drip-ruby 3.4.2 → 3.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a315464f308426c87063f971108b2861cc7f6beacf9320fdf16af17bed73fc16
-  data.tar.gz: 70cd96e4f9ea7a463f73ae83990e8cfda6519563bbcaec9b4942d1862d7613b8
+  metadata.gz: 37b3a95212197fb3a6921842f1613d3ee1e4f2189322f11e102c3146ddea7d21
+  data.tar.gz: 11f956e7ad3323e9e5837d28ed6e2cfbbf0c359f7a91c257fdafdfd3255dcec5
 SHA512:
-  metadata.gz: b9d9dba42336127f9cfc9269ab57ff0f7af9fac620fb735d0749cb40ecf76a96175e25bee9b2a55ef94fd4ba038d10ae0fa371c9b0b0d7ded6f09f4169bbcb93
-  data.tar.gz: 1991082152cbf1bfc5748a37e6108418313871ea5272e8ad42b33a2be4081174b282601deedd027f8187df2e513071ea80636423f77168fffe2d2f42dba82af2
+  metadata.gz: 84bb04b31f437feda68912b961a8f98c643dafdc153a6a9284daf73b32e045e29670faf99d45d928a4df7c0af433a3ccda1af1e41b287372126a2d928ec02996
+  data.tar.gz: 6c99c173680a681847fba94e3697b93ffebc999b1d146eb936ee23eeb9f00511e8c150c5b1c7bd5e9154bc72205c32dcb484fc90a83c70e00fa92c4ad0766ffc

data/.github/workflows/ci.yml

@@ -0,0 +1,35 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["3.1", "3.2", "3.3", "3.4"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+      - run: bundle exec rake test
+
+  # Runs the suite through the same flake.nix shell used for local development,
+  # so a broken dev environment fails CI instead of surfacing only when someone
+  # next runs `nix develop`. No Nix cache action is wired up here: this flake
+  # doesn't build anything from source, so every package is already served by
+  # the public cache.nixos.org substituter and there's nothing to gain from one.
+  nix:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: DeterminateSystems/determinate-nix-action@v3
+      - run: nix develop --command bundle install
+      - run: nix develop --command bundle exec rake test
+      - run: nix develop --command bundle exec rubocop

data/.rubocop.yml

@@ -1,11 +1,15 @@
+plugins:
+  - rubocop-performance
+
 inherit_from: .rubocop_todo.yml
 
 AllCops:
-  TargetRubyVersion: '2.3'
+  TargetRubyVersion: '3.1'
+  NewCops: enable
   Exclude:
     - 'test/fixtures/**/*'
 
-Layout/AlignParameters:
+Layout/ParameterAlignment:
   EnforcedStyle: with_fixed_indentation
 
 Layout/ClosingParenthesisIndentation:
@@ -14,15 +18,32 @@ Layout/ClosingParenthesisIndentation:
 Layout/DotPosition:
   EnforcedStyle: trailing
 
-Style/BracesAroundHashParameters:
-  Enabled: false
-
 Layout/AccessModifierIndentation:
   EnforcedStyle: outdent
 
-Metrics/LineLength:
+Layout/LineLength:
   Enabled: false
 
+Style/StringLiterals:
+  Enabled: false
+
+# This codebase intentionally uses the compact `class Drip::Client::Foo`
+# style throughout instead of nested `module`/`class` blocks.
+Style/ClassAndModuleChildren:
+  Enabled: false
+
+# Methods are documented with "Public:"-style comments above each method
+# rather than class/module-level documentation.
+Style/Documentation:
+  Enabled: false
+
+# Data-literal methods that just enumerate known classes aren't meaningfully
+# simplified by splitting them up.
+Metrics/MethodLength:
+  Exclude:
+    - 'lib/drip/resources.rb'
+    - 'lib/drip/collections.rb'
+
 Layout/MultilineOperationIndentation:
   EnforcedStyle: 'indented'
 

