abacatepay-ruby 0.1.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ec476ed39de31a64c6de7517af308b971922f06a8a554de6764ea4992052b641
-  data.tar.gz: cf82e3363dfa431419b29b120fcabddb671d91e3789ec90880dd131b46a08684
+  metadata.gz: 8249cc166bb8f5534c7299d4da8aac7c08193e8a33df8e7a7618737adb44a08c
+  data.tar.gz: f939f4979946f82d9e5a189d634ca4a7c99aa11e555646aec213b2f34dd4b817
 SHA512:
-  metadata.gz: 84f338ecbd8a318c44987d7417579f812b5002c66eb04929e59511b61a4de9a378df861449ce98d7d24753cf4ef8bd373886b6ce602fd53c500bcca5f5254274
-  data.tar.gz: 7e87dd6972d35d967bb1cece1e825579f96a26b0da3f624ead50734195bcf15c193674a5c0e6cbffd1e167ea28a8ee2fb63f6d78ec4151633ed4037445b0825d
+  metadata.gz: 4a14de54241b2901c7873becb95bab7bcceee8e7208b60b02114138eba6c72b1b6c16d5167c9f26f1b96fa9343bbe40097153f8b801b927b5c5dff02b3c0585c
+  data.tar.gz: e70fc7b7efea2223fbe1093f6f792e394f697da22fe92f01c738bec6a016df8116d09c5d4eec56accd4dbd5cd63a4628a8b6bb721742b76695f1436edc1139e7

data/.rubocop.yml

@@ -0,0 +1,125 @@
+plugins:
+  - rubocop-rspec
+
+AllCops:
+  TargetRubyVersion: 3.2
+  NewCops: enable
+  SuggestExtensions: false
+  Exclude:
+    - "vendor/**/*"
+    - "pkg/**/*"
+    - "tmp/**/*"
+    - "sig/**/*"
+
+# The codebase uses double quotes consistently (Bundler gem template default).
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes
+
+Layout/LineLength:
+  Max: 120
+
+# Resources subclass Resource, which intentionally has no #initialize —
+# it is a behaviour mixin, not a stateful base class. Calling super would
+# only reach Object#initialize, which is a no-op.
+Lint/MissingSuper:
+  Exclude:
+    - "lib/abacate_pay/resources/**/*.rb"
+    - "spec/**/*"
+
+# Test doubles exist precisely to expose or stub inherited behaviour.
+Lint/UselessMethodDefinition:
+  Exclude:
+    - "spec/**/*"
+
+RSpec/MultipleMemoizedHelpers:
+  Max: 10
+
+# Enums expose a `.values` class method returning an Array. The cop assumes a
+# Hash and would rewrite it to `each_value`, which does not exist there.
+Style/HashEachMethods:
+  AllowedReceivers:
+    - described_class
+
+# Enum modules are self-documenting constant tables; a doc comment per
+# module adds noise without adding information.
+Style/Documentation:
+  Exclude:
+    - "lib/abacate_pay/enums/**/*.rb"
+
+Naming/MethodParameterName:
+  AllowedNames:
+    - id
+
+# `verify!` raises on failure and returns true on success — the bang, not a
+# question mark, is the right signal. `valid?` is the predicate counterpart.
+Naming/PredicateMethod:
+  AllowedMethods:
+    - verify!
+
+# Faraday errors carry a response payload, not just a message; the compact
+# form is how Faraday itself documents constructing them.
+Style/RaiseArgs:
+  AllowedCompactTypes:
+    - Faraday::ConnectionFailed
+    - Faraday::TimeoutError
+    - Faraday::ClientError
+    - Faraday::ServerError
+
+# Development dependencies live in the gemspec so a single file describes the
+# gem completely.
+Gemspec/DevelopmentDependencies:
+  EnforcedStyle: gemspec
+
+Metrics/MethodLength:
+  Max: 25
+  Exclude:
+    - "spec/**/*"
+
+Metrics/AbcSize:
+  Max: 25
+  Exclude:
+    - "spec/**/*"
+
+Metrics/CyclomaticComplexity:
+  Max: 12
+
+Metrics/PerceivedComplexity:
+  Max: 12
+
+Metrics/ClassLength:
+  Max: 200
+  Exclude:
+    - "spec/**/*"
+
+# RSpec describe/context blocks are naturally long; length is not a
+# meaningful signal there.
+Metrics/BlockLength:
+  Exclude:
+    - "spec/**/*"
+    - "*.gemspec"
+
+Metrics/ParameterLists:
+  Exclude:
+    - "lib/abacate_pay/resources/**/*.rb"
+
+RSpec/ExampleLength:
+  Max: 20
+
+RSpec/MultipleExpectations:
+  Max: 10
+
+RSpec/NestedGroups:
+  Max: 4
+
+RSpec/SpecFilePathFormat:
+  Enabled: false
+
+# These specs deliberately cut across the whole library rather than describing
+# a single class.
+RSpec/DescribeClass:
+  Exclude:
+    - "spec/clients/request_contract_spec.rb"
+    - "spec/packaging_spec.rb"

