Allow to skip signature verification

lib/line/bot/v2/webhook_parser.rb

@@ -11,8 +11,20 @@ module V2
       class WebhookParser
         class InvalidSignatureError < StandardError; end
 
-        def initialize(channel_secret:)
+        # Initialize webhook parser
+        #
+        # @param channel_secret [String]
+        #   The channel secret used for signature verification.
+        # @param skip_signature_verification [() -> bool, nil]
+        #   A callable object with type `() -> bool` that determines whether to skip
+        #   webhook signature verification. Signature verification is skipped if and
+        #   only if this callable is provided and returns `true`.
+        #   This can be useful in scenarios such as when you're in the process of
+        #   updating the channel secret and need to temporarily bypass verification
+        #   to avoid disruptions.
+        def initialize(channel_secret:, skip_signature_verification: nil)
           @channel_secret = channel_secret
+          @skip_signature_verification = skip_signature_verification
         end
 
         # Parse events from the raw request body and validate the signature.
@@ -31,7 +43,10 @@ def initialize(channel_secret:)
         #
         # @example Sinatra usage
         #   def parser
-        #     @parser ||= Line::Bot::V2::WebhookParser.new(channel_secret: ENV.fetch("LINE_CHANNEL_SECRET"))
+        #     @parser ||= Line::Bot::V2::WebhookParser.new(
+        #       channel_secret: ENV.fetch("LINE_CHANNEL_SECRET"),
+        #       skip_signature_verification: -> { ENV['SKIP_SIGNATURE_VERIFICATION'] == 'true' }
+        #     )
         #   end
         #
         #   post '/callback' do
@@ -54,7 +69,11 @@ def initialize(channel_secret:)
         #     "OK"
         #   end
         def parse(body:, signature:)
-          raise InvalidSignatureError.new("Invalid signature: #{signature}") unless verify_signature(body: body, signature: signature)
+          should_skip = @skip_signature_verification&.call || false
+
+          unless should_skip == true || verify_signature(body: body, signature: signature)
+            raise InvalidSignatureError.new("Invalid signature: #{signature}")
+          end
 
           data = JSON.parse(body.chomp, symbolize_names: true)
           data = Line::Bot::V2::Utils.deep_underscore(data)
@@ -66,14 +85,14 @@ def parse(body:, signature:)
           end
         end
 
-        private
-
         def verify_signature(body:, signature:)
           hash = OpenSSL::HMAC.digest(OpenSSL::Digest.new('SHA256'), @channel_secret, body)
           expected = Base64.strict_encode64(hash)
           variable_secure_compare(signature, expected)
         end
 
+        private
+
         # To avoid timing attacks
         def variable_secure_compare(a, b)
           secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))

sig/line/bot/v2/webhook_parser.rbs

@@ -5,18 +5,19 @@ module Line
         class InvalidSignatureError < ::StandardError
         end
         @channel_secret: String
+        @skip_signature_verification: (^() -> bool) | nil
 
-        def initialize: (channel_secret: String) -> void
+        def initialize: (channel_secret: String, ?skip_signature_verification: (^() -> bool) | nil) -> void
 
         def parse: (
             body: String,
             signature: String
           ) -> Array[Webhook::Event]
+
+        def verify_signature: (body: String, signature: String) -> bool
 
         private
 
-        def verify_signature: (body: String, signature: String) -> bool
-
         def variable_secure_compare: (String, String) -> bool
 
         def secure_compare: (String, String) -> bool

spec/line/bot/v2/webhook_parser_skip_verification_spec.rb

@@ -0,0 +1,75 @@
+require 'spec_helper'
+
+describe Line::Bot::V2::WebhookParser do
+  let(:channel_secret) { 'dummy_channel_secret' }
+  let(:signature) { 'invalid_signature' }
+  let(:webhook) do
+    <<~JSON
+      {
+        "destination": "xxxxxxxxxx",
+        "events": [
+          {
+            "type": "message",
+            "message": {
+              "type": "text",
+              "id": "123456789",
+              "quoteToken": "q3Plxr4AgKd...",
+              "text": "Hello, world"
+            },
+            "timestamp": 1462629479859,
+            "source": {
+              "type": "user",
+              "userId": "U4af4980629..."
+            },
+            "webhookEventId": "01FZ74A0TDDPYRVKNK77XKC3ZR",
+            "deliveryContext": {
+              "isRedelivery": false
+            },
+            "replyToken": "fbf94e269485410da6b7e3a5e33283e8",
+            "mode": "active"
+          }
+        ]
+      }
+    JSON
+  end
+
+  describe '#parse with skip_signature_verification' do
+    context 'when skip_signature_verification is not provided' do
+      let(:parser) { Line::Bot::V2::WebhookParser.new(channel_secret: channel_secret) }
+
+      it 'verifies the signature' do
+        expect(parser).to receive(:verify_signature).and_return(false)
+        expect { parser.parse(body: webhook, signature: signature) }.to raise_error(Line::Bot::V2::WebhookParser::InvalidSignatureError)
+      end
+    end
+
+    context 'when skip_signature_verification returns false' do
+      let(:parser) { Line::Bot::V2::WebhookParser.new(channel_secret: channel_secret, skip_signature_verification: -> { false }) }
+
+      it 'verifies the signature' do
+        expect(parser).to receive(:verify_signature).and_return(false)
+        expect { parser.parse(body: webhook, signature: signature) }.to raise_error(Line::Bot::V2::WebhookParser::InvalidSignatureError)
+      end
+    end
+
+    context 'when skip_signature_verification returns true' do
+      let(:parser) { Line::Bot::V2::WebhookParser.new(channel_secret: channel_secret, skip_signature_verification: -> { true }) }
+
+      it 'skips signature verification and parses the webhook' do
+        expect(parser).not_to receive(:verify_signature)
+        events = parser.parse(body: webhook, signature: signature)
+        expect(events).not_to be_empty
+        expect(events.first).to be_a(Line::Bot::V2::Webhook::MessageEvent)
+      end
+    end
+
+    context 'when skip_signature_verification is nil' do
+      let(:parser) { Line::Bot::V2::WebhookParser.new(channel_secret: channel_secret, skip_signature_verification: nil) }
+
+      it 'verifies the signature' do
+        expect(parser).to receive(:verify_signature).and_return(false)
+        expect { parser.parse(body: webhook, signature: signature) }.to raise_error(Line::Bot::V2::WebhookParser::InvalidSignatureError)
+      end
+    end
+  end
+end