spotify/crtauth-java — pull request #17 by noaresare (2014-10-23 14:44:04+00:00)
Title: Moved HMAC functionality from digest module to CrtAuthCodec.

* Since message verification is now part of the deserializeAuthenticated
interface in CrtAuthCodec it seems reasonable move it.
* Removed the DigestAlgorithm abstraction and the unused SHA-1 implementation
from the digest module.
* Moved the HMAC variant from VerifiableDigestAlgorithm to a static method
in CrtAuthCodec.
* Removed the somewhat confusing double builder parameter to CrtAuthServer
where both secret and DigestAlgorithm filled the same function.

I understand that this goes against the idea of dependency injection of various pieces of functionality, but I think this simplification is worthwhile, for the following reason:
* It makes the CrtAauthServer API much easier to understand. With the previous code, the secret parameter was overriden if the caller provided her own DigestAlgorithm, which would have been confusing.
* I think that tying it closely to the codec is reasonable because the algorithm used is a core part of the protocol. As soon as it gets replaced by another HMAC, that is a different protocol. Once we have that, I'm more than willing to consider building an abstraction.
* Less code to maintain :)