SECURITY-9707: add option to not to use escher because of service mesh

Co-authored-by: Istvan Demeter <[email protected]>

lib/session_validator/client.rb

@@ -15,6 +15,10 @@ class SessionValidator::Client
   SERVICE_REQUEST_TIMEOUT = 2.freeze
   NETWORK_ERRORS = Faraday::Retry::Middleware::DEFAULT_EXCEPTIONS + [Faraday::ConnectionFailed] - ['Timeout::Error']
 
+  def initialize(use_escher: true)
+    @use_escher = use_escher
+  end
+
   def valid?(msid)
     response_status = client.get("/sessions/#{msid}", nil, headers).status
     (200..299).include?(response_status) || (500..599).include?(response_status)
@@ -23,7 +27,7 @@ def valid?(msid)
   end
 
   def filter_invalid(msids)
-    response = client.post("/sessions/filter", JSON.generate({msids: msids}), headers)
+    response = client.post("/sessions/filter", JSON.generate({ msids: msids }), headers)
     if response.status == 200
       JSON.parse(response.body)
     else
@@ -40,7 +44,7 @@ def client
       faraday.options[:open_timeout] = SERVICE_REQUEST_TIMEOUT
       faraday.options[:timeout] = SERVICE_REQUEST_TIMEOUT
       faraday.request :retry, interval: 0.05, interval_randomness: 0.5, backoff_factor: 2, methods: [:get, :post], exceptions: NETWORK_ERRORS
-      faraday.use Faraday::Middleware::Escher::RequestSigner, escher_config
+      faraday.use(Faraday::Middleware::Escher::RequestSigner, escher_config) if @use_escher
       faraday.adapter Faraday.default_adapter
     end
   end
@@ -67,6 +71,6 @@ def escher_config
   end
 
   def headers
-    {"content-type" => "application/json"}
+    { "content-type" => "application/json" }
   end
 end

session-validator-client.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |s|
   s.name        = "session-validator-client"
-  s.version     = "5.0.0"
+  s.version     = "5.1.0"
   s.summary     = "Ruby client for Emarsys session validator service"
   s.authors     = ["Emarsys Technologies Ltd."]
   s.email       = "[email protected]"

spec/session_validator/client_spec.rb

@@ -12,7 +12,35 @@
     before do
       stub_const 'ENV', ENV.to_h.merge('SESSION_VALIDATOR_URL' => service_url)
       allow(::Escher::Keypool).to receive_message_chain(:new, :get_active_key).with("session_validator")
-                                    .and_return(escher_keypool)
+                                                                              .and_return(escher_keypool)
+    end
+
+    context "when use_escher is true (default)" do
+      it "uses escher middleware to sign the request" do
+        http_request.to_return status: [200, "OK"]
+
+        validation
+
+        assert_requested(:get, "#{service_url}/sessions/#{msid}") do |req|
+          headers = req.headers.keys.map(&:downcase)
+          expect(headers).to include('x-ems-auth', 'x-ems-date')
+        end
+      end
+    end
+
+    context "when use_escher is false" do
+      subject(:validation) { SessionValidator::Client.new(use_escher: false).valid? msid }
+
+      it "uses escher middleware to sign the request" do
+        http_request.to_return status: [200, "OK"]
+
+        validation
+
+        assert_requested(:get, "#{service_url}/sessions/#{msid}") do |req|
+          headers = req.headers.keys.map(&:downcase)
+          expect(headers).not_to include('x-ems-auth', 'x-ems-date')
+        end
+      end
     end
 
     context "when msid is valid" do
@@ -66,7 +94,7 @@
     before do
       stub_const 'ENV', ENV.to_h.merge('SESSION_VALIDATOR_URL' => service_url)
       allow(::Escher::Keypool).to receive_message_chain(:new, :get_active_key).with("session_validator")
-                                      .and_return(escher_keypool)
+                                                                              .and_return(escher_keypool)
     end
 
     context "when request times out" do
@@ -87,7 +115,7 @@
       before { http_request.to_return body: JSON.generate(invalid_msids) }
 
       it { is_expected.to have_requested(:post, "#{service_url}/sessions/filter").
-          with(body: JSON.generate({msids: msids})) }
+        with(body: JSON.generate({ msids: msids })) }
     end
 
     context "when response status code is not 200 OK" do