flashpi 0.1.0

data/lib/flashpi/webhooks.rb

@@ -0,0 +1,223 @@
+# frozen_string_literal: true
+
+module Flashpi
+  # Verification of the webhooks Flashpi sends (Standard Webhooks). It needs no API key, and is
+  # also available as `client.webhooks`.
+  #
+  # A webhook is signed with HMAC-SHA256 over `webhook-id.webhook-timestamp.body` using the
+  # endpoint's `whsec_` secret. During a secret rotation Flashpi signs with both secrets, so the
+  # `webhook-signature` header lists several signatures.
+  #
+  #   event = Flashpi::Webhooks.unwrap(request.raw_post, request.headers, ENV.fetch("FLASHPI_WEBHOOK_SECRET"))
+  #   case event[:type]
+  #   when "webhook_endpoint.verification" then render json: { challenge: event[:data][:challenge] }
+  #   when "invoice.authorized" then ...
+  #   end
+  #
+  # Error trackers can record the local variables of the method that raises, so every
+  # verification error is raised by a method that holds neither the secret, its key nor the
+  # expected signature.
+  module Webhooks
+    # Default largest gap, in seconds, between a webhook's timestamp and the receiver's clock.
+    TOLERANCE_SECONDS = 300
+
+    SECRET_PREFIX = "whsec_"
+    # Key sizes of a Standard Webhooks secret (Flashpi makes 32-byte keys).
+    MIN_SECRET_BYTES = 24
+    MAX_SECRET_BYTES = 64
+    SIGNATURE_BYTES = 32
+    TIMESTAMP = /\A[0-9]{1,12}\z/
+    BASE64 = %r{\A[A-Za-z0-9+/]*={0,2}\z}
+    NO_MATCH = "No webhook-signature matches the body and the secret"
+
+    class << self
+      # Checks that a webhook comes from Flashpi and is recent.
+      #
+      # Raises a {WebhookVerificationError} otherwise: answer 400 and ignore the request. Pass the
+      # raw body exactly as received; a body parsed and serialized again does not match.
+      #
+      # @param payload [String] the raw body
+      # @param headers [Hash, #each] the request headers: a Hash in any letter case, a Rack env
+      #   (`HTTP_WEBHOOK_ID`) or Rails' `request.headers`; repeated headers may come as Arrays
+      # @param secret [String] the endpoint's signing secret (`whsec_...`)
+      # @param tolerance [Integer, Float, nil] largest gap, in seconds, between
+      #   `webhook-timestamp` and now (default 300)
+      # @param now [Time, Integer, Float, nil] the current time, for tests: a Time or Unix seconds
+      # @return [nil]
+      # @raise [WebhookVerificationError]
+      # @raise [TypeError, ArgumentError] for a bad `tolerance` or `now`
+      def verify_signature(payload, headers, secret, tolerance: nil, now: nil)
+        tolerance_seconds, now_seconds = verify_options(tolerance, now)
+        key = signing_key(secret)
+        webhook_id = header(headers, "webhook-id")
+        timestamp = header(headers, "webhook-timestamp")
+        signatures = header(headers, "webhook-signature")
+        if webhook_id.nil? || timestamp.nil? || signatures.nil?
+          reject!(:missing_headers, "The webhook-id, webhook-timestamp and webhook-signature headers are required")
+        end
+        reject!(:invalid_timestamp, "The webhook-timestamp is not valid") unless TIMESTAMP.match?(timestamp)
+        # Written so that anything unexpected fails closed.
+        unless (now_seconds.floor - timestamp.to_i).abs <= tolerance_seconds
+          reject!(:timestamp_out_of_range,
+                  "The webhook-timestamp is more than #{shown(tolerance_seconds)} seconds away from now")
+        end
+
+        body = payload_bytes(payload)
+        reject!(:no_matching_signature, NO_MATCH) unless signed?(key, "#{webhook_id.b}.#{timestamp}.".b + body,
+                                                                 signatures)
+        nil
+      end
+
+      # Verifies a webhook (see {verify_signature}) and returns its parsed body, with Symbol keys.
+      #
+      # Branch on `event[:type]`. Endpoints in thin mode receive no `data`: read the event with
+      # `client.events.get(event[:id])`.
