honeymaker 0.9.0 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12080b0cbcae6a52a2680efde8f4131b30f4ebcf70647c1c297ac88217c459ba
-  data.tar.gz: c475a4e5da6e8f7ac2e0b5f3eaa84e12192eec504876871028935a6b3be05cae
+  metadata.gz: 8751e8712e47b27bf82073fa2b7de4ec7d7404e9b6195a6cbcd06a2a48749acd
+  data.tar.gz: 414e8fd8e266d7d8cd7acc3abd4b39f18d450fb5ba08ebf0b9121c599fc7ff9f
 SHA512:
-  metadata.gz: c6c9bffcfa55f7f096a4128c2b09119e06d11e5be58bc04dde162a693600595e7662334034d38a049b7faaa2f9535976668b22890564bf6ddcf82f8f1c1ade2e
-  data.tar.gz: eedbdfab0c9fa12e8b4ae86362eafcd90b4d8319caace49bdb642405ca99a90836af69a6c8a50d9a13e555f6f1be4008175fb7e019927d8198060d7835a3754c
+  metadata.gz: ccf214595dccd90388f8a77dffca7cb0618047c025531c219c1030d2af821d96b682f67f991ff701de013f847cea045b5c7a9b4f5f1a6a96f19490549c18a6ef
+  data.tar.gz: e724a084bfc8bd6bca47bd6bced65a12eb75818e58b05f31022d549d246bb8fa1920763bbc27179b1d0339938b899309ee8b8be0f8718a96163834b9f8107a8d

data/lib/honeymaker/clients/bitvavo.rb

@@ -7,6 +7,11 @@ module Honeymaker
       ACCESS_WINDOW = "10000"
       RATE_LIMITS = { default: 100, orders: 100 }.freeze
 
+      # Bitvavo requires a mandatory operatorId on every order create/cancel
+      # (errorCode 203). It's a positive int64 the caller sets themselves to
+      # attribute an order to a trader/bot for audit; the value is cosmetic.
+      DEFAULT_OPERATOR_ID = 1
+
       def get_assets
         get_public("/v2/assets")
       end
@@ -51,11 +56,12 @@ module Honeymaker
       end
 
       def place_order(market:, side:, order_type:, amount: nil, amount_quote: nil, price: nil,
-                      time_in_force: nil, client_order_id: nil)
+                      time_in_force: nil, client_order_id: nil, operator_id: nil)
         result = post_signed("/v2/order", {
           market: market, side: side, orderType: order_type,
           amount: amount, amountQuote: amount_quote, price: price,
-          timeInForce: time_in_force, clientOrderId: client_order_id
+          timeInForce: time_in_force, clientOrderId: client_order_id,
+          operatorId: operator_id || DEFAULT_OPERATOR_ID
         })
         return result if result.failure?
 
@@ -71,8 +77,10 @@ module Honeymaker
         Result::Success.new(normalize_order("#{raw['market']}-#{raw['orderId']}", raw))
       end
 
-      def cancel_order(market:, order_id:)
-        delete_signed("/v2/order", { market: market, orderId: order_id })
+      def cancel_order(market:, order_id:, operator_id: nil)
+        delete_signed("/v2/order", {
+          market: market, orderId: order_id, operatorId: operator_id || DEFAULT_OPERATOR_ID
+        })
       end
 
       def get_trades(market:, limit: nil, start_time: nil, end_time: nil, trade_id_from: nil, trade_id_to: nil)

data/lib/honeymaker/clients/kraken.rb

@@ -237,8 +237,25 @@ module Honeymaker
         end
       end
 
+      # Kraken rejects any request whose nonce is <= the last nonce it saw for the
+      # same API key. We protect against in-process collisions (microsecond bursts,
+      # backward clock corrections) by tracking the last issued nonce per API key
+      # under a mutex. Cross-process reuse of the same API key (other workers,
+      # other containers, other tools) is not protected here — affected users
+      # should increase the Nonce Window on their Kraken API key.
+      @@nonce_mutex = Mutex.new
+      @@last_nonces = {}
+
+      def self.reset_nonce_state!
+        @@nonce_mutex.synchronize { @@last_nonces.clear }
+      end
+
       def nonce
-        (Time.now.utc.to_f * 1_000_000).to_i
+        key = @api_key ? Digest::SHA256.hexdigest(@api_key) : :__no_api_key__
+        @@nonce_mutex.synchronize do
+          candidate = (Time.now.utc.to_f * 1_000_000).to_i
+          @@last_nonces[key] = [candidate, (@@last_nonces[key] || 0) + 1].max
+        end
       end
 
       def private_headers(path, body)

data/lib/honeymaker/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Honeymaker
-  VERSION = "0.9.0"
+  VERSION = "0.9.3"
 end

data/test/honeymaker/clients/bitvavo_client_test.rb

@@ -47,6 +47,36 @@ class Honeymaker::Clients::BitvavoTest < Minitest::Test
     assert result.success?
   end
 
