add ability to sign response payload

.ruby-version

@@ -0,0 +1 @@
+2.4.2

app/views.py

@@ -1,24 +1,54 @@
 import json
 import logging
+import base64
 
 from django.conf import settings
 from django.shortcuts import get_object_or_404
 from django.views.decorators.csrf import csrf_exempt
 
 from lionheart.decorators import render_json
+from lionheart.utils import JSONResponse
 import requests
 
+from Crypto.PublicKey import RSA
+from Crypto.Signature import PKCS1_v1_5
+from Crypto.Hash import SHA256
+from Crypto import Random
+
 logger = logging.getLogger(__name__)
 
-@render_json
 @csrf_exempt
 def verify_receipt(request):
     data = {
         'receipt-data': request.body.strip().decode("utf-8"),
         'password': settings.APP_SPECIFIC_SHARED_SECRET
     }
-    print(data['receipt-data'])
     response = requests.post(settings.RECEIPT_VERIFICATION_URL, data=json.dumps(data))
     payload = response.json()
-    return payload
+    response = JSONResponse(payload)
+
+    # If signing key is available, sign the payload to detect potential tampering.
+    if settings.B64_ENCODED_SIGNING_KEY:
+        key_data = base64.b64decode(settings.B64_ENCODED_SIGNING_KEY)
+        key = RSA.importKey(key_data)
+
+        data = json.dumps(payload).encode("utf8")
+
+        digest = SHA256.new()
+        digest.update(data)
+
+        use_salt = False
+        if use_salt:
+            rndfile = Random.new()
+            salt_data = rndfile.read(64)
+            salt = base64.b64encode(nonce_data)
+
+            digest.update(salt_data)
+            response['X-Salt'] = nonce
+
+        signer = PKCS1_v1_5.new(key)
+        signature = signer.sign(digest)
+        response['X-Signature'] = base64.b64encode(signature)
+
+    return response
 

requirements.txt

@@ -28,3 +28,4 @@ foreman==0.9.7
 rerun==1.0.28
 gevent
 requests
+pycrypto

settings.py

@@ -204,6 +204,7 @@
 
 APP_SPECIFIC_SHARED_SECRET = os.environ.get("APP_SPECIFIC_SHARED_SECRET")
 RECEIPT_VERIFICATION_ENVIRONMENT = os.environ.get("RECEIPT_VERIFICATION_ENVIRONMENT")
+B64_ENCODED_SIGNING_KEY = os.environ.get("B64_ENCODED_SIGNING_KEY")
 
 if RECEIPT_VERIFICATION_ENVIRONMENT == "production":
     RECEIPT_VERIFICATION_URL = "https://buy.itunes.apple.com/verifyReceipt"