[libeufin] branch master updated (18abe97 -> 01cec79)

[gnunet]

This is an automated email from the git hooks/post-receive script.

ms pushed a change to branch master
in repository libeufin.

    from 18abe97  fix reading of URI parameters
     new c7e8b73  Define suggested Exchange
     new 01cec79  Sanity-check usernames at Sandbox.

The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.


Summary of changes:
 nexus/src/main/kotlin/tech/libeufin/nexus/Taler.kt |  2 +-
 .../kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt |  2 +-
 .../tech/libeufin/nexus/server/NexusServer.kt      | 18 +----------
 .../src/main/kotlin/tech/libeufin/sandbox/Main.kt  | 21 +++++++++++--
 util/src/main/kotlin/HTTP.kt                       |  6 ++--
 util/src/main/kotlin/strings.kt                    | 35 ++++++++++++++++++++++
 6 files changed, 59 insertions(+), 25 deletions(-)

diff --git a/nexus/src/main/kotlin/tech/libeufin/nexus/Taler.kt 
b/nexus/src/main/kotlin/tech/libeufin/nexus/Taler.kt
index 840ef52..31fff08 100644
--- a/nexus/src/main/kotlin/tech/libeufin/nexus/Taler.kt
+++ b/nexus/src/main/kotlin/tech/libeufin/nexus/Taler.kt
@@ -478,7 +478,7 @@ private fun getCurrency(facadeName: String): String {
     }
 }
 
-fun talerFacadeRoutes(route: Route, httpClient: HttpClient) {
+fun talerFacadeRoutes(route: Route) {
     route.get("/config") {
         val facadeId = ensureNonNull(call.parameters["fcid"])
         call.request.requirePermission(
diff --git a/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt 
b/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt
index bfbfb37..37c710c 100644
--- a/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt
+++ b/nexus/src/main/kotlin/tech/libeufin/nexus/ebics/EbicsNexus.kt
@@ -314,7 +314,7 @@ fun Route.ebicsBankConnectionRoutes(client: HttpClient) {
     }
 
     post("/download/{msgtype}") {
-        val orderType = 
requireNotNull(call.parameters["msgtype"]).toUpperCase(Locale.ROOT)
+        val orderType = 
requireNotNull(call.parameters["msgtype"]).uppercase(Locale.ROOT)
         if (orderType.length != 3) {
             throw NexusError(HttpStatusCode.BadRequest, "ebics order type must 
be three characters")
         }
diff --git a/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt 
b/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt
index 12fd7aa..f7e0295 100644
--- a/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt
+++ b/nexus/src/main/kotlin/tech/libeufin/nexus/server/NexusServer.kt
@@ -119,22 +119,6 @@ fun ApplicationCall.expectUrlParameter(name: String): 
String {
         ?: throw NexusError(HttpStatusCode.BadRequest, "Parameter '$name' not 
provided in URI")
 }
 
-fun isValidResourceName(name: String): Boolean {
-    return name.matches(Regex("[a-z]([-a-z0-9]*[a-z0-9])?"))
-}
-
-fun requireValidResourceName(name: String): String {
-    if (!isValidResourceName(name)) {
-        throw NexusError(
-            HttpStatusCode.BadRequest,
-            "Invalid resource name. The first character must be a lowercase 
letter, " +
-                    "and all following characters (except for the last 
character) must be a dash, " +
-                    "lowercase letter, or digit. The last character must be a 
lowercase letter or digit."
-        )
-    }
-    return name
-}
-
 suspend inline fun <reified T : Any> ApplicationCall.receiveJson(): T {
     try {
         return this.receive()
@@ -1060,7 +1044,7 @@ fun serverMain(host: String, port: Int) {
                 }
             }
             route("/facades/{fcid}/taler-wire-gateway") {
-                talerFacadeRoutes(this, client)
+                talerFacadeRoutes(this)
             }
             route("/facades/{fcid}/anastasis") {
                 anastasisFacadeRoutes(this, client)
diff --git a/sandbox/src/main/kotlin/tech/libeufin/sandbox/Main.kt 
b/sandbox/src/main/kotlin/tech/libeufin/sandbox/Main.kt
index c64e7b7..c60435b 100644
--- a/sandbox/src/main/kotlin/tech/libeufin/sandbox/Main.kt
+++ b/sandbox/src/main/kotlin/tech/libeufin/sandbox/Main.kt
@@ -81,6 +81,7 @@ import kotlin.system.exitProcess
 private val logger: Logger = LoggerFactory.getLogger("tech.libeufin.sandbox")
 private val hostName: String? = getValueFromEnv("LIBEUFIN_SANDBOX_HOSTNAME")
 private val currencyEnv: String? = getValueFromEnv("LIBEUFIN_SANDBOX_CURRENCY")
+private val envName: String? = getValueFromEnv("TALER_ENV_NAME")
 const val SANDBOX_DB_ENV_VAR_NAME = "LIBEUFIN_SANDBOX_DB_CONNECTION"
 
