apidepth 0.2.3 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f499652eea585017c268ea82a997a9e11af46e36c912b6f672fa91fd7d354eb4
-  data.tar.gz: aa70866eaf7876101236b986472ad14b24ea68bcaa9a38a68ed901d88e1f06b5
+  metadata.gz: ee27b15f831798b976f293eda67c90c9cccab735e75cb82a225d3ea511331622
+  data.tar.gz: 2ed0a290e8acab029c51eb12a116d295f8dfaa1390eef934cb61e5f9344b63ce
 SHA512:
-  metadata.gz: 22a04205584e05a111b2422209733b4c06b0008dada3840caa340915d2d9ffb7195dec530c4791b692990812f357b4148a714da904ada5fba15e5b20f854460e
-  data.tar.gz: 607dca2a4455e60fcf21bd3502382107a3840b02ca23102a0dac4fc4c903c62101bf46b099210591182aa6350f229ffc0209f650a71076060c1e482b83340cee
+  metadata.gz: b32de3265dc5a4add529dd10741d21aa935ba18fccf669614fb74b9b06ed5d8125200d0ec26be7cf0c9349b8f6cc9a56d173ed4b2ba89acd551b5684bd411aa8
+  data.tar.gz: bf7106cbfdf0a003824b625680a047978f1f8a27c862ce8df52551f316405e47dbd4444e3e64361f35cedf6317f74575a9998ed766afdbdd6459d56a5a719404

data/README.md

@@ -1,5 +1,9 @@
 # apidepth
 
+[![Gem Version](https://img.shields.io/gem/v/apidepth)](https://rubygems.org/gems/apidepth)
+[![Ruby](https://img.shields.io/badge/ruby-%3E%3D%202.7-ruby)](https://rubygems.org/gems/apidepth)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+
 Most API monitoring tools measure latency from their servers to the vendor. That's not what your users feel. Apidepth instruments `Net::HTTP` directly — every outbound call your app makes to Stripe, OpenAI, or Twilio is timed at the socket level, from your server. Then it benchmarks your numbers against anonymized fleet data, so when Stripe is slow you can tell if it's you or everyone.
 
 No payload capture. No credentials touch our infrastructure. No changes to your application code beyond a one-time initializer.

data/lib/apidepth/collector.rb

@@ -189,6 +189,8 @@ module Apidepth
     end
 
     def drain_queue
+      return [].freeze if @queue.empty?
+
       events = []
       events << @queue.pop(true) while events.size < MAX_BATCH_SIZE
       events
@@ -240,13 +242,7 @@ module Apidepth
 
       key = Apidepth.configuration.api_key
       if key.nil? || key.empty?
-        unless @warned_no_key
-          @warned_no_key = true
-          Apidepth.logger&.warn(
-            "[Apidepth] No API key configured — events are being dropped. " \
-            "Visit www.apidepth.io to create an account and get your key."
-          )
-        end
+        warn_no_api_key!
         return
       end
 
@@ -292,7 +288,7 @@ module Apidepth
 
       if host.match?(/\A\d+\z/)
         int = host.to_i
-        if int >= 0 && int <= 0xFFFFFFFF
+        if int.between?(0, 0xFFFFFFFF)
           host = [int >> 24, (int >> 16) & 0xFF, (int >> 8) & 0xFF,
                   int & 0xFF].join(".")
         end
@@ -305,6 +301,18 @@ module Apidepth
             "addresses (got #{url.host.inspect})."
     end
 
+    def warn_no_api_key!
+      @stats_mutex.synchronize do
+        unless @warned_no_key
+          @warned_no_key = true
+          Apidepth.logger&.warn(
+            "[Apidepth] No API key configured — events are being dropped. " \
+            "Visit www.apidepth.io to create an account and get your key."
+          )
+        end
+      end
+    end
+
     def validate_api_key!(key)
       return if key.nil? || key.empty?
       return unless key.match?(/[\r\n]/)

data/lib/apidepth/net_http_instrumentation.rb

@@ -88,7 +88,8 @@ module Apidepth
           }.merge(rl || {})
         )
       )
-    rescue StandardError
+    rescue StandardError => e
+      Apidepth.logger&.debug("[Apidepth] Instrumentation error: #{e.class}: #{e.message}")
       nil
     end
 
@@ -110,7 +111,8 @@ module Apidepth
           ts: Process.clock_gettime(Process::CLOCK_REALTIME, :millisecond)
         )
       )
-    rescue StandardError
+    rescue StandardError => e
+      Apidepth.logger&.debug("[Apidepth] Instrumentation error: #{e.class}: #{e.message}")
       nil
     end
   end

data/lib/apidepth/rate_limit_headers.rb

@@ -72,6 +72,7 @@ module Apidepth
       headers.each do |name|
         val = response[name]
         next unless val
+        next unless val.strip.match?(/\A\d+\z/)
 