data/.rubocop_todo.yml

@@ -1,103 +1,7 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config`
-# on 2019-05-02 16:45:21 -0500 using RuboCop version 0.67.2.
+# using RuboCop version 1.88.2.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
 # versions of RuboCop, may require this file to be generated again.
-
-# Offense count: 2
-# Cop supports --auto-correct.
-Layout/EmptyLineAfterGuardClause:
-  Exclude:
-    - 'lib/drip/client/subscribers.rb'
-    - 'lib/drip/response.rb'
-
-# Offense count: 2
-# Cop supports --auto-correct.
-# Configuration parameters: AllowUnusedKeywordArguments, IgnoreEmptyMethods.
-Lint/UnusedMethodArgument:
-  Exclude:
-    - 'lib/drip/client.rb'
-    - 'lib/drip/collection.rb'
-
-# Offense count: 2
-Metrics/AbcSize:
-  Max: 25
-
-# Offense count: 8
-# Configuration parameters: CountComments, ExcludedMethods.
-# ExcludedMethods: refine
-Metrics/BlockLength:
-  Max: 46
-
-# Offense count: 4
-# Configuration parameters: CountComments, ExcludedMethods.
-Metrics/MethodLength:
-  Max: 26
-
-# Offense count: 1
-Metrics/PerceivedComplexity:
-  Max: 8
-
-# Offense count: 4
-# Cop supports --auto-correct.
-Performance/InefficientHashSearch:
-  Exclude:
-    - 'lib/drip/resource.rb'
-    - 'lib/drip/response.rb'
-
-# Offense count: 24
-# Cop supports --auto-correct.
-# Configuration parameters: AutoCorrect, EnforcedStyle.
-# SupportedStyles: nested, compact
-Style/ClassAndModuleChildren:
-  Enabled: false
-
-# Offense count: 44
-Style/Documentation:
-  Enabled: false
-
-# Offense count: 1
-# Cop supports --auto-correct.
-Style/Encoding:
-  Exclude:
-    - 'drip-ruby.gemspec'
-
-# Offense count: 2
-# Cop supports --auto-correct.
-Style/ExpandPathArguments:
-  Exclude:
-    - 'drip-ruby.gemspec'
-    - 'test/test_helper.rb'
-
-# Offense count: 1
-# Configuration parameters: MinBodyLength.
-Style/GuardClause:
-  Exclude:
-    - 'lib/drip/client.rb'
-
-# Offense count: 2
-# Cop supports --auto-correct.
-Style/IfUnlessModifier:
-  Exclude:
-    - 'lib/drip/client.rb'
-
-# Offense count: 2
-Style/MissingRespondToMissing:
-  Exclude:
-    - 'lib/drip/resource.rb'
-    - 'lib/drip/response.rb'
-
-# Offense count: 12
-# Cop supports --auto-correct.
-# Configuration parameters: Strict.
-Style/NumericLiterals:
-  MinDigits: 8
-
-# Offense count: 700
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyle, ConsistentQuotesInMultiline.
-# SupportedStyles: single_quotes, double_quotes
-Style/StringLiterals:
-  Enabled: false

data/CHANGELOG.md

@@ -6,10 +6,50 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
-[master]: https://github.com/DripEmail/drip-ruby/compare/v3.4.2...HEAD
+[main]: https://github.com/DripEmail/drip-ruby/compare/v3.5.0...HEAD
 
 - Your contribution here!
 
