yaser/Dena
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
master
Dena/docs/releases/1.4.0.md
Yaser 38084458fe Initial commit
2026-08-13 19:50:53 +03:30

171 lines
7.7 KiB
Markdown
Raw Permalink Blame History

## Peatio 1.4.0 (March 12, 2018) ##
### Overview ###
This release is focused on security upgrades which include:
1. Refactoring existing JWT implementation by adding validation for JWT fields.
2. Automatic member registration based on JWT payload.
3. Removal of keypair auth.
4. Removal requirement for private key to be stored at environment variable (now Peatio requires only public key for JWT to work).
The release also includes various fixes and improvements.
### Breaking changes ###
* [#629](https://github.com/rubykube/peatio/pull/629): Remove keypair authentication.
The patch removes all stuff related to APIv2 authentication using Hash-based Message Authentication Code (HMAC).
Some important components which are removed:
* `APIToken`
* `APIv2::Auth::KeypairAuthenticator`
* `Private::APITokensController`
* `APIv2::IncorrectSignatureError`
* `APIv2::TonceUsedError`
* `APIv2::InvalidTonceError`
* `APIv2::InvalidAccessKeyError`
* `APIv2::DisabledAccessKeyError`
* `APIv2::ExpiredAccessKeyError`
* `APIv2::OutOfScopeError`
All existing Peatio clients should think of upgrading to JWT, or wait until secure server-to-server API is released.
* [#620](https://github.com/rubykube/peatio/pull/620): Refactor withdraw destination: implement new fiat withdraw story, leverage existing withdraw API resources, and update UI.
The patch replaces `FundSource` in favor of `WithdrawDestination`.
Model `WithdrawDestination` works in STI mode providing `WithdrawDestination::Coin` and `WithdrawDestination::Fiat`.
Both `WithdrawDestination::Coin` and `WithdrawDestination::Fiat` are packed with common fields:
* `label`
`WithdrawDestination::Coin` is shipped with additional fields:
* `address`
`WithdrawDestination::Fiat` is shipped with typical bank withdraw fields:
* `bank_name`
* `bank_branch_name`
* `bank_branch_address`
* `bank_identifier_code`
* `bank_account_number`
* `bank_account_holder_name`
Instead of keeping common table structure we moved specific fields into JSON field called `details`.
API changes include:
* Withdraw entity: new field called `type`, available values are `fiat` and `coin`.
* Withdraw entity: field `address` (string) is replaced with `destination` object.
* Withdraw address entity replaced in favor of destination: includes `id`, `label`, `type`, `currency`, and all specific fields to withdraw destination type.
* `GET /withdraws/addresses` is now `GET /withdraws/destinations`.
* `POST /withdraws/addresses` is now `POST /withdraws/destinations`.
* `POST /withdraws/destinations`: mandatory params include `currency`, `label`, and specific fields to withdraw destination type.
* `DELETE /withdraws/addresses/:id` is now `DELETE /withdraws/destinations/:id`.
* `POST /withdraws`: parameter `address_id` renamed to `destination_id`.
`Member#withdraws` and `Member#withdraw_destinations` are now always ordered with `id DESC`.
`Private::FundSourcesController` is migrated to `Private::WithdrawDestinationsController`, `destroy` action is removed until we will denormalize withdraw fields, or find another solution for storing withdraw destination data.
* [#676](https://github.com/rubykube/peatio/pull/676): Stop keeping private key for JWT, use it only in specs.
The patch replaces `JWT_SHARED_SECRET_KEY` (private key) with `JWT_PUBLIC_KEY` (public key) for security reasons. So Peatio now will not store any private keys which is much better for security.
We removed all predefined values for `JWT_SHARED_SECRET_KEY` in all environments.
We included new guide for getting keypair to be used with JWT in config/application.yml (available after `bin/init_config`).
