<commit_before>require 'google/api_client'
require 'google/api_client/auth/installed_app'
require 'google_api_client_secrets'
require 'openssl'
require 'base64'
class ApplicationController < ActionController::Base

  #Prevent CSRF attacks by raising an exception.
  #For APIs, you may want to use :null_session instead.
  #protect_from_forgery with: :exception

  #before_action :verify_authentication
  before_action :authenticate

  private


  def authenticate
    authenticate_or_request_with_http_token do |signature, options|
      logger.warn "Signature obtained: #{signature}"
      begin
      logger.warn "Encoded signature: #{encode(request.body.string)}"
      rescue => ex
        logger.warn "Error during encoding: #{request.body.string}"
      end
      #verify(signature, request.body)
      true
    end
  end

  def encode(message)
    secret_token = 'arrow <PASSWORD> chess secret'

    sha1 = OpenSSL::Digest::Digest.new('sha1')
    tag = OpenSSL::HMAC.hexdigest(sha1, secret_token, message)
    Base64.encode64(tag)
  end

  def verify(signature, message)
    #this is a time attack blocker
    expected = Digest::SHA1.hexdigest(encode(message))
    actual = Digest::SHA1.hexdigest(signature)
    expected == actual
  end


  #This method gets token from android client (using Authorization request header) and asks Google+ services for access token and user identity
  #After that it matches obtained user identity with the same value stored in our database.
  #If user is found it is set to the @current_user variable for further work, if not - 401 response is returned to the client
  def verify_authentication
    authenticate_or_request_with_http_token do |one_time_token, options|
      #convert client secrets to authorization object<commit_msg>New Authentication mechanism was implemented<commit_after>require 'google/api_client'
require 'google/api_client/auth/installed_app'
require 'google_api_client_secrets'
require 'openssl'
require 'base64'
class ApplicationController < ActionController::Base

  #Prevent CSRF attacks by raising an exception.
  #For APIs, you may want to use :null_session instead.
  #protect_from_forgery with: :exception

  #before_action :verify_authentication
  before_action :authenticate

  private


  def authenticate
    authenticate_or_request_with_http_token do |signature, options|
      verify(signature, request.body.string)
    end
  end

  def encode(message)
    secret_token = 'arrow labs chess secret'

    sha1 = OpenSSL::Digest::Digest.new('sha1')
    tag = OpenSSL::HMAC.digest(sha1, secret_token, message)
    Base64.strict_encode64(tag).gsub!(/=+$/, '')
  end

  def verify(signature, message)
    logger.warn "Actual signature: #{signature}"
    encoded = encode(message)
    logger.warn "Expected signature: #{encoded}"
    #this is a time attack blocker
    actual = Digest::SHA1.hexdigest(signature)
    logger.warn "Actual encoded signature: #{actual}"
    expected = Digest::SHA1.hexdigest(encoded)
    logger.warn "Expected encoded signature: #{expected}"
    expected == actual
  end


  #This method gets token from android client (using Authorization request header) and asks Google+ services for access token and user identity
  #After that it matches obtained user identity with the same value stored in our database.
  #If user is found it is set to the @current_user variable for further work, if not - 401 response is returned to the client
  def verify_authentication
    authenticate_or_request_with_http_token do |one_time_token, options|
      #convert client secrets to authorization object
{'fraction_non_alphanumeric': 0.07578712733351908, 'fraction_numerical': 0.00780161604903873, 'mean_word_length': 4.431164901664145, 'pattern_counts': {'":': 0, '<': 6, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6189413', 'n_tokens_mistral': 1044, 'n_tokens_neox': 980, 'n_words': 339}