abacatepay-ruby 0.1.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec476ed39de31a64c6de7517af308b971922f06a8a554de6764ea4992052b641
-  data.tar.gz: cf82e3363dfa431419b29b120fcabddb671d91e3789ec90880dd131b46a08684
+  metadata.gz: 604226a94737477c55324bf08cb81736cce65fdf482453bd2667572c8986b010
+  data.tar.gz: 4e292b8d7db21a444cc4348bd59bc2cf396849ff8d99db4d4463ab1b651962fe
 SHA512:
-  metadata.gz: 84f338ecbd8a318c44987d7417579f812b5002c66eb04929e59511b61a4de9a378df861449ce98d7d24753cf4ef8bd373886b6ce602fd53c500bcca5f5254274
-  data.tar.gz: 7e87dd6972d35d967bb1cece1e825579f96a26b0da3f624ead50734195bcf15c193674a5c0e6cbffd1e167ea28a8ee2fb63f6d78ec4151633ed4037445b0825d
+  metadata.gz: 55eeee33fcf8a4b509c849f85d90ccb3f0fb4a2b4aad040325da4a6ed19bf2b60394190ce848ff0b03fa98ec56b0bddccf2fae677c19b1db1dfc7c744819286a
+  data.tar.gz: e8258c5ba01696d7d76fb85b4314a047052b04f13e0a90c4a826fe83f14ce967ea817cb445d3158a61be27a6ec4af99da9fc0c4dd477449c1bf1b60412f7f612

data/.rubocop.yml

@@ -0,0 +1,136 @@
+plugins:
+  - rubocop-rspec
+
+AllCops:
+  TargetRubyVersion: 3.2
+  NewCops: enable
+  SuggestExtensions: false
+  Exclude:
+    - "vendor/**/*"
+    - "pkg/**/*"
+    - "tmp/**/*"
+    - "sig/**/*"
+
+# The codebase uses double quotes consistently (Bundler gem template default).
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes
+
+Layout/LineLength:
+  Max: 120
+
+# Resources subclass Resource, which intentionally has no #initialize —
+# it is a behaviour mixin, not a stateful base class. Calling super would
+# only reach Object#initialize, which is a no-op.
+Lint/MissingSuper:
+  Exclude:
+    - "lib/abacate_pay/resources/**/*.rb"
+    - "spec/**/*"
+
+# Test doubles exist precisely to expose or stub inherited behaviour.
+Lint/UselessMethodDefinition:
+  Exclude:
+    - "spec/**/*"
+
+RSpec/MultipleMemoizedHelpers:
+  Max: 10
+
+# Enums expose a `.values` class method returning an Array. The cop assumes a
+# Hash and would rewrite it to `each_value`, which does not exist there.
+Style/HashEachMethods:
+  AllowedReceivers:
+    - described_class
+
+# Enum modules are self-documenting constant tables; a doc comment per
+# module adds noise without adding information.
+Style/Documentation:
+  Exclude:
+    - "lib/abacate_pay/enums/**/*.rb"
+
+Naming/MethodParameterName:
+  AllowedNames:
+    - id
+
+# `verify!` raises on failure and returns true on success — the bang, not a
+# question mark, is the right signal. `valid?` is the predicate counterpart.
+Naming/PredicateMethod:
+  AllowedMethods:
+    - verify!
+
+# Faraday errors carry a response payload, not just a message; the compact
+# form is how Faraday itself documents constructing them.
+Style/RaiseArgs:
+  AllowedCompactTypes:
+    - Faraday::ConnectionFailed
+    - Faraday::TimeoutError
+    - Faraday::ClientError
+    - Faraday::ServerError
+
+# Development dependencies live in the gemspec so a single file describes the
+# gem completely.
+Gemspec/DevelopmentDependencies:
+  EnforcedStyle: gemspec
+
+Metrics/MethodLength:
+  Max: 25
+  Exclude:
+    - "spec/**/*"
+
+Metrics/AbcSize:
+  Max: 25
+  Exclude:
+    - "spec/**/*"
+
+Metrics/CyclomaticComplexity:
+  Max: 12
+
+Metrics/PerceivedComplexity:
+  Max: 12
+
+Metrics/ClassLength:
+  Max: 200
+  Exclude:
+    - "spec/**/*"
+
+# RSpec describe/context blocks are naturally long; length is not a
+# meaningful signal there.
+Metrics/BlockLength:
+  Exclude:
+    - "spec/**/*"
+    - "*.gemspec"
+
+Metrics/ParameterLists:
+  Exclude:
+    - "lib/abacate_pay/resources/**/*.rb"
+
+RSpec/ExampleLength:
+  Max: 20
+
+RSpec/MultipleExpectations:
+  Max: 10
+
+RSpec/NestedGroups:
+  Max: 4
+
+RSpec/SpecFilePathFormat:
+  Enabled: false
+
+# These specs deliberately cut across the whole library rather than describing
+# a single class.
+RSpec/DescribeClass:
+  Exclude:
+    - "spec/clients/request_contract_spec.rb"
+    - "spec/clients/pagination_spec.rb"
+    - "spec/clients/resilience_spec.rb"
+    - "spec/clients/logging_spec.rb"
+    - "spec/clients/boleto_spec.rb"
+    - "spec/packaging_spec.rb"
+
+# `has_more?` mirrors the API's own `hasMore` field and matches the convention
+# other payment SDKs use for cursor pagination. `more?` would read as a
+# different question.
+Naming/PredicatePrefix:
+  AllowedMethods:
+    - has_more?

