alogram_payrisk 0.3.0 → 0.3.1

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8 → httpx-1.8.0}/lib/httpx/connection/http2.rb

@@ -118,7 +118,7 @@ module HTTPX
         return false
       end
       unless (stream = @streams[request])
-        stream = @connection.new_stream
+        stream = @connection.new_stream(**request.http2_stream_options)
         handle_stream(stream, request)
         @streams[request] = stream
         @max_requests -= 1
@@ -128,6 +128,8 @@ module HTTPX
     rescue ::HTTP2::Error::StreamLimitExceeded
       @pending.unshift(request)
       false
+    rescue StandardError => e
+      emit(:error, request, e)
     end
 
     def consume
@@ -312,7 +314,21 @@ module HTTPX
       end
       _, status = h.shift
       headers = request.options.headers_class.new(h)
+
+      raise HTTPX::Error, "maximum number of response headers exceeded" if h.size > @options.max_response_headers
+
+      if (max_header_value_size = @options.max_response_header_value_size)
+        headers.each do |_, v| # rubocop:disable Style/HashEachMethods
+          raise HTTPX::Error, "maximum header value size exceeded" if v.size > max_header_value_size
+        end
+      end
+
       response = request.options.response_class.new(request, status, "2.0", headers)
+
+      if response.content_length && response.content_length > request.options.max_response_body_size
+        raise HTTPX::Error.new, "maximum response body size exceeded"
+      end
+
       request.response = response
       @streams[request] = stream
 
@@ -428,11 +444,28 @@ module HTTPX
     end
 
     def frame_with_extra_info(frame)
+      flags_bits = frame.fetch(:flags, 0)
       case frame[:type]
       when :data
-        frame.merge(payload: frame[:payload].bytesize)
-      when :headers, :ping
-        frame.merge(payload: log_redact_headers(frame[:payload]))
+        flags = [] #: Array[Symbol]
+        flags << :end_stream if flags_bits.anybits?(0b0001)
+        flags << :padded if flags_bits.anybits?(0b1000)
+        frame.merge(payload: frame[:payload].bytesize, flags: flags)
+      when :push_promise, :headers
+        flags = [] #: Array[Symbol]
+        flags << :end_stream if flags_bits.anybits?(0b0001)
+        flags << :priority if flags_bits.anybits?(0b0010)
+        flags << :end_headers if flags_bits.anybits?(0b0100)
+        flags << :padded if flags_bits.anybits?(0b1000)
+        frame.merge(payload: log_redact_headers(frame[:payload]), flags: flags)
+      when :ping
+        flags = [] #: Array[Symbol]
+        flags << :ack if flags_bits.anybits?(0b0001)
+        frame.merge(payload: log_redact_headers(frame[:payload]), flags: flags)
+      when :settings
+        flags = [] #: Array[Symbol]
+        flags << :ack if flags_bits.anybits?(0b0001)
+        frame.merge(flags: flags)
       when :window_update
         connection_or_stream = if (id = frame[:stream]).zero?
           @connection

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8 → httpx-1.8.0}/lib/httpx/connection.rb

@@ -47,8 +47,8 @@ module HTTPX
     def initialize(uri, options)
       @current_session = @current_selector = @max_concurrent_requests =
                            @parser = @sibling = @coalesced_connection = @altsvc_connection =
-                                                  @family = @io = @ssl_session = @timeout =
-                                                                    @connected_at = @response_received_at = nil
+                                                  @ping_timer = @family = @io = @ssl_session =
+                                                                            @timeout = @connected_at = @response_received_at = nil
 
