digital_femsa 1.0.0 → 1.1.1

data/lib/digital_femsa/models/webhook_request.rb

@@ -12,9 +12,10 @@ Generator version: 7.5.0
 
 require 'date'
 require 'time'
+require 'uri'
 
 module DigitalFemsa
-  # a webhook
+  # Parameters used to create or update a webhook.
   class WebhookRequest
     # Here you must place the URL of your Webhook remember that you must program what you will do with the events received. Also do not forget to handle the HTTPS protocol for greater security.
     attr_accessor :url
@@ -86,9 +87,10 @@ module DigitalFemsa
         invalid_properties.push('invalid value for "url", url cannot be nil.')
       end
 
-      pattern = Regexp.new(/^(?!.*(localhost|127\.0\.0\.1)).*$/)
-      if @url !~ pattern
-        invalid_properties.push("invalid value for \"url\", must conform to the pattern #{pattern}.")
+      begin
+        validate_url_safety(@url) if @url
+      rescue ArgumentError => e
+        invalid_properties.push(e.message)
       end
 
       if @synchronous.nil?
@@ -103,7 +105,11 @@ module DigitalFemsa
     def valid?
       warn '[DEPRECATED] the `valid?` method is obsolete'
       return false if @url.nil?
-      return false if @url !~ Regexp.new(/^(?!.*(localhost|127\.0\.0\.1)).*$/)
+      begin
+        validate_url_safety(@url)
+      rescue ArgumentError
+        return false
+      end
       return false if @synchronous.nil?
       true
     end
@@ -115,12 +121,245 @@ module DigitalFemsa
         fail ArgumentError, 'url cannot be nil'
       end
 
-      pattern = Regexp.new(/^(?!.*(localhost|127\.0\.0\.1)).*$/)
-      if url !~ pattern
-        fail ArgumentError, "invalid value for \"url\", must conform to the pattern #{pattern}."
+      validate_url_safety(url)
+      @url = url
+    end
+
+    private
+
+    # Comprehensive URL validation to prevent SSRF attacks
+    # @param [String] url URL to validate
+    def validate_url_safety(url)
+      # Parse the URL to extract hostname
+      begin
+        uri = URI.parse(url)
+        hostname = uri.hostname
+        port = uri.port
+        
+        # Ensure URL has a valid scheme (http/https)
+        unless uri.scheme =~ /\A(https?)\z/
+          fail ArgumentError, "invalid value for \"url\", must use http or https scheme"
+        end
+
+        # Block if hostname is nil or empty
+        if hostname.nil? || hostname.empty?
+          fail ArgumentError, "invalid value for \"url\", hostname cannot be empty"
+        end
+
+        # Block localhost variations and private IP ranges
+        if hostname_matches_restricted_patterns?(hostname)
+          fail ArgumentError, "invalid value for \"url\", hostname points to restricted network resource"
+        end
+
+        # Block ports commonly used for internal services
+        if port_matches_restricted_ports?(port)
+          fail ArgumentError, "invalid value for \"url\", port is not allowed"
+        end
+
+      rescue URI::InvalidURIError
+        fail ArgumentError, "invalid value for \"url\", must be a valid URL"
       end
+    end
 