data/CHANGELOG.md

@@ -1,5 +1,175 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
 ## [Unreleased]
 
-## [0.1.0] - 2024-12-11
+## [1.1.0] - 2026-08-05
+
+### Added
+
+- **BOLETO support.** The method was rejected outright by the `Billings::Methods`
+  enum even though it is a first-class payment method in the v2 API. Adds the
+  enum value, the boleto-only `due_date`/`interest`/`fine` fields on checkouts,
+  and a `method:` argument on `TransparentClient#create` (which previously
+  hard-coded PIX). Boleto responses now expose `bar_code`, `url`, `br_code`,
+  `br_code_base64` and `expires_at`.
+- **Cursor pagination.** List endpoints cap at 100 items and report `hasMore`
+  plus a cursor; the SDK discarded that metadata, making record 101
+  unreachable. `list` now returns an `AbacatePay::Collection` — Enumerable and
+  Array-compatible, so existing code is unaffected — carrying `has_more?` and
+  `next_cursor`. `each_page` and `auto_paging_each` walk every page.
+- **Retries with exponential backoff and jitter** on 429 and 5xx, configurable
+  via `config.max_retries` (default 2). Only idempotent methods are retried;
+  POST never is, because repeating `checkouts/create` after a timeout could
+  charge a customer twice and the API exposes no idempotency key.
+- **Optional request logging** via `config.logger`, with the bearer token
+  redacted and bodies never logged.
+- `SubscriptionClient#change_plan` and `#record_usage` — the last two of the 45
+  documented v2 endpoints. All 45 are now covered.
+- `subscription.payment_failed` and `subscription.trial_started` webhook event
+  types. `payment_failed` is the dunning signal.
+- Checkout fields the v2 API accepts but the SDK never sent: `max_installments`
+  (nested under `card`), `up_sell_product_id` and `custom_metadata`.
+- A `User-Agent` identifying the SDK and Ruby version.
+
+### Fixed
+
+- `Webhooks.parse` aside, malformed API responses raised `JSON::ParserError`
+  and a missing `data` field raised `KeyError`; both are now `ApiError`.
+
+### Changed
+
+- `BillingClient`'s deprecation warning now states that its `/billings/*`
+  endpoints do not exist on either API version, so every call fails. It will be
+  removed in 2.0.0.
+
+### Corrected
+
+- The 1.0.0 notes stated that the v1 API "has been retired and answers Not found
+  for every path". That is wrong: v1 is still served, under a different dialect
+  — singular paths (`/v1/billing/`, `/v1/customer/`) and different resource
+  names (`pixQrCode`). The original diagnosis tested v2-shaped paths against
+  `/v1`. The fix itself stands: this SDK only ever spoke v2's dialect, so 10 of
+  the 12 paths it calls do not exist on v1 and routing there produced 404s.
+
+## [1.0.0] - 2026-08-05
+
+First stable release. The public surface is now covered by CI on four Ruby
+versions and will not change without a major bump.
+
+### Added
+
+- Full API coverage: checkouts, coupons, customers, payouts, PIX transfers,
+  products, store, subscriptions and transparent checkout.
+- `AbacatePay::Webhooks.construct_event` — verifies the signature and parses the
+  body in a single call, so an unverified payload cannot be acted on.
+- `AbacatePay::Webhooks::PayloadError` for malformed or non-object webhook bodies.
+- `PaymentLinkClient` (`AbacatePay.payment_links`) — reusable multi-payment links.
+- `WebhookClient` (`AbacatePay.webhook_endpoints`) — webhook endpoint registration,
+  with local HTTPS validation so a bad endpoint fails before the round trip.
+- `CheckoutClient#refund`, `TransparentClient#refund`, `PaymentLinkClient#refund` —
+  refunds were previously impossible through the SDK.
+- `SubscriptionClient#cancel` — a subscription created through the SDK could not
+  be cancelled through it.
+- CI workflow running the suite on Ruby 3.2, 3.3, 3.4 and 4.0, plus RuboCop, a
+  dependency audit and a gem build check on every pull request.
+- Request-contract specs that let the client build its own connection, asserting
+  the real endpoint path, bearer token, timeout and outgoing JSON body. The
+  existing client specs injected their own Faraday connection, so a wrong
+  endpoint path could not fail them.
+- Coverage measurement: simplecov has been a declared dependency since 0.1.0
+  without ever being loaded. Line coverage is now 99.13% with a 90% floor.
+- Dependabot for bundler and GitHub Actions.
+
+### Fixed
+
+- **The SDK routed to a retired API.** `api_url` derived the version from the
+  token prefix and fell back to `/v1` for any format it did not recognise. The
+  v1 prefix has been retired and answers
+  `{"success":false,"data":null,"error":"Not found"}` on every path, so anyone
+  holding a token in an older format failed 100% of calls with a message that
