Accept the master key as base64

Author: mdpye

pusher/crypto.py

@@ -9,6 +9,7 @@
 import hashlib
 import nacl
 import base64
+import binascii
 
 from pusher.util import (
     ensure_text,
@@ -29,27 +30,45 @@ def is_encrypted_channel(channel):
         return True
     return False
 
-def is_encryption_master_key_valid(encryption_master_key):
+def parse_master_key(encryption_master_key, encryption_master_key_base64):
     """
-    is_encryption_master_key_valid() checks if the provided encryption_master_key is valid by checking its length
-    the key is assumed to be a six.binary_type (python2 str or python3 bytes)
+    parse_master_key validates, parses and returns the bytes of the encryption master key
+    from the constructor arguments.
+    At present there is a deprecated "raw" key and a suggested base64 encoding.
     """
-    if encryption_master_key is not None and len(encryption_master_key) == 32:
-        return True
+    if encryption_master_key is not None and encryption_master_key_base64 is not None:
+        raise ValueError("Do not provide both encryption_master_key and encryption_master_key_base64. " +
+                "encryption_master_key is deprecated, provide only encryption_master_key_base64")
 
-    return False
+    if encryption_master_key is not None:
+        if len(encryption_master_key) == 32:
+            return ensure_binary(encryption_master_key, "encryption_master_key")
+        else:
+            raise ValueError("encryption_master_key must be 32 bytes long. It is also deprecated, please use encryption_master_key_base64")
+
+    if encryption_master_key_base64 is not None:
+        try:
+            decoded = base64.b64decode(encryption_master_key_base64, validate=True)
+
+            if len(decoded) == 32:
+                return decoded
+            else:
+                raise ValueError("encryption_master_key_base64 must be a base64 string which decodes to 32 bytes")
+        except binascii.Error:
+            raise ValueError("encryption_master_key_base64 must be valid base64")
+
+    return None
 
 def generate_shared_secret(channel, encryption_master_key):
     """
     generate_shared_secret() takes a six.binary_type (python2 str or python3 bytes) channel name and encryption_master_key
     and returns the sha256 hash in six.binary_type format
     """
-    if is_encryption_master_key_valid(encryption_master_key):
-        # the key has to be 32 bytes long
-        hashable = channel + encryption_master_key
-        return hashlib.sha256(hashable).digest()
+    if encryption_master_key is None:
+        raise ValueError("No master key was provided for use with encrypted channels. Please provide encryption_master_key_base64 as an argument to the Pusher SDK")
 
-    raise ValueError("Provided encryption_master_key is not 32 char long")
+    hashable = channel + encryption_master_key
+    return hashlib.sha256(hashable).digest()
 
 def encrypt(channel, data, encryption_master_key, nonce=None):
     """

pusher/pusher_client.py

@@ -125,7 +125,6 @@ def trigger(self, channels, event_name, data, socket_id=None):
         return Request(self, POST, "/apps/%s/events" % self.app_id, params)
 
 
-
     @request_method
     def trigger_batch(self, batch=[], already_encoded=False):
         """Trigger multiple events with a single HTTP call.

pusher/util.py

@@ -10,6 +10,7 @@
 import re
 import six
 import sys
+import base64
 
 channel_name_re = re.compile('\A[-a-zA-Z0-9_=@,.;]+\Z')
 app_id_re = re.compile('\A[0-9]+\Z')

pusher_tests/test_authentication_client.py

@@ -34,9 +34,16 @@ def test_authenticate_for_private_channels(self):
         self.assertEqual(authenticationClient.authenticate(u'private-channel', u'345.23'), expected)
 
     def test_authenticate_for_private_encrypted_channels(self):
-        encryp_master_key=u'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY'
+        # The authentication client receives the decoded bytes of the key
+        # not the base64 representation
+        master_key=b'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY'
         authenticationClient = AuthenticationClient(
-            key=u'foo', secret=u'bar', host=u'host', app_id=u'4', encryption_master_key=encryp_master_key, ssl=True)
+                key=u'foo',
+                secret=u'bar',
+                host=u'host',
+                app_id=u'4',
+                encryption_master_key=master_key,
+                ssl=True)
 
         expected = {
             u'auth': u'foo:fff0503dfe4929f5162efe4d1dacbce524b0d8e7e1331117a8651c0e74d369e3',

pusher_tests/test_crypto.py

@@ -25,28 +25,40 @@ def test_is_encrypted_channel(self):
           { "input":"--djsah private-encrypted-ajkshdak", "expected":False }
         ]
 