-      @url = url
+    # Check if hostname matches restricted patterns
+    # @param [String] hostname Hostname to check
+    # @return [Boolean] true if hostname is restricted
+    def hostname_matches_restricted_patterns?(hostname)
+      # Convert to lowercase for case-insensitive comparison
+      hostname = hostname.downcase
+
+      # Block localhost variations
+      localhost_patterns = [
+        'localhost',
+        '127.0.0.1',
+        '127.0.0.0',
+        '0.0.0.0',
+        '::1',
+        '0:0:0:0:0:0:0:1',
+        'ip6-localhost',
+        'ip6-loopback'
+      ]
+
+      # Block private IP ranges
+      private_ip_patterns = [
+        /^127\.\d+\.\d+\.\d+/,      # 127.0.0.0/8 (loopback)
+        /^10\.\d+\.\d+\.\d+/,       # 10.0.0.0/8
+        /^172\.(1[6-9]|2[0-9]|3[0-1])\.\d+\.\d+/,  # 172.16.0.0/12
+        /^192\.168\.\d+\.\d+/,      # 192.168.0.0/16
+        /^169\.254\.\d+\.\d+/,      # 169.254.0.0/16 (link-local)
+        /^224\.\d+\.\d+\.\d+/,      # 224.0.0.0/4 (multicast)
+        /^fc00:/,                    # fc00::/7 (IPv6 unique local)
+        /^fe80:/,                    # fe80::/10 (IPv6 link-local)
+        /^ff00:/                     # ff00::/8 (IPv6 multicast)
+      ]
+
+      # Block internal hostnames and services
+      internal_hostnames = [
+        'internal',
+        'intranet',
+        'corp',
+        'private',
+        'admin',
+        'management',
+        'api-gateway',
+        'database',
+        'cache',
+        'redis',
+        'mongo',
+        'mysql',
+        'postgres',
+        'elasticsearch',
+        'kibana',
+        'grafana',
+        'prometheus',
+        'consul',
+        'vault',
+        'etcd',
+        'zookeeper',
+        'kafka',
+        'rabbitmq'
+      ]
+
+      # Check localhost patterns
+      return true if localhost_patterns.include?(hostname)
+
+      # Check private IP ranges
+      private_ip_patterns.each do |pattern|
+        return true if hostname.match?(pattern)
+      end
+
+      # Check internal hostnames (including subdomains)
+      internal_hostnames.each do |internal_name|
+        return true if hostname.include?(internal_name)
+      end
+
+      # Check for common DNS rebinding services
+      dns_rebinding_domains = [
+        'xip.io',
+        'nip.io',
+        'sslip.io',
+        'localtest.me',
+        'vcap.me',
+        'localho.st',
+        '127-0-0-1.org.uk'
+      ]
+
+      dns_rebinding_domains.each do |domain|
+        return true if hostname.end_with?(domain)
+      end
+
+      # Check if hostname resolves to private IP (basic check)
+      # Note: In production, you might want to add actual DNS resolution here
+      if hostname_resolves_to_private_ip?(hostname)
+        return true
+      end
+
+      false
+    end
+
+    # Check if port matches restricted ports
+    # @param [Integer] port Port to check
+    # @return [Boolean] true if port is restricted
+    def port_matches_restricted_ports?(port)
+      return false if port.nil?  # Allow default ports
+
+      # Block ports commonly used for internal services
+      restricted_ports = [
+        22,    # SSH
+        23,    # Telnet
+        25,    # SMTP
+        53,    # DNS
+        135,   # Windows RPC
+        139,   # NetBIOS
+        445,   # SMB
+        1433,  # SQL Server
+        1521,  # Oracle
+        2049,  # NFS
+        2181,  # Zookeeper
+        3306,  # MySQL
+        3389,  # RDP
+        5432,  # PostgreSQL
+        5672,  # RabbitMQ
+        5984,  # CouchDB
+        6379,  # Redis
+        6380,  # Redis SSL
+        8080,  # Common internal web services
+        8081,  # Alternative web services
+        8443,  # Alternative HTTPS
+        9000,  # Common internal services
+        9042,  # Cassandra
+        9092,  # Kafka
+        9200,  # Elasticsearch
+        9300,  # Elasticsearch transport
+        11211, # Memcached
+        27017, # MongoDB
+        27018, # MongoDB shard
+        27019, # MongoDB config
+        5000,  # Common internal services
+        5001,  # Alternative services
+        6000,  # Common internal services
+        7000,  # Common internal services
+        7001,  # WebLogic
+        8000,  # Common internal services
+        8001,  # Alternative services
+        8009,  # AJP
+        8443,  # Tomcat SSL
+        8888,  # Common internal services
+        9001,  # Common internal services
+        9090,  # Common internal services
+        9091,  # Common internal services
+        9093,  # Common internal services
+        9999,  # Common internal services
+        10000, # Common internal services
+        10001, # Common internal services
+        10002, # Common internal services
+        10003, # Common internal services
+        10004, # Common internal services
+        10005, # Common internal services
+        10006, # Common internal services
+        10007, # Common internal services
+        10008, # Common internal services
+        10009, # Common internal services
+        10010  # Common internal services
+      ]
+
+      restricted_ports.include?(port)
+    end
+
+    # Basic check if hostname might resolve to private IP
+    # @param [String] hostname Hostname to check
+    # @return [Boolean] true if hostname might resolve to private IP
+    def hostname_resolves_to_private_ip?(hostname)
+      # This is a basic heuristic. In production, you might want to
+      # actually resolve the hostname and check the IP addresses.
+      
+      # Check for common patterns that might resolve to internal IPs
+      suspicious_patterns = [
+        /^internal-/,
+        /^private-/,
+        /^intranet-/,
+        /^corp-/,
+        /^dev-/,
+        /^test-/,
+        /^staging-/,
+        /^admin-/,
+        /^db-/,
+        /^cache-/,
+        /^api-/,
+        /^service-/,
+        /^worker-/,
+        /^node-/,
+        /^server-/,
+        /^host-/,
+        /^vm-/,
+        /^container-/
+      ]
+
+      suspicious_patterns.each do |pattern|
+        return true if hostname.match?(pattern)
+      end
+
+      false
     end
 
