Merge pull request #2 from verifymy/NIT-2435

add hmac in allowed-redirects request

Author: rhuan-verifymy

examples/business/add-allowed-urls.php

@@ -8,9 +8,10 @@
 
 $baseURL = "https://oauth-dev.verifymycontent.com";
 $nucleusApiKey = "222222";
+$apiSecret = "22222222";
 
 # Setup SDK
-$vmc = new VerifyMy($baseURL, $nucleusApiKey);
+$vmc = new VerifyMy($baseURL, $nucleusApiKey, $apiSecret);
 
 
 //add new allowed url request

examples/business/remove-allowed-urls.php

@@ -8,9 +8,10 @@
 
 $baseURL = "https://oauth-dev.verifymycontent.com";
 $nucleusApiKey = "222222";
+$apiSecret = "22222222";
 
 # Setup SDK
-$vmc = new VerifyMy($baseURL, $nucleusApiKey);
+$vmc = new VerifyMy($baseURL, $nucleusApiKey, $apiSecret);
 
 
 //add new allowed url request

src/Business/BusinessClient.php

@@ -13,7 +13,7 @@ interface BusinessClient
         self::API_VERSION_V1 => BusinessClientV1::class,
     ];
 
-    const URI = 'business';
+    const URI = 'v1/business';
 
     /**
      * @param AllowedRedirectUrlsRequest $request

src/Business/BusinessClientV1.php

@@ -2,6 +2,7 @@
 
 namespace VerifyMy\SDK\Business;
 
+use VerifyMy\SDK\Commons\Security\HMAC;
 use VerifyMy\SDK\Commons\Transport\HTTP;
 use VerifyMy\SDK\Business\BusinessClient;
 use VerifyMy\SDK\Business\Entity\Requests\AllowedRedirectUrlsRequest;
@@ -18,18 +19,24 @@ final class BusinessClientV1 implements BusinessClient
      */
     private $transport;
 
+    /**
+     * @var HMAC $hmac
+     */
+    private HMAC $hmac;
+
 
     /**
      * @var string $baseURL
      * @var string $nucleusApiKey
      */
     private $nucleusApiKey;
 
-    public function __construct(string $baseURL, string $nucleusApiKey)
+    public function __construct(string $baseURL, string $nucleusApiKey, string $apiSecret)
     {
         $uri = BusinessClient::URI;
         $this->transport = new HTTP("$baseURL/$uri");
         $this->nucleusApiKey = $nucleusApiKey;
+        $this->hmac = new HMAC($nucleusApiKey, $apiSecret);
     }
 
     /**
@@ -45,7 +52,7 @@ public function addAllowedRedirectUrls(AllowedRedirectUrlsRequest $request): voi
             self::ENDPOINT_ALLOWED_REDIRECT_URLS,
             $data["urls"],
             [
-                'Authorization' => $this->nucleusApiKey,
+                'Authorization' => $this->hmac->sign($data["urls"]),
             ],
             [204]
         );
@@ -64,8 +71,9 @@ public function removeAllowedRedirectUrls(AllowedRedirectUrlsRequest $request):
             self::ENDPOINT_ALLOWED_REDIRECT_URLS,
             $data["urls"],
             [
-                'Authorization' => $this->nucleusApiKey,
+                'Authorization' => $this->hmac->sign($data["urls"]),
             ],
         );
     }
-}
+}
+    

src/Commons/Security/HMAC.php

@@ -1,6 +1,6 @@
 <?php
 
-namespace VerifyMy\Commons\Security;
+namespace VerifyMy\SDK\Commons\Security;
 
 class HMAC {
 
@@ -42,4 +42,12 @@ private function removePrefix($header)
     {
         return preg_replace('/^hmac ?/i', '', $header);
     }
+
+    /*
+     * Sign the input with the API key and secret
+     */
+    public function sign($input): string
+    {
+        return sprintf("hmac %s", $this->generate($input));
+    }
 }

src/VerifyMy.php

@@ -11,10 +11,10 @@ final class VerifyMy implements VerifyMyInterface
      */
     private $businessClient;
 
-    public function __construct($baseURL, $nucleusAPIKey)
+    public function __construct($baseURL, $nucleusAPIKey, $apiSecret)
     {
         $businessClientClassName = BusinessClient::API_VERSIONS[BusinessClient::API_VERSION_V1];
-        $this->businessClient = new $businessClientClassName($baseURL, $nucleusAPIKey);
+        $this->businessClient = new $businessClientClassName($baseURL, $nucleusAPIKey, $apiSecret);
     }
 
     public function business(): BusinessClient