Add a helper function to verify webhook requests

The new `request::verified()` takes POST params as a string as does all
the work needed to call `paddle::verify_signature()`.

This involves extracting the `p_signature` POST parameter to get the
signature, and getting the public key PEM.

Change `params::parse()` to return a
`BTreeMap<Cow<'a, str>, Cow<'a, str>>` instead of `String` keys &
values. This is because `paddle::verify_signature()` needs a `(<&str,
&str)` iterator. Actually, it still doesn't solve the problem because
the types don't match. We need to modify the input type of
`verify_signature()`, but at least this change gives us references.

Make `params` private to the crate because we no longer need to use it
in `main()`.

6 files changed, 26 insertions, 6 deletions

diff --git a/license-generator/Cargo.lock b/license-generator/Cargo.lock
index bf95a83..b82881a 100644
--- a/license-generator/Cargo.lock
+++ b/license-generator/Cargo.lock
@@ -286,6 +286,7 @@ dependencies = [
  "fastcgi 1.0.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "log 0.4.6 (registry+https://github.com/rust-lang/crates.io-index)",
  "mysql 14.1.1 (registry+https://github.com/rust-lang/crates.io-index)",
+ "paddle 0.0.1",
  "rand 0.5.5 (registry+https://github.com/rust-lang/crates.io-index)",
  "sha1 0.6.0 (registry+https://github.com/rust-lang/crates.io-index)",
  "simplelog 0.5.3 (registry+https://github.com/rust-lang/crates.io-index)",
diff --git a/license-generator/Cargo.toml b/license-generator/Cargo.toml
index 34a8c95..b50bec1 100644
--- a/license-generator/Cargo.toml
+++ b/license-generator/Cargo.toml
@@ -7,6 +7,7 @@ error-chain = "0.12.0"
 fastcgi = "1.0.0"
 log = "0.4.6"
 mysql = "14.1.1"
+paddle = { path = "paddle" }
 rand = "0.5.5"
 sha1 = { version = "0.6.0", features = ["std"] }
 simplelog = "0.5.3"
diff --git a/license-generator/src/lib.rs b/license-generator/src/lib.rs
index 64d96e9..bf3ed57 100644
--- a/license-generator/src/lib.rs
+++ b/license-generator/src/lib.rs
@@ -2,12 +2,15 @@
 extern crate error_chain;
 extern crate log;
 extern crate mysql;
+extern crate paddle;
 extern crate rand;
 extern crate sha1;
 extern crate url;
 
 
+mod params;
+
 pub mod database;
 pub mod errors;
-pub mod params;
 pub mod purchaser;
+pub mod request;
diff --git a/license-generator/src/main.rs b/license-generator/src/main.rs
index 43a9d77..2211d6e 100644
--- a/license-generator/src/main.rs
+++ b/license-generator/src/main.rs
@@ -15,8 +15,8 @@ use simplelog::{Config, LevelFilter, WriteLogger};
 
 use license_generator::database;
 use license_generator::errors::*;
-use license_generator::params;
 use license_generator::purchaser::Purchaser;
+use license_generator::request;
 
 fn main() -> Result<()> {
     let log_file_path = env::var("LOG_FILE")
@@ -63,8 +63,8 @@ fn main() -> Result<()> {
         write!(&mut req.stdout(), "\n\nstdin: {}\n", stdin)
             .unwrap_or(());
 
-        let p = params::parse(&stdin);
-        write!(&mut req.stdout(), "\n{:?}\n", p)
+        let is_verified = request::verified(&stdin);
+        write!(&mut req.stdout(), "\n{:?}\n", is_verified)
             .unwrap_or(());
     });
 
diff --git a/license-generator/src/params.rs b/license-generator/src/params.rs
index 80136c2..1b234e7 100644
--- a/license-generator/src/params.rs
+++ b/license-generator/src/params.rs
@@ -1,9 +1,10 @@
+use std::borrow::Cow;
 use std::collections::BTreeMap;
 
 use url::form_urlencoded;
 
-pub fn parse(params: &str) -> BTreeMap<String, String> {
-    let iter = form_urlencoded::parse(params.as_bytes()).into_owned();
+pub(crate) fn parse<'a>(params: &'a str) -> BTreeMap<Cow<'a, str>, Cow<'a, str>> {
+    let iter = form_urlencoded::parse(params.as_bytes());
     let mut dict = BTreeMap::new();
 
     for (key, value) in iter {
diff --git a/license-generator/src/request.rs b/license-generator/src/request.rs
new file mode 100644
index 0000000..103656c
--- /dev/null
+++ b/license-generator/src/request.rs
@@ -0,0 +1,14 @@
+use paddle;
+
+use params;
+
+pub fn verified(req_params: &str) -> bool {
+    let mut p = params::parse(&req_params);
+    let signature = p.remove("p_signature");
+    let pem = include_bytes!("../private/paddle.pubkey.asc");
+
+    match signature {
+        Some(signature) => paddle::verify_signature(pem, &signature, p),
+        None => false,
+    }
+}