         n = val.strip.to_i
         return n if n >= 0

data/lib/apidepth/registry_loader.rb

@@ -12,14 +12,32 @@ module Apidepth
     # registry (remote → disk cache → bundled baseline already loaded by
     # VendorRegistry.initialize_registry) and starts the background
     # refresh thread.
+    #
+    # Startup strategy: apply the on-disk cache synchronously so the in-process
+    # registry is populated immediately (no blocking network call on the boot
+    # thread). The initial remote fetch is dispatched to a background thread so
+    # that slow or unreachable endpoints (CI, air-gapped environments) do not
+    # block Rails boot for up to 8 seconds (open_timeout + read_timeout).
+    # The background refresh loop (start_refresh_thread) is unchanged.
     def self.load_and_start
-      registry = fetch_remote || load_from_disk
-      VendorRegistry.replace(registry) if registry
+      # Apply disk cache immediately — zero network latency, registry is ready
+      # before the application begins serving requests.
+      disk_registry = load_from_disk
+      VendorRegistry.replace(disk_registry) if disk_registry
+
+      # Fetch the freshest registry from the network in the background so the
+      # boot thread is never blocked by the remote request.
+      Thread.new do
+        registry = fetch_remote
+        VendorRegistry.replace(registry) if registry
+      end.tap do |t|
+        t.abort_on_exception = false
+        t.name = "apidepth-registry-init"
+      end
+
       start_refresh_thread
     end
 
-    private
-
     def self.start_refresh_thread
       Thread.new do
         loop do
@@ -213,6 +231,17 @@ module Apidepth
       raise ArgumentError, "registry_cache_path must not contain '..' traversal segments (got #{path.inspect})"
     end
 
+    # Reset mutable class-level warn state under @mutex.
+    # Called by tests instead of raw instance_variable_set so that state
+    # changes go through the same lock used in production code paths.
+    def self.reset_state!
+      @mutex.synchronize do
+        @conflict_vendors = {}
+        @warned_stale     = {}
+        @warned_conflict  = {}
+      end
+    end
+
     # Ruby's `private` keyword does not apply to `def self.method` — those remain
     # public class methods regardless of placement inside a private block.
     # private_class_method is the correct idiom.

data/lib/apidepth/vendor_registry.rb

@@ -64,6 +64,10 @@ module Apidepth
       [%r{/[a-z0-9]{24,}}, "/:token"]
     ].freeze
 
+    # True when the runtime supports Regexp.timeout (introduced in Ruby 3.2).
+    # Used by apply_vendor_normalizers to enable ReDoS protection when available.
+    RUBY_GTE_3_2 = Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.2")
+
     class << self
       def identify(host, raw_path)
         hosts, patterns = @mutex.synchronize { [@hosts, @patterns] }
@@ -169,11 +173,28 @@ module Apidepth
         path.split("?").first
       end
 
+      # First-match-wins: iteration stops at the first pattern that matches the
+      # path. Vendor authors must order rules from most-specific to least-specific
+      # to ensure that narrower patterns (e.g. /v1/charges/:id) are tested before
+      # broader catch-alls (e.g. /v1/:resource/:id). A less-specific rule placed
+      # earlier will shadow any more-specific rules that follow it.
+      #
+      # ReDoS protection: on Ruby >= 3.2 we apply a per-match timeout of 1ms so
+      # that a pathological pattern from a compromised or misconfigured registry
+      # cannot stall the request thread indefinitely. On older Ruby, Regexp.timeout
+      # is not available — use a trusted, internally-reviewed registry source.
       def apply_vendor_normalizers(rules, path)
+        if RUBY_GTE_3_2
+          saved_timeout = Regexp.timeout
+          Regexp.timeout = 0.001
+        end
+
         rules.each do |pattern, replacement|
           return path.gsub(pattern, replacement) if path.match?(pattern)
         end
         path
+      ensure
+        Regexp.timeout = saved_timeout if RUBY_GTE_3_2
       end
 
       def apply_generic_normalizers(path)

data/lib/apidepth/version.rb

@@ -1,5 +1,5 @@
 # lib/apidepth/version.rb
 
 module Apidepth
-  VERSION = "0.2.3".freeze
+  VERSION = "0.3.0".freeze
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: apidepth
 version: !ruby/object:Gem::Version
-  version: 0.2.3
+  version: 0.3.0
 platform: ruby
 authors:
 - Apidepth
+autorequire:
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-05-27 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -93,6 +94,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.65'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.22'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.22'
 description: Know if your API slowness is your code or the vendor's. Apidepth instruments
   Net::HTTP to track real production latency to Stripe, OpenAI, Twilio and others
   — then benchmarks your p95 against anonymized fleet data so you can see if it's
@@ -120,10 +135,11 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://apidepth.io
-  source_code_uri: https://github.com/cmwright33/apidepth-ruby
-  changelog_uri: https://github.com/cmwright33/apidepth-ruby/blob/main/CHANGELOG.md
-  bug_tracker_uri: https://github.com/cmwright33/apidepth-ruby/issues
+  source_code_uri: https://github.com/apidepth-io/apidepth-ruby
+  changelog_uri: https://github.com/apidepth-io/apidepth-ruby/blob/main/CHANGELOG.md
+  bug_tracker_uri: https://github.com/apidepth-io/apidepth-ruby/issues
   rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -138,7 +154,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.11
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Know if your API slowness is your code or the vendor's
 test_files: []