-        # do the actual testing
         for t in testcases:
           self.assertEqual(
               crypto.is_encrypted_channel( t["input"] ),
-              t["expected"]
+              t["expected"],
           )
 
-    def test_is_encryption_master_key_valid(self):
+    def test_parse_master_key_successes(self):
         testcases = [
-          { "input":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa", "expected":True },
-          { "input":"                                ", "expected":True },
-          { "input":"private--encrypted--djsahajksha-", "expected":True },
-          { "input":"dadasda;enc   ted--djsahajkshdak", "expected":True },
-          { "input":"--====9.djsahajkshdak", "expected":False }
-        ]
+                { "deprecated": "this is 32 bytes 123456789012345", "base64": None, "expected": b"this is 32 bytes 123456789012345" },
+                { "deprecated": "this key has nonprintable char \x00", "base64": None, "expected": b"this key has nonprintable char \x00"},
+                { "deprecated": None, "base64": "dGhpcyBpcyAzMiBieXRlcyAxMjM0NTY3ODkwMTIzNDU=", "expected": b"this is 32 bytes 123456789012345" },
+                { "deprecated": None, "base64": "dGhpcyBrZXkgaGFzIG5vbnByaW50YWJsZSBjaGFyIAA=", "expected": b"this key has nonprintable char \x00" },
+            ]
 
-        # do the actual testing
         for t in testcases:
-          self.assertEqual(
-              crypto.is_encryption_master_key_valid( t["input"] ),
-              t["expected"]
-          )
+            self.assertEqual(
+                    crypto.parse_master_key(t["deprecated"], t["base64"]),
+                    t["expected"]
+                )
+
+    def test_parse_master_key_rejections(self):
+        testcases = [
+                { "deprecated": "some bytes", "base64": "also some bytes", "expected": "both" },
+                { "deprecated": "this is 31 bytes 12345678901234", "base64": None, "expected": "32 bytes"},
+                { "deprecated": "this is 33 bytes 1234567890123456", "base64": None, "expected": "32 bytes"},
+                { "deprecated": None, "base64": "dGhpcyBpcyAzMSBieXRlcyAxMjM0NTY3ODkwMTIzNA==", "expected": "decodes to 32 bytes" },
+                { "deprecated": None, "base64": "dGhpcyBpcyAzMyBieXRlcyAxMjM0NTY3ODkwMTIzNDU2", "expected": "decodes to 32 bytes" },
+                { "deprecated": None, "base64": "dGhpcyBpcyAzMSBieXRlcyAxMjM0NTY3ODkwMTIzNA=", "expected": "valid base64" },
+                { "deprecated": None, "base64": "dGhpcyBpcyA!MiBieXRlcyAxMjM0NTY3OD#wMTIzNDU=", "expected": "valid base64" },
+            ]
+
+        for t in testcases:
+            with self.assertRaisesRegex(ValueError, t["expected"]):
+                crypto.parse_master_key(t["deprecated"], t["base64"])
 
     def test_generate_shared_secret(self):
         testcases = [

pusher_tests/test_pusher_client.py

@@ -12,6 +12,7 @@
 from decimal import Decimal
 import random
 import nacl
+import base64
 
 from pusher.pusher_client import PusherClient
 from pusher.http import GET
@@ -36,11 +37,6 @@ def test_cluster_should_be_text(self):
 
         self.assertRaises(TypeError, lambda: PusherClient(app_id=u'4', key=u'key', secret=u'secret', ssl=True, cluster=4))
 
-    def test_encryption_master_key_should_be_text(self):
-        PusherClient(app_id=u'4', key=u'key', secret=u'secret', ssl=True, cluster=u'eu', encryption_master_key="8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY")
-
-        self.assertRaises(TypeError, lambda: PusherClient(app_id=u'4', key=u'key', secret=u'secret', ssl=True, cluster=4, encryption_master_key=48762478647865374856347856888764 ))
-
     def test_host_behaviour(self):
         conf = PusherClient(app_id=u'4', key=u'key', secret=u'secret', ssl=True)
         self.assertEqual(conf.host, u'api.pusherapp.com', u'default host should be correct')
@@ -143,12 +139,18 @@ def test_trigger_batch_success_case_2(self):
     def test_trigger_batch_with_mixed_channels_success_case(self):
         json_dumped = u'{"message": "something"}'
 