data/CHANGELOG.md

@@ -1,5 +1,125 @@
+# Changelog
+
+All notable changes to this project are documented here.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
 ## [Unreleased]
 
-## [0.1.0] - 2024-12-11
+## [1.0.0] - 2026-08-05
+
+First stable release. The public surface is now covered by CI on four Ruby
+versions and will not change without a major bump.
+
+### Added
+
+- Full API coverage: checkouts, coupons, customers, payouts, PIX transfers,
+  products, store, subscriptions and transparent checkout.
+- `AbacatePay::Webhooks.construct_event` — verifies the signature and parses the
+  body in a single call, so an unverified payload cannot be acted on.
+- `AbacatePay::Webhooks::PayloadError` for malformed or non-object webhook bodies.
+- `PaymentLinkClient` (`AbacatePay.payment_links`) — reusable multi-payment links.
+- `WebhookClient` (`AbacatePay.webhook_endpoints`) — webhook endpoint registration,
+  with local HTTPS validation so a bad endpoint fails before the round trip.
+- `CheckoutClient#refund`, `TransparentClient#refund`, `PaymentLinkClient#refund` —
+  refunds were previously impossible through the SDK.
+- `SubscriptionClient#cancel` — a subscription created through the SDK could not
+  be cancelled through it.
+- CI workflow running the suite on Ruby 3.2, 3.3, 3.4 and 4.0, plus RuboCop, a
+  dependency audit and a gem build check on every pull request.
+- Request-contract specs that let the client build its own connection, asserting
+  the real endpoint path, bearer token, timeout and outgoing JSON body. The
+  existing client specs injected their own Faraday connection, so a wrong
+  endpoint path could not fail them.
+- Coverage measurement: simplecov has been a declared dependency since 0.1.0
+  without ever being loaded. Line coverage is now 99.13% with a 90% floor.
+- Dependabot for bundler and GitHub Actions.
+
+### Fixed
+
+- **The SDK routed to a retired API.** `api_url` derived the version from the
+  token prefix and fell back to `/v1` for any format it did not recognise. The
+  v1 prefix has been retired and answers
+  `{"success":false,"data":null,"error":"Not found"}` on every path, so anyone
+  holding a token in an older format failed 100% of calls with a message that
+  did not point at the cause. There is one base URL now:
+  `https://api.abacatepay.com/v2`.
+- **Three source files were missing from the built gem.** The gemspec builds its
+  file list from `git ls-files`, so a file nobody had staged was silently
+  dropped from the package; because the manifests require every component
+  explicitly, `require "abacate_pay"` then raised `LoadError` on the installed
+  gem while the whole suite stayed green against the working tree. A packaging
+  spec now asserts that every file under `lib/` ships.
+- **Using the SDK before calling `configure` raised `NoMethodError`.** The most
+  common first-run mistake surfaced as `undefined method 'api_url' for nil` from
+  inside the client instead of naming the missing call. It is now a
+  `ConfigurationError` that says what to do.
+- **Assigning `AbacatePay.configuration` directly left stale clients behind.**
+  `configure` discarded memoized clients but the raw writer did not, so a client
+  built against replaced credentials outlived them.
+- **Webhook verification crashed on a missing signature header.** A request
+  without `X-Webhook-Signature` reached `secure_compare` as `nil` and raised
+  `NoMethodError`, so `valid?` returned neither `true` nor `false` and the
