duo_api 1.5.1 → 1.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3c2901cdf24a0a40675217841570d9483f01fc377c1942c97e6e7b10be65dc6e
-  data.tar.gz: 9571e1c9261ad6d6d1cc818f283f61e9c8c18be78345323f59385d573b7820cd
+  metadata.gz: 3753b5e4577945ac32fcd29df3307e0452382f73399f75823d448d7272d26e60
+  data.tar.gz: 76612140f24f72a775157b6e905c971e1d1f203651ad01ee77a26c56fe396d8f
 SHA512:
-  metadata.gz: 911450aebc22fb9a7a58b79c561c35f73ef8a5d3af69d201929a488505d56c05e539d06912062bff0d50afa31f7be1cb3790c44b4bcda80c867993a28acf734a
-  data.tar.gz: 24007e11ad3f01e2de7d364f2dcf663f5d30764f7063cb2fcd85186f735dacffb1965df99b8cc684c145fdd9ccad00d4eea7d024e5a18dd8fe50ed900481228f
+  metadata.gz: e69f9e683ec473edafd2b2e835a351f9258aee5480e2414cce3d0f23a74c824e0f9076c795d2bcccbdd1dcfb44555da067308d17d3468d87e0bdf11b1c15e347
+  data.tar.gz: b2922d5baf7d43f8d349478bc11fd5c7d5619a915eec6cf45b2c301448fca527cb2de8f02d59d26e211b87f2d5aa13c0b6d3ab8582a1dfb1f92de4fbf8a376e9

data/lib/duo_api/api_client.rb

@@ -13,16 +13,19 @@ require 'uri'
 #
 class DuoApi
   attr_accessor :ca_file
-  attr_reader :default_params
+  attr_reader :default_params, :ca_pinning_disabled
 
   VERSION = Gem.loaded_specs['duo_api'] ? Gem.loaded_specs['duo_api'].version : '0.0.0'
 
+  # Version of the bundled CA certificate collection
+  CA_BUNDLE_VERSION = '1.0'
+
   # Constants for handling rate limit backoff
   MAX_BACKOFF_WAIT_SECS = 32
   INITIAL_BACKOFF_WAIT_SECS = 1
   BACKOFF_FACTOR = 2
 
-  def initialize(ikey, skey, host, proxy = nil, ca_file: nil, default_params: {})
+  def initialize(ikey, skey, host, proxy = nil, ca_file: nil, disable_ca_pinning: false, default_params: {})
     @ikey = ikey
     @skey = skey
     @host = host
@@ -38,8 +41,15 @@ class DuoApi
         proxy_uri.password
       ]
     end
-    @ca_file = ca_file ||
-               File.join(File.dirname(__FILE__), '..', '..', 'ca_certs.pem')
+
+    raise ArgumentError, 'Cannot both disable CA pinning and provide a custom CA file' if disable_ca_pinning && ca_file
+
+    @ca_pinning_disabled = disable_ca_pinning
+    @ca_file = if disable_ca_pinning
+                 nil
+               else
+                 ca_file || File.join(File.dirname(__FILE__), '..', '..', 'ca_certs.pem')
+               end
     @default_params = default_params.transform_keys(&:to_sym)
   end
 
@@ -71,7 +81,7 @@ class DuoApi
     request = Net::HTTP.const_get(method.capitalize).new(uri.to_s)
     request.basic_auth(@ikey, signed)
     request['Date'] = current_date
-    request['User-Agent'] = "duo_api_ruby/#{VERSION}"
+    request['User-Agent'] = user_agent
 
     # Set Content-Type and request body for JSON requests
     if params_go_in_body
@@ -80,11 +90,9 @@ class DuoApi
     end
 
     # Start the HTTP session
-    Net::HTTP.start(
-      uri.host, uri.port, *@proxy,
-      use_ssl: true, ca_file: @ca_file,
-      verify_mode: OpenSSL::SSL::VERIFY_PEER
-    ) do |http|
+    http_opts = { use_ssl: true, verify_mode: OpenSSL::SSL::VERIFY_PEER }
+    http_opts[:ca_file] = @ca_file if @ca_file
+    Net::HTTP.start(uri.host, uri.port, *@proxy, **http_opts) do |http|
       wait_secs = INITIAL_BACKOFF_WAIT_SECS
       loop do
         resp = http.request(request)
@@ -101,6 +109,13 @@ class DuoApi
 
   private
 
+  # Build the User-Agent string, including the CA bundle version and the
+  # current CA pinning state.
+  def user_agent
+    ca_pinning_state = @ca_pinning_disabled ? 'disabled' : 'enabled'
+    "duo_api_ruby/#{VERSION} ca_bundle/#{CA_BUNDLE_VERSION} (ca_pinning=#{ca_pinning_state})"
+  end
+
   # Encode a key-value pair for a URL
   def encode_key_val(key, val)
     key = ERB::Util.url_encode(key.to_s)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: duo_api
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.6.0
 platform: ruby
 authors:
 - Duo Security
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-10-14 00:00:00.000000000 Z
+date: 2026-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64