airwallex 0.3.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: aff1a8f847f36f804c6ff9738480a8acd8e9aae867a9a3846311521337544c15
-  data.tar.gz: af199726a6f9cdcf4eef3d47c1ac1c24fd3ce92f9dd564c57730e75a8e4230ce
+  metadata.gz: ec7542a0e82153bbd60acceadb071eba2d48d328d89fa34d72d8a23dc30aeb45
+  data.tar.gz: b14a15b3b70878c6291bc6ffd447ccf81d4cab5d86e61b806cc0708bd70590e2
 SHA512:
-  metadata.gz: 41ddfe80904d71772a0ed87a6f6f26ff3f857b8502bfde57c6e8b42bd53a162d6235ac6ae99ca52a11f2e4688dbe0682a96806ec2e97f1e2e3f617c038766c45
-  data.tar.gz: 907a5e84b3a38f3b4664ccf41d5ac4d62e04804073034845dfd9503b880113f2bc32d8c365ca9cca96dd6870ac4ebc1283ca93da93fb59128789b001b556ef47
+  metadata.gz: 1e401e23580f1347cbf2caae60b985138c59e73a22ba758578c7ffd99b2318859f766e7c0e0a13f55bff4da29a6796029a359a12a9c1db32b213c972244e70a3
+  data.tar.gz: b7779fbdc8227ae72d20eda510799bb6898edb43c74d7aa6a6a30b7110f304be96b2e17673b02e832c2a9638c48f987b6ecf54027fc4b18f754d218fbaec4398

data/CHANGELOG.md

@@ -1,15 +1,47 @@
 ## [Unreleased]
 
+## [0.6.0] - 2026-08-28
+
+### Fixed
+- `Webhook::Event` now correctly exposes the event type. Airwallex sends this field as `"name"` in
+  the webhook payload, not `"type"` — the previous `Event#type` reader was reading a key that doesn't
+  exist and always returned `nil`. The accessor is renamed to `Event#name` to match Airwallex's actual
+  field. **Breaking change:** `event.type` → `event.name`.
+
+## [0.5.0] - 2026-08-28
+
+### Fixed
+- Webhook signature verification no longer rejects valid webhooks when Airwallex sends
+  millisecond-precision timestamps. `verify_timestamp` now detects millisecond values (anything at or
+  above `MS_THRESHOLD = 10_000_000_000`, which safely distinguishes seconds from milliseconds until the
+  year 2286) and normalizes them to seconds before comparing against the tolerance window.
+
+## [0.4.0] - 2026-08-27
+
+### Fixed
+- `Idempotency` and `AuthRefresh` middleware are now actually registered on the Faraday connection.
+  Previously both classes existed but were never wired in, so the "automatic `request_id` generation"
+  and "retry once after a 401" behavior documented in the README did not happen at runtime.
+- Fixed a bug in `AuthRefresh` where the 401-retry guard used `env[:request][:auth_retry]`, a key that
+  doesn't exist on `Faraday::RequestOptions` and would have raised `NoMethodError` the first time it ran.
+- CI now triggers on pushes to `main` (previously configured for `master`, so pushes never ran CI).
+
+### Changed
+- `Client#request` no longer manually manages the `Authorization` header or calls
+  `ensure_authenticated!` directly; this is now owned by the `AuthRefresh` middleware.
+
 ## [0.3.0] - 2025-11-25
 
 ### Added
+- BatchTransfer resource (create, retrieve, list) for bulk payout operations
+- Dispute resource (retrieve, list, accept, submit_evidence) for chargeback management
 - Foreign Exchange resources:
   - Rate resource (retrieve, list) for real-time exchange rate queries
   - Quote resource (create, retrieve) for locking exchange rates with expiration helpers
   - Conversion resource (create, retrieve, list) for executing currency conversions
   - Balance resource (list, retrieve) for querying account balances across currencies
 - Enhanced List operation to handle both array responses and paginated responses
-- 38 new tests (278 total) covering FX and balance operations
+- 63 new tests (278 total) covering batch transfers, disputes, FX, and balance operations
 - Comprehensive manual test suite for regression testing
 
 ### Changed
@@ -19,13 +51,6 @@
 ### Fixed
 - List operation now correctly handles Balance API's direct array response format
 
-## [0.2.1] - 2025-11-25
-
-### Added
-- BatchTransfer resource (create, retrieve, list) for bulk payout operations
-- Dispute resource (retrieve, list, accept, submit_evidence) for chargeback management
-- 25 new tests (240 total) covering batch transfers and disputes
-
 ## [0.2.0] - 2025-11-25
 
