jamm 2.3.0 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb73f3a736756e42ca49cedb1fb255e011fb39e0c34dabc2f85bfd537836afe1
-  data.tar.gz: d5ce67a32f315473bca8800024d19b939b9dafefb358a077e7f30fa551dd01ed
+  metadata.gz: fe888992acfb9739e5206ab7aaa3428f3e246998e633ff60e09999c2d96f3992
+  data.tar.gz: 6ee9932e4775b93a8b18e9dba2173871d6c36b0e727563111c8462801db481e3
 SHA512:
-  metadata.gz: ff218dca883cf3515ce3d37a89147c6ce1a615fc53568f0916edb48211f6de1a5b4af7c5613066a74a3df017cd81ec76d734c9ecec259b3a78457af4eb3d4900
-  data.tar.gz: 69cd60e93b565297f43fd08f7b6a768a6ae5955dddd47d4553b18756e5a3123cdb6548e596e1c9317928f613064c96c66630de9783fab57229d146e78ecfcbe2
+  metadata.gz: c33699a5edbb8cd8f52c5848bc5534b735f9ebca0990b45ceb2105408a2e5fbad7aca6205a0f788c5b6213e954d9a9c56e7d7f71f8f2cb47f491f7786afe658d
+  data.tar.gz: 73722cb39c3acbbd828c8011e4303f0ff1a8936b1dd390f34edbef5fe9dc26cf3375d6f025a8b20c8abd3e2a37fe80e3fbdc97b195dbbd899fcde93a099c3260

data/CHANGELOG.md

@@ -5,21 +5,17 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [2.3.0] - 2026-06-24
+## [2.5.0] - 2026-07-03
 
 ### Added
 
-- Resolve numeric enum wire values (`status`, `api_source`, …) onto their string enum constants on every webhook model, matching REST API responses (the backend serializes webhooks with `json.Marshal`, so all enums arrive numeric)
-- Surface the refund `rfd-` id on the flat `refund_id` attribute in addition to the nested `refund.id`
-- Parse `EVENT_TYPE_USER_ACCOUNT_DELETED` webhooks (previously raised `Unknown event type`)
+- Added `Jamm::Webhook.verify_and_parse(raw_body)` — verifies the HMAC signature over the exact received `content` bytes and parses in one step. Unlike `Jamm::Webhook.verify`, it is not broken by JSON re-serialization (correctly handles `&`, `<`, `>` in content) and rejects bodies with duplicate top-level keys.
 
-### Fixed
+## [2.4.0] - 2026-07-01
 
-- Webhook parsing no longer fails on new fields added by the backend (forward-compatible)
-- Refund webhooks now expose the nested transaction fields and the refund's `rfd-` id (`refund.id`)
-- `status` on refund/charge webhooks is no longer left as a raw integer
-- Nested webhook fields (e.g. `refund.error`) are now typed model instances instead of raw Hashes, so `error.code` / `error.message` work instead of raising `NoMethodError`
-- `Webhook.parse` now accepts payloads with either string or symbol keys
+### Added
+
+- Send the `X-SDK-Version` request header (`ruby:<version>`) so the backend can track SDK version usage per merchant
 
 ## [2.2.0] - 2026-05-20
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    jamm (2.3.0)
+    jamm (2.5.0)
       base64 (~> 0.2)
       rest-client (~> 2.0)
       typhoeus (~> 1.0, >= 1.0.1)
@@ -24,7 +24,9 @@ GEM
       ffi (>= 1.15.0)
     faker (3.5.1)
       i18n (>= 1.8.11, < 2)
-    ffi (1.17.0)
+    ffi (1.17.0-aarch64-linux-gnu)
+    ffi (1.17.0-arm64-darwin)
+    ffi (1.17.0-x86_64-linux-gnu)
     gimei (1.5.0)
     hashdiff (1.1.0)
     http-accept (1.7.0)

data/jamm.gemspec

@@ -21,6 +21,7 @@ Gem::Specification.new do |s|
 
   s.files = `git ls-files`.split("\n").reject do |file|
     file.start_with?(
+      'compatibility',
       'examples',
       'images',
       'openapi',

data/lib/jamm/api/models/v1_charge_message.rb

@@ -62,8 +62,6 @@ module Api
 
     attr_accessor :refund
 
-    attr_accessor :api_source
-
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -107,8 +105,7 @@ module Api
         :'consumption_tax' => :'consumptionTax',
         :'error' => :'error',
         :'refund_id' => :'refundId',
-        :'refund' => :'refund',
-        :'api_source' => :'apiSource'
+        :'refund' => :'refund'
       }
     end
 
@@ -138,8 +135,7 @@ module Api
         :'consumption_tax' => :'Integer',
         :'error' => :'Apiv1Error',
         :'refund_id' => :'String',
-        :'refund' => :'RefundInfo',
-        :'api_source' => :'ChargeMessageApiSource'
+        :'refund' => :'RefundInfo'
       }
     end
 
