Ruby REST client

ruby -c session.rb

# Complete Sandbox REST CLI. Ruby2.6+, libsodium1.0.20; stdlib HTTP/TLS.
# Run ruby session.rb status|activate|check|validate|deactivate. Safe decisions.
# Requires unchanged ../../security/ruby/verify.rb and a trusted public key file.
require 'net/http'
require 'uri'
require 'time'
require 'securerandom'
require 'fileutils'
require_relative '../../security/ruby/verify'

class Refusal < StandardError
  attr_reader :code, :request_id
  def initialize(code, id = nil); super(code); @code = code; @request_id = id; end
end
class Unreachable < StandardError; end
class Session
  def required(name)
    value = ENV.fetch(name)
    raise 'Invalid configuration' if value.empty? || value.match?(/[\r\n]/)
    value
  end
  def read(file)
    stat = File.lstat(file)
    raise 'Unsafe file' unless stat.file? && !stat.symlink? && stat.size <= 1_048_576
    File.binread(file)
  end
  def object(raw)
    value = RawJson.new(raw.dup).parse
    raise Refusal.new('INVALID_RESPONSE') unless value.is_a?(Hash)
    value
  end
  def initialize
    @app = required('KDP_APP_ID'); raise 'App ID' unless /\A[A-Za-z0-9_-]{3,160}\z/.match?(@app)
    uri = URI(ENV.fetch('KDP_BASE_URL', 'https://licensing.kdpika.com/api/v1').sub(%r{/+\z}, ''))
    local = uri.scheme == 'http' && ['127.0.0.1', 'localhost'].include?(uri.host) && ENV['KDP_ALLOW_LOOPBACK'] == '1'
    raise 'Unsafe URL' unless uri.host && (uri.scheme == 'https' || local) && !uri.userinfo && !uri.query && !uri.fragment && uri.path == '/api/v1'
    @base = uri.to_s
    root = required('KDP_STATE_DIR'); key = required('KDP_TRUSTED_KEY_FILE')
    raise 'Absolute paths required' unless File.absolute_path(root) == root && File.absolute_path(key) == key
    @trusted = read(key); public_key = object(@trusted)
    raise 'Trusted key' unless public_key['algorithm'] == 'Ed25519' && public_key['encoding'] == 'base64url'
    FileUtils.mkdir_p(root, mode: 0o700); raise 'Root symlink' if File.symlink?(root)
    @dir = File.join(root, Digest::SHA256.hexdigest([@base, @app, 'SANDBOX', 'ruby-rest-v1'].join('|'))[0, 20])
    FileUtils.mkdir_p(@dir, mode: 0o700); raise 'Namespace symlink' if File.symlink?(@dir)
    File.chmod(0o700, @dir)
    @lock = File.open(File.join(@dir, '.lock'), File::WRONLY | File::CREAT | File::EXCL, 0o600)
    begin
      identity = File.join(@dir, 'installation.json')
      write('installation.json', {'installation_id' => 'lmp-install-' + SecureRandom.uuid}) unless File.exist?(identity) || File.symlink?(identity)
      @installation = object(read(identity)).fetch('installation_id')
      raise 'Invalid identity; do not reset automatically' unless /\Almp-install-[a-f0-9-]{36}\z/.match?(@installation)
    rescue StandardError
      close; raise
    end
  end
  def close
    return unless @lock
    @lock.close; File.unlink(File.join(@dir, '.lock')); @lock = nil
  end
  def write(name, value)
    temporary = File.join(@dir, 'write-' + SecureRandom.hex(12))
    File.open(temporary, File::WRONLY | File::CREAT | File::EXCL, 0o600) { |file| file.write(JSON.generate(value)); file.flush; file.fsync }
    File.rename(temporary, File.join(@dir, name))
  end
  def state
    file = File.join(@dir, 'session.json'); return nil unless File.exist?(file) || File.symlink?(file)
    raw = read(file); object(raw); value = JSON.parse(raw)
    raise 'Invalid state' unless value['token'].is_a?(String) && /\Aact_[A-Za-z0-9_-]+\z/.match?(value['token']) &&
      (value['envelope'].nil? || value['envelope'].is_a?(String)) && value['checkpoint'].is_a?(String)
    timestamp(value['checkpoint']); value
  end
  def clear
    file = File.join(@dir, 'session.json'); File.unlink(file) if File.exist?(file) || File.symlink?(file)
  end
  def timestamp(value)
    raise Refusal.new('INVALID_TIME') unless value.is_a?(String) && /\A\d{4}-\d\d-\d\dT\d\d:\d\d:\d\d(?:\.\d+)?(?:Z|[+-]\d\d:\d\d)\z/.match?(value)
    Time.iso8601(value)
  rescue ArgumentError
    raise Refusal.new('INVALID_TIME')
  end
  def request(endpoint, body, token = nil)
    uri = URI(@base + endpoint); request = Net::HTTP::Post.new(uri.request_uri)
    request['Accept'] = 'application/json'; request['Content-Type'] = 'application/json'; request['User-Agent'] = 'KDPika-REST-Ruby-example/1.0'
    if token
      request['Authorization'] = 'Bearer ' + token; request['X-Installation-ID'] = @installation
    else
      request['X-App-ID'] = @app; request['X-Environment'] = 'SANDBOX'
