123456789_123456789_123456789_123456789_123456789_

Module: Gem::GemcutterUtilities

Relationships & Source Files
Namespace Children
Classes:
Extension / Inclusion / Inheritance Descendants
Included In:
Super Chains via Extension / Inclusion / Inheritance
Instance Chain:
self, Text
Defined in: lib/rubygems/gemcutter_utilities.rb,
lib/rubygems/gemcutter_utilities/webauthn_listener.rb,
lib/rubygems/gemcutter_utilities/webauthn_poller.rb,
lib/rubygems/gemcutter_utilities/webauthn_listener/response.rb

Overview

Utility methods for using the RubyGems API.

Constant Summary

Instance Attribute Summary

Instance Method Summary

Text - Included

#clean_text

Remove any non-printable characters and make the text suitable for printing.

#format_text

Wraps text to wrap characters and optionally indents by indent characters.

#levenshtein_distance

Returns a value representing the “cost” of transforming str1 into str2 Vendored version of DidYouMean::Levenshtein.distance from the ruby/did_you_mean gem @ 1.4.0 github.com/ruby/did_you_mean/blob/2ddf39b874808685965dbc47d344cf6c7651807c/lib/did_you_mean/levenshtein.rb#L7-L37.

#truncate_text, #min3

Instance Attribute Details

#default_host?Boolean (readonly, private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 345

def default_host?
  host == Gem::DEFAULT_HOST
end

#host (rw)

The host to connect to either from the RUBYGEMS_HOST environment variable or from the user’s configuration

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 69

def host
  configured_host = Gem.host unless
    Gem.configuration.disable_default_gem_server

  @host ||=
    begin
      env_rubygems_host = ENV["RUBYGEMS_HOST"]
      env_rubygems_host = nil if env_rubygems_host&.empty?

      env_rubygems_host || configured_host
    end
end

#host=(value) (rw)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 18

attr_writer :host

#scope=(value) (writeonly)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 19

attr_writer :scope

Instance Method Details

#add_key_option

Add the –key option

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 24

def add_key_option
  add_option("-k", "--key KEYNAME", Symbol,
             "Use the given API key",
             "from #{Gem.configuration.credentials_path}") do |value,options|
    options[:key] = value
  end
end

#add_otp_option

Add the –otp option

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 35

def add_otp_option
  add_option("--otp CODE",
             "Digit code for multifactor authentication",
             "You can also use the environment variable GEM_HOST_OTP_CODE") do |value, options|
    options[:otp] = value
  end
end

#api_key

The API key from the command options or from the user’s configuration.

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 46

def api_key
  if ENV["GEM_HOST_API_KEY"]
    ENV["GEM_HOST_API_KEY"]
  elsif options[:key]
    verify_api_key options[:key]
  elsif Gem.configuration.api_keys.key?(host)
    Gem.configuration.api_keys[host]
  else
    Gem.configuration.rubygems_api_key
  end
end

#api_key_forbidden?(response) ⇒ Boolean (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 385

def api_key_forbidden?(response)
  response.is_a?(Gem::Net::HTTPForbidden) && response.body.start_with?("The API key doesn't have access")
end

#fetch_otp(credentials) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 256

def fetch_otp(credentials)
  options[:otp] = if webauthn_url = webauthn_verification_url(credentials)
    server = TCPServer.new 0
    port = server.addr[1].to_s

    url_with_port = "#{webauthn_url}?port=#{port}"
    say "You have enabled multi-factor authentication. Please visit #{url_with_port} to authenticate via security device. If you can't verify using WebAuthn but have OTP enabled, you can re-run the gem signin command with the `--otp [your_code]` option."

    threads = [WebauthnListener.listener_thread(host, server), WebauthnPoller.poll_thread(options, host, webauthn_url, credentials)]
    otp_thread = wait_for_otp_thread(*threads)

    threads.each(&:join)

    if error = otp_thread[:error]
      alert_error error.message
      terminate_interaction(1)
    end

    say "You are verified with a security device. You may close the browser window."
    otp_thread[:otp]
  else
    say "You have enabled multi-factor authentication. Please enter OTP code."
    ask "Code: "
  end
end

