Add API Key parsing for experimental APIs

content/common/experiments/api_key.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/common/experiments/api_key.h"
+
+#include <vector>
+
+#include "base/base64.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/strings/string_split.h"
+#include "base/strings/string_util.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/time/time.h"
+
+namespace content {
+
+namespace {
+
+const char* kApiKeyFieldSeparator = "|";
+}
+
+ApiKey::~ApiKey() {}
+
+scoped_ptr<ApiKey> ApiKey::Parse(const std::string& key_text) {
+  if (key_text.empty()) {
+    return nullptr;
+  }
+
+  // API Key should resemble:
+  // signature|origin|api_name|expiry_timestamp
+  std::vector<std::string> parts =
+      SplitString(key_text, kApiKeyFieldSeparator, base::KEEP_WHITESPACE,
+                  base::SPLIT_WANT_ALL);
+  if (parts.size() != 4) {
+    return nullptr;
+  }
+
+  const std::string& signature = parts[0];
+  const std::string& origin_string = parts[1];
+  const std::string& api_name = parts[2];
+  const std::string& expiry_string = parts[3];
+
+  uint64_t expiry_timestamp;
+  if (!base::StringToUint64(expiry_string, &expiry_timestamp)) {
+    return nullptr;
+  }
+
+  // signed data is (origin + "|" + api_name + "|" + expiry).
+  const std::string& data = key_text.substr(key_text.find('|') + 1);

[Marijn Kruisselbrink, 2016/01/05 00:59:14]

'|' should probably be the same kApiKeyFieldSeparator?

Also there isn't really any reason to call find here I would think? You already
know that it will return signature.length().

And why is this data a const std::string&? Of course it'll work since the
lifetime of the temporary this is taking a reference to is being extended
appropriately, but might as well keep the code clear and just have a std::string
directly.

[iclelland, 2016/01/05 20:26:31]

Yes, missed that one, thanks...
... and that's true as well. Done.
 
Done.

+
+  return scoped_ptr<ApiKey>(new ApiKey(signature, data, GURL(origin_string),

[Marijn Kruisselbrink, 2016/01/05 00:59:14]

nit: return make_scoped_ptr(new ApiKey(..)) is I think generally how new scoped
pointers are returned

[iclelland, 2016/01/05 20:26:31]

Done.

+                                       api_name, expiry_timestamp));
+}
+
+ApiKey::ApiKey(const std::string& signature,
+               const std::string& data,
+               const GURL& origin,
+               const std::string& api_name,
+               uint64_t expiry_timestamp)
+    : signature_(signature),
+      data_(data),
+      origin_(origin),
+      api_name_(api_name),
+      expiry_timestamp_(expiry_timestamp) {}
+
+bool ApiKey::IsAppropriate(const std::string& origin,
+                           const std::string& api_name) const {
+  return ValidateOrigin(origin) && ValidateApiName(api_name);
+}
+
+bool ApiKey::IsValid(const base::Time& now) const {
+  // TODO(iclelland): Validate signature on key data here as well.
+  // https://crbug.com/543215
+  return ValidateDate(now);
+}
+
+bool ApiKey::ValidateOrigin(const std::string& origin) const {
+  return GURL(origin) == origin_;
+}
+
+bool ApiKey::ValidateApiName(const std::string& api_name) const {
+  return api_name == api_name_;

[chasej, 2015/12/21 20:09:10]

I think the API name comparison should be case-insensitive. We could rely on API
authors being careful/consistent with the case in browser implementation and in
registering the experiment in the API console.  However, the API name is not a
password, so it's not necessary to be strict on casing.

[iclelland, 2016/01/05 20:26:31]

Done.

+}
+
+bool ApiKey::ValidateDate(const base::Time& now) const {
+  base::Time expiry_time = base::Time::FromDoubleT((double)expiry_timestamp_);
+  return expiry_time > now;
+}
+
+}  // namespace content