+## [3.5.0] - 2026-07-10
+
+[3.5.0]: https://github.com/DripEmail/drip-ruby/compare/v3.4.3...v3.5.0
+
+### Security
+- `Drip::Client::HTTPClient` no longer forwards the `Authorization`/Basic-auth
+  credentials when an HTTP redirect points to a different host than the one
+  originally requested.
+- Path segments and query values built from caller-supplied ids (`id`,
+  `campaign_id`, `workflow_id`, `subscriber_id`, etc.) are now consistently
+  URL-escaped, matching the existing behavior for emails and tags.
+
+### Fixed
+- `Drip::Client::Orders#create_or_update_order` no longer merges the `email`
+  option under a symbol key alongside a possible string `"email"` key, which
+  produced a hash with a duplicate JSON key and a deprecation warning under
+  recent `json` gem versions.
+
+### Changed
+- Raised `required_ruby_version` to `>= 3.1` and bumped development
+  dependencies (minitest, mocha, rake, rubocop, rubocop-performance,
+  shoulda-context, simplecov, webmock) to current versions.
+- Replaced Travis CI with a GitHub Actions workflow that runs the test suite
+  across Ruby 3.1-3.4 (via `ruby/setup-ruby`) plus a job that runs the suite
+  and rubocop through the project's `flake.nix` shell (via
+  `DeterminateSystems/determinate-nix-action`), so the documented dev
+  environment is itself covered by CI.
+- Upgraded rubocop from 0.67.2 to 1.x, resolved the accumulated
+  `.rubocop_todo.yml` offenses, and fixed the underlying code where
+  reasonable rather than just re-suppressing them.
+- Added a `flake.nix` development shell (ruby, bundler, libyaml, pkg-config)
+  for a reproducible local dev environment.
+
+## [3.4.3] - 2023-02-15
+
+[3.4.3]: https://github.com/DripEmail/drip-ruby/compare/v3.4.2...v3.4.3
+
+### Added
+- `Drip::Client::ShopperActivity#create_checkout_activity_event` can create `checkout` activity events now
+
 ## [3.4.2] - 2021-04-25
 
 [3.4.2]: https://github.com/DripEmail/drip-ruby/compare/v3.4.1...v3.4.2

data/Gemfile

@@ -5,12 +5,13 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in drip-ruby.gemspec
 gemspec
 
-gem "bundler", ">= 1.6", "< 3"
+gem "base64"
+gem "bundler", ">= 2.0", "< 5"
 gem "minitest", "~> 5.0"
-gem "mocha", "~> 1.1"
-gem "rake", "~> 12.0"
-gem "rubocop", "~> 0.67.2"
-gem "rubocop-performance", "~> 1.1.0"
-gem "shoulda-context", "~> 1.0"
-gem "simplecov", require: false
-gem "webmock", "~> 3.4"
+gem "mocha", "~> 2.1"
+gem "rake", "~> 13.0"
+gem "rubocop", "~> 1.81"
+gem "rubocop-performance", "~> 1.26"
+gem "shoulda-context", "~> 1.2"
+gem "simplecov", "~> 0.22", require: false
+gem "webmock", "~> 3.24"

data/README.md

@@ -2,8 +2,7 @@
 
 A Ruby toolkit for the [Drip](https://www.getdrip.com/) API.
 
-[![Build Status](https://travis-ci.org/DripEmail/drip-ruby.svg?branch=master)](https://travis-ci.org/DripEmail/drip-ruby)
-[![Code Climate](https://codeclimate.com/github/DripEmail/drip-ruby/badges/gpa.svg)](https://codeclimate.com/github/DripEmail/drip-ruby)
+[![CI](https://github.com/DripEmail/drip-ruby/actions/workflows/ci.yml/badge.svg)](https://github.com/DripEmail/drip-ruby/actions/workflows/ci.yml)
 [![Gem Version](https://badge.fury.io/rb/drip-ruby.svg)](https://badge.fury.io/rb/drip-ruby)
 
 

data/drip-ruby.gemspec

@@ -1,7 +1,6 @@
-# coding: utf-8
 # frozen_string_literal: true
 
-lib = File.expand_path('../lib', __FILE__)
+lib = File.expand_path('lib', __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require 'drip/version'
 
@@ -17,8 +16,9 @@ Gem::Specification.new do |spec|
 
   spec.files         = `git ls-files -z`.split("\x0")
   spec.executables   = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
-  spec.test_files    = spec.files.grep(%r{^(test|spec|features)/})
   spec.require_paths = ["lib"]
 