#get_key_name(scope) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 371

def get_key_name(scope)
  hostname = Socket.gethostname || "unknown-host"
  user = ENV["USER"] || ENV["USERNAME"] || "unknown-user"
  ts = Time.now.strftime("%Y%m%d%H%M%S")
  default_key_name = "#{hostname}-#{user}-#{ts}"

  key_name = ask "API Key name [#{default_key_name}]: " unless scope
  if key_name.nil? || key_name.empty?
    default_key_name
  else
    key_name
  end
end

#get_mfa_params(profile) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 361

def get_mfa_params(profile)
  mfa_level = profile["mfa"]
  params = {}
  if ["ui_only", "ui_and_gem_signin"].include?(mfa_level)
    selected = ask_yes_no("Would you like to enable MFA for this key? (strongly recommended)")
    params["mfa"] = true if selected
  end
  params
end

#get_scope_params(scope) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 312

def get_scope_params(scope)
  scope_params = { index_rubygems: true }

  if scope
    scope_params = { scope => true }
  else
    say "The default access scope is:"
    scope_params.each do |k, _v|
      say "  #{k}: y"
    end
    say "\n"
    customise = ask_yes_no("Do you want to customise scopes?", false)
    if customise
      EXCLUSIVELY_API_SCOPES.each do |excl_scope|
        selected = ask_yes_no("#{excl_scope} (exclusive scope, answering yes will not prompt for other scopes)", false)
        next unless selected

        return { excl_scope => true }
      end

      scope_params = {}

      API_SCOPES.each do |s|
        selected = ask_yes_no(s.to_s, false)
        scope_params[s] = true if selected
      end
    end
    say "\n"
  end

  scope_params
end

#get_user_profile(identifier, password) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 349

def (identifier, password)
  return {} unless default_host?

  response = rubygems_api_request(:get, "api/v1/profile/me.yaml") do |request|
    request.basic_auth identifier, password
  end

  with_response response do |resp|
    Gem::ConfigFile.load_with_rubygems_config_hash(clean_text(resp.body))
  end
end

#mfa_unauthorized?(response) ⇒ Boolean

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 122

def mfa_unauthorized?(response)
  response.is_a?(Gem::Net::HTTPUnauthorized) && response.body.start_with?("You have enabled multifactor authentication")
end

#otp

The OTP code from the command options or from the user’s configuration.

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 61

def otp
  options[:otp] || ENV["GEM_HOST_OTP_CODE"]
end

#pretty_host(host) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 304

def pretty_host(host)
  if default_host?
    "RubyGems.org"
  else
    host
  end
end

#request_with_otp(method, uri, &block) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 247

def request_with_otp(method, uri, &block)
  request_method = Gem::Net::HTTP.const_get method.to_s.capitalize

  Gem::RemoteFetcher.fetcher.request(uri, request_method) do |req|
    req["OTP"] = otp if otp
    block.call(req)
  end
end

#rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, credentials: {}, &block)

Creates an RubyGems API to #host and Gem.path with the given HTTP method.

If allowed_push_host metadata is present, then it will only allow that host.

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 87

def rubygems_api_request(method, path, host = nil, allowed_push_host = nil, scope: nil, credentials: {}, &block)
  require_relative "vendored_net_http"

  self.host = host if host
  unless self.host
    alert_error "You must specify a gem server"
    terminate_interaction(ERROR_CODE)
  end

  if allowed_push_host
    allowed_host_uri = Gem::URI.parse(allowed_push_host)
    host_uri         = Gem::URI.parse(self.host)

    unless (host_uri.scheme == allowed_host_uri.scheme) && (host_uri.host == allowed_host_uri.host)
      alert_error "#{self.host.inspect} is not allowed by the gemspec, which only allows #{allowed_push_host.inspect}"
      terminate_interaction(ERROR_CODE)
    end
  end

  uri = Gem::URI.parse "#{self.host}/#{path}"
  response = request_with_otp(method, uri, &block)

  if mfa_unauthorized?(response)
    fetch_otp(credentials)
    response = request_with_otp(method, uri, &block)
  end

  if api_key_forbidden?(response)
    update_scope(scope)
    request_with_otp(method, uri, &block)
  else
    response
  end
end

#set_api_key(host, key)

Returns true when the user has enabled multifactor authentication from response text and no otp provided by options.