       @exhausted = @cloned = @main_sibling = false
 
@@ -222,10 +222,27 @@ module HTTPX
 
         consume
       when :closed
-        return
+        return if @pending.empty?
+
+        # there are pending requests to send, restart the state machine.
+        idling
+
+        # @fiber-switch-guard
+        # fiber may have switch after ensuring that @io is closed.
+        return unless @state == :idle
+
+        call
       when :closing
         consume
         transition(:closed)
+
+        # @fiber-switch-guard
+        # fiber may have switch while closing @io.
+        return if @state == :closed &&
+                  # only remain here if there are pending requests.
+                  @pending.empty?
+
+        call
       when :open
         consume
       end
@@ -251,7 +268,12 @@ module HTTPX
       case @state
       when :idle
         purge_after_closed
-        disconnect
+
+        # @fiber-switch-guard
+        if @io.can_disconnect? && @pending.empty?
+          disconnect
+          return
+        end
       when :closed
         @connected_at = nil
       end
@@ -319,7 +341,7 @@ module HTTPX
           @pending << request
           transition(:active) if @state == :inactive
           request.ping!
-          ping
+          ping(request)
           return
         end
 
@@ -341,6 +363,9 @@ module HTTPX
 
     def idling
       purge_after_closed
+
+      return unless @state == :closed
+
       @write_buffer.clear
       transition(:idle)
       return unless @parser
@@ -421,6 +446,8 @@ module HTTPX
         if @timeout
           @timeout -= error.timeout
           return unless @timeout <= 0
+
+          @timeout = nil
         end
 
         error = error.to_connection_error if connecting?
@@ -660,7 +687,12 @@ module HTTPX
         @exhausted = true
         parser.close
 
+        # @fiber-switch-guard
+        # fiber may have switched while closing @io, check whether still in the exhausted loop.
+        next unless @exhausted
+
         idling
+
         @exhausted = false
       end
       parser.on(:origin) do |origin|
@@ -676,6 +708,9 @@ module HTTPX
         enqueue_pending_requests_from_parser(parser)
 
         reset
+
+        next unless @state == :closed
+
         # :reset event only fired in http/1.1, so this guarantees
         # that the connection will be closed here.
         idling unless @pending.empty?
@@ -766,6 +801,9 @@ module HTTPX
         return unless @write_buffer.empty?
 
         purge_after_closed
+
+        # @fiber-switch-guard
+        return unless @state == :closing && (@io.nil? || @io.can_disconnect?)
       when :already_open
         nextstate = :open
         # the first check for given io readiness must still use a timeout.
@@ -833,7 +871,15 @@ module HTTPX
     end
 
     def purge_after_closed
-      @io.close if @io
+      if @io
+        @io.close
+
+        # @fiber-switch-guard
+        # due to fiber scheduler, multiple fibers may be listening on the same connection
+        # and moving the state machine forward; in such cases, when the control flow reaches
+        # this line, the io object may not be closed anymore.
+        return unless @io&.can_disconnect?
+      end
       @read_buffer.clear
       @timeout = nil
     end
@@ -906,14 +952,24 @@ module HTTPX
       end
     end
 
-    def ping
+    def ping(_request)
       return if parser.waiting_for_ping?
 
       parser.ping
+
+      ping_timeout = @options.timeout[:ping_timeout]
+
+      @ping_timer = @current_selector.after(ping_timeout) do
+        error = PingTimeoutError.new(ping_timeout, "Timed out after #{ping_timeout} seconds")
+        on_error(error)
+      end
+
       call
     end
 
     def pong
+      @ping_timer.cancel
+      @ping_timer = nil
       @response_received_at = Utils.now
       @no_more_requests_counter = 0
       send_pending
@@ -964,6 +1020,7 @@ module HTTPX
       set_request_write_timeout(request)
       set_request_read_timeout(request)
       set_request_request_timeout(request)
+      set_request_total_request_timeout(request)
     end
 
     def set_request_read_timeout(request)
@@ -1016,6 +1073,18 @@ module HTTPX
       request.handle_error(error)
     end
 
+    def set_request_total_request_timeout(request)
+      return if request.started?
+
+      total_request_timeout = request.total_request_timeout
+
+      return if total_request_timeout.nil? || total_request_timeout.infinite?
+
+      set_request_timeout(:total_request_timeout, request, total_request_timeout, :headers, :complete) do
+        read_timeout_callback(request, total_request_timeout, TotalRequestTimeoutError)
+      end
+    end
+
     def set_request_timeout(label, request, timeout, start_event, finish_events, &callback)
       request.set_timeout_callback(start_event) do
         unless (selector = @current_selector)

