210. EPMO Open Source Coordination Office Redaction File Detail Report

Produced by Araxis Merge on 5/25/2018 9:22:54 AM Central Daylight Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.

210.1 Files compared

#	Location	File	Last Modified
1	C:\AraxisMergeCompare\Pri_un\ZIP\DSM-cif\Direct_API\application\views\api\onboarding\services	folders.php	Tue May 22 13:19:28 2018 UTC
2	C:\AraxisMergeCompare\Pri_re\ZIP\DSM-cif\Direct_API\application\views\api\onboarding\services	folders.php	Thu May 24 22:18:37 2018 UTC

210.2 Comparison summary

Description	Between Files 1 and 2
Description	Text Blocks	Lines
Unchanged	5	220
Changed	4	10
Inserted	0	0
Removed	0	0

210.3 Comparison options

Whitespace
Character case	Differences in character case are significant
Line endings	Differences in line endings (`CR` and `LF` characters) are ignored
CR/LF characters	Not shown in the comparison detail

210.4 Active regular expressions

No regular expressions were active.

210.5 Comparison detail

	1	<?php
	2	/**
	3	* @package direct-as -a-service
	4	* @subpack age views
	5	* @fileso urce
	6	/ /* */
	7
	8	$t his->load- >view('api /header');
	9	$t his->load- >view('api /nav');
	10	?>
	11	<h1><a h ref="/onbo arding/doc umentation /" class=" underline" >Documenta tion</a> & rarr; /dir ect/folder s - GET</h 1>
	12	<p>The F olders web service a llows auth orized app lications to return all custom folders u sing the D irect stan dards and can be acc essed by s ending a G ET request to /direc t/folders. An exampl e of the H eaders and Arguments for the F olders GET request c an be seen below.</p >
	13	<h3>Auth entication </h3>
	14	<p>
	15	The API au thenticati on utilize d is based upon hash message a uthenticat ion code ( HMAC). HMA C is an au thenticati on method that combi nes a cryp tographic hash funct ion with a secret cr yptographi c key. Aft er the suc cessful re gistration of an app lication o n the API, a public and privat e key like the examp le below w ill be pro visioned f or its use .
	16	</p>
	17	<p class ="code">
	18	Public Key : REDACTED
	19	<br/>Priva te Key: RE DACTED
	20	</p>
	21	<p>
	22	On every r equest tha t an appli cation sen ds to the API they m ust includ e an Autho rization h eader. The authoriza tion heade r is a str ing that t he API wil l utilize to confirm the ident ity, and t he message content, of the sen der. The a uthorizati on header consists o f three pa rts. The f irst part is the API identifie r, represe nted by th e word "DA AS", which stands fo r Direct a s a Servic e. The API identifie r is follo wed by a s pace that separates it from th e identify ing conten t. The ide ntifying c ontent con sists of t he unique public key and the b ase64 enco ded HMAC h ash genera ted by the request c ontent and the priva te key, de limited by a colon. An example of the au thorizatio n header i s below.
	23	</p>
	24	<p class ="code">
	25	Authorizat ion: DAAS REDACTED
	26	</p>
	27	<p>
	28	The HMAC s tring is g enerated b y running an HMAC ha sh functio n on a pla in text st ring and t he applica tion's pri vate key. The plain text strin g that mus t be hashe d using HM AC is cons tructed as follows:
	29	<ul>
	30	<l i>HTTP Req uest Type< /li>
	31	<l i>Date</li >
	32	<l i>Content- MD5 (Optio nal)</li>
	33	<l i>Content Type (Not including boundary)< /li>
	34	<l i>URI</li>
	35	</ul>
	36	These valu es are sep arated by new line c haracters ("\n"). An example o f the plai n text str ing is bel ow:
	37	</p>
	38	<p class ="code">
	39	GET\n06/03 /2013 12:1 3:56 EST\n iB94gawbwU SiZy5FuruI OQ==\n/dir ect/folder s/format/j son?mailbo x=1
	40	</p>
	41	<p>
	42	The string above is hashed wit h the appl ication's private ke y using th e SHA-256 algorithm. A snippet of JavaSc ript code showing an example o f this is shown belo w:
	43	</p>
	44	<p class ="code">
	45	var hashSt ring = Cry ptoJS.Hmac SHA256("GE T\n06/03/2 013 12:13: 56 EDT\niB 94gawbwUSi Zy5FuruIOQ ==\n/direc t/folders/ format/jso n?mailbox= 1"," REDACTED ");