-        encryp_master_key=u'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY'
+        master_key = b'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY'
+        master_key_base64 = base64.b64encode(master_key)
         event_name_2 = "my-event-2"
         chan_2 = "private-encrypted-2"
         payload = {"message": "hello worlds"}
 
-        pc = PusherClient(app_id=u'4', key=u'key', secret=u'secret', encryption_master_key=encryp_master_key, ssl=True)
+        pc = PusherClient(
+                app_id=u'4',
+                key=u'key',
+                secret=u'secret',
+                encryption_master_key_base64=master_key_base64,
+                ssl=True)
         request = pc.trigger_batch.make_request(
                 [{
                     u'channel': u'my-chan',
@@ -162,9 +164,8 @@ def test_trigger_batch_with_mixed_channels_success_case(self):
         )
 
         # simulate the same encryption process and check equality
-        encryp_master_key = ensure_binary(encryp_master_key, "encryp_master_key")
-        chan_2 = ensure_binary(chan_2,"chan_2")
-        shared_secret = generate_shared_secret(chan_2, encryp_master_key)
+        chan_2 = ensure_binary(chan_2, "chan_2")
+        shared_secret = generate_shared_secret(chan_2, master_key)
 
         box = nacl.secret.SecretBox(shared_secret)
 
@@ -207,7 +208,12 @@ def test_trigger_with_private_encrypted_channel_string_fail_case_no_encryption_m
     def test_trigger_with_public_channel_with_encryption_master_key_specified_success(self):
         json_dumped = u'{"message": "something"}'
 
-        pc = PusherClient(app_id=u'4', key=u'key', secret=u'secret', encryption_master_key=u'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY', ssl=True)
+        pc = PusherClient(
+                app_id=u'4',
+                key=u'key',
+                secret=u'secret',
+                encryption_master_key_base64=u'OHRXNUZRTG5pUTFzQlFGd3J3N3Q2VFZFc0paZDEweVk=',
+                ssl=True)
 
         with mock.patch('json.dumps', return_value=json_dumped) as json_dumps_mock:
 
@@ -222,8 +228,14 @@ def test_trigger_with_public_channel_with_encryption_master_key_specified_succes
 
     def test_trigger_with_private_encrypted_channel_success(self):
         # instantiate a new client configured with the master encryption key
-        encryp_master_key=u'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY'
-        pc = PusherClient(app_id=u'4', key=u'key', secret=u'secret', encryption_master_key=encryp_master_key, ssl=True)
+        master_key = b'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY'
+        master_key_base64 = base64.b64encode(master_key)
+        pc = PusherClient(
+                app_id=u'4',
+                key=u'key',
+                secret=u'secret',
+                encryption_master_key_base64=master_key_base64,
+                ssl=True)
 
         # trigger a request to a private-encrypted channel and capture the request to assert equality
         chan = "private-encrypted-tst"
@@ -232,10 +244,8 @@ def test_trigger_with_private_encrypted_channel_success(self):
         request = pc.trigger.make_request(chan, event_name, payload)
 
         # simulate the same encryption process and check equality
-
-        encryp_master_key = ensure_binary(encryp_master_key,"encryp_master_key")
-        chan = ensure_binary(chan,"chan")
-        shared_secret = generate_shared_secret(chan, encryp_master_key)
+        chan = ensure_binary(chan, "chan")
+        shared_secret = generate_shared_secret(chan, master_key)
 
         box = nacl.secret.SecretBox(shared_secret)
 
@@ -284,9 +294,12 @@ def test_trigger_disallow_invalid_channels(self):
             self.pusher_client.trigger.make_request([u'so/me_channel!'], u'some_event', {u'message': u'hello world'}))
 
     def test_trigger_disallow_private_encrypted_channel_with_multiple_channels(self):
-        # instantiate a new client configured with the master encryption key
-        encryp_master_key=u'8tW5FQLniQ1sBQFwrw7t6TVEsJZd10yY'
-        pc = PusherClient(app_id=u'4', key=u'key', secret=u'secret', encryption_master_key=encryp_master_key, ssl=True)
+        pc = PusherClient(
+                app_id=u'4',
+                key=u'key',
+                secret=u'secret',
+                encryption_master_key_base64=u'OHRXNUZRTG5pUTFzQlFGd3J3N3Q2VFZFc0paZDEweVk=',
+                ssl=True)
 
         self.assertRaises(ValueError, lambda:
             self.pusher_client.trigger.make_request([u'my-chan', u'private-encrypted-pippo'], u'some_event', {u'message': u'hello world'}))