    end
    request.body = JSON.generate(body); raw = ''.b; response = nil
    begin
      # Explicit nil proxy prevents accidental forwarding through environment proxies.
      http = Net::HTTP.new(uri.host, uri.port, nil); http.use_ssl = uri.scheme == 'https'; http.verify_mode = OpenSSL::SSL::VERIFY_PEER
      http.open_timeout = 5; http.read_timeout = 15; http.max_retries = 0
      http.start { |connection| connection.request(request) { |reply| response = reply; reply.read_body { |part| raw << part; raise Refusal.new('INVALID_RESPONSE') if raw.bytesize > 1_048_576 } } }
    rescue Refusal
      raise
    rescue StandardError
      raise Unreachable
    end
    begin; value = object(raw); rescue StandardError; raise Refusal.new('INVALID_RESPONSE'); end
    id = value['request_id']; id = nil unless id.is_a?(String) && /\Areq_[A-Za-z0-9_-]{1,120}\z/.match?(id)
    unless response.code.to_i.between?(200, 299) && value['success'] == true
      code = value.dig('error', 'code') rescue nil
      code = 'HTTP_ERROR' unless code.is_a?(String) && /\A[A-Z0-9_]{1,64}\z/.match?(code)
      raise Refusal.new(code, id)
    end
    [value, id]
  end
  def accepted(source, id = nil)
    {'valid' => true, 'source' => source, 'signature_valid' => false, 'error_code' => nil, 'request_id' => id,
     'pdf_export_allowed' => false, 'seat_count' => nil, 'message' => 'Your license is ready.'}
  end
  def verify(envelope, source, checkpoint, id = nil)
    raise Refusal.new('SIGNATURE_INVALID', id) unless verify_envelope(@trusted.dup, envelope.dup)
    payload = JSON.parse(envelope).fetch('payload'); now = Time.now
    unless payload['product_id'] == @app && payload['environment'] == 'sandbox' &&
      payload.dig('device', 'installation_hash') == Digest::SHA256.hexdigest(@installation)
      raise Refusal.new('BINDING_MISMATCH', id)
    end
    server = timestamp(payload['server_time']); next_time = timestamp(payload['next_validation_at']); grace = timestamp(payload['offline_grace_until'])
    raise Refusal.new('INVALID_TIME', id) if next_time < server || grace < server
    latest = checkpoint ? [server, timestamp(checkpoint)].max : server
    raise Refusal.new('CLOCK_ROLLBACK_DETECTED', id) if now + 300 < latest
    raise Refusal.new('LICENSE_NOT_ACTIVE', id) unless payload['status'] == 'active'
    raise Refusal.new('LICENSE_NOT_STARTED', id) if payload['starts_at'] && now < timestamp(payload['starts_at'])
    raise Refusal.new('LICENSE_EXPIRED', id) if payload['expires_at'] && now >= timestamp(payload['expires_at'])
    raise Refusal.new('OFFLINE_GRACE_EXPIRED', id) if source != 'online' && now > grace
    features = payload.fetch('features'); raise Refusal.new('INVALID_RESPONSE') unless features.is_a?(Hash)
    value = accepted(source, id); value['signature_valid'] = true; value['pdf_export_allowed'] = features['pdf_export'] == true
    seat = features['seat_count']; value['seat_count'] = seat if seat.is_a?(Integer) && seat.between?(0, 9_007_199_254_740_991)
    value
  end
  def run(action)
    saved = state
    return {'activated' => !saved.nil?, 'installation_hash' => Digest::SHA256.hexdigest(@installation), 'storage_security' => 'permission-protected-file'} if action == 'status'
    if action == 'activate'
      license = required('KDP_LICENSE_KEY'); raise 'Sandbox key required' unless license.start_with?('TEST')
      raise Refusal.new('ALREADY_ACTIVATED') if saved
      body = {'license_key' => license, 'device_id' => @installation, 'device_name' => 'Ruby REST example', 'platform' => RUBY_PLATFORM, 'app_version' => '1.0.0'}
      body['email'] = required('KDP_CUSTOMER_EMAIL') if ENV['KDP_CUSTOMER_EMAIL'] && !ENV['KDP_CUSTOMER_EMAIL'].empty?