+      #
+      # @return [Hash{Symbol => Object}] the event
+      # @raise [WebhookVerificationError]
+      def unwrap(payload, headers, secret, tolerance: nil, now: nil)
+        verify_signature(payload, headers, secret, tolerance:, now:)
+        event = parse(payload)
+        reject!(:invalid_payload, "The webhook body is not a JSON object") unless event.is_a?(Hash)
+
+        _ = event
+      end
+
+      private
+
+      def parse(payload)
+        Internal::JSONText.parse(Internal::JSONText.decode(payload.b))
+      rescue Internal::JSONText::Invalid
+        reject!(:invalid_payload, "The webhook body is not JSON")
+      end
+
+      # Raises from a frame that holds only the reason.
+      def reject!(reason, message)
+        raise WebhookVerificationError.new(reason, message)
+      end
+
+      # A header without letter case, or in a Rack env's form (`HTTP_WEBHOOK_ID`). Repeated
+      # headers: signature lists are joined, otherwise the first. An empty value is missing. Names
+      # and values are read as bytes (as Rack servers give them), so no encoding of theirs can
+      # make the checks below raise anything but a WebhookVerificationError.
+      def header(headers, name)
+        unless headers.respond_to?(:each)
+          raise TypeError, "headers must be a Hash (or Rack env, or Rails request.headers), not #{headers.class}"
+        end
+
+        env_name = "HTTP_#{name.upcase.tr("-", "_")}"
+        values = [] #: Array[String]
+        headers.each do |key, value|
+          next unless key.is_a?(String) || key.is_a?(Symbol)
+
+          field = key.to_s.b
+          next unless field.casecmp?(name) || field == env_name
+
+          values << value.b if value.is_a?(String)
+          values.concat(value.grep(String).map(&:b)) if value.is_a?(Array)
+        end
+        found = name == "webhook-signature" ? values.join(" ") : values.first
+        found.nil? || found.empty? ? nil : found
+      end
+
+      # The decoded key of a `whsec_` secret, in a {Internal::Secret}.
+      def signing_key(secret)
+        unless secret.is_a?(String) && !secret.b.strip.empty?
+          reject!(:invalid_secret,
+                  "The webhook secret is empty: copy it from the console or webhook_endpoints.get_secret")
+        end
+
+        size = key_size(secret)
+        if size.zero?
+          reject!(:invalid_secret, "The webhook secret is not a whsec_ secret (base64 after the prefix)")
+        elsif size < MIN_SECRET_BYTES || size > MAX_SECRET_BYTES
+          reject!(:invalid_secret, "The webhook secret is not a complete whsec_ secret: copy it again from the " \
+                                   "console or webhook_endpoints.get_secret")
+        end
+        Internal::Secret.new(decode_base64(encoded_key(secret)) || "")
+      end
+
+      # The size of a secret's key, or 0 when it is not base64. It returns instead of raising, so
+      # the key never stays in the frame of an error.
+      def key_size(secret)
+        key = decode_base64(encoded_key(secret))
+        key ? key.bytesize : 0
+      end
+
+      # The base64 after the prefix, read as bytes.
+      def encoded_key(secret)
+        secret.b.strip.delete_prefix(SECRET_PREFIX)
+      end
+
+      # Whether a v1 signature of the header signs `message`. The signatures are read before the
+      # expected one is computed, and nothing after that can raise, so the expected signature
+      # never stays in the frame of an error.
+      def signed?(key, message, signatures)
+        candidates = v1_signatures(signatures)
+        expected = OpenSSL::HMAC.digest("SHA256", key.reveal, message)
+        candidates.any? { |signature| OpenSSL.fixed_length_secure_compare(signature, expected) }
+      end
+
+      # The decoded v1 signatures of a `webhook-signature` header that have the right size.
+      def v1_signatures(signatures)
+        signatures.b.split(/ /).filter_map do |entry|
+          version, comma, encoded = entry.partition(",")
+          next if comma.empty? || version != "v1"
+
+          signature = decode_base64(encoded)
+          signature if signature && signature.bytesize == SIGNATURE_BYTES
+        end
+      end
+
+      # Standard base64 to bytes, or nil when it is not base64 (padding optional, like atob).
+      def decode_base64(value)
+        return nil unless BASE64.match?(value) && value.length % 4 != 1
+
+        data = (value.length % 4).zero? ? value.sub(/=+\z/, "") : value
+        return nil if data.include?("=") || data.length % 4 == 1
+
+        # Only the alphabet is left, in a length that decodes once padded.