@@ -241,12 +237,6 @@ module Api
       if attributes.key?(:'refund')
         self.refund = attributes[:'refund']
       end
-
-      if attributes.key?(:'api_source')
-        self.api_source = attributes[:'api_source']
-      else
-        self.api_source = 'API_SOURCE_UNSPECIFIED'
-      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -287,8 +277,7 @@ module Api
           consumption_tax == o.consumption_tax &&
           error == o.error &&
           refund_id == o.refund_id &&
-          refund == o.refund &&
-          api_source == o.api_source
+          refund == o.refund
     end
 
     # @see the `==` method
@@ -300,7 +289,7 @@ module Api
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [id, customer, status, description, merchant_name, initial_amount, discount, final_amount, amount_refunded, currency, processed_at, jamm_fee, created_at, updated_at, original_transaction_jamm_fee, consumption_tax, error, refund_id, refund, api_source].hash
+      [id, customer, status, description, merchant_name, initial_amount, discount, final_amount, amount_refunded, currency, processed_at, jamm_fee, created_at, updated_at, original_transaction_jamm_fee, consumption_tax, error, refund_id, refund].hash
     end
 
     # Builds the object from hash

data/lib/jamm/api/models/v1_error_type.rb

@@ -38,6 +38,7 @@ module Api
     PAYMENT_CUSTOMER_NOT_FOUND = "ERROR_TYPE_PAYMENT_CUSTOMER_NOT_FOUND".freeze
     PAYMENT_CUSTOMER_INACTIVE = "ERROR_TYPE_PAYMENT_CUSTOMER_INACTIVE".freeze
     PAYMENT_SERVICE_DISABLED = "ERROR_TYPE_PAYMENT_SERVICE_DISABLED".freeze
+    PAYMENT_BANK_UNAVAILABLE = "ERROR_TYPE_PAYMENT_BANK_UNAVAILABLE".freeze
     CSV_VALIDATION_FAILED = "ERROR_TYPE_CSV_VALIDATION_FAILED".freeze
     CSV_TOTP_REQUIRED = "ERROR_TYPE_CSV_TOTP_REQUIRED".freeze
     CSV_TOTP_INVALID = "ERROR_TYPE_CSV_TOTP_INVALID".freeze
@@ -55,7 +56,7 @@ module Api
     TOTP_DISABLE_FAILED = "ERROR_TYPE_TOTP_DISABLE_FAILED".freeze
 
     def self.all_vars
-      @all_vars ||= [UNSPECIFIED, AUTH_FAILED, AUTH_REJECTED, ACCOUNT_CREATION_FAILED, ACCOUNT_MODIFICATION_FAILED, ACCOUNT_DELETION_FAILED, ACCOUNT_BANK_REGISTRATION_FAILED, KYC_REJECTED, NOTIFICATION_WEBHOOK_FAILED, NOTIFICATION_EMAIL_FAILED, NOTIFICATION_SMS_FAILED, PAYMENT_GATEWAY_UNAVAILABLE, PAYMENT_GATEWAY_FAILED, PAYMENT_VALIDATION_FAILED, PAYMENT_CHARGE_FAILED, PAYMENT_CHARGE_REJECTED, PAYMENT_CHARGE_OVER_LIMIT, PAYMENT_CHARGE_SUBSCRIPTION_EXPIRED, PAYMENT_LINK_EXPIRED, PAYMENT_CHARGE_INSUFFICIENT_FUNDS, PAYMENT_CUSTOMER_NOT_FOUND, PAYMENT_CUSTOMER_INACTIVE, PAYMENT_SERVICE_DISABLED, CSV_VALIDATION_FAILED, CSV_TOTP_REQUIRED, CSV_TOTP_INVALID, CSV_TOTP_EXPIRED, CSV_TOTP_LOCKED, CSV_BATCH_TOO_LARGE, CSV_CUSTOMER_NOT_FOUND, CSV_PROCESSING_FAILED, CSV_CHALLENGE_NOT_FOUND, CSV_DUPLICATE_USER, TOTP_SETUP_FAILED, TOTP_ALREADY_ENABLED, TOTP_NOT_ENABLED, TOTP_SETUP_INVALID, TOTP_DISABLE_FAILED].freeze
+      @all_vars ||= [UNSPECIFIED, AUTH_FAILED, AUTH_REJECTED, ACCOUNT_CREATION_FAILED, ACCOUNT_MODIFICATION_FAILED, ACCOUNT_DELETION_FAILED, ACCOUNT_BANK_REGISTRATION_FAILED, KYC_REJECTED, NOTIFICATION_WEBHOOK_FAILED, NOTIFICATION_EMAIL_FAILED, NOTIFICATION_SMS_FAILED, PAYMENT_GATEWAY_UNAVAILABLE, PAYMENT_GATEWAY_FAILED, PAYMENT_VALIDATION_FAILED, PAYMENT_CHARGE_FAILED, PAYMENT_CHARGE_REJECTED, PAYMENT_CHARGE_OVER_LIMIT, PAYMENT_CHARGE_SUBSCRIPTION_EXPIRED, PAYMENT_LINK_EXPIRED, PAYMENT_CHARGE_INSUFFICIENT_FUNDS, PAYMENT_CUSTOMER_NOT_FOUND, PAYMENT_CUSTOMER_INACTIVE, PAYMENT_SERVICE_DISABLED, PAYMENT_BANK_UNAVAILABLE, CSV_VALIDATION_FAILED, CSV_TOTP_REQUIRED, CSV_TOTP_INVALID, CSV_TOTP_EXPIRED, CSV_TOTP_LOCKED, CSV_BATCH_TOO_LARGE, CSV_CUSTOMER_NOT_FOUND, CSV_PROCESSING_FAILED, CSV_CHALLENGE_NOT_FOUND, CSV_DUPLICATE_USER, TOTP_SETUP_FAILED, TOTP_ALREADY_ENABLED, TOTP_NOT_ENABLED, TOTP_SETUP_INVALID, TOTP_DISABLE_FAILED].freeze
     end
 