      reply, id = request('/licenses/activate', body); token = reply['activation_token']
      raise Refusal.new('INVALID_RESPONSE', id) unless token.is_a?(String) && /\Aact_[A-Za-z0-9_-]+\z/.match?(token)
      begin
        envelope = canonical(reply.fetch('license')); result = verify(envelope, 'online', nil, id)
        write('session.json', {'token' => token, 'envelope' => envelope, 'checkpoint' => Time.now.utc.iso8601(6)}); return result
      rescue StandardError
        begin; request('/licenses/deactivate', {}, token); rescue StandardError; end
        raise
      end
    end
    raise Refusal.new('NOT_ACTIVATED') unless saved
    if action == 'deactivate'
      reply, id = request('/licenses/deactivate', {}, saved['token']); raise Refusal.new('INVALID_RESPONSE', id) unless reply['deactivated'] == true
      clear; value = accepted('online', id); value['message'] = 'This installation has been deactivated.'; return value
    end
    if action == 'check' && saved['envelope']
      begin
        value = verify(saved['envelope'], 'cache', saved['checkpoint'])
        if Time.now < timestamp(JSON.parse(saved['envelope']).dig('payload', 'next_validation_at'))
          saved['checkpoint'] = Time.now.utc.iso8601(6); write('session.json', saved); return value
        end
      rescue Refusal
        saved['envelope'] = nil; write('session.json', saved)
      end
    end
    begin
      reply, id = request('/licenses/validate', {}, saved['token']); envelope = canonical(reply.fetch('license'))
      value = verify(envelope, 'online', saved['checkpoint'], id); saved['envelope'] = envelope
    rescue Unreachable
      raise Refusal.new('OFFLINE_CACHE_MISSING') unless saved['envelope']
      value = verify(saved['envelope'], 'offline', saved['checkpoint'])
    rescue Refusal => error
      if ['INVALID_TOKEN', 'DEVICE_MISMATCH', 'LICENSE_REVOKED', 'LICENSE_EXPIRED', 'LICENSE_CANCELLED'].include?(error.code)
        clear
      else
        saved['envelope'] = nil; write('session.json', saved)
      end
      raise
    end
    saved['checkpoint'] = Time.now.utc.iso8601(6); write('session.json', saved); value
  end
end

if $PROGRAM_NAME == __FILE__
  client = nil; code = 2
  begin
    raise 'Choose an action' unless ARGV.length == 1 && ['status', 'activate', 'check', 'validate', 'deactivate'].include?(ARGV[0])
    client = Session.new
    begin
      puts JSON.generate(client.run(ARGV[0])); code = 0
    rescue Refusal, Unreachable => error
      value = client.accepted('local', error.is_a?(Refusal) ? error.request_id : nil)
      value['valid'] = false; value['error_code'] = error.is_a?(Refusal) ? error.code : 'NETWORK_ERROR'
      value['message'] = 'Your license could not be confirmed. Connect and try again, or contact your software provider.'
      puts JSON.generate(value); code = 1
    end
  rescue StandardError
    warn 'Check application settings and private storage. Contact your software provider if the problem continues.'
  ensure
    client.close if client
  end
  exit code
end