Make #verify for authenticators raise

Also add #verify! as a non-raising version.  This makes the raising
consistent across the library

lib/rbnacl.rb

@@ -34,6 +34,10 @@ class IncorrectPrimitiveError < ArgumentError; end
   # The signature was forged or otherwise corrupt
   class BadSignatureError < CryptoError; end
 
+  # The authenticator was forged or otherwise corrupt
+  class BadAuthenticatorError < CryptoError; end
+
+
   # Public Key Encryption (Box): Curve25519XSalsa20Poly1305
   require "rbnacl/boxes/curve25519xsalsa20poly1305"
   require "rbnacl/boxes/curve25519xsalsa20poly1305/private_key"

lib/rbnacl/auth.rb

@@ -1,5 +1,6 @@
 # encoding: binary
 module RbNaCl
+
   # Secret Key Authenticators
   #
   # These provide a means of verifying the integrity of a message, but only
@@ -39,8 +40,21 @@ def self.auth(key, message)
     # @param [#to_str] message the message to be authenticated
     #
     # @return [Boolean] Was it valid?
+    def self.verify!(key, authenticator, message)
+      new(key).verify!(authenticator, message)
+    end
+
+    # Verifies the given authenticator with the message.
+    #
+    # @param [#to_str] key the key used for the authenticator
+    # @param [#to_str] authenticator to be checked
+    # @param [#to_str] message the message to be authenticated
+    #
+    # @raise [InvalidTagError] if the tag isn't valid
+    #
+    # @return [true] if it's valid
     def self.verify(key, authenticator, message)
-      new(key).verify(authenticator, message)
+      verify!(key, authenticator, message) || raise(BadAuthenticatorError, "Invalid authenticator provided, message is corrupt")
     end
 
     # Compute authenticator for message
@@ -61,12 +75,24 @@ def auth(message)
     # @param [#to_str] message the message to be authenticated
     #
     # @return [Boolean] Was it valid?
-    def verify(authenticator, message)
+    def verify!(authenticator, message)
       auth = authenticator.to_s
       return false unless auth.bytesize == tag_bytes
       verify_message(auth, message)
     end
 
+    # Verifies the given authenticator with the message.
+    #
+    # @param [#to_str] authenticator to be checked
+    # @param [#to_str] message the message to be authenticated
+    #
+    # @raise [InvalidTagError] if the tag isn't valid
+    #
+    # @return [Boolean] Was it valid?
+    def verify(authenticator, message)
+      verify!(authenticator, message) || raise(BadAuthenticatorError, "Invalid authenticator provided, message is corrupt")
+    end
+
     # The crypto primitive for this authenticator instance
     #
     # @return [Symbol] The primitive used

spec/shared/authenticator.rb

@@ -53,15 +53,41 @@
     end
 
     it "fails to validate an invalid authenticator" do
-      described_class.verify(key, tag, message+"\0").should be false
+      expect { described_class.verify(key, tag, message+"\0") }.to raise_error(RbNaCl::BadAuthenticatorError)
     end
 
     it "fails to validate a short authenticator" do
-      described_class.verify(key, tag[0,tag.bytesize - 2], message).should be false
+      expect { described_class.verify(key, tag[0,tag.bytesize - 2], message) }.to raise_error(RbNaCl::BadAuthenticatorError)
     end
 
     it "fails to validate a long authenticator" do
-      described_class.verify(key, tag+"\0", message).should be false
+      expect { described_class.verify(key, tag+"\0", message) }.to raise_error(RbNaCl::BadAuthenticatorError)
+    end
+  end
+
+  context ".verify!" do
+    it "verify an authenticator" do
+      described_class.verify(key, tag, message).should eq true
+    end
+
+    it "raises TypeError on a nil key" do
+      expect { described_class.verify!(nil, tag, message) }.to raise_error(TypeError)
+    end
+
+    it "raises ArgumentError on a key which is too long" do
+      expect { described_class.verify!("\0"*33, tag, message) }.to raise_error(ArgumentError)
+    end
+
+    it "fails to validate an invalid authenticator" do
+      described_class.verify!(key, tag, message+"\0").should be false
+    end
+
+    it "fails to validate a short authenticator" do
+      described_class.verify!(key, tag[0,tag.bytesize - 2], message).should be false
+    end
+
+    it "fails to validate a long authenticator" do
+      described_class.verify!(key, tag+"\0", message).should be false
     end
   end
 
@@ -81,15 +107,33 @@
       end
 
       it "fails to validate an invalid authenticator" do
-        authenticator.verify(tag, message+"\0").should be false
+        expect { authenticator.verify(tag, message+"\0") }.to raise_error(RbNaCl::BadAuthenticatorError)
+      end
+
+      it "fails to validate a short authenticator" do
+        expect { authenticator.verify(tag[0,tag.bytesize - 2], message) }.to raise_error(RbNaCl::BadAuthenticatorError)
+      end
+
+      it "fails to validate a long authenticator" do
+        expect { authenticator.verify(tag+"\0", message) }.to raise_error(RbNaCl::BadAuthenticatorError)
+      end
+    end
+
+    context "#verify!" do
+      it "verifies an authenticator" do
+        authenticator.verify!(tag, message).should be true
+      end
+
+      it "fails to validate an invalid authenticator" do
+        authenticator.verify!(tag, message+"\0").should be false
       end
 
       it "fails to validate a short authenticator" do
-        authenticator.verify(tag[0,tag.bytesize - 2], message).should be false
+        authenticator.verify!(tag[0,tag.bytesize - 2], message).should be false
       end
 
       it "fails to validate a long authenticator" do
-        authenticator.verify(tag+"\0", message).should be false
+        authenticator.verify!(tag+"\0", message).should be false
       end
     end
   end