gocardless - npm Package Compare versions

Comparing version 1.0.0-beta to 1.0.0-beta2

lib/client.js

@@ -0,1 +1,2 @@
+var _ = require('lodash');
 var request = require('request');
@@ -52,6 +53,15 @@
 Client.prototype.confirmResource = function confirmResource(params, cb) {
+  if (!Signer.verify(params, this.config.appSecret)) {
+    var err = 'Signature does not match params.' +
+              'This request has been tampered with.';
+    return _.isFunction(cb) && cb(new Error(err));
+  }
+
   var opts = {
     uri: this.config.baseUrl + constants.API_ROOT + '/confirm',
     method: 'POST',
-    json: params,
+    json: {
+      resource_type: params.resource_type,
+      resource_id: params.resource_id
+    },
     headers: {
@@ -68,4 +78,2 @@ Accept: 'application/json'
 
-Client.prototype.verifySignature = Signer.verify;
-
 module.exports = Client;

package.json

@@ -8,3 +8,3 @@ {
   ],
-  "version": "1.0.0-beta",
+  "version": "1.0.0-beta2",
   "author": {
@@ -11,0 +11,0 @@ "name": "Andy Appleton",

README.md

 # GoCardless Node.js client library
 
-## Version 1.0.0-beta note
+## Version 1.0.0-beta2 note
 
@@ -5,0 +5,0 @@ This replaces the previous [gocardless npm module](https://npmjs.org/package/gocardless/0.1.1) and is not API compatible. It will be released as 1.0.

test/integration/resources-test.js

 var path = require('path');
 
 var nock = require('nock');
+var expect = require('expect.js');
 
 var gocardlessFactory = require('../../lib/gocardless');
+var Signer = require('../../lib/helpers/request-signer');
 
@@ -209,7 +211,7 @@ var fixtures = path.resolve('test/fixtures');
       function confirmResourceOfType(resourceType) {
-        var id, expectedParams, authHeader;
+        var id, params, authHeader;
 
         beforeEach(function() {
           id = '123ABC';
-          expectedParams = {
+          params = {
             resource_type: resourceType,
@@ -226,13 +228,36 @@ resource_id: id
 
-        it('confirms the resource', function(done) {
-          server
-            .matchHeader('Authorization', 'Basic ' + authHeader)
-            .post('/api/v1/confirm', expectedParams)
-            .reply(200);
+        describe('with a good signature', function() {
+          beforeEach(function() {
+            var query = Signer.toQuery(params);
+            params.signature = Signer.sign(query, config.appSecret);
+          });
 
-          gocardless.confirmResource({
-            resource_type: resourceType,
-            resource_id: id
-          }, done);
+          it('confirms the resource', function(done) {
+            server
+              .matchHeader('Authorization', 'Basic ' + authHeader)
+              .post('/api/v1/confirm', {
+                resource_id: '123ABC',
+                resource_type: resourceType
+              }).reply(200);
+
+            gocardless.confirmResource(params, done);
+          });
         });
+
+        describe('with a bad signature', function() {
+          beforeEach(function() {
+            var query = Signer.toQuery({ hacked: 'params' });
+            params.signature = Signer.sign(query, config.appSecret);
+          });
+
+          it('does not confirm the resource', function(done) {
+            server.post('/api/v1/confirm').reply(200);
+
+            gocardless.confirmResource(params, function(err) {
+              expect(server.isDone()).to.be(false);
+              expect(err).to.be.a(Error);
+              done();
+            });
+          });
+        });
       }
@@ -239,0 +264,0 @@

test/unit/client-test.js

@@ -5,2 +5,4 @@ var sinon = require('sinon');
 
+expect = require('sinon-expect').enhance(expect, sinon, 'was');
+
 var Client = require('../../lib/client');
@@ -154,2 +156,3 @@ var Signer = require('../../lib/helpers/request-signer');
     var requestMock;
+    var params;
 
@@ -160,44 +163,64 @@ beforeEach(function() {
       client = new (require('../../lib/client'))(config);
+      params = { resource_id: 123, resource_type: 'bill' };
     });
 
-    it('posts to the correct url', function() {
-      var expectedUri = config.baseUrl + '/api/v1/confirm';
-      client.confirmResource();
-      expect(requestMock.args[0][0].method).to.be('POST');
-      expect(requestMock.args[0][0].uri).to.be(expectedUri);
-    });
+    describe('given a bad signature', function() {
+      beforeEach(function() {
+        params.signature = Signer.sign(Signer.toQuery({a:1}), config.appSecret);
+      });
 
-    it('sends passed params as JSON', function() {
-      var params = { some: 'data' };
-      client.confirmResource(params);
-      expect(requestMock.args[0][0].json).to.be(params);
-    });
+      it('does not make the confirm request', function() {
+        client.confirmResource(params);
+        expect(requestMock).was.notCalled();
+      });
 
-    it('adds Accept header', function() {
-      client.confirmResource();
-      expect(requestMock.args[0][0].headers).to.eql({
-        Accept: 'application/json'
+      it('calls the callback with an error', function() {
+        var cb = sinon.spy();
+        client.confirmResource(params, cb);
+        expect(cb.args[0][0]).to.be.a(Error);
       });
     });
 
-    it('adds basic auth details', function() {
-      client.confirmResource();
-      expect(requestMock.args[0][0].auth).to.eql({
-        user: config.appId,
-        pass: config.appSecret
+    describe('given a good signature', function() {
+      beforeEach(function() {
+        params.signature = Signer.sign(Signer.toQuery(params), config.appSecret);
       });
-    });
 
-    it('passes a callback', function() {
-      function cb() {}
-      client.confirmResource(null, cb);
-      expect(requestMock.args[0][1]).to.be(cb);
-    });
-  });
+      it('posts to the correct url', function() {
+        var expectedUri = config.baseUrl + '/api/v1/confirm';
+        client.confirmResource(params);
+        expect(requestMock.args[0][0].method).to.be('POST');
+        expect(requestMock.args[0][0].uri).to.be(expectedUri);
+      });
 
-  describe('#verifySignature', function() {
-    it('is Signer.verify', function() {
-      expect(new Client(config).verifySignature).to.be(Signer.verify);
+      it('passes resource_type and resource_id params as JSON', function() {
+        client.confirmResource(params);
+        expect(requestMock.args[0][0].json).to.eql({
+          resource_id: params.resource_id,
+          resource_type: params.resource_type
+        });
+      });
+
+      it('adds Accept header', function() {
+        client.confirmResource(params);
+        expect(requestMock.args[0][0].headers).to.eql({
+          Accept: 'application/json'
+        });
+      });
+
+      it('adds basic auth details', function() {
+        client.confirmResource(params);
+        expect(requestMock.args[0][0].auth).to.eql({
+          user: config.appId,
+          pass: config.appSecret
+        });
+      });
+
+      it('passes a callback', function() {
+        function cb() {}
+        client.confirmResource(params, cb);
+        expect(requestMock.args[0][1]).to.be(cb);
+      });
     });
   });
 });

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Found 1 instance in 1 package

New author

Supply chain risk

A new npm collaborator published a version of the package for the first time. New collaborators are usually benign additions to a project, but do indicate a change to the security surface area of a package.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

53305

increased by3.91%

Lines of code

1436

increased by3.46%

Number of medium supply chain risk alerts

0

decreased by-100%

No dependency changes