+        "#{data}#{"=" * (-data.length % 4)}".unpack1("m").to_s
+      end
+
+      def payload_bytes(payload)
+        unless payload.is_a?(String)
+          reject!(:invalid_payload,
+                  "Pass the raw webhook body as a String (not parsed JSON)")
+        end
+
+        payload.b
+      end
+
+      # The checked tolerance and clock. Bad values are programming errors: TypeError or
+      # ArgumentError, never a skipped time check.
+      def verify_options(tolerance, now)
+        value = tolerance.nil? ? TOLERANCE_SECONDS : tolerance
+        unless value.is_a?(Integer) || value.is_a?(Float)
+          raise TypeError,
+                "tolerance must be a number of seconds, 0 or more"
+        end
+        raise ArgumentError, "tolerance must be a number of seconds, 0 or more" unless value.to_f.finite? && value >= 0
+
+        [value.to_f, clock(now)]
+      end
+
+      def clock(now)
+        seconds = case now
+                  when nil then Time.now.to_f
+                  when Time then now.to_f
+                  when Integer then now.bit_length > 1000 ? Float::INFINITY : now.to_f
+                  when Float then now
+                  else raise TypeError, "now must be a Time or a number of Unix seconds"
+                  end
+        raise ArgumentError, "now must be a Time or a number of Unix seconds" unless seconds.finite?
+
+        seconds
+      end
+
+      def shown(seconds)
+        seconds == seconds.floor ? seconds.to_i.to_s : seconds.to_s
+      end
+    end
+  end
+end

data/lib/flashpi.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "json"
+require "net/http"
+require "openssl"
+require "securerandom"
+require "time"
+require "uri"
+require "zlib"
+
+require_relative "flashpi/version"
+require_relative "flashpi/errors"
+require_relative "flashpi/api_response"
+require_relative "flashpi/page"
+require_relative "flashpi/internal/secret"
+require_relative "flashpi/internal/validate"
+require_relative "flashpi/internal/json_text"
+require_relative "flashpi/internal/problems"
+require_relative "flashpi/internal/request"
+require_relative "flashpi/internal/multipart"
+require_relative "flashpi/internal/transport"
+require_relative "flashpi/internal/engine"
+require_relative "flashpi/internal/resource"
+require_relative "flashpi/internal/settings"
+require_relative "flashpi/resources/documents"
+require_relative "flashpi/resources/issuers"
+require_relative "flashpi/resources/issuer_onboardings"
+require_relative "flashpi/resources/webhook_endpoints"
+require_relative "flashpi/resources/events"
+require_relative "flashpi/webhooks"
+require_relative "flashpi/client"
+
+# The official Ruby SDK for Flashpi, the electronic invoicing API for Ecuador's SRI.
+#
+#   require "flashpi"
+#
+#   flashpi = Flashpi::Client.new # reads FLASHPI_API_KEY
+#   invoice = flashpi.invoices.create({ issuerId: "...", ... })
+#   invoice[:accessKey]
+module Flashpi
+end

data/sig/flashpi/internal.rbs

@@ -0,0 +1,376 @@
+# The SDK's internals: not part of its API, and free to change in any release.
+module Flashpi
+  module Internal
+    class Secret[out T]
+      @reader: ^() -> T
+
+      def initialize: (T value) -> void
+      def reveal: () -> T
+      def marshal_dump: () -> bot
+      def _dump: (Integer level) -> bot
+    end
+
+    module Validate
+      MAX_TIMEOUT: Float
+      TOKEN: Regexp
+      AROUND: Regexp
+      CONTROL: Regexp
+      FRAMING: Array[String]
+
+      def self?.timeout!: (String name, untyped value) -> Float
+      def self?.retries!: (String name, untyped value) -> Integer
+      def self?.header_name!: (untyped name) -> String
+      def self?.header_value!: (String label, untyped value) -> String
+      def self?.headers!: (String label, untyped headers) -> Hash[String, String]
+      def self?.utf8: (String text) -> String?