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8 → httpx-1.8.0}/lib/httpx/errors.rb

@@ -62,15 +62,22 @@ module HTTPX
   # Error raised when there was a timeout while sending a request from the server.
   class WriteTimeoutError < RequestTimeoutError; end
 
+  # Error raised when a response couldn't be received for a request after multiple interactions.
+  # This error should not be retriable.
+  class TotalRequestTimeoutError < RequestTimeoutError; end
+
   # Error raised when there was a timeout while waiting for the HTTP/2 settings frame from the server.
   class SettingsTimeoutError < TimeoutError; end
 
   # Error raised when there was a timeout while resolving a domain to an IP.
   class ResolveTimeoutError < TimeoutError; end
 
-  # Error raise when there was a timeout waiting for readiness of the socket the request is related to.
+  # Error raised when there was a timeout waiting for readiness of the socket the request is related to.
   class OperationTimeoutError < TimeoutError; end
 
+  # Error raised when a connection liveness probe (aka ping) times out.
+  class PingTimeoutError < TimeoutError; end
+
   # Error raised when there was an error while resolving a domain to an IP.
   class ResolveError < Error; end
 

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8 → httpx-1.8.0}/lib/httpx/io/tcp.rb

@@ -190,10 +190,20 @@ module HTTPX
         log { "error closing socket" }
         log { e.full_message(highlight: false) }
       ensure
-        transition(:closed)
+        # @fiber-switch-guard
+        # ensure that all :closed IOs don't leave dangling sockets
+        # behind. This may happen in a fiber scheduler scenario where
+        # connection is reused across fibers.
+        transition(:closed) if @io.closed?
       end
     end
 
+    # signals that the connection that contains this IO can be checked back into the pool.
+    # that includes sockets opened outside of the scope of the session, or closed IOs.
+    def can_disconnect?
+      @keep_open || @state == :closed
+    end
+
     def connected?
       @state == :connected
     end

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8 → httpx-1.8.0}/lib/httpx/options.rb

@@ -8,12 +8,12 @@ module HTTPX
     WINDOW_SIZE = 1 << 14 # 16K
     MAX_BODY_THRESHOLD_SIZE = (1 << 10) * 112 # 112K
     KEEP_ALIVE_TIMEOUT = 20
+    PING_TIMEOUT = 2
     SETTINGS_TIMEOUT = 10
     CLOSE_HANDSHAKE_TIMEOUT = 10
     CONNECT_TIMEOUT = READ_TIMEOUT = WRITE_TIMEOUT = 60
-    REQUEST_TIMEOUT = OPERATION_TIMEOUT = nil
+    REQUEST_TIMEOUT = OPERATION_TIMEOUT = TOTAL_REQUEST_TIMEOUT = nil
     RESOLVER_TYPES = %i[memory file].freeze
-
     # default value used for "user-agent" header, when not overridden.
     USER_AGENT = "httpx.rb/#{VERSION}".freeze # rubocop:disable Style/RedundantFreeze
 