+  # Bitvavo requires a mandatory integer operatorId on every order create/cancel
+  # (errorCode 203). These tests yield the real Faraday request block so we assert
+  # what the client actually sends, not just the stubbed response.
+
+  def test_place_order_sends_default_operator_id
+    req = capture_request(:post, { "orderId" => "123" })
+    @client.place_order(market: "BTC-EUR", side: "buy", order_type: "market", amount_quote: "100")
+    assert_equal @client.class::DEFAULT_OPERATOR_ID, req.body[:operatorId]
+    assert_kind_of Integer, req.body[:operatorId]
+  end
+
+  def test_place_order_operator_id_override
+    req = capture_request(:post, { "orderId" => "123" })
+    @client.place_order(market: "BTC-EUR", side: "buy", order_type: "market", amount_quote: "100", operator_id: 42)
+    assert_equal 42, req.body[:operatorId]
+  end
+
+  def test_cancel_order_sends_default_operator_id
+    req = capture_request(:delete, { "orderId" => "123" })
+    @client.cancel_order(market: "BTC-EUR", order_id: "123")
+    assert_equal @client.class::DEFAULT_OPERATOR_ID, req.params[:operatorId]
+    assert_kind_of Integer, req.params[:operatorId]
+  end
+
+  def test_cancel_order_operator_id_override
+    req = capture_request(:delete, { "orderId" => "123" })
+    @client.cancel_order(market: "BTC-EUR", order_id: "123", operator_id: 42)
+    assert_equal 42, req.params[:operatorId]
+  end
+
   def test_withdraw
     stub_connection(:post, { "success" => true })
     result = @client.withdraw(symbol: "BTC", amount: "0.1", address: "addr")
@@ -102,4 +132,25 @@ class Honeymaker::Clients::BitvavoTest < Minitest::Test
     connection.stubs(method).returns(response)
     @client.instance_variable_set(:@connection, connection)
   end
+
+  # Records what the client sets on the Faraday request. Unlike stub_connection,
+  # this yields the request block (connection.post { |req| ... }) so the real
+  # body/params-building code in post_signed/delete_signed actually executes.
+  class RequestRecorder
+    attr_accessor :headers, :body, :params
+    attr_reader :requested_url
+
+    def url(path)
+      @requested_url = path
+    end
+  end
+
+  def capture_request(method, body)
+    response = stub(body: body)
+    recorder = RequestRecorder.new
+    connection = stub
+    connection.stubs(method).yields(recorder).returns(response)
+    @client.instance_variable_set(:@connection, connection)
+    recorder
+  end
 end

data/test/honeymaker/clients/kraken_client_test.rb

@@ -4,6 +4,7 @@ require "test_helper"
 
 class Honeymaker::Clients::KrakenTest < Minitest::Test
   def setup
+    Honeymaker::Clients::Kraken.reset_nonce_state! if Honeymaker::Clients::Kraken.respond_to?(:reset_nonce_state!)
     @client = Honeymaker::Clients::Kraken.new(
       api_key: "test_key",
       api_secret: Base64.strict_encode64("test_secret_key_1234567890123456")
@@ -74,8 +75,65 @@ class Honeymaker::Clients::KrakenTest < Minitest::Test
     refute headers.key?(:"API-Key")
   end
 
+  def test_reset_nonce_state_is_available_for_test_isolation
+    assert_respond_to Honeymaker::Clients::Kraken, :reset_nonce_state!
+  end
+
+  def test_nonce_is_strictly_increasing_in_a_tight_loop
+    nonces = Array.new(10_000) { @client.send(:nonce) }
+
+    assert_strictly_increasing nonces
+  end
+
+  def test_nonce_is_strictly_increasing_when_clock_is_frozen
+    frozen_time = Time.utc(2026, 1, 1, 12, 0, 0)
+    Time.stubs(:now).returns(frozen_time)
+
+    nonces = Array.new(3) { @client.send(:nonce) }
+
+    assert_strictly_increasing nonces
+  end
+
+  def test_nonce_is_strictly_increasing_across_clients_with_the_same_api_key
+    frozen_time = Time.utc(2026, 1, 1, 12, 0, 0)
+    Time.stubs(:now).returns(frozen_time)
+    other_client = Honeymaker::Clients::Kraken.new(
+      api_key: "test_key",
+      api_secret: Base64.strict_encode64("test_secret_key_1234567890123456")
+    )
+
+    nonces = [
+      @client.send(:nonce),
+      other_client.send(:nonce),
+      @client.send(:nonce),
+      other_client.send(:nonce)
+    ]
+
+    assert_strictly_increasing nonces
+  end
+
+  def test_nonce_sequences_are_independent_for_different_api_keys
+    frozen_time = Time.utc(2026, 1, 1, 12, 0, 0)
+    Time.stubs(:now).returns(frozen_time)
+    first_key_client = Honeymaker::Clients::Kraken.new(api_key: "first_key", api_secret: @client.api_secret)
+    second_key_client = Honeymaker::Clients::Kraken.new(api_key: "second_key", api_secret: @client.api_secret)
+
+    first_key_first_nonce = first_key_client.send(:nonce)
+    first_key_second_nonce = first_key_client.send(:nonce)
+    second_key_first_nonce = second_key_client.send(:nonce)
+
+    assert_operator first_key_second_nonce, :>, first_key_first_nonce
+    assert_equal first_key_first_nonce, second_key_first_nonce
+  end
+
   private
 
+  def assert_strictly_increasing(values)
+    values.each_cons(2) do |previous, current|
+      assert_operator current, :>, previous
+    end
+  end
+
   def stub_connection(method, body)
     response = stub(body: body)
     connection = stub

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: honeymaker
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.9.3
 platform: ruby
 authors:
 - Deltabadger