+    end
+
+    module JSONText
+      class Invalid < StandardError
+      end
+
+      MAX_NESTING: Integer
+
+      def self?.encode: (untyped body) -> String
+      def self?.parse: (String text) -> untyped
+      def self?.decode: (String bytes) -> String
+      def self?.plain: (untyped value, Hash[Integer, bool] seen) -> untyped
+      def self?.plain_hash: (Hash[untyped, untyped] hash, Hash[Integer, bool] seen) -> Hash[String, untyped]
+      def self?.key_text: (untyped key) -> String
+      def self?.nested: [R] (Object container, Hash[Integer, bool] seen) { () -> R } -> R
+      def self?.text: (String value) -> String
+    end
+
+    module Problems
+      ERROR_CLASSES: Hash[Integer, singleton(APIError)]
+      DELTA_SECONDS: Regexp
+      MAX_DELTA_DIGITS: Integer
+      MAX_DELTA: Integer
+      TIME_ZONE: Regexp
+
+      def self?.error: (Integer status, Hash[String, String] headers, String body_text) -> APIError
+      def self?.parse: (String body_text) -> Types::problem?
+      def self?.message: (Integer status, Types::problem? problem, String body_text) -> String
+      def self?.text: (untyped value) -> String?
+      def self?.retry_after: (String? value, ?Float now) -> Integer?
+      def self?.date: (String value) -> Float?
+      def self?.iso8601: (String value) -> Float?
+    end
+
+    class ClientConfig
+      @api_key: Secret[String]
+
+      attr_reader base_url: String
+      attr_reader timeout: Float
+      attr_reader max_retries: Integer
+      attr_reader language: String?
+      attr_reader default_headers: Hash[String, String]
+
+      def initialize: (
+        api_key: String, base_url: String, timeout: Float, max_retries: Integer, language: String?,
+        default_headers: Hash[String, String]
+      ) -> void
+      def api_key: () -> String
+    end
+
+    type http_method = :get | :post | :patch | :delete
+    type response_type = :json | :text | :bytes | :none
+
+    class RequestSpec
+      attr_reader http_method: http_method
+      attr_reader path: String
+      attr_reader query: Hash[untyped, untyped]?
+      attr_reader body: untyped
+      attr_reader multipart: Multipart?
+      attr_reader accept: String
+      attr_reader response_type: response_type
+      attr_reader options: Hash[Symbol, untyped]
+      attr_reader min_timeout: Float
+      attr_reader recover_document: bool
+
+      def initialize: (
+        http_method: http_method, path: String, ?query: Hash[untyped, untyped]?, ?body: untyped,
+        ?multipart: Multipart?, ?accept: String, ?response_type: response_type,
+        ?options: Hash[Symbol, untyped], ?min_timeout: Float, ?recover_document: bool
+      ) -> void
+      def with_query: (Hash[untyped, untyped] query) -> RequestSpec
+    end
+
+    class Attempt
+      @headers: Secret[Hash[String, String]]
+      @content: Secret[String?]
+
+      attr_reader http_method: http_method
+      attr_reader url: String
+      attr_reader target: String
+      attr_reader timeout: Float
+      attr_reader response_type: response_type
+
+      def initialize: (
+        http_method: http_method, url: String, target: String, headers: Hash[String, String],
+        content: String?, timeout: Float, response_type: response_type
+      ) -> void
+      def headers: () -> Hash[String, String]
+      def content: () -> String?
+      def verb: () -> String
+    end
+
+    class RawResponse
+      attr_reader status: Integer
+      attr_reader headers: Hash[String, String]
+      attr_reader body: String
+
+      def initialize: (Integer status, Hash[String, String] headers, String body) -> void
+    end
+
+    module Path
+      UNRESERVED: Regexp
+      BLANK: Regexp
+
+      def self?.of: (String template, *untyped ids) -> String
+      def self?.segment: (untyped id, String shown) -> String
+      def self?.encode: (String text) -> String
+    end
+
+    interface _Clock
+      def now: () -> Float
+      def sleep: (Float seconds) -> untyped
+      def rand: () -> Float
+    end
+
+    module Clock
+      def self?.now: () -> Float
+      def self?.sleep: (Float seconds) -> untyped
+      def self?.rand: () -> Float
+    end
+
+    class Multipart
+      MAX_CERTIFICATE_BYTES: Integer
+      DEFAULT_FILENAME: String
+      CONTENT_TYPE: String
+      PIECE: Integer
+
+      @body: Secret[String]
+
+      attr_reader content_type: String
+
+      def self.certificate: (untyped upload) -> Multipart
+      def self.member: (Hash[untyped, untyped] upload, Symbol name) -> untyped
+      def self.read: (untyped file) -> String
+      def self.read_io: (untyped file) -> String
+      def self.read_piece: (untyped file, Integer length) -> untyped
+      def self.refuse!: (singleton(Exception) error, String message) -> bot
+
+      def initialize: (String password, String content, String filename) -> void
+      def content: () -> String
+
+      private
+
+      def encode: (String boundary, String password, String content, String filename) -> String
+      def escape: (String filename) -> String
+    end
+
+    class Deadline
+      @clock: _Clock
+      @end: Float
+
+      def initialize: (Float seconds, ?_Clock clock) -> void
+      def left: () -> Float
+      def passed?: () -> bool
+      def left!: (singleton(Exception) error) -> Float
+      def limit: (Float? timeout, singleton(Exception) error) -> Float
+    end
+
+    module DeadlineHTTP : Net::HTTP
+      @socket: untyped
+
+      attr_accessor flashpi_deadline: Deadline?