 data class SandboxError(
@@ -98,9 +99,18 @@ class Superuser : CliktCommand("Add superuser or change pw") 
{
         execThrowableOrTerminate {
             dbCreateTables(getDbConnFromEnv(SANDBOX_DB_ENV_VAR_NAME))
         }
+        try {
+            requireValidResourceName(username)
+        } catch (e: UtilError) {
+            println(e) // Gives instructions about the allowed format.
+            exitProcess(1)
+        }
         transaction {
+            val user = SandboxUserEntity.find {
+                SandboxUsersTable.username eq username
+            }.firstOrNull()
+
             val hashedPw = CryptoUtil.hashpw(password)
-            val user = SandboxUserEntity.find { SandboxUsersTable.username eq 
username }.firstOrNull()
             if (user == null) {
                 SandboxUserEntity.new {
                     this.username = this@Superuser.username
@@ -1008,10 +1018,15 @@ fun serverMain(dbName: String, port: Int) {
                         "Withdrawal operation: $wopid not found"
                     )
                 }
+                SandboxAssert(
+                    envName != null,
+                    "Env name not found, cannot suggest Exchange."
+                )
                 val ret = TalerWithdrawalStatus(
                     selection_done = wo.selectionDone,
                     transfer_done = wo.transferDone,
-                    amount = "${currencyEnv}:1"
+                    amount = "${currencyEnv}:1",
+                    suggested_exchange = 
"https://exchange.${envName}.taler.net/";
                 )
                 call.respond(ret)
                 return@get
@@ -1021,7 +1036,7 @@ fun serverMain(dbName: String, port: Int) {
              * as the wire transfer subject, and pays the exchange - which
              * is as well collected in this request.
              */
-            post("/withdrawal-operation/{wopid}") {
+            post("/api/withdrawal-operation/{wopid}") {
                 val wopid: String = ensureNonNull(call.parameters["wopid"])
                 val body = call.receiveJson<TalerWithdrawalConfirmation>()
 
diff --git a/util/src/main/kotlin/HTTP.kt b/util/src/main/kotlin/HTTP.kt
index 045e92a..4d53547 100644
--- a/util/src/main/kotlin/HTTP.kt
+++ b/util/src/main/kotlin/HTTP.kt
@@ -32,9 +32,9 @@ fun extractUserAndPassword(authorizationHeader: String): 
Pair<String, String> {
         // FIXME/note: line below doesn't check for "Basic" presence.
         val split = authorizationHeader.split(" ")
         val plainUserAndPass = String(base64ToBytes(split[1]), Charsets.UTF_8)
-        val ret = plainUserAndPass.split(":")
-        if (ret.size != 2) throw java.lang.Exception(
-            "HTTP Basic auth line does not contain username and (only) 
password"
+        val ret = plainUserAndPass.split(":", limit = 2)
+        if (ret.size < 2) throw java.lang.Exception(
+            "HTTP Basic auth line does not contain username and password"
         )
         ret
     } catch (e: Exception) {
diff --git a/util/src/main/kotlin/strings.kt b/util/src/main/kotlin/strings.kt
index e3f6565..e44b9a2 100644
--- a/util/src/main/kotlin/strings.kt
+++ b/util/src/main/kotlin/strings.kt
@@ -148,4 +148,39 @@ private val ibanRegex = 
Regex("^[A-Z]{2}[0-9]{2}[a-zA-Z0-9]{1,30}$")
 
 fun validateIban(iban: String): Boolean {
     return ibanRegex.matches(iban)
+}
+
+fun isValidResourceName(name: String): Boolean {
+    return name.matches(Regex("[a-z]([-a-z0-9]*[a-z0-9])?"))
+}
+
+fun requireValidResourceName(name: String): String {
+    if (!isValidResourceName(name)) {
+        throw UtilError(
+            HttpStatusCode.BadRequest,
+            "Invalid resource name. The first character must be a lowercase 
letter, " +
+                    "and all following characters (except for the last 
character) must be a dash, " +
+                    "lowercase letter, or digit. The last character must be a 
lowercase letter or digit.",
+            LibeufinErrorCode.LIBEUFIN_EC_GENERIC_PARAMETER_MALFORMED
+        )
+    }
+    return name
+}
+
+
+fun sanityCheckOrThrow(credentials: Pair<String, String>) {
+    if (!sanityCheckCredentials(credentials)) throw UtilError(
+        HttpStatusCode.BadRequest,
+        "Please only use alphanumeric credentials.",
+        LibeufinErrorCode.LIBEUFIN_EC_GENERIC_PARAMETER_MALFORMED
+    )
+}
+/**
+ * Sanity-check user's credentials.
+ */
+fun sanityCheckCredentials(credentials: Pair<String, String>): Boolean {
+    val allowedChars = Regex("^[a-zA-Z0-9]+$")
+    if (!allowedChars.matches(credentials.first)) return false
+    if (!allowedChars.matches(credentials.second)) return false
+    return true
 }
\ No newline at end of file

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.