+  endpoint returned a server error instead of rejecting the request. Missing and
+  empty signatures — and a missing secret — are now `SignatureError`.
+- **`Webhooks.parse` leaked parser internals.** Malformed JSON raised
+  `JSON::ParserError` and a non-object JSON body raised `TypeError`; both now
+  raise `PayloadError`.
+- **`config.timeout` was dead configuration.** It was documented and settable but
+  never reached Faraday, so a hung gateway blocked the calling thread forever.
+  It now sets both the read and open timeout.
+- **Changing the token at runtime had no effect.** Clients were memoized on first
+  use and never rebuilt, so `AbacatePay.configure` after a first API call kept
+  sending the previous bearer token. `configure` now discards memoized clients.
+- `Configuration#api_url` was declared twice — as an `attr_reader` and as a
+  method. The dead reader has been removed.
+- `CustomerClient#get` and `#delete` had no test coverage at all.
+- The `customer` and `billing` specs stubbed singular endpoint paths while the
+  clients call the plural ones; the specs never noticed because they bypassed
+  connection building.
+- Component loading no longer depends on a `Dir` glob whose correctness rested on
+  alphabetical ordering placing `client.rb` before its subclasses. The three
+  manifest files were also missing every class added after 0.1.0.
+
+### Security
+
+- **faraday is now `~> 2.14, >= 2.14.3`**, excluding CVE-2026-54297 (High): an
+  uncontrolled recursion in `NestedParamsEncoder` allowing stack-exhaustion DoS
+  via deeply nested query parameters. The previous `~> 2.9` constraint let
+  consumers resolve to a vulnerable version.
+- Webhook handling no longer crashes on unauthenticated input (see Fixed).
+
+### Changed
+
+- **BREAKING: `required_ruby_version` is now `>= 3.2.0`** (was `>= 2.6.0`). The
+  old floor was never installable — faraday 2.x requires Ruby 3.0 or newer — so
+  no working installation is losing support, but a `bundle update` on Ruby 2.6
+  or 3.1 will now refuse to resolve instead of failing later.
+- **`config.environment` is deprecated and now warns.** It was declared,
+  defaulted, and validated, but read by nothing. Per AbacatePay's own
+  documentation the environment is decided by the API key — Dev mode keys
+  simulate transactions — so the setting could never have worked. It is kept as
+  an accepted no-op so existing initializers keep loading.
+- `validate!` no longer rejects unknown `environment` values, and now rejects an
+  empty or whitespace-only token.
+- Releases publish from a `v*` tag instead of every push to `main`, and verify
+  that the tag matches `AbacatePay::VERSION` before publishing.
+- Publishing uses RubyGems Trusted Publishing (OIDC) instead of a long-lived API
+  key written to `~/.gem/credentials`.
+- `rubygems_mfa_required` is enabled on the gem.
+
+### Removed
+
+- Publishing to GitHub Packages. The step never executed successfully in any run
+  and nothing consumed the gem from that registry.
+- `sig/abacatepay/rails.rbs`. Leftover `bundle gem` scaffolding declaring an
+  `Abacatepay::Rails` module that does not exist in this codebase — and it was
+  shipping inside the published gem, where a type checker would read it.
+
+## [0.1.0] - 2024-12-13
 
 - Initial release
+
+[1.0.0]: https://github.com/AbacatePay/abacatepay-ruby-sdk/releases/tag/v1.0.0
+[0.1.0]: https://github.com/AbacatePay/abacatepay-ruby-sdk/releases/tag/v0.1.0