booqable 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ce7d8b0be4851e4e78229078331a2f73cbe7cb7702c1555df9dec0903be28d0e
-  data.tar.gz: c79ed318eb3a38534291ef5e4abeb6a5749c7a2684bcd1befbf43d6f7f1d0e8a
+  metadata.gz: eb7d9650b7c441ded7b819566722c9dd860d83c28338407897c3e359367954a3
+  data.tar.gz: 6fd5b29991f14b4503b244fcb05db3613c7d87baf215904274066081a2d71107
 SHA512:
-  metadata.gz: 9d6dead61b0b4bfd8374c9b51aec7dccc724988b5417f9585018ee549840ee207756642b38aedbfcf4fdb4e313f9764fdc64b1d1d6e7593c057edb20d6095afc
-  data.tar.gz: c5e34b3a736ab3bdca397dfd1245d07b8dd8e246e32d4d0f24e097c41f52d47307c645a547592e60b90dc27f98e2e817193a1059f2696c0a726316c0693c1f88
+  metadata.gz: 38b96b39b3d88bfe1209a102f15117f2f7292d38f0ffebb5d2d0e80cbf93d8cb5622462b9bfef7a3cc784a52f25c4bdcad97333de5401a7d8cc2ca0abcbaae15
+  data.tar.gz: f53f2f5c9347c8f3ea266abfc8882b42e8e1239c9df104cb46277a2467ad22710fc68a7417808eb32ac37d1ee0a3891a9e704e558101dbb30962b54da2d1b917

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [1.2.1] - 2026-06-10
+
+- Require `oauth2 >= 2.0.22` to address GHSA-pp92-crg2-gfv9, where a
+  protocol-relative redirect `Location` could override the request authority and
+  leak the bearer `Authorization` header to an attacker-controlled host.
+
+
 ## [1.2.0] - 2026-05-27
 
 - Add optional `around_refresh_token` configuration. When provided, the OAuth

data/lib/booqable/client.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "did_you_mean"
+
 module Booqable
   # Client for the Booqable API
   #
@@ -40,11 +42,22 @@ module Booqable
       access_token
     ]
 
+    # Accepted aliases for configuration options, mapping the alias to its
+    # canonical {Booqable::Configurable} key.
+    OPTION_ALIASES = {
+      skip_retries: :no_retries
+    }.freeze
+
     # Initialize a new Client
     #
     # @param options [Hash] Configuration options for the client
     # @see Booqable::Configurable For a complete list of supported configuration options
     def initialize(options = {})
+      options = normalize_aliases(options)
+
+      unknown_keys = options.keys.map(&:to_sym) - Booqable::Configurable.keys
+      raise ArgumentError, unknown_options_message(unknown_keys) unless unknown_keys.empty?
+
       # Use options passed in, but fall back to module defaults
       #
       # This may look like a `.keys.each` which should be replaced with `#each_key`, but
@@ -94,5 +107,34 @@ module Booqable
 
       inspected
     end
+
+    private
+
+    # Rewrite any aliased option keys to their canonical configuration key.
+    #
+    # @param options [Hash] options as passed to {#initialize}
+    # @return [Hash] options with aliases replaced by their canonical keys
+    def normalize_aliases(options)
+      options.to_h do |key, value|
+        [ OPTION_ALIASES.fetch(key.to_sym, key), value ]
+      end
+    end
+
+    # Build an error message for unknown configuration options, suggesting
+    # similarly-named valid options via did_you_mean when one is close enough.
+    #
+    # @param unknown_keys [Array<Symbol>] options that aren't valid config keys
+    # @return [String]
+    def unknown_options_message(unknown_keys)
+      dictionary = Booqable::Configurable.keys + OPTION_ALIASES.keys
+      spell_checker = DidYouMean::SpellChecker.new(dictionary: dictionary)
+
+      message = "unknown configuration option(s): #{unknown_keys.join(", ")}"
+
+      suggestions = unknown_keys.flat_map { |key| spell_checker.correct(key) }.uniq
+      message += ". Did you mean: #{suggestions.join(", ")}?" unless suggestions.empty?
+
+      message
+    end
   end
 end

data/lib/booqable/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Booqable
-  VERSION = "1.2.0"
+  VERSION = "1.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: booqable
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Hrvoje Šimić
@@ -86,6 +86,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.22
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -93,6 +96,9 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.0'
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 2.0.22
 - !ruby/object:Gem::Dependency
   name: jwt
   requirement: !ruby/object:Gem::Requirement