+
+      private
+
+      def connect: () -> void
+      def ssl_socket_connect: (OpenSSL::SSL::SSLSocket socket, Float? timeout) -> void
+      def on_connect: () -> void
+    end
+
+    class DeadlineSocket
+      @http: DeadlineHTTP
+
+      attr_reader io: untyped
+
+      def initialize: (untyped io, DeadlineHTTP http) -> void
+      def read_nonblock: (Integer length, ?String? buffer, ?exception: bool) -> (String | Symbol | nil)
+      def write_nonblock: (String data, ?exception: bool) -> (Integer | Symbol)
+      def to_io: () -> self
+      def wait_readable: (?Float? timeout) -> untyped
+      def wait_writable: (?Float? timeout) -> untyped
+      def close: () -> untyped
+      def closed?: () -> bool
+      def eof?: () -> bool
+      def respond_to_missing?: (Symbol name, ?bool include_private) -> bool
+      def method_missing: (Symbol name, *untyped args, **untyped options) ?{ (*untyped) -> untyped } -> untyped
+
+      private
+
+      def deadline: () -> Deadline?
+      def limited: (Float? timeout, singleton(Exception) error) -> Float?
+    end
+
+    module Proxy
+      LOOPBACK: Regexp
+
+      # The environment, or a Hash for the tests.
+      interface _Env
+        def []: (String name) -> String?
+        def key?: (String name) -> bool
+      end
+
+      def self?.from_env: (URI::Generic uri, ?_Env env) -> [String, Integer, String?, String?]?
+      def self?.bypassed?: (URI::Generic uri, String? no_proxy) -> bool
+      def self?.parse: (String name, String value) -> [String, Integer, String?, String?]
+      def self?.refuse!: (String name) -> bot
+    end
+
+    class Transport
+      MAX_IDLE: Integer
+      CONNECTION_ERRORS: Array[singleton(Exception)]
+      TIMEOUT_ERRORS: Array[singleton(Exception)]
+      REQUESTS: Hash[Symbol, singleton(Net::HTTP::Get) | singleton(Net::HTTP::Post) | singleton(Net::HTTP::Patch) | singleton(Net::HTTP::Delete)]
+
+      @host: String
+      @port: Integer
+      @use_ssl: bool
+      @proxy: [String, Integer, String?, String?]?
+      @clock: _Clock
+      @idle: Array[Net::HTTP & DeadlineHTTP]
+      @mutex: Thread::Mutex
+      @pid: Integer
+
+      def initialize: (String base_url, ?_Clock clock) -> void
+      def perform: (Attempt attempt) -> RawResponse
+      def close: () -> nil
+
+      private
+
+      def exchange: (Net::HTTP & DeadlineHTTP http, Attempt attempt, Deadline deadline) -> RawResponse
+      def gzip_inflater: (Net::HTTPResponse response) -> Zlib::Inflate?
