airwallex 0.12.0 → 0.13.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 20abbd73aa43d82620559c0f067a6236619d3dad597b778b41b75af6d87fb225
-  data.tar.gz: 6a477ebe40ec72d267d42f9b98669d783dd7db32c9cf9d30ed0b671c07810252
+  metadata.gz: db311617af38ee6ed53131e0342f3614f7f0acfbe5e85d1b215995d2dd58086d
+  data.tar.gz: 393fab63946953d355e0b20796693c6177df6d8cc30b666ee755ab1c9c57160f
 SHA512:
-  metadata.gz: ac0aa15ebc45b61bbd7004010bbdfc261c1243d373cbd59b4dbb141e680b0d46ca079ab25f2d4c4e9017f5d4a4730fff4950f632e5415c82de0728cd3e3837b8
-  data.tar.gz: 948df17c305f0ab1c88791b29afe1df2218197c12512cbb52c7f80cb0524c9e1903a7e4b1b25597c2ed447d010fed846df94e48ec988ccdf85019913318fa561
+  metadata.gz: 381883a72671f0c450ff93504c1988b14c215c986d403536db5e3df3210b4734466b0a7c91474458500c8ff390187d15163387b104e9df50ced3f498ca2afb5e
+  data.tar.gz: 6d0bc5fcb4e76857711cff2b6503515f2907895bdb6eadb778787647914a5d739450486ad394ab2ce718ff1ea3687badf2c9b63a4c2b4796480ee7f66f1619cc

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 ## [Unreleased]
 
+## [0.13.0] - 2026-10-21
+
+### Added
+
+- `EmbeddedComponent.authorize(code_challenge:, scope:, identity: nil, headers: {})`
+  for `POST /api/v1/authentication/authorize`. It returns a symbolized Hash,
+  `{ authorization_code: }`, for the embedded component SDK. The code is
+  single use and expires in 30 seconds. Pass `headers:` with `x-on-behalf-of`
+  to issue it for a connected account
+- `APIResource.symbolized_post` takes an optional `headers` argument
+
+### Changed
+
+- `RFI.respond` and `RFI#respond` now send a normal JSON body, so the
+  Idempotency middleware adds a `request_id` like it does for other POSTs.
+  0.12.0 left it out because the endpoint doesn't document one, but a sandbox
+  test confirmed Airwallex accepts it
+
 ## [0.12.0] - 2026-10-06
 
 ### Added

data/README.md

@@ -16,6 +16,7 @@ This gem provides a Ruby interface to Airwallex's payment infrastructure, design
 - **Billing**: Products, prices, billing customers, and subscriptions for recurring/instalment billing
 - **Recurring Payments**: Payment consents and payment sources for merchant-initiated (off-session) charges
 - **Scale**: Connected accounts, funds splits, and charges for platforms onboarding sub-merchants
+- **Embedded Components**: Authorization codes for Airwallex's embedded UI components, including for connected accounts
 - **Compliance**: Retrieve, list and respond to Requests for Information (RFIs), and upload supporting documents, including for connected accounts
 - **Sandbox Simulations**: Deposits, issuing transactions, disputes, transfer status, Direct Debit mandates, connected account/offboarding review outcomes, RFIs, and POS terminals — see [Sandbox Simulations](#sandbox-simulations)
 - **Idempotency**: Automatic request deduplication for safe retries
@@ -521,6 +522,32 @@ has the wrong answer shape), and `PermissionError` with
 answering RFIs for connected accounts through the API hasn't been enabled
 for your platform; ask your Airwallex Account Manager to turn it on.
 
+### Embedded Components
+
+Airwallex's embedded UI components (beneficiary, payout, onboarding, KYB, RFI,
+SCA and tax forms) need an authorization code from your backend.
+`EmbeddedComponent.authorize` mints one using a PKCE S256 challenge. Pass
+`x-on-behalf-of` to issue it for a connected account; without it the code is
+for the platform account. The code is single use and expires in 30 seconds,
+so give it and the `code_verifier` to the browser SDK straight away.
+
+```ruby
+code_verifier = SecureRandom.urlsafe_base64(64)
+code_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+
+Airwallex::EmbeddedComponent.authorize(
+  code_challenge: code_challenge,
+  scope: ['transfer:write'], # beneficiary and payout components
+  headers: { 'x-on-behalf-of' => 'acct_123' }
+)
+# => { authorization_code: "..." }
+```
+
+The other scopes are `onboarding:write`, `kyb:write`, `rfi:read`, `rfi:write`,
+`sca:read`, `sca:write`, `tax_form:read` and `tax_form:write`. `identity:` is
+only used by embedded SCA. A bad `code_challenge` or `scope` raises
+`BadRequestError` (`field_required`, `invalid_argument` or `validation_failed`).
+
 ### Sandbox Simulations
 
 Sandbox-only endpoints (`/api/v1/simulation/...`) that stand in for the bank,

data/lib/airwallex/api_resource.rb

@@ -31,9 +31,10 @@ module Airwallex
     #
     # @param path [String] the request path
     # @param params [Hash] request body
+    # @param headers [Hash] e.g. { "x-on-behalf-of" => account_id }
     # @return [Hash] symbolized response
-    def self.symbolized_post(path, params = {})
-      Util.deep_symbolize_keys(Airwallex.client.post(path, params))
+    def self.symbolized_post(path, params = {}, headers = {})
+      Util.deep_symbolize_keys(Airwallex.client.post(path, params, headers))
     end
 