@@ -79,9 +79,15 @@ module HTTPX
     # :decompress_response_body :: whether to auto-decompress response body (defaults to <tt>true</tt>).
     # :compress_request_body :: whether to auto-decompress response body (defaults to <tt>true</tt>)
     # :timeout :: hash of timeout configurations (supports <tt>:connect_timeout</tt>, <tt>:settings_timeout</tt>,
-    #             <tt>:operation_timeout</tt>, <tt>:keep_alive_timeout</tt>,  <tt>:read_timeout</tt>,  <tt>:write_timeout</tt>
-    #             and <tt>:request_timeout</tt>
+    #             <tt>:operation_timeout</tt>, <tt>:keep_alive_timeout</tt>, <tt>:read_timeout</tt>,  <tt>:write_timeout</tt>,
+    #             <tt>:request_timeout</tt>, <tt>:total_request_timeout</tt> and <tt>:ping_timeout</tt>,
     # :headers :: hash of HTTP headers (ex: <tt>{ "x-custom-foo" => "bar" }</tt>)
+    # :max_response_body_size :: maximum size (in bytes) that the response body can consume (no threshold by default), after which an
+    #                            error is raised.
+    # :max_response_headers :: maximum number of header fields that a response can receive, after which an error is raised.
+    # :max_response_header_value_size :: maximum size (in bytes) a header value can have (no threshold by default).
+    #                                    for cases where the value is broken into multiple header fields (such as "cookie" or "set-cookie"),
+    #                                    this is the total aggregated size.
     # :window_size :: number of bytes to read from a socket
     # :buffer_size :: internal read and write buffer size in bytes
     # :body_threshold_size :: maximum size in bytes of response payload that is buffered in memory.
@@ -387,6 +393,7 @@ module HTTPX
     # number options
     %i[
       max_concurrent_requests max_requests window_size buffer_size
+      max_response_body_size max_response_headers max_response_header_value_size
       body_threshold_size debug_level
     ].each do |option|
       class_eval(<<-OUT, __FILE__, __LINE__ + 1)
@@ -553,15 +560,20 @@ module HTTPX
       :supported_compression_formats => %w[gzip deflate],
       :decompress_response_body => true,
       :compress_request_body => true,
+      :max_response_headers => 1000,
+      :max_response_header_value_size => nil,
+      :max_response_body_size => Float::INFINITY,
       :timeout => {
         connect_timeout: CONNECT_TIMEOUT,
         settings_timeout: SETTINGS_TIMEOUT,
         close_handshake_timeout: CLOSE_HANDSHAKE_TIMEOUT,
         operation_timeout: OPERATION_TIMEOUT,
         keep_alive_timeout: KEEP_ALIVE_TIMEOUT,
+        ping_timeout: PING_TIMEOUT,
         read_timeout: READ_TIMEOUT,
         write_timeout: WRITE_TIMEOUT,
         request_timeout: REQUEST_TIMEOUT,
+        total_request_timeout: TOTAL_REQUEST_TIMEOUT,
       }.freeze,
       :headers_class => Class.new(Headers, &SET_TEMPORARY_NAME),
       :headers => EMPTY_HASH,

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8 → httpx-1.8.0}/lib/httpx/parser/http1.rb

@@ -9,11 +9,13 @@ module HTTPX
 
       attr_reader :status_code, :http_version, :headers
 
-      def initialize(observer)
+      def initialize(observer, max_headers, max_header_value_size)
         @observer = observer
         @state = :idle
         @buffer = "".b
         @headers = {}
+        @max_headers = max_headers
+        @max_header_value_size = max_header_value_size
         @content_length = nil
         @_has_trailers = @upgrade = false
       end
@@ -117,7 +119,11 @@ module HTTPX
           value.strip!
           raise Error, "wrong header format" if value.nil?
 
-          (headers[key.downcase] ||= []) << value
+          values = (headers[key.downcase] ||= []) << value
+
+          raise Error, "maximum header value size exceeded" if @max_header_value_size && (values.sum(&:size) > @max_header_value_size)
+
+          raise Error, "maximum number of response headers exceeded" if headers.size > @max_headers
         end
       end
 

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8 → httpx-1.8.0}/lib/httpx/plugins/auth.rb

@@ -20,6 +20,9 @@ module HTTPX
       #
       # :auth_header_value :: the token to use as a string, or a callable which returns a string when called.
       # :auth_header_type :: the authentication type to use in the "authorization" header value (i.e. "Bearer", "Digest"...)
+      # :auth_header_expires_at :: timestamp at which the auth header will be discarded. should be a callable (like a proc)
+      #                            receiving the request as an argument, and should return either a Time object, or an integer (UNIX time).
+      # :auth_header_expires_in :: time (in seconds) since the first use of an auth header after which that header will be discarded.
       # :generate_auth_value_on_retry :: callable which returns whether the request should regenerate the auth_header_value
       #                                  when the request is retried (this option will only work if the session also loads the
       #                                  <tt>:retries</tt> plugin).
@@ -32,6 +35,22 @@ module HTTPX
           value
         end
 