-  spec.required_ruby_version = '>= 2.3'
+  spec.required_ruby_version = '>= 3.1'
+
+  spec.metadata['rubygems_mfa_required'] = 'true'
 end

data/flake.lock

@@ -0,0 +1,61 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1783522502,
+        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

data/flake.nix

@@ -0,0 +1,32 @@
+{
+  description = "Development environment for drip-ruby";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    flake-utils.url = "github:numtide/flake-utils";
+  };
+
+  outputs = { self, nixpkgs, flake-utils }:
+    flake-utils.lib.eachDefaultSystem (system:
+      let
+        pkgs = nixpkgs.legacyPackages.${system};
+      in
+      {
+        devShells.default = pkgs.mkShell {
+          packages = [
+            pkgs.ruby_3_3
+            pkgs.bundler
+            pkgs.libyaml
+            pkgs.pkg-config
+          ];
+
+          shellHook = ''
+            export GEM_HOME="$PWD/.bundle/gems"
+            export BUNDLE_PATH="$GEM_HOME"
+            export PATH="$GEM_HOME/bin:$PATH"
+            echo "drip-ruby dev shell ($(ruby -v))"
+            echo "Run 'bundle install' then 'bundle exec rake test' to get started."
+          '';
+        };
+      });
+}

data/lib/drip/client/accounts.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module Drip
   class Client
     module Accounts
@@ -18,7 +20,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#accounts
       def account(id)
-        make_json_api_request :get, "v2/accounts/#{id}"
+        make_json_api_request :get, "v2/accounts/#{CGI.escape id.to_s}"
       end
     end
   end

data/lib/drip/client/broadcasts.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module Drip
   class Client
     module Broadcasts
@@ -24,7 +26,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#broadcasts
       def broadcast(id)
-        make_json_api_request :get, "v2/#{account_id}/broadcasts/#{id}"
+        make_json_api_request :get, "v2/#{account_id}/broadcasts/#{CGI.escape id.to_s}"
       end
     end
   end

data/lib/drip/client/campaign_subscriptions.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module Drip
   class Client
     module CampaignSubscriptions
@@ -10,7 +12,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs.rest-api#campaign_subscriptions
       def campaign_subscriptions(subscriber_id)
-        make_json_api_request :get, "v2/#{account_id}/subscribers/#{subscriber_id}/campaign_subscriptions"
+        make_json_api_request :get, "v2/#{account_id}/subscribers/#{CGI.escape subscriber_id.to_s}/campaign_subscriptions"
       end
     end
   end

data/lib/drip/client/campaigns.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module Drip
   class Client
     module Campaigns
@@ -26,7 +28,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#campaigns
       def campaign(id)
-        make_json_api_request :get, "v2/#{account_id}/campaigns/#{id}"
+        make_json_api_request :get, "v2/#{account_id}/campaigns/#{CGI.escape id.to_s}"
       end
 
       # Public: Activate a campaign.
@@ -36,7 +38,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#campaigns
       def activate_campaign(id)
-        make_json_api_request :post, "v2/#{account_id}/campaigns/#{id}/activate"
+        make_json_api_request :post, "v2/#{account_id}/campaigns/#{CGI.escape id.to_s}/activate"
       end
 
       # Public: Pause a campaign.
@@ -46,7 +48,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#campaigns
       def pause_campaign(id)
-        make_json_api_request :post, "v2/#{account_id}/campaigns/#{id}/pause"
+        make_json_api_request :post, "v2/#{account_id}/campaigns/#{CGI.escape id.to_s}/pause"
       end
 
       # Public: List everyone subscribed to a campaign.
@@ -70,7 +72,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#campaigns
       def campaign_subscribers(id, options = {})
-        make_json_api_request :get, "v2/#{account_id}/campaigns/#{id}/subscribers", options
+        make_json_api_request :get, "v2/#{account_id}/campaigns/#{CGI.escape id.to_s}/subscribers", options
       end
     end
   end

data/lib/drip/client/configuration.rb

@@ -6,7 +6,15 @@ module Drip
       DEFAULT_URL_PREFIX = "https://api.getdrip.com/"
       private_constant :DEFAULT_URL_PREFIX
 
