Elasticsearch + searchkick

目前 JS framework 选择性很高很多自由，但也经常碰到各种配置问题 (Webpack 就很多小细节要注意) . 经典 jquery 至少还是个比较简单的工具。

维护新闻内容累的项目挺累的，加油。还是你有跑动一些爬虫？ Vue.js 很不错的，简约轻便易学。

gem "rails-controller-testing" 可以回去使用 ActionController::TestCase 个人比较习惯使用 assigns(:item) 使用 test, 尤其是 api 接口用 ActionDispatch::IntegrationTest 不方便

以下是我包装的一个 concern (private key 故意没有填入)

# app/controllers/concerns/ping_plus_plus_concern.rb

require "base64"
require "openssl"

module PingPlusPlusConcern
  extend ActiveSupport::Concern

  PUBLIC_KEY_PATH = File.join(Rails.root, 'config', 'pingpp_rsa_public_key.pem')

  included do 
    before_action :set_public_key
    before_action :set_private_key
  end

  def verify_signature(signature, token)
    verify_hash = OpenSSL::Digest::SHA256.new
    pub = OpenSSL::PKey::RSA.new(@public_key)
    pub.verify(verify_hash, Base64.urlsafe_decode64(signature), token)
  end 

  def generate_signature(token)
    sign_hash = OpenSSL::Digest::SHA256.new
    priv = OpenSSL::PKey::RSA.new(@private_key)
    signature = Base64.urlsafe_encode64(priv.sign(sign_hash, token))
    signature.gsub!(/\n/, '')
  end

  def set_public_key
    @public_key = File.read(PUBLIC_KEY_PATH)
  end

  def set_private_key
    @private_key = "" # TODO
  end

  ##
  ## check request header and verify from pingpp
  ## get header at "x-pingplusplus-signature" and verify against json payload
  ##
  def verify_signature?
    # x-pingplusplus-signature  RSA-SHA256 private key?
    sig = request.headers["x-pingplusplus-signature"].presence
    logger.info "[Charges verify_signature] signature=#{sig}"

    # json payload from request body
    token = request.body.read
    logger.info "[Charges verify_signature] token=#{token}"

    # verify
    verify = verify_signature(sig, token)
    logger.info "[Charges verify_signature] verify=#{verify}"
    return verify
  end
end

然后 controller 里头可以这样使用：

# app/controllers/charges_controller.rb

class ChargesController < ApplicationController
  include PingPlusPlusConcern

  # skip CSRF, for callback
  skip_before_action :verify_authenticity_token, only: [:callback]

  # json response
  respond_to :json

  ...

  # POST /charges/callback
  # for pingplusplus webhook
  def callback
    unless Rails.env.test?
        head :no_content, status: :unauthorized and return unless verify_signature?
    end

    if webhook_params[:type] == "charge.succeeded"
        # handle webhook
    end
  end

end

@runup v1.6.8 has build problems, try following the issue: https://github.com/sparklemotion/nokogiri/issues/1483 若是本地 development 开发几台的话可以试试： brew uninstall xz; gem install nokogirl -v 1.6.8

@peter 我 DNS 在阿里云上，letsencrypt 搞了老半天无法验证，看了 letsencrypt 反馈好像很多国内 DNS 商无法验证？

This is excellent... 我个人很喜欢 skylight.io 的简约风格，但是多次环境、火墙、deployment 等等的头痛后，今天最后找寻国内的 APM. 找到了 oneapm, 从注册到安装到 deploy 上服务器整整花了 5 分钟不到。值得推荐！