+        def option_auth_header_expires_at(value)
+          unless value.respond_to?(:call)
+            value = Float(value)
+            raise TypeError, "`:auth_header_expires_at` must be positive" unless value.positive?
+          end
+
+          value
+        end
+
+        def option_auth_header_expires_in(value)
+          value = Float(value)
+          raise TypeError, "`:auth_header_expires_in` must be positive" unless value.positive?
+
+          value
+        end
+
         def option_generate_auth_value_on_retry(value)
           raise TypeError, "`:generate_auth_value_on_retry` must be a callable" unless value.respond_to?(:call)
 
@@ -43,7 +62,7 @@ module HTTPX
         def initialize(*)
           super
 
-          @auth_header_value = nil
+          @auth_header_value = @auth_header_expires_at = nil
           @auth_header_value_mtx = Thread::Mutex.new
           @skip_auth_header_value = false
         end
@@ -65,7 +84,7 @@ module HTTPX
 
         def reset_auth_header_value!
           @auth_header_value_mtx.synchronize do
-            @auth_header_value = nil
+            @auth_header_value = @auth_header_expires_at = nil
           end
         end
 
@@ -75,7 +94,12 @@ module HTTPX
           return super if @skip_auth_header_value || request.authorized?
 
           auth_header_value = @auth_header_value_mtx.synchronize do
-            @auth_header_value ||= generate_auth_token
+            try_invalidate_auth_header_value
+
+            @auth_header_value ||= begin
+              set_auth_header_expires_at(request)
+              generate_auth_token
+            end
           end
 
           request.authorize(auth_header_value) if auth_header_value
@@ -83,6 +107,14 @@ module HTTPX
           super
         end
 
+        def try_invalidate_auth_header_value
+          return unless (expires_at = @auth_header_expires_at)
+
+          return if expires_at > Time.now.utc.to_i
+
+          @auth_header_value = @auth_header_expires_at = nil
+        end
+
         def generate_auth_token
           return unless (auth_value = @options.auth_header_value)
 
@@ -91,6 +123,19 @@ module HTTPX
           auth_value
         end
 
+        def set_auth_header_expires_at(request)
+          @auth_header_expires_at = if (expires_in = request.options.auth_header_expires_in)
+            Time.now.to_i + expires_in
+          elsif (expires_at = request.options.auth_header_expires_at)
+            if expires_at.respond_to?(:call)
+              expires_at = expires_at.call(request).to_f
+              raise Error, "`:auth_header_expires_at` must be positive" unless expires_at.positive?
+
+              expires_at
+            end
+          end
+        end
+
         def dynamic_auth_token?(auth_header_value)
           auth_header_value&.respond_to?(:call)
         end
@@ -150,7 +195,10 @@ module HTTPX
             # otherwise, it means that the first request already passed here, so this request should
             # use whatever was generated for it.
             @auth_header_value_mtx.synchronize do
-              @auth_header_value = generate_auth_token if request.auth_token_value == @auth_header_value
+              if request.auth_token_value == @auth_header_value
+                @auth_header_value = generate_auth_token
+                set_auth_header_expires_at(request)
+              end
             end
 
             request.unauthorize!

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8/lib/httpx/plugins/response_cache → httpx-1.8.0/lib/httpx/plugins/cache}/file_store.rb

@@ -3,7 +3,7 @@
 require "pathname"
 
 module HTTPX::Plugins
-  module ResponseCache
+  module Cache
     # Implementation of a file system based cache store.
     #
     # It stores cached responses in a file under a directory pointed by the +dir+

data/vendor/bundle/ruby/3.3.0/gems/{httpx-1.7.8/lib/httpx/plugins/response_cache → httpx-1.8.0/lib/httpx/plugins/cache}/store.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module HTTPX::Plugins
-  module ResponseCache
+  module Cache
     # Implementation of a thread-safe in-memory cache store.
     class Store
       def initialize