From 57d522ce3972ea08f7c3c6b1b37d30a56b5cab5f Mon Sep 17 00:00:00 2001
From: Liang Tao <amethyst.black@gmail.com>
Date: Sun, 13 Sep 2015 20:32:41 +0800
Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E9=AA=8C=E8=AF=81=E5=9B=9E?=
 =?UTF-8?q?=E8=B0=83=E8=AF=B7=E6=B1=82=E7=9A=84=E5=87=BD=E6=95=B0=E3=80=82?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 lib/qiniu/auth.rb       | 42 ++++++++++++++++++++++++++++++-----------
 spec/qiniu/auth_spec.rb | 17 +++++++++++++++++
 2 files changed, 48 insertions(+), 11 deletions(-)

diff --git a/lib/qiniu/auth.rb b/lib/qiniu/auth.rb
index f261701..9e3213f 100755
--- a/lib/qiniu/auth.rb
+++ b/lib/qiniu/auth.rb
@@ -206,11 +206,7 @@ module Qiniu
           return authorize_download_url(download_url, args)
         end # authorize_download_url_2
 
-        def generate_acctoken(url, body = '')
-          ### 提取AK/SK信息
-          access_key = Config.settings[:access_key]
-          secret_key = Config.settings[:secret_key]
-
+        def generate_acctoken_sign_with_mac(access_key, secret_key, url, body)
           ### 解析URL，生成待签名字符串
           uri = URI.parse(url)
           signing_str = uri.path
@@ -232,13 +228,12 @@ module Qiniu
 
           ### 生成数字签名
           sign = calculate_hmac_sha1_digest(secret_key, signing_str)
-          encoded_sign = Utils.urlsafe_base64_encode(sign)
+          return Utils.urlsafe_base64_encode(sign)
+        end # generate_acctoken_sign_with_mac
 
-          ### 生成管理授权凭证
-          acctoken = "#{access_key}:#{encoded_sign}"
-
-          ### 返回管理授权凭证
-          return acctoken
+        def generate_acctoken(url, body = '')
+          encoded_sign = generate_acctoken_sign_with_mac(Config.settings[:access_key], Config.settings[:secret_key], url, body)
+          return "#{Config.settings[:access_key]}:#{encoded_sign}"
         end # generate_acctoken
 
         def generate_uptoken(put_policy)
@@ -259,6 +254,31 @@ module Qiniu
           ### 返回上传授权凭证
           return uptoken
         end # generate_uptoken
+
+        def authenticate_callback_request(auth_str, url, body = '')
+          ### 提取AK/SK信息
+          access_key = Config.settings[:access_key]
+          secret_key = Config.settings[:secret_key]
+
+          ### 检查签名格式
+          ak_pos = auth_str.index(access_key)
+          if ak_pos.nil? then
+            return false
+          end
+
+          colon_pos = auth_str.index(':', ak_pos + 1)
+          if colon_pos.nil? || ((ak_pos + access_key.length) != colon_pos) then
+            return false
+          end
+
+          encoded_sign = generate_acctoken_sign_with_mac(access_key, secret_key, url, body)
+          sign_pos = auth_str.index(encoded_sign, colon_pos + 1)
+          if sign_pos.nil? || ((sign_pos + encoded_sign.length) != auth_str.length) then
+            return false
+          end
+
+          return true
+        end # authenticate_callback_request
       end # class << self
 
     end # module Auth
diff --git a/spec/qiniu/auth_spec.rb b/spec/qiniu/auth_spec.rb
index cf4fa88..6405702 100755
--- a/spec/qiniu/auth_spec.rb
+++ b/spec/qiniu/auth_spec.rb
@@ -69,6 +69,23 @@ module Qiniu
         end
       end
     end
+
+    ### 测试回调签名
+    context ".authenticate_callback_request" do
+      url = '/test.php'
+      body = 'name=xxx&size=1234'
+      false.should == Qiniu::Auth.authenticate_callback_request('ABCD', url, body)
+      false.should == Qiniu::Auth.authenticate_callback_request(Config.settings[:access_key], url, body)
+      false.should == Qiniu::Auth.authenticate_callback_request('QBox ' + Config.settings[:access_key] + ':', url, body)
+      false.should == Qiniu::Auth.authenticate_callback_request('QBox ' + Config.settings[:access_key] + ':????', url, body)
+
+      acctoken = Qiniu::Auth.generate_acctoken(url, body)
+      auth_str = 'QBox ' + acctoken
+
+      false.should == Qiniu::Auth.authenticate_callback_request(auth_str + '  ', url, body)
+      true.should == Qiniu::Auth.authenticate_callback_request(auth_str, url, body)
+      true.should == Qiniu::Auth.authenticate_callback_request(acctoken, url, body)
+    end
   end # module Auth
 
   module Exception_Auth