     # Perform a one-off GET that returns a plain, symbolized Hash rather

data/lib/airwallex/resources/embedded_component.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Airwallex
+  # Server-side support for Airwallex embedded components (the beneficiary,
+  # payout, onboarding, KYB, RFI, SCA and tax form UI components). The
+  # browser SDK needs an authorization code minted by your backend; this
+  # class mints it. See
+  # https://www.airwallex.com/docs/api/authentication/embedded_components/authorize
+  #
+  # Scopes: transfer:write (beneficiary and payout components),
+  # onboarding:write, kyb:write, rfi:read, rfi:write, sca:read, sca:write,
+  # tax_form:read, tax_form:write.
+  #
+  # @example Authorize the payout component for a connected account
+  #   code_verifier = SecureRandom.urlsafe_base64(64)
+  #   code_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+  #
+  #   Airwallex::EmbeddedComponent.authorize(
+  #     code_challenge: code_challenge,
+  #     scope: ["transfer:write"],
+  #     headers: { "x-on-behalf-of" => "acct_123" }
+  #   )
+  #   # => { authorization_code: "..." }
+  class EmbeddedComponent < APIResource
+    AUTHORIZE_PATH = "/api/v1/authentication/authorize"
+
+    # Issue a single-use authorization code for an embedded component. The
+    # code expires in 30 seconds; hand it, with the code_verifier, to the
+    # browser SDK straight away.
+    #
+    # @param code_challenge [String] BASE64URL(SHA256(code_verifier)), the
+    #   PKCE S256 challenge (RFC 7636 section 4)
+    # @param scope [Array<String>] e.g. ["transfer:write"]
+    # @param identity [String, nil] only used by embedded SCA
+    # @param headers [Hash] e.g. { "x-on-behalf-of" => account_id }; without
+    #   it the code is issued for the platform account
+    # @return [Hash] { authorization_code: }
+    def self.authorize(code_challenge:, scope:, identity: nil, headers: {})
+      params = { code_challenge: code_challenge, scope: scope }
+      params[:identity] = identity if identity
+      symbolized_post(AUTHORIZE_PATH, params, headers)
+    end
+  end
+end

data/lib/airwallex/resources/rfi.rb

@@ -110,31 +110,17 @@ module Airwallex
       )
     end
 
-    # Respond to an RFI. params are sent as-is (see the class docs for the
-    # body shape). Unlike other POSTs, no request_id is added: the endpoint
-    # doesn't document one.
+    # Respond to an RFI. See the class docs for the body shape.
     #
     # @param rfi_id [String]
     # @param params [Hash] questions: (required) array of { id:, answer: { type:, ... } }
     # @param opts [Hash] headers: (e.g. { "x-on-behalf-of" => account_id })
     # @return [RFI]
     def self.respond(rfi_id, params = {}, opts = {})
-      response = Airwallex.client.post("#{resource_path}/#{rfi_id}/respond", without_request_id(params),
-                                       opts[:headers] || {})
+      response = Airwallex.client.post("#{resource_path}/#{rfi_id}/respond", params, opts[:headers] || {})
       new(response)
     end
 
-    # Pre-encode the body as JSON: the Idempotency middleware only adds
-    # request_id to Hash bodies, and the JSON middleware passes strings on
-    # unchanged
-    #
-    # @param params [Hash]
-    # @return [String]
-    def self.without_request_id(params)
-      JSON.generate(params)
-    end
-    private_class_method :without_request_id
-
     # Simulate Airwallex raising an RFI
     #
     # @param params [Hash] type: (required, one of "KYC", "KYC_ONGOING",

data/lib/airwallex/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Airwallex
-  VERSION = "0.12.0"
+  VERSION = "0.13.0"
 end

data/lib/airwallex.rb

@@ -57,6 +57,7 @@ require_relative "airwallex/resources/linked_account"
 require_relative "airwallex/resources/account_offboarding"
 require_relative "airwallex/resources/rfi"
 require_relative "airwallex/resources/uploaded_file"
+require_relative "airwallex/resources/embedded_component"
 require_relative "airwallex/resources/pos_terminal"
 
 module Airwallex

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: airwallex
 version: !ruby/object:Gem::Version
-  version: 0.12.0
+  version: 0.13.0
 platform: ruby
 authors:
 - Chayut Orapinpatipat
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-06 00:00:00.000000000 Z
+date: 2026-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -100,6 +100,7 @@ files:
 - lib/airwallex/resources/customer.rb
 - lib/airwallex/resources/deposit.rb
 - lib/airwallex/resources/dispute.rb
+- lib/airwallex/resources/embedded_component.rb
 - lib/airwallex/resources/funds_split.rb
 - lib/airwallex/resources/funds_split_reversal.rb
 - lib/airwallex/resources/global_account.rb
@@ -149,7 +150,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Production-grade Ruby client for the Airwallex API