     # Checks equality by comparing each attribute.

data/lib/digital_femsa/models/webhook_response.rb

@@ -14,7 +14,7 @@ require 'date'
 require 'time'
 
 module DigitalFemsa
-  # webhooks model
+  # Represents a webhook endpoint configured to receive event notifications.
   class WebhookResponse
     attr_accessor :deleted
 

data/lib/digital_femsa/models/webhook_update_request.rb

@@ -14,7 +14,7 @@ require 'date'
 require 'time'
 
 module DigitalFemsa
-  # an updated webhook
+  # Parameters used to update a webhook. All fields are optional; send only the fields you want to change.
   class WebhookUpdateRequest
     # Here you must place the URL of your Webhook remember that you must program what you will do with the events received. Also do not forget to handle the HTTPS protocol for greater security.
     attr_accessor :url

data/lib/digital_femsa/version.rb

@@ -11,5 +11,5 @@ Generator version: 7.5.0
 =end
 
 module DigitalFemsa
-  VERSION = '1.0.0'
+  VERSION = '1.1.1'
 end

data/lib/digital_femsa.rb

@@ -25,6 +25,7 @@ require 'digital_femsa/models/api_key_update_request'
 require 'digital_femsa/models/balance_common_field'
 require 'digital_femsa/models/balance_response'
 require 'digital_femsa/models/charge_order_response'
+require 'digital_femsa/models/charge_order_response_channel'
 require 'digital_femsa/models/charge_order_response_payment_method'
 require 'digital_femsa/models/charge_request'
 require 'digital_femsa/models/charge_request_payment_method'
@@ -50,8 +51,6 @@ require 'digital_femsa/models/create_customer_payment_methods_request'
 require 'digital_femsa/models/create_customer_payment_methods_response'
 require 'digital_femsa/models/customer'
 require 'digital_femsa/models/customer_address'
-require 'digital_femsa/models/customer_antifraud_info'
-require 'digital_femsa/models/customer_antifraud_info_response'
 require 'digital_femsa/models/customer_fiscal_entities_data_response'
 require 'digital_femsa/models/customer_fiscal_entities_request'
 require 'digital_femsa/models/customer_fiscal_entities_response'
@@ -103,12 +102,11 @@ require 'digital_femsa/models/order_discount_lines_request'
 require 'digital_femsa/models/order_fiscal_entity_address_response'
 require 'digital_femsa/models/order_fiscal_entity_request'
 require 'digital_femsa/models/order_fiscal_entity_response'
-require 'digital_femsa/models/order_next_action_response'
-require 'digital_femsa/models/order_next_action_response_redirect_to_url'
 require 'digital_femsa/models/order_refund_request'
 require 'digital_femsa/models/order_request'
 require 'digital_femsa/models/order_request_customer_info'
 require 'digital_femsa/models/order_response'
+require 'digital_femsa/models/order_response_channel'
 require 'digital_femsa/models/order_response_charges'
 require 'digital_femsa/models/order_response_checkout'
 require 'digital_femsa/models/order_response_customer_info'
@@ -132,14 +130,12 @@ require 'digital_femsa/models/product_data_response'
 require 'digital_femsa/models/product_order_response'
 require 'digital_femsa/models/shipping_order_response'
 require 'digital_femsa/models/shipping_request'
-require 'digital_femsa/models/sms_checkout_request'
 require 'digital_femsa/models/transaction_response'
 require 'digital_femsa/models/transfer_destination_response'
 require 'digital_femsa/models/transfer_method_response'
 require 'digital_femsa/models/transfer_response'
 require 'digital_femsa/models/transfers_response'
 require 'digital_femsa/models/update_customer'
-require 'digital_femsa/models/update_customer_antifraud_info'
 require 'digital_femsa/models/update_customer_fiscal_entities_response'
 require 'digital_femsa/models/update_customer_payment_methods_response'
 require 'digital_femsa/models/update_order_discount_lines_request'

data/spec/api/balances_api_spec.rb

@@ -13,35 +13,37 @@ Generator version: 7.5.0
 require 'spec_helper'
 require 'json'
 
