File Coverage

blib/lib/UID2/Client.pm

Criterion	Covered	Total	%
statement	91	104	87.5
branch	11	20	55.0
condition	6	17	35.2
subroutine	23	24	95.8
pod	8	8	100.0
total	139	173	80.3

package UID2::Client;
use strict;
use warnings;

our $VERSION = '0.01';

use Class::Accessor::Lite (
    rw => [qw(endpoint auth_key secret_key identity_scope http keys)],
);

use Carp;
use HTTP::Tiny;
use JSON;
use Crypt::PRNG qw(random_bytes);
use Crypt::Misc qw(encode_b64 decode_b64);

use UID2::Client::Decryption;
use UID2::Client::Key;
use UID2::Client::KeyContainer;
use UID2::Client::Timestamp;
use UID2::Client::IdentityScope;

sub new {
    my ($class, $options) = @_;
    my $secret_key = $options->{secret_key} // croak 'secret_key required';
    $secret_key = decode_b64($secret_key);
    my $http = do {
        if ($options->{http_options} && $options->{http}) {
            croak 'only one of http_options or http can be specified';
        } elsif ($options->{http_options}) {
            HTTP::Tiny->new(%{$options->{http_options}});
        } elsif ($options->{http}) {
            $options->{http};
        } else {
            HTTP::Tiny->new;
        }
    };
    bless {
        endpoint       => $options->{endpoint} // croak('endpoint required'),
        auth_key       => $options->{auth_key} // croak('auth_key required'),
        secret_key     => $secret_key,
        identity_scope => $options->{identity_scope} // UID2::Client::IdentityScope::UID2,
        http           => $http,
        keys           => undef,
    }, $class;
}

sub new_euid {
    my ($class, $options) = @_;
    $class->new({ %$options, identity_scope => UID2::Client::IdentityScope::EUID });
}

sub refresh {
    my $self = shift;
    eval {
        $self->keys(_parse_json($self->get_latest_keys));
    }; if ($@) {
        return { is_success => undef, reason => $@ };
    }
    +{ is_success => 1 };
}

sub refresh_json {
    my ($self, $json) = @_;
    eval {
        $self->keys(_parse_json($json));
    }; if ($@) {
        return { is_success => undef, reason => $@ };
    }
    +{ is_success => 1 };
}

my $V2_NONCE_LEN = 8;

sub get_latest_keys {
    my $self = shift;
    my $nonce = random_bytes($V2_NONCE_LEN);
    my $res = $self->http->post($self->endpoint . '/v2/key/latest', {
        headers => {
            'Authorization' => 'Bearer ' . $self->auth_key,
            'Content-Type' => 'text/plain',
        },
        content => $self->_make_v2_request($nonce),
    });
    unless ($res->{success}) {
        if ($res->{status} == 599) {
            chomp(my $content = $res->{content});
            croak $content;
        } else {
            croak "$res->{status} $res->{reason}";
        }
    }
    $self->_parse_v2_response($res->{content}, $nonce);
}

sub _make_v2_request {
    my ($self, $nonce, $now) = @_;
    $now //= UID2::Client::Timestamp->now;
    my $data = pack 'q> a*', $now->get_epoch_milli, $nonce;
    my $payload = UID2::Client::Decryption::encrypt_gcm($data, $self->secret_key),
    my $version = 1;
    my $envelope = pack 'C a*', $version, $payload;
    encode_b64($envelope);
}

sub _parse_v2_response {
    my ($self, $envelope, $nonce) = @_;
    my $envelope_bytes = decode_b64($envelope);
    my $payload = UID2::Client::Decryption::decrypt_gcm($envelope_bytes, $self->secret_key);
    if (length($payload) < 16) {
        croak 'invalid payload';
    }
    my ($res_nonce, $data) = unpack "x8 a${V2_NONCE_LEN} a*", $payload;
    if ($res_nonce ne $nonce) {
        croak 'nonce mismatch';
    }
    $data;
}

sub _parse_json {
    my $content = shift;
    my $obj = decode_json($content);
    my @keys;
    for my $entry (@{$obj->{body}}) {
        $entry->{secret} = decode_b64($entry->{secret});
        push @keys, UID2::Client::Key->new($entry);
    }
    UID2::Client::KeyContainer->new(@keys);
}

sub decrypt {
    my ($self, $token, $now) = @_;
    UID2::Client::Decryption::decrypt_token($token, $now, $self->keys, $self->identity_scope);
}

sub encrypt_data {
    my ($self, $data, $request) = @_;
    $request->{identity_scope} = $self->identity_scope;
    $request->{keys} = $self->keys unless $request->{key};
    UID2::Client::Decryption::encrypt_data($data, $request);
}

sub decrypt_data {
    my ($self, $data) = @_;
    UID2::Client::Decryption::decrypt_data($data, $self->keys, $self->identity_scope);
}

1;
__END__