Migration steps:
1. Generate new keypair using guide from application.yml.
2. Update private key at your JWT provider.
3. Set public key value to `JWT_PUBLIC_KEY` at Peatio.
4. Ask JWT provider for new token.
5. Ensure API works by using cURL: `curl -H "Authorization: Bearer JWT" http://localhost:3000/api/v2/members/me`.
* [#661](https://github.com/rubykube/peatio/pull/661): Remove Member#jwt without replacements.
The patch removes dangerous method which was used only for testing purposes.
* [#662](https://github.com/rubykube/peatio/pull/662): Remove helper controller used for testing: Test::ModuleController & Test::MembersController.
The patch removed controllers & routes which was used for QA purposes. These resources could generate example members, and return them including JWT.
### New features ###
* [#657](https://github.com/rubykube/peatio/pull/657): Add on the fly member registration based on JWT payload (Barong only).
The patch implements automatic member registration based on JWT payload when using API (only for JWT provided by Barong).
How it works: When client makes request to API and passes header `Authorization: Bearer JWT` authenticator `APIv2::Auth::JWTAuthenticator` will decode, verify JWT, and, if JWT is issued by Barong, will register or update member.
JWT payload structure (see linked [commit at Barong](https://github.com/rubykube/barong/commit/3196b9ca0ff749be7158c6dbbf6b8c13a6ca9999)):
1. `email`: member email.
2. `uid`: used ID at barong (similar value to `sn` at Peatio).
3. `level`: member level represented as number (see available values at `Member::Levels`, app/enums/member/levels.rb).
4. `state`: member state (values are defined by Barong, some of them include `active`, `pending`), Peatio will set member to disabled unless `state` is `active`.
### Enhancements ###
* [#665](https://github.com/rubykube/peatio/pull/665): Update JWT specs by adding additional JWT fields.
The patch adds specs which cover most of common usage for the next fields:
1. iat
2. exp
3. jti
4. sub
5. iss
6. aud
* [#658](https://github.com/rubykube/peatio/pull/658): Update JWT gem to 2.1.x.
* [#669](https://github.com/rubykube/peatio/pull/669): Enable verification of special JWT payload fields.
The patch allows to customize which JWT fields should be validated by setting environment variables:
1. `JWT_ISSUER`
2. `JWT_AUDIENCE`
3. `JWT_DEFAULT_LEEWAY`
4. `JWT_ISSUED_AT_LEEWAY`
5. `JWT_EXPIRATION_LEEWAY`
6. `JWT_NOT_BEFORE_LEEWAY`
Get more info at config/application.yml (available after running `bin/init_config`).
Specs will now generate public and private keypair in runtime automatically.
* [#643](https://github.com/rubykube/peatio/pull/643): Update bin/init_config & bin/link_config according to new config templates structure and updated requirements for config/seed.
### Fixes ###
* [#616](https://github.com/rubykube/peatio/pull/616): Fix wrong blockchain explorer URL in deposit & withdrawal history.
The patch fixes interpolation issues with URL addresses displayed at user deposit/withdraw history, and in many places at admin panel. The wallet URL address template was interpolated using transaction ID, now it is interpolated with address.
* [#649](https://github.com/rubykube/peatio/pull/649): Fix broken market «Notify» On/Off buttons.
The feature was broken after migration currencies.yml to database. The patch restores previous behaviour.
* [#675](https://github.com/rubykube/peatio/pull/675): Fix order of commands in bin/setup to resolve issues with asset installation step.
The patch fixes related issues in workbench:
* [rubykube/workbench#25](https://github.com/rubykube/workbench/issues/25)
* [rubykube/workbench#27](https://github.com/rubykube/workbench/issues/27)
* [#674](https://github.com/rubykube/peatio/pull/674): Add missing DASH/USD market to markets.yml.
* [#677](https://github.com/rubykube/peatio/pull/677): Fix regression after [#372](https://github.com/rubykube/peatio/pull/372).
The patch resolved issues with broken websocket_api.rb daemon.
Reference in New Issue View Git Blame Copy Permalink