-# Unit tests for DigitalFemsa::BalancesApi
-# Automatically generated by openapi-generator (https://openapi-generator.tech)
-# Please update as you see appropriate
-describe 'BalancesApi' do
-  before do
-    # run before each test
-    @api_instance = DigitalFemsa::BalancesApi.new
-  end
+RSpec.describe DigitalFemsa::BalancesApi do
+  let(:config) { DigitalFemsa::Configuration.new }
+  let(:api_client) { instance_double(DigitalFemsa::ApiClient) }
+  let(:api_instance) { described_class.new(api_client) }
 
-  after do
-    # run after each test
+  before do
+    allow(api_client).to receive(:config).and_return(config)
+    allow(api_client).to receive(:select_header_accept).and_return('application/vnd.app-v2.1.0+json')
   end
 
   describe 'test an instance of BalancesApi' do
-    it 'should create an instance of BalancesApi' do
-      expect(@api_instance).to be_instance_of(DigitalFemsa::BalancesApi)
+    it 'creates an instance of BalancesApi' do
+      expect(api_instance).to be_instance_of(DigitalFemsa::BalancesApi)
     end
   end
 
-  # unit tests for get_balance
-  # Get a company's balance
-  # Get a company's balance
-  # @param [Hash] opts the optional parameters
-  # @option opts [String] :accept_language Use for knowing which language to use
-  # @return [BalanceResponse]
-  describe 'get_balance test' do
-    it 'should work' do
-      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+  describe '#get_balance_with_http_info' do
+    it 'raises for invalid accept_language' do
+      expect do
+        api_instance.get_balance_with_http_info(accept_language: 'fr')
+      end.to raise_error(ArgumentError, /invalid value for "accept_language"/)
     end
-  end
 
+    it 'sends GET request to balance endpoint' do
+      expect(api_client).to receive(:call_api).with(:GET, '/balance', hash_including(
+        operation: :'BalancesApi.get_balance',
+        return_type: 'BalanceResponse'
+      )).and_return([:balance, 200, {}])
+
+      data = api_instance.get_balance(accept_language: 'es')
+      expect(data).to eq(:balance)
+    end
+  end
 end

data/spec/api/charges_api_spec.rb

@@ -13,68 +13,111 @@ Generator version: 7.5.0
 require 'spec_helper'
 require 'json'
 
-# Unit tests for DigitalFemsa::ChargesApi
-# Automatically generated by openapi-generator (https://openapi-generator.tech)
-# Please update as you see appropriate
-describe 'ChargesApi' do
-  before do
-    # run before each test
-    @api_instance = DigitalFemsa::ChargesApi.new
-  end
+RSpec.describe DigitalFemsa::ChargesApi do
+  let(:config) { DigitalFemsa::Configuration.new }
+  let(:api_client) { instance_double(DigitalFemsa::ApiClient) }
+  let(:api_instance) { described_class.new(api_client) }
 
-  after do
-    # run after each test
+  before do
+    allow(api_client).to receive(:config).and_return(config)
+    allow(api_client).to receive(:select_header_accept).and_return('application/vnd.app-v2.1.0+json')
+    allow(api_client).to receive(:select_header_content_type).and_return('application/json')
+    allow(api_client).to receive(:object_to_http_body) { |value| value.to_json }
   end
 
   describe 'test an instance of ChargesApi' do
-    it 'should create an instance of ChargesApi' do
-      expect(@api_instance).to be_instance_of(DigitalFemsa::ChargesApi)
+    it 'creates an instance of ChargesApi' do
+      expect(api_instance).to be_instance_of(DigitalFemsa::ChargesApi)
     end
   end
 
-  # unit tests for get_charges
-  # Get A List of Charges
-  # @param [Hash] opts the optional parameters
-  # @option opts [String] :accept_language Use for knowing which language to use
-  # @option opts [String] :x_child_company_id In the case of a holding company, the company id of the child company to which will process the request.
-  # @option opts [Integer] :limit The numbers of items to return, the maximum value is 250
-  # @option opts [String] :search General order search, e.g. by mail, reference etc.
-  # @option opts [String] :_next next page
-  # @option opts [String] :previous previous page
-  # @return [GetChargesResponse]
-  describe 'get_charges test' do
-    it 'should work' do
-      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+  describe '#get_charges_with_http_info' do
+    it 'raises for limit higher than 250' do
+      expect do
+        api_instance.get_charges_with_http_info(limit: 251)
+      end.to raise_error(ArgumentError, /must be smaller than or equal to 250/)
     end
-  end
 