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 237

def set_api_key(host, key)
  if default_host?
    Gem.configuration.rubygems_api_key = key
  else
    Gem.configuration.set_api_key host, key
  end
end

#sign_in(sign_in_host = nil, scope: nil)

Signs in with the RubyGems API at sign_in_host and sets the rubygems API key.

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 152

def ( = nil, scope: nil)
   ||= host
  return if api_key

  pretty_host = pretty_host()

  say "Enter your #{pretty_host} credentials."
  say "Don't have an account yet? " \
      "Create one at #{}/sign_up"

  identifier = ask "Username/email: "
  password   = ask_for_password "      Password: "
  say "\n"

  key_name     = get_key_name(scope)
  scope_params = get_scope_params(scope)
  profile      = (identifier, password)
  mfa_params   = get_mfa_params(profile)
  all_params   = scope_params.merge(mfa_params)
  warning      = profile["warning"]
  credentials  = { identifier: identifier, password: password }

  say "#{warning}\n" if warning

  response = rubygems_api_request(:post, "api/v1/api_key",
                                  , credentials: credentials, scope: scope) do |request|
    request.basic_auth identifier, password
    request["OTP"] = otp if otp
    request.body = Gem::URI.encode_www_form({ name: key_name }.merge(all_params))
  end

  with_response response do |resp|
    say "Signed in with API key: #{key_name}."
    set_api_key host, resp.body
  end
end

#update_scope(scope)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 126

def update_scope(scope)
          = host
  pretty_host         = pretty_host()
  update_scope_params = { scope => true }

  say "The existing key doesn't have access of #{scope} on #{pretty_host}. Please sign in to update access."

  identifier = ask "Username/email: "
  password   = ask_for_password "      Password: "

  response = rubygems_api_request(:put, "api/v1/api_key",
                                  , scope: scope) do |request|
    request.basic_auth identifier, password
    request["OTP"] = otp if otp
    request.body = Gem::URI.encode_www_form({ api_key: api_key }.merge(update_scope_params))
  end

  with_response response do |_resp|
    say "Added #{scope} scope to the existing API key"
  end
end

#verify_api_key(key)

Retrieves the pre-configured API key key or terminates interaction with an error.

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 193

def verify_api_key(key)
  if Gem.configuration.api_keys.key? key
    Gem.configuration.api_keys[key]
  else
    alert_error "No such API key. Please add it to your configuration (done automatically on initial `gem push`)."
    terminate_interaction(ERROR_CODE)
  end
end

#wait_for_otp_thread(*threads) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 282

def wait_for_otp_thread(*threads)
  loop do
    threads.each do |otp_thread|
      return otp_thread unless otp_thread.alive?
    end
    sleep 0.1
  end
ensure
  threads.each(&:exit)
end

#webauthn_verification_url(credentials) (private)

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 293

def webauthn_verification_url(credentials)
  response = rubygems_api_request(:post, "api/v1/webauthn_verification") do |request|
    if credentials.empty?
      request.add_field "Authorization", api_key
    else
      request.basic_auth credentials[:identifier], credentials[:password]
    end
  end
  response.is_a?(Gem::Net::HTTPSuccess) ? response.body : nil
end

#with_response(response, error_prefix = nil)

If response is an HTTP Success (2XX) response, yields the response if a block was given or shows the response body to the user.

If the response was not successful, shows an error to the user including the error_prefix and the response body. If the response was a permanent redirect, shows an error to the user including the redirect location.

[ GitHub ]

  
# File 'lib/rubygems/gemcutter_utilities.rb', line 210

def with_response(response, error_prefix = nil)
  case response
  when Gem::Net::HTTPSuccess then
    if block_given?
      yield response
    else
      say clean_text(response.body)
    end
  when Gem::Net::HTTPPermanentRedirect, Gem::Net::HTTPRedirection then
    message = "The request has redirected permanently to #{response["location"]}. Please check your defined push host URL."
    message = "#{error_prefix}: #{message}" if error_prefix

    say clean_text(message)
    terminate_interaction(ERROR_CODE)
  else
    message = response.body
    message = "#{error_prefix}: #{message}" if error_prefix

    say clean_text(message)
    terminate_interaction(ERROR_CODE)
  end
end