<commit_before>require 'sinatra'
require 'omniauth'
require 'omniauth-oauth2'
require 'rack/ssl'
require 'json'
require 'digest/sha2'
require 'openssl'
require 'base64'
require 'rack'

# These variables should all be set in your environment
API = ENV['API']
CLIENT_ID = ENV['CLIENT_ID']
CLIENT_SECRET = ENV['CLIENT_SECRET']
REDIRECT_URL = ENV['REDIRECT_URL']
AUTHORIZE_URL = ENV['AUTHORIZE_URL']
TOKEN_URL = ENV['TOKEN_URL']
SCOPE = ENV['SCOPE']
SECRET = ENV['SECRET']
COOKIE_SECRET = ENV['COOKIE_SECRET']

use Rack::SSL
use Rack::Session::Cookie, :secret => COOKIE_SECRET
use OmniAuth::Builder do
  provider :oauth2, CLIENT_ID, CLIENT_SECRET, :client_options => {
             :authorize_url => AUTHORIZE_URL,
             :token_url => TOKEN_URL },
           :scope => SCOPE
end

# Encryption Algorithm
alg = "AES-256-CBC"

# Generate key via SHA256
digest = Digest::SHA256.new
digest.update(SECRET)
key = digest.digest

get '/auth/:name/callback' do
  iv = OpenSSL::Cipher::Cipher.new(alg).random_iv
  iv64 = Base64.encode64(iv)

  aes = OpenSSL::Cipher::Cipher.new(alg)
  aes.encrypt
  aes.key = key
  aes.iv = iv

  # Now we go ahead and encrypt our plain text.
  token = aes.update(request.env['omniauth.auth']['credentials']['token']) + aes.final
  token64 = Base64.encode64(token)

  query = { :token => token64,
            :iv => iv64,
            :expires_at => request.env['omniauth.auth']['credentials']['expires_at'] }
  redirect "#{REDIRECT_URL}##{Rack::Utils.build_query(query)}"
end

MISSING_AUTHORIZATION = 'Must provide Authorization header with encrypted token'
MISSING_PARAMS = 'Must provide both parameters in the Authorization header'
FORMAT = 'Authorization: token=<token> iv=<iv>'

get '/*' do
  authorization = request.env['HTTP_AUTHORIZATION']
  unless authorization
    status 400
    headers 'Content-Type' => 'application/json'
    return {:error => MISSING_AUTHORIZATION,
            :format => FORMAT}.to_json
  end

  auth_params = {}
  authorization.split.each do |param|
    parts = param.split('=', 2)
    auth_params[parts[0]] = parts[1]
  end

  unless auth_params['token'] and auth_params['iv']
    status 400
    request.headers 'Content-Type' => 'application/json'
    return {:error => MISSING_PARAMS,
            :format => FORMAT}.to_json
  end

  aes = OpenSSL::Cipher::Cipher.new(alg)
  aes.decrypt
  aes.key = key
  aes.iv = Base64.decode64(auth_params['iv'])
  token = aes.update(Base64.decode64(auth_params['token'])) + aes.final

  res = Faraday.get do |req|
    req.headers['Authorization'] = "Bearer #{token}"
    req.url "#{API}#{request.path}"
    req.params = params.clone
  end

  status res.status
  headers res.headers
  res.body
end<commit_msg>Moving to urlsafe Base64<commit_after>require 'sinatra'
require 'omniauth'
require 'omniauth-oauth2'
require 'rack/ssl'
require 'json'
require 'digest/sha2'
require 'openssl'
require 'base64'
require 'rack'

# These variables should all be set in your environment
API = ENV['API']
CLIENT_ID = ENV['CLIENT_ID']
CLIENT_SECRET = ENV['CLIENT_SECRET']
REDIRECT_URL = ENV['REDIRECT_URL']
AUTHORIZE_URL = ENV['AUTHORIZE_URL']
TOKEN_URL = ENV['TOKEN_URL']
SCOPE = ENV['SCOPE']
SECRET = ENV['SECRET']
COOKIE_SECRET = ENV['COOKIE_SECRET']

use Rack::SSL
use Rack::Session::Cookie, :secret => COOKIE_SECRET
use OmniAuth::Builder do
  provider :oauth2, CLIENT_ID, CLIENT_SECRET, :client_options => {
             :authorize_url => AUTHORIZE_URL,
             :token_url => TOKEN_URL },
           :scope => SCOPE
end

# Encryption Algorithm
alg = "AES-256-CBC"

# Generate key via SHA256
digest = Digest::SHA256.new
digest.update(SECRET)
key = digest.digest

get '/auth/:name/callback' do
  iv = OpenSSL::Cipher::Cipher.new(alg).random_iv
  iv64 = Base64.urlsafe_encode64(iv)

  aes = OpenSSL::Cipher::Cipher.new(alg)
  aes.encrypt
  aes.key = key
  aes.iv = iv

  # Now we go ahead and encrypt our plain text.
  token = aes.update(request.env['omniauth.auth']['credentials']['token']) + aes.final
  token64 = Base64.urlsafe_encode64(token)

  query = { :token => <PASSWORD>,
            :iv => iv64,
            :expires_at => request.env['omniauth.auth']['credentials']['expires_at'] }
  redirect "#{REDIRECT_URL}##{Rack::Utils.build_query(query)}"
end

MISSING_AUTHORIZATION = 'Must provide Authorization header with encrypted token'
MISSING_PARAMS = 'Must provide both parameters in the Authorization header'
FORMAT = 'Authorization: token=<token> iv=<iv>'

get '/*' do
  authorization = request.env['HTTP_AUTHORIZATION']
  unless authorization
    status 400
    headers 'Content-Type' => 'application/json'
    return {:error => MISSING_AUTHORIZATION,
            :format => FORMAT}.to_json
  end

  auth_params = {}
  authorization.split.each do |param|
    parts = param.split('=', 2)
    auth_params[parts[0]] = parts[1]
  end

  unless auth_params['token'] and auth_params['iv']
    status 400
    request.headers 'Content-Type' => 'application/json'
    return {:error => MISSING_PARAMS,
            :format => FORMAT}.to_json
  end

  aes = OpenSSL::Cipher::Cipher.new(alg)
  aes.decrypt
  aes.key = key
  aes.iv = Base64.urlsafe_decode64(auth_params['iv'])
  token = aes.update(Base64.urlsafe_decode64(auth_params['token'])) + aes.final

  res = Faraday.get do |req|
    req.headers['Authorization'] = "Bearer #{token}"
    req.url "#{API}#{request.path}"
    req.params = params.clone
  end

  status res.status
  headers res.headers
  res.body
end
{'fraction_non_alphanumeric': 0.1378804547121379, 'fraction_numerical': 0.017235056839017236, 'mean_word_length': 4.155954631379962, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 36, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '429802', 'n_tokens_mistral': 2034, 'n_tokens_neox': 1913, 'n_words': 418}