     # Builds the enum from string

data/lib/jamm/api/models/v1_refund_info.rb

@@ -17,7 +17,7 @@ module Api
   # RefundInfo contains refund-specific details for refund and refund_failed webhook events.
   class RefundInfo
     # External refund identifier (rfd-*).
-    attr_accessor :id
+    attr_accessor :refund_id
 
     # Amount refunded for this event.
     attr_accessor :amount_refunded
@@ -39,7 +39,7 @@ module Api
     # Attribute mapping from ruby-style variable name to JSON key.
     def self.attribute_map
       {
-        :'id' => :'id',
+        :'refund_id' => :'refundId',
         :'amount_refunded' => :'amountRefunded',
         :'jamm_fee' => :'jammFee',
         :'consumption_tax' => :'consumptionTax',
@@ -57,7 +57,7 @@ module Api
     # Attribute type mapping.
     def self.openapi_types
       {
-        :'id' => :'String',
+        :'refund_id' => :'String',
         :'amount_refunded' => :'Integer',
         :'jamm_fee' => :'Integer',
         :'consumption_tax' => :'Integer',
@@ -88,8 +88,8 @@ module Api
         h[k.to_sym] = v
       }
 
-      if attributes.key?(:'id')
-        self.id = attributes[:'id']
+      if attributes.key?(:'refund_id')
+        self.refund_id = attributes[:'refund_id']
       end
 
       if attributes.key?(:'amount_refunded')
@@ -137,7 +137,7 @@ module Api
     def ==(o)
       return true if self.equal?(o)
       self.class == o.class &&
-          id == o.id &&
+          refund_id == o.refund_id &&
           amount_refunded == o.amount_refunded &&
           jamm_fee == o.jamm_fee &&
           consumption_tax == o.consumption_tax &&
@@ -155,7 +155,7 @@ module Api
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [id, amount_refunded, jamm_fee, consumption_tax, original_transaction_fee_waived, error, processed_at].hash
+      [refund_id, amount_refunded, jamm_fee, consumption_tax, original_transaction_fee_waived, error, processed_at].hash
     end
 
     # Builds the object from hash

data/lib/jamm/api.rb

@@ -19,7 +19,6 @@ require 'jamm/api/configuration'
 # Models
 require 'jamm/api/models/apiv1_error'
 require 'jamm/api/models/apiv1_status'
-require 'jamm/api/models/charge_message_api_source'
 require 'jamm/api/models/customer_service_update_customer_body'
 require 'jamm/api/models/googlerpc_status'
 require 'jamm/api/models/protobuf_any'

data/lib/jamm/client.rb

@@ -9,6 +9,7 @@ module Jamm
       base.config.host = Jamm.openapi.config.host
       base.config.scheme = Jamm.openapi.config.scheme
       base.default_headers['Authorization'] = "Bearer #{Jamm::OAuth.token}"
+      base.default_headers['X-SDK-Version'] = "ruby:#{Jamm::VERSION}"
 