-      CONFIGURATION_FIELDS = %i[access_token api_key account_id url_prefix http_open_timeout http_timeout].freeze
+      CONFIGURATION_FIELDS = %i[
+        access_token
+        account_id
+        api_key
+        http_open_timeout
+        http_timeout
+        skip_analytics
+        url_prefix
+      ].freeze
 
       attr_accessor(*CONFIGURATION_FIELDS)
 

data/lib/drip/client/conversions.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module Drip
   class Client
     module Conversions
@@ -22,7 +24,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#conversions
       def conversion(id)
-        make_json_api_request :get, "v2/#{account_id}/goals/#{id}"
+        make_json_api_request :get, "v2/#{account_id}/goals/#{CGI.escape id.to_s}"
       end
     end
   end

data/lib/drip/client/forms.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "cgi"
+
 module Drip
   class Client
     module Forms
@@ -18,7 +20,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://www.getdrip.com/docs/rest-api#forms
       def form(id)
-        make_json_api_request :get, "v2/#{account_id}/forms/#{id}"
+        make_json_api_request :get, "v2/#{account_id}/forms/#{CGI.escape id.to_s}"
       end
     end
   end

data/lib/drip/client/http_client.rb

@@ -13,40 +13,59 @@ module Drip
       def make_request(drip_request, redirected_url: nil, step: 0)
         raise TooManyRedirectsError, 'too many HTTP redirects' if step >= REDIRECT_LIMIT
 
-        uri = redirected_url || drip_request.url.tap do |orig_url|
+        uri = redirected_url || request_uri(drip_request)
+        response = perform_request(drip_request, uri)
+
+        return make_request(drip_request, redirected_url: URI(response["Location"]), step: step + 1) if response.is_a?(Net::HTTPRedirection)
+
+        response
+      end
+
+    private
+
+      def request_uri(drip_request)
+        drip_request.url.tap do |orig_url|
           next if drip_request.http_verb != :get
 
           orig_url.query = URI.encode_www_form(drip_request.options)
         end
+      end
 
-        response = Net::HTTP.start(uri.host, uri.port, connection_options(uri.scheme)) do |http|
+      def perform_request(drip_request, uri)
+        Net::HTTP.start(uri.host, uri.port, connection_options(uri.scheme)) do |http|
           request = drip_request.verb_klass.new uri
           request.body = drip_request.body
 
-          add_standard_headers(request)
+          add_standard_headers(request, authenticated: same_host?(uri, drip_request.url))
           request['Content-Type'] = drip_request.content_type
 
           http.request request
         end
-
-        return make_request(drip_request, redirected_url: URI(response["Location"]), step: step + 1) if response.is_a?(Net::HTTPRedirection)
-
-        response
       end
 
-    private
+      # Only send credentials to the host the request was originally made to.
+      # A redirect to a different host must not be able to exfiltrate the API
+      # key/access token.
+      def same_host?(uri, original_url)
+        uri.host == original_url.host
+      end
 
-      def add_standard_headers(request)
+      def add_standard_headers(request, authenticated:)
         request['User-Agent'] = "Drip Ruby v#{Drip::VERSION}"
         request['Accept'] = "*/*"
 
+        add_authentication(request) if authenticated
+
+        request['Skip-Analytics'] = true if @config.skip_analytics
+        request
+      end
+
+      def add_authentication(request)
         if @config.access_token
           request['Authorization'] = "Bearer #{@config.access_token}"
         else
           request.basic_auth @config.api_key, ""
         end
-
-        request
       end
 
       def connection_options(uri_scheme)

data/lib/drip/client/orders.rb

@@ -12,7 +12,7 @@ module Drip
       # Returns a Drip::Response.
       # See https://developer.drip.com/#orders
       def create_or_update_order(email, options = {})
-        data = options.merge(email: email)
+        data = options.merge("email" => email)
         make_json_api_request :post, "v2/#{account_id}/orders", private_generate_resource("orders", data)
       end