+  did not point at the cause. There is one base URL now:
+  `https://api.abacatepay.com/v2`.
+- **Three source files were missing from the built gem.** The gemspec builds its
+  file list from `git ls-files`, so a file nobody had staged was silently
+  dropped from the package; because the manifests require every component
+  explicitly, `require "abacate_pay"` then raised `LoadError` on the installed
+  gem while the whole suite stayed green against the working tree. A packaging
+  spec now asserts that every file under `lib/` ships.
+- **Using the SDK before calling `configure` raised `NoMethodError`.** The most
+  common first-run mistake surfaced as `undefined method 'api_url' for nil` from
+  inside the client instead of naming the missing call. It is now a
+  `ConfigurationError` that says what to do.
+- **Assigning `AbacatePay.configuration` directly left stale clients behind.**
+  `configure` discarded memoized clients but the raw writer did not, so a client
+  built against replaced credentials outlived them.
+- **Webhook verification crashed on a missing signature header.** A request
+  without `X-Webhook-Signature` reached `secure_compare` as `nil` and raised
+  `NoMethodError`, so `valid?` returned neither `true` nor `false` and the
+  endpoint returned a server error instead of rejecting the request. Missing and
+  empty signatures — and a missing secret — are now `SignatureError`.
+- **`Webhooks.parse` leaked parser internals.** Malformed JSON raised
+  `JSON::ParserError` and a non-object JSON body raised `TypeError`; both now
+  raise `PayloadError`.
+- **`config.timeout` was dead configuration.** It was documented and settable but
+  never reached Faraday, so a hung gateway blocked the calling thread forever.
+  It now sets both the read and open timeout.
+- **Changing the token at runtime had no effect.** Clients were memoized on first
+  use and never rebuilt, so `AbacatePay.configure` after a first API call kept
+  sending the previous bearer token. `configure` now discards memoized clients.
+- `Configuration#api_url` was declared twice — as an `attr_reader` and as a
+  method. The dead reader has been removed.
+- `CustomerClient#get` and `#delete` had no test coverage at all.
+- The `customer` and `billing` specs stubbed singular endpoint paths while the
+  clients call the plural ones; the specs never noticed because they bypassed
+  connection building.
+- Component loading no longer depends on a `Dir` glob whose correctness rested on
+  alphabetical ordering placing `client.rb` before its subclasses. The three
+  manifest files were also missing every class added after 0.1.0.
+
+### Security
+
+- **faraday is now `~> 2.14, >= 2.14.3`**, excluding CVE-2026-54297 (High): an
+  uncontrolled recursion in `NestedParamsEncoder` allowing stack-exhaustion DoS
+  via deeply nested query parameters. The previous `~> 2.9` constraint let
+  consumers resolve to a vulnerable version.
+- Webhook handling no longer crashes on unauthenticated input (see Fixed).
+
+### Changed
+
+- **BREAKING: `required_ruby_version` is now `>= 3.2.0`** (was `>= 2.6.0`). The
+  old floor was never installable — faraday 2.x requires Ruby 3.0 or newer — so
+  no working installation is losing support, but a `bundle update` on Ruby 2.6
+  or 3.1 will now refuse to resolve instead of failing later.
+- **`config.environment` is deprecated and now warns.** It was declared,
+  defaulted, and validated, but read by nothing. Per AbacatePay's own
+  documentation the environment is decided by the API key — Dev mode keys
+  simulate transactions — so the setting could never have worked. It is kept as
+  an accepted no-op so existing initializers keep loading.
+- `validate!` no longer rejects unknown `environment` values, and now rejects an
+  empty or whitespace-only token.
+- Releases publish from a `v*` tag instead of every push to `main`, and verify
+  that the tag matches `AbacatePay::VERSION` before publishing.
+- Publishing uses RubyGems Trusted Publishing (OIDC) instead of a long-lived API
+  key written to `~/.gem/credentials`.
+- `rubygems_mfa_required` is enabled on the gem.
+
+### Removed
+
+- Publishing to GitHub Packages. The step never executed successfully in any run
+  and nothing consumed the gem from that registry.
+- `sig/abacatepay/rails.rbs`. Leftover `bundle gem` scaffolding declaring an
+  `Abacatepay::Rails` module that does not exist in this codebase — and it was
+  shipping inside the published gem, where a type checker would read it.
+
+## [0.1.0] - 2024-12-13
 
 - Initial release
+
+[1.1.0]: https://github.com/AbacatePay/abacatepay-ruby-sdk/releases/tag/v1.1.0
+[1.0.0]: https://github.com/AbacatePay/abacatepay-ruby-sdk/releases/tag/v1.0.0
+[0.1.0]: https://github.com/AbacatePay/abacatepay-ruby-sdk/releases/tag/v0.1.0