       # Platform feature, optionally set merchant id to call Jamm API
       # on behalf of the merchant.

data/lib/jamm/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Jamm
-  VERSION = '2.3.0'
+  VERSION = '2.5.0'
 end

data/lib/jamm/webhook.rb

@@ -11,157 +11,39 @@ module Jamm
     # Parse command is for parsing the received webhook message.
     # It does not call anything remotely, instead returns the suitable object.
     def self.parse(json)
-      # Webhook payloads may arrive with string or symbol keys depending on how
-      # the caller decoded the JSON (e.g. JSON.parse with or without
-      # symbolize_names: true). Normalize to symbols so event-type routing,
-      # wrapper flattening, and field lookups are reliable either way.
-      json = deep_symbolize_keys(json)
-
-      out = build(Jamm::OpenAPI::MerchantWebhookMessage, json)
+      out = Jamm::OpenAPI::MerchantWebhookMessage.new(json)
 
       case json[:event_type]
-      when Jamm::OpenAPI::EventType::CHARGE_CREATED,
-           Jamm::OpenAPI::EventType::CHARGE_UPDATED,
-           Jamm::OpenAPI::EventType::REFUND_SUCCEEDED,
-           Jamm::OpenAPI::EventType::REFUND_FAILED,
-           Jamm::OpenAPI::EventType::CHARGE_SUCCESS,
-           Jamm::OpenAPI::EventType::CHARGE_FAIL
-        out.content = build(Jamm::OpenAPI::ChargeMessage, flatten_charge_content(json[:content]))
+      when Jamm::OpenAPI::EventType::CHARGE_CREATED
+        out.content = Jamm::OpenAPI::ChargeMessage.new(json[:content])
         return out
 
-      when Jamm::OpenAPI::EventType::CONTRACT_ACTIVATED
-        out.content = build(Jamm::OpenAPI::ContractMessage, json[:content])
+      when Jamm::OpenAPI::EventType::CHARGE_UPDATED
+        out.content = Jamm::OpenAPI::ChargeMessage.new(json[:content])
         return out
 
-      when Jamm::OpenAPI::EventType::USER_ACCOUNT_DELETED
-        out.content = build(Jamm::OpenAPI::UserAccountMessage, json[:content])
+      when Jamm::OpenAPI::EventType::REFUND_SUCCEEDED
+        out.content = Jamm::OpenAPI::ChargeMessage.new(json[:content])
         return out
-      end
-
-      raise 'Unknown event type'
-    end
 
-    # Build a generated model from a webhook payload while normalizing the
-    # quirks of the webhook wire format. Applied to every model, so charges,
-    # contracts, user-account and refund messages all benefit:
-    #
-    #   1. Forward-compat: the Jamm backend can add new fields to webhook
-    #      payloads at any time. The generated model `initialize` raises
-    #      ArgumentError on any key outside `attribute_map`, so unknown keys are
-    #      dropped first. Known keys are snake_case, matching `attribute_map`.
-    #   2. Numeric enums: the backend serializes webhook payloads with Go's
-    #      `json.Marshal` (not protojson), so every enum field (status,
-    #      api_source, ...) arrives as its integer value, while the generated
-    #      enums are string-based. Each integer is mapped back to the enum string
-    #      so it matches the values returned by the REST API.
-    #   3. Nested models: the generated `initialize` assigns nested objects
-    #      verbatim (the `_deserialize` coercion only runs from `build_from_hash`,
-    #      which expects camelCase keys the webhook does not use). So a nested
-    #      field like `refund.error` would stay a raw Hash and `error.code` would
-    #      raise NoMethodError. We coerce nested model fields (and arrays of them)
-    #      recursively so the typed accessors work.
-    def self.build(klass, attributes)
-      return nil if attributes.nil?
-
-      known = klass.attribute_map
-      types = klass.openapi_types
-      filtered = attributes.each_with_object({}) do |(key, value), acc|
-        sym = key.to_sym
-        next unless known.key?(sym)
-
-        acc[sym] = coerce(types[sym], value)
-      end
+      when Jamm::OpenAPI::EventType::REFUND_FAILED
+        out.content = Jamm::OpenAPI::ChargeMessage.new(json[:content])
+        return out
 
-      klass.new(filtered)
-    end
+      when Jamm::OpenAPI::EventType::CHARGE_SUCCESS
+        out.content = Jamm::OpenAPI::ChargeMessage.new(json[:content])
+        return out
 
-    # Refund webhooks (REFUND_SUCCEEDED / REFUND_FAILED) deliver `content` as a
-    # nested { transaction, refund } wrapper instead of a flat ChargeMessage.
-    # Flatten it back into a ChargeMessage so callers always receive the same shape.
-    def self.flatten_charge_content(content)
-      return content unless content.is_a?(Hash) && content.key?(:transaction)
-
-      refund = content[:refund]
-      # Keep `refund` as the raw Hash: `build` coerces it into a typed RefundInfo
-      # (and recursively types its nested `error`). Also surface the refund's
-      # `rfd-` id on the flat `refund_id` attribute the model documents.
-      charge = content[:transaction].merge(refund: refund)
-      charge[:refund_id] = refund[:id] if refund.is_a?(Hash) