File Coverage

blib/lib/Mojolicious/Plugin/YubiVerify.pm

Criterion	Covered	Total	%
statement	43	82	52.4
branch	0	18	0.0
condition	0	15	0.0
subroutine	14	20	70.0
pod	1	1	100.0
total	58	136	42.6

package Mojolicious::Plugin::YubiVerify;

#
# Copyright (c) by Kirill Miazine
#
# This software is distributed under an ISC-style license, please see
#  for details.
#

use strict;
use warnings;
use base 'Mojolicious::Plugin';

our $VERSION = '0.04';

use Mojo::UserAgent;
use URI::Escape qw(uri_escape);
use MIME::Base64 qw(encode_base64 decode_base64);
use Digest::HMAC_SHA1 qw(hmac_sha1); # Mojo::Util's hmac_sha1_sum gives HEX
use String::Random qw(random_string);
use List::Util qw(shuffle);

use constant API_ID => 1851;                            # API id and API key are "borrowed" from
use constant API_KEY => 'oBVbNt7IZehZGR99rvq8d6RZ1DM='; # http://demo.yubico.com/php-yubico/demo.php
use constant API_URLS => map { sprintf('http://api%s.yubico.com/wsapi/2.0/verify', $_) } ('', 2..5);
use constant PARALLEL => 2;
use constant STATUSMAP => (
    OK => 'The OTP is valid.',
    BAD_OTP => 'The OTP is invalid format.',
    REPLAYED_OTP => 'The OTP has already been seen by the service.',
    BAD_SIGNATURE => 'The HMAC signature verification failed.',
    MISSING_PARAMETER => 'The request lacks a parameter.',
    NO_SUCH_CLIENT => 'The request id does not exist.',
    OPERATION_NOT_ALLOWED => 'The request id is not allowed to verify OTPs.',
    BACKEND_ERROR => 'Unexpected error in our server. Please contact us if you see this error.',
    NOT_ENOUGH_ANSWERS => 'Server could not get requested number of syncs during before timeout.',
    REPLAYED_REQUEST => 'Server has seen the OTP/Nonce combination before.',
);

sub register {
    my ($plugin, $app, $conf) = @_;

    $conf->{'api_id'}   ||= API_ID;
    $conf->{'api_key'}  ||= API_KEY;
    $conf->{'parallel'} ||= PARALLEL;

    $app->helper(
        yubi_verify => sub {
            my $self = shift;
            my $otp = shift or return;
            my $ret_res = shift; # for testing

            my $ua = Mojo::UserAgent->new;
            my $nonce = random_string('c' x 40);
            my $query_string = _signedq(
                $conf->{'api_key'},
                id => $conf->{'api_id'},
                otp => $otp,
                nonce => $nonce,
                timestamp => 1,
                sl => 42,
                timeout => undef,
            );
            my @res = grep { ref($_) eq 'HASH' and defined $_->{'status'} }
                      map { {_resp2p($_->res->body)} }
                      grep { $_->res->code and $_->res->code == 200 }
                      map { $ua->get("$_?$query_string") }
                          (shuffle(API_URLS))[0..($conf->{'parallel'}-1)];

            for my $res (@res) {
                next if $res->{'status'} ne 'OK';
                next if !defined $res->{'otp'} or $res->{'otp'} ne $otp;
                next if !defined $res->{'nonce'} or $res->{'nonce'} ne $nonce;
                my ($key_id) = ($res->{'otp'} =~ /^(.+)(.{32})$/);
                my $h = delete $res->{'h'};
                return ($key_id, ($ret_res ? \@res : ()))
                    if $res->{'status'} eq 'OK' and $h eq
                                                    _b64hmacsig(_sortedq(%{$res}),
                                                                decode_base64($conf->{'api_key'}));
            }

            return (undef, ($ret_res ? \@res : ()))
        }
    );
}

sub _sortedq {
    my %p = @_; join('&', map { join('=', $_, uri_escape($p{$_}, '^A-Za-z0-9:._~-')) }
                               sort grep { defined $p{$_} } keys %p);
}

sub _b64hmacsig {
    encode_base64(hmac_sha1(@_), '');
}

sub _signedq {
    my $key = shift;
    my $q = _sortedq(@_);
    # avoid BAD_SIGNATURE,
    # as in http://code.google.com/p/php-yubico/source/browse/trunk/Yubico.php
    (my $h = _b64hmacsig($q, decode_base64($key))) =~ s/\+/%2B/g;
    return "$q&h=$h";
}

sub _resp2p {
    my $p = {map { split /=/, $_, 2 } grep { /=/ } split /\r?\n/, $_[0]};
    return map { $_ => $p->{$_} } qw(otp nonce h t status timestamp sessioncounter sessionuse sl);
}

42;

__END__