests.headers.signature'))
5053
->setAlgorithmHeader($this->configurations->get('signed-requests.headers.algorithm'));
5154

52-
if (!$request->isValid($this->configurations->get('signed-requests.key'))) {
55+
if (!$signed->isValid($this->configurations->get('signed-requests.key'))) {
5356
throw new InvalidSignatureException();
5457
}
5558

‎src/Requests/Signed.php‎ renamed to ‎src/Requests/Verifier.php‎

Lines changed: 55 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
use Illuminate\Http\Request;
66
use SoapBox\SignedRequests\Signature;
77

8-
class Signed extends Request
8+
class Verifier
99
{
1010
/**
1111
* The header that holds the signature.
@@ -21,16 +21,23 @@ class Signed extends Request
2121
*/
2222
protected $algorithmHeader;
2323

24+
/**
25+
* The underlying request that has the signature to validate.
26+
*
27+
* @var \Illluminate\Http\Request
28+
*/
29+
protected $request;
30+
2431
/**
2532
* Sets the local header key for locating the signature to the provided key.
2633
*
2734
* @param string $header
2835
* The header key where the signature is located.
2936
*
30-
* @return \SoapBox\SignedRequests\Requests\Signed
37+
* @return \SoapBox\SignedRequests\Requests\Verifier
3138
* The updated instance to enable fluent access.
3239
*/
33-
public function setSignatureHeader(string $header) : Signed
40+
public function setSignatureHeader(string $header) : Verifier
3441
{
3542
$this->signatureHeader = $header;
3643
return $this;
@@ -42,10 +49,10 @@ public function setSignatureHeader(string $header) : Signed
4249
* @param string $header
4350
* The header key where the algorithm is located.
4451
*
45-
* @return \SoapBox\SignedRequests\Requests\Signed
52+
* @return \SoapBox\SignedRequests\Requests\Verifier
4653
* The updated instance of to enable fluent access.
4754
*/
48-
public function setAlgorithmHeader(string $header) : Signed
55+
public function setAlgorithmHeader(string $header) : Verifier
4956
{
5057
$this->algorithmHeader = $header;
5158
return $this;
@@ -73,6 +80,48 @@ protected function getSignature() : string
7380
return $this->header($this->signatureHeader);
7481
}
7582

83+
/**
84+
* Used to wrap the existing request so we can verify the signature.
85+
*
86+
* @param \Illuminate\Http\Request $request
87+
* The request to be verified.
88+
*/
89+
public function __construct(Request $request)
90+
{
91+
$this->request = $request;
92+
}
93+
94+
/**
95+
* Forward calls to the underlying request so we can use this object like a
96+
* request.
97+
*
98+
* @param string $method
99+
* The method to call on the underlying request.
100+
* @param mixed $parameters
101+
* The parameters to send to the method on the request.
102+
*
103+
* @return mixed
104+
* Returns the results of the calls on the parent.
105+
*/
106+
public function __call($method, $parameters)
107+
{
108+
return $this->request->$method(...$parameters);
109+
}
110+
111+
/**
112+
* Forward calls to parameters to the request.
113+
*
114+
* @param string $key
115+
* The name of the property we're attempting to access.
116+
*
117+
* @return mixed
118+
* The value of the property on the request.
119+
*/
120+
public function __get($key)
121+
{
122+
return $this->request->$key;
123+
}
124+
76125
/**
77126
* Returns the request body content, and handles unescaping slashes for
78127
* json content.
@@ -87,7 +136,7 @@ protected function getSignature() : string
87136
*/
88137
public function getContent($asResource = false)
89138
{
90-
$content = parent::getContent($asResource);
139+
$content = $this->request->getContent($asResource);
91140

92141
json_decode($content);
93142

‎tests/Middlewares/VerifySignatureTest.php‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@
44

55
use Mockery;
66
use Tests\TestCase;
7+
use Illuminate\Http\Request;
8+
use SoapBox\SignedRequests\Signature;
79
use Illuminate\Contracts\Config\Repository;
810
use SoapBox\SignedRequests\Requests\Signed;
911
use SoapBox\SignedRequests\Middlewares\VerifySignature;
@@ -59,12 +61,7 @@ public function it_throws_an_invalid_signature_exception_if_the_request_is_not_v
5961
->with('signed-requests.key')
6062
->andReturn('key');
6163