 ### Added

data/README.md

@@ -319,8 +319,8 @@ begin
     timestamp,
     tolerance: 300 # 5 minutes
   )
-  
-  case event.type
+
+  case event.name
   when 'payment_intent.succeeded'
     handle_successful_payment(event.data)
   when 'payout.transfer.failed'

data/lib/airwallex/client.rb

@@ -7,6 +7,8 @@ require "json"
 
 module Airwallex
   class Client
+    LOGIN_PATH = "/api/v1/authentication/login"
+
     attr_reader :config, :access_token, :token_expires_at
 
     def initialize(config = Airwallex.configuration)
@@ -19,11 +21,7 @@ module Airwallex
 
     def connection
       @connection ||= Faraday.new(url: config.api_url) do |conn|
-        conn.request :json
-        conn.request :multipart
-        conn.request :retry, retry_options
-        conn.response :json, content_type: /\bjson$/
-        conn.response :logger, config.logger, { headers: true, bodies: true } if config.logger
+        configure_middleware(conn)
 
         conn.headers["Content-Type"] = "application/json"
         conn.headers["User-Agent"] = user_agent
@@ -55,10 +53,9 @@ module Airwallex
 
     def authenticate!
       @token_mutex.synchronize do
-        response = connection.post("/api/v1/authentication/login") do |req|
+        response = connection.post(LOGIN_PATH) do |req|
           req.headers["x-client-id"] = config.client_id
           req.headers["x-api-key"] = config.api_key
-          req.headers.delete("Authorization")
         end
 
         handle_response_errors(response)
@@ -85,12 +82,9 @@ module Airwallex
     private
 
     def request(method, path, data, headers)
-      ensure_authenticated!
-
       response = connection.public_send(method) do |req|
         req.url(path)
         req.headers.merge!(headers)
-        req.headers["Authorization"] = "Bearer #{access_token}"
 
         case method
         when :get, :delete
@@ -104,6 +98,16 @@ module Airwallex
       response.body
     end
 
+    def configure_middleware(conn)
+      conn.use Airwallex::Middleware::Idempotency
+      conn.request :json
+      conn.request :multipart
+      conn.request :retry, retry_options
+      conn.use Airwallex::Middleware::AuthRefresh, self
+      conn.response :json, content_type: /\bjson$/
+      conn.response :logger, config.logger, { headers: true, bodies: true } if config.logger
+    end
+
     def handle_response_errors(response)
       return if response.success?
 

data/lib/airwallex/middleware/auth_refresh.rb

@@ -9,24 +9,38 @@ module Airwallex
       end
 
       def call(env)
-        # Skip authentication refresh for login endpoint
-        return @app.call(env) if env[:url].path.include?("/authentication/login")
+        # Skip authentication entirely for the login endpoint itself
+        return @app.call(env) if login_request?(env)
 
-        # Ensure token is valid before making request
-        @client.ensure_authenticated! unless env[:url].path.include?("/authentication/")
+        # Ensure token is valid before making the request, then attach it
+        @client.ensure_authenticated! unless authentication_request?(env)
+        authorize!(env)
 
         response = @app.call(env)
 
         # If we get a 401, try refreshing the token and retrying once
-        if response.status == 401 && !env[:request].fetch(:auth_retry, false)
+        if response.status == 401
           @client.authenticate!
-          env[:request][:auth_retry] = true
-          env[:request_headers]["Authorization"] = "Bearer #{@client.access_token}"
+          authorize!(env)
           response = @app.call(env)
         end
 
         response
       end
+
+      private
+
+      def login_request?(env)
+        env[:url].path.include?(Client::LOGIN_PATH)
+      end
+
+      def authentication_request?(env)
+        env[:url].path.include?("/authentication/")
+      end
+
+      def authorize!(env)
+        env[:request_headers]["Authorization"] = "Bearer #{@client.access_token}"
+      end
     end
   end
 end

data/lib/airwallex/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Airwallex
-  VERSION = "0.3.0"
+  VERSION = "0.6.0"
 end

data/lib/airwallex/webhook.rb

@@ -5,6 +5,8 @@ require "openssl"
 module Airwallex
   module Webhook
     DEFAULT_TOLERANCE = 300 # 5 minutes
+    # Timestamps below this are seconds, at/above are milliseconds. Valid until year 2286.
+    MS_THRESHOLD = 10_000_000_000
 
     module_function
 
@@ -37,6 +39,8 @@ module Airwallex
     def verify_timestamp(timestamp, tolerance)
       current_time = Time.now.to_i
       timestamp_int = timestamp.to_i
+      # Airwallex sends x-timestamp in milliseconds; normalize to seconds before comparing.
+      timestamp_int /= 1000 if timestamp_int > MS_THRESHOLD
 
       if (current_time - timestamp_int).abs > tolerance
         raise SignatureVerificationError, "Timestamp outside tolerance (#{tolerance}s)"
@@ -54,11 +58,11 @@ module Airwallex
     private_class_method :compute_signature, :verify_timestamp, :secure_compare
 
     class Event
-      attr_reader :id, :type, :data, :created_at
+      attr_reader :id, :name, :data, :created_at
 
       def initialize(attributes = {})
         @id = attributes["id"]
-        @type = attributes["type"]
+        @name = attributes["name"]
         @data = attributes["data"]
         @created_at = attributes["created_at"]
       end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: airwallex
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Chayut Orapinpatipat
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2025-11-25 00:00:00.000000000 Z
+date: 2026-08-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -122,7 +122,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.11
+rubygems_version: 3.4.10
 signing_key:
 specification_version: 4
 summary: Production-grade Ruby client for the Airwallex API