+      def limit_timeouts: (Net::HTTP http, Deadline deadline) -> void
+      def build_request: (Attempt attempt) -> Net::HTTPRequest
+      def checkout: () -> (Net::HTTP & DeadlineHTTP)
+      def checkin: (Net::HTTP & DeadlineHTTP http) -> void
+      def discard: (Net::HTTP http) -> void
+      def connect: () -> (Net::HTTP & DeadlineHTTP)
+      def forked?: () -> bool
+      def seconds: (Float value) -> String
+    end
+
+    class Engine
+      USER_AGENT: String
+      MAX_RETRY_AFTER: Integer
+      INITIAL_RETRY_DELAY: Float
+      MAX_RETRY_DELAY: Float
+      IN_PROGRESS_FIRST_WAIT: Float
+      IN_PROGRESS_MAX_WAIT: Float
+      IN_PROGRESS: String
+      OPTION_NAMES: Array[Symbol]
+
+      class Call
+        @content: Secret[String?]
+
+        attr_reader options: Hash[Symbol, untyped]
+        attr_reader max_retries: Integer
+        attr_reader timeout: Float
+        attr_reader url: String
+        attr_reader target: String
+        attr_reader idempotency_key: String?
+
+        def initialize: (
+          options: Hash[Symbol, untyped], max_retries: Integer, timeout: Float, url: String, target: String,
+          idempotency_key: String?, content: String?
+        ) -> void
+        def content: () -> String?
+      end
+
+      @base_path: String
+
+      attr_reader config: ClientConfig
+      attr_accessor transport: Transport
+      attr_accessor clock: _Clock
+
+      def initialize: (ClientConfig config, Transport transport, ?_Clock clock) -> void
+      def request: (RequestSpec spec) -> APIResponse[untyped]
+
+      private
+
+      def unanswered?: (Error failure) -> bool
+      def attempt_once: (RequestSpec spec, Call call) -> (APIResponse[untyped] | APIError | APIConnectionError)
+      def prepare: (RequestSpec spec) -> Call
+      def body_content: (RequestSpec spec) -> String?
+      def attempt_of: (RequestSpec spec, Call call) -> Attempt
+      def recover_document: (Call call, String document_id) -> APIResponse[untyped]
+      def retry_delay: (Error failure, Integer retries) -> Float?
+      def backoff: (Integer retries) -> Float
+      def recoverable_document: (RequestSpec spec, APIError failure) -> String?
+      def deleted: (APIError failure) -> APIResponse[nil]
+      def check_options: (Hash[Symbol, untyped] options) -> Hash[Symbol, untyped]
+      def language: (String label, untyped value) -> String
+      def idempotency_key_of: (http_method http_method, Hash[Symbol, untyped] options) -> String?
+      def build_target: (String path, Hash[untyped, untyped]? query) -> String
+      def query_name: (untyped name) -> String
+      def query_value: (untyped value) -> String
+      def query_text: (String value) -> String
+      def build_headers: (RequestSpec spec, Call call) -> Hash[String, String]
+      def read_response: (RawResponse raw, response_type response_type) -> (APIResponse[untyped] | APIError)
+      def read_data: (RawResponse raw, response_type response_type) -> untyped
+    end
+
+    class Resource
+      @engine: Engine
+      @with_response: ResponseView?
+
+      def self.response_methods: (*Symbol names) -> void
+
+      def initialize: (Engine engine) -> void
+      def with_response: () -> ResponseView
+
+      private
+
+      def operation: (http_method http_method, String template, *untyped ids, **untyped settings) -> RequestSpec
+      def send_request: (RequestSpec spec) -> untyped
+      def send_call: (RequestSpec spec) -> APIResponse[untyped]
+      def paginate: (RequestSpec spec) -> Page[untyped]
+      def fetch_page: (RequestSpec spec, RequestSpec page_spec) -> APIResponse[Page[untyped]]
+    end
+
+    class ResponseView
+      SLOT: Symbol
+
+      @resource: Resource
+
+      def self.record: (APIResponse[untyped] result) -> void
+
+      def initialize: (Resource resource) -> void
+
+      private
+
+      attr_reader resource: Resource
+
+      def capture: [T] () { () -> T } -> APIResponse[T]
+    end
+
+    module Settings
+      API_KEY_CHARACTERS: Regexp
+      JS_SPACE: String
+      AROUND: Regexp
+
+      def self?.configure: (
+        untyped api_key, base_url: untyped, timeout: untyped, max_retries: untyped, language: untyped,
+        default_headers: untyped
+      ) -> ClientConfig
+      def self?.refuse!: (String message) -> bot
+      def self?.http_url?: (untyped url) -> bool
+      def self?.trimmed_key: (untyped api_key) -> String
+      def self?.key_problem: (String key) -> String?
+    end
+  end
+end