62-
$request = new class() extends Signed {
63-
public function isValid(string $key) : bool
64-
{
65-
return false;
66-
}
67-
};
64+
$request = new Request();
6865

6966
$this->middleware->handle($request, function () { });
7067
}
@@ -76,22 +73,27 @@ public function it_should_call_our_callback_if_the_request_is_valid()
7673
{
7774
$this->configurations->shouldReceive('get')
7875
->with('signed-requests.headers.signature')
79-
->andReturn('HTTP_SIGNATURE');
76+
->andReturn('signature');
8077

8178
$this->configurations->shouldReceive('get')
8279
->with('signed-requests.headers.algorithm')
83-
->andReturn('HTTP_ALGORITHM');
80+
->andReturn('algorithm');
8481

8582
$this->configurations->shouldReceive('get')
8683
->with('signed-requests.key')
8784
->andReturn('key');
8885

89-
$request = new class() extends Signed {
90-
public function isValid(string $key) : bool
91-
{
92-
return true;
93-
}
94-
};
86+
$query = [];
87+
$request = [];
88+
$attributes = [];
89+
$cookies = [];
90+
$files = [];
91+
$server = [
92+
'HTTP_SIGNATURE' => hash_hmac('sha256', 'a', 'key'),
93+
'HTTP_ALGORITHM' => 'sha256'
94+
];
95+
96+
$request = new Request($query, $request, $attributes, $cookies, $files, $server, 'a');
9597

9698
$this->middleware->handle($request, function () {
9799
// This should be called.

‎tests/Requests/SignedTest.php‎ renamed to ‎tests/Requests/VerifierTest.php‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,25 +4,25 @@
44

55
use Tests\TestCase;
66
use Illuminate\Http\Request;
7-
use SoapBox\SignedRequests\Requests\Signed;
7+
use SoapBox\SignedRequests\Requests\Verifier;
88

9-
class SignedTest extends TestCase
9+
class VerifierTest extends TestCase
1010
{
1111
/**
1212
* @test
1313
*/
14-
public function it_is_a_request()
14+
public function it_can_be_constructed()
1515
{
16-
$request = new Signed();
17-
$this->assertInstanceOf(Request::class, $request);
16+
$request = new Verifier(new Request());
17+
$this->assertInstanceOf(Verifier::class, $request);
1818
}
1919

2020
/**
2121
* @test
2222
*/
2323
public function the_signature_header_key_can_be_set()
2424
{
25-
$request = new class() extends Signed {
25+
$request = new class(new Request()) extends Verifier {
2626
public function getSignatureHeader()
2727
{
2828
return $this->signatureHeader;
@@ -42,7 +42,7 @@ public function getSignatureHeader()
4242
*/
4343
public function the_algorithm_header_key_can_be_set()
4444
{
45-
$request = new class() extends Signed {
45+
$request = new class(new Request()) extends Verifier {
4646
public function getAlgorithmHeader()
4747
{
4848
return $this->algorithmHeader;
@@ -58,17 +58,17 @@ public function getAlgorithmHeader()
5858
}
5959

6060
/**
61-
* A test helper to generate a signed request.
61+
* A test helper to generate a Signed request.
6262
*
6363
* @param array $headers
6464
* The request headers we'd like to include.
6565
* @param string $content
6666
* The content of the request.
6767
*
68-
* @return \SoapBox\SignedRequests\Requests\Signed
68+
* @return \SoapBox\SignedRequests\Requests\Verifier
6969
* A configured signed request.
7070
*/
71-
protected function makeSignedRequest(array $headers = [], string $content = null) : Signed
71+
protected function makeSignedRequest(array $headers = [], string $content = null) : Verifier
7272
{
7373
$query = [];
7474
$request = [];
@@ -77,7 +77,9 @@ protected function makeSignedRequest(array $headers = [], string $content = null
7777
$files = [];
7878
$server = $headers;
7979

80-
return new Signed($query, $request, $attributes, $cookies, $files, $server, $content);
80+
$request = new Request($query, $request, $attributes, $cookies, $files, $server, $content);
81+
82+
return new Verifier($request);
8183
}
8284

8385
/**

0 commit comments

Comments
 (0)