	46	<br/>var b ase64 = en code64(""+ hashString );
	47	<br/>var a uthorizati on = "DAAS REDACTED :"+base64;
	48	</p>
	49	<p>
	50	In the exa mple above the Conte nt MD5 is provided b ut this is an option al field. If the Con tent MD5 h eader is n ot specifi ed then th e hash sho uld not ha ve the MD5 specified either.
	51	</p>
	52	<h3>Head ers</h3>
	53	<div cla ss="column ">
	54	<div class ="left">
	55	<u l>
	56	<li> Authorizat ion</li>
	57	<p>
	58	The fi rst requir ed header is the Aut horization header co vered in t he Authent ication se ction at t he top of this page.
	59	</p>
	60	<li> Date or X- Daas-Date< /li>
	61	<p>
	62	The se cond requi red header that must be includ ed is the Date heade r. Some br owsers wil l not let an applica tion speci fy the Dat e header p rogrammati cally, so in this ca se it is a lso accept able to us e the X-Da as-Date he ader as th e API will interpret them inte rchangeabl y. This he ader shoul d be popul ated with the curren t date and time, in any standa rd format (including time zone informati on if not time zone agnostic), when the GET reques t is submi tted. The value supp lied in th e Date hea der must m atch the v alue used in the cre ation of t he hash st ring for t he Authori zation hea der.
	63	</p>
	64	</ ul>
	65	</div>
	66	<div class ="right">
	67	<u l>
	68	<li> Content-Md 5</li>
	69	<p>
	70	The op tional hea der is the Content-M d5 header. This head er should contain an MD5 hash of the GET query str ing. If th is header is specifi ed then it must also be includ ed in the hash strin g for the authorizat ion header . This ext ra securit y measure is not typ ically nec essary for GET reque sts, howev er the opt ion is ava ilable so that the p arameters sent in th e GET requ est can be validated by the AP I as not h aving been tampered with in tr ansit.
	71	</p>
	72	</ ul>
	73	</div>
	74	</div>
	75	<h3>Argu ments</h3>
	76	<p>
	77	There are 1 argument s that can be sent t o the fold ers web se rvice.
	78	</p>
	79	<div cla ss="column ">
	80	<div class ="left">
	81	<u l>
	82	<li> Mailbox</l i>
	83	<p>
	84	This i s a requir ed field w hich ident ifies whic h mailbox' s messages should be returned. This is t he local p ortion of the Direct address, i.e., test .user@<?ph p echo CLI NICAL_DOMA IN;?> is t he Direct address so that pass ed value y ou would t est.user.
	85	</p>
	86	</ ul>
	87	</div>
	88	<div class ="right">
	89	&n bsp;
	90	</div>
	91	</div>
	92	<h3>Exam ple Respon se</h3>
	93	<ul>
	94	<li>Succes s</li>
	95	<u l>
	96	<li> HTTP-200, {"request_ id":"1","m ailbox":"v auser","fo lder":[{"i d":"inbox" ,"name":"I nbox","tot al":58,"ne w":52},{"i d":"sent", "name":"Se nt","total ":75,"new" :60},{"id" :"draft"," name":"Dra fts","tota l":53,"new ":25},{"id ":"archive d","name": "Archive", "total":1, "new":1},{ "id":"3"," name":"[Cu stom].Cust om Folder" ","total": 7,"new":0} ]}</li>
	97	</ ul>
	98	<li>Error< /li>
	99	<u l>
	100	<li> HTTP-401, {"request_ id":"2","m essage": " Access Den ied. Authe ntication Failed."}< /li>
	101	<li> HTTP-403, {"request_ id":"3","m essage":"A ccess Deni ed. Use No t Authoriz ed."}</li>
	102	<li> HTTP-403, {"request_ id":"4","m essage":"A ccess Deni ed. User N ot Authori zed."}</li >
	103	<li> HTTP-422, {"request_ id":"5","f ields":["m ailbox"]," message":" 'Mailbox' is a requi red field. "}</li>
	104	<li> HTTP-422, {"request_ id":"6","m essage":"' Mailbox' c ontains in valid inpu t","fields ":["mailbo x"]}</li>
	105	</ ul>
	106	</ul>
	107	<h3>Samp le Code</h 3>
	108	<p>
	109	The folder s web serv ice is con structed i n the same manner th at the val idate web service is . Please c lick <a hr ef="/onboa rding/docu mentation/ validate_e xample">he re</a> to be taken t o some sam ple code s nippets fo r the vali date web s ervice and use that as a basis for creat ing the fo lders call .
	110	</p>
	111	</div>
	112	<?PHP $this->loa d->view('a pi/footer' ); ?>
	113	</di v>
	114	</ body>
	115	</html>