-  # unit tests for orders_create_charge
-  # Create charge
-  # Create charge for an existing orden
-  # @param id Identifier of the resource
-  # @param charge_request requested field for a charge
-  # @param [Hash] opts the optional parameters
-  # @option opts [String] :accept_language Use for knowing which language to use
-  # @option opts [String] :x_child_company_id In the case of a holding company, the company id of the child company to which will process the request.
-  # @return [ChargeOrderResponse]
-  describe 'orders_create_charge test' do
-    it 'should work' do
-      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    it 'raises for limit lower than 1' do
+      expect do
+        api_instance.get_charges_with_http_info(limit: 0)
+      end.to raise_error(ArgumentError, /must be greater than or equal to 1/)
+    end
+
+    it 'maps list filters into query params' do
+      expect(api_client).to receive(:call_api).with(:GET, '/charges', hash_including(
+        operation: :'ChargesApi.get_charges',
+        query_params: {
+          limit: 10,
+          next: 'next_token',
+          previous: 'prev_token',
+          search: 'ord_123'
+        },
+        return_type: 'GetChargesResponse'
+      )).and_return([:list, 200, {}])
+
+      data = api_instance.get_charges(
+        limit: 10,
+        _next: 'next_token',
+        previous: 'prev_token',
+        search: 'ord_123'
+      )
+
+      expect(data).to eq(:list)
     end
   end
 
-  # unit tests for update_charge
-  # Update a charge
-  # @param id Identifier of the resource
-  # @param charge_update_request requested field for update a charge
-  # @param [Hash] opts the optional parameters
-  # @option opts [String] :accept_language Use for knowing which language to use
-  # @option opts [String] :x_child_company_id In the case of a holding company, the company id of the child company to which will process the request.
-  # @return [ChargeResponse]
-  describe 'update_charge test' do
-    it 'should work' do
-      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+  describe '#orders_create_charge_with_http_info' do
+    it 'raises when id is missing' do
+      expect do
+        api_instance.orders_create_charge_with_http_info(nil, { amount: 1000 })
+      end.to raise_error(ArgumentError, /Missing the required parameter 'id'/)
+    end
+
+    it 'raises when charge_request is missing' do
+      expect do
+        api_instance.orders_create_charge_with_http_info('ord_123', nil)
+      end.to raise_error(ArgumentError, /Missing the required parameter 'charge_request'/)
+    end
+
+    it 'builds escaped path and sends charge payload' do
+      payload = { amount: 1500, currency: 'MXN' }
+
+      expect(api_client).to receive(:call_api).with(:POST, '/orders/ord%2F123/charges', hash_including(
+        operation: :'ChargesApi.orders_create_charge',
+        body: payload.to_json,
+        return_type: 'ChargeOrderResponse'
+      )).and_return([:created, 201, {}])
+
+      data = api_instance.orders_create_charge('ord/123', payload)
+      expect(data).to eq(:created)
     end
   end
 
+  describe '#update_charge_with_http_info' do
+    it 'raises when id is missing' do
+      expect do
+        api_instance.update_charge_with_http_info(nil, { reference_id: 'ref_1' })
+      end.to raise_error(ArgumentError, /Missing the required parameter 'id'/)
+    end
+
+    it 'raises when charge_update_request is missing' do
+      expect do
+        api_instance.update_charge_with_http_info('chg_123', nil)
+      end.to raise_error(ArgumentError, /Missing the required parameter 'charge_update_request'/)
+    end
+
+    it 'sends PUT request with serialized payload' do
+      payload = { reference_id: 'new_reference' }
+
+      expect(api_client).to receive(:call_api).with(:PUT, '/charges/chg_123', hash_including(
+        operation: :'ChargesApi.update_charge',
+        body: payload.to_json,
+        return_type: 'ChargeResponse'
+      )).and_return([:updated, 200, {}])
+
+      data = api_instance.update_charge('chg_123', payload)
+      expect(data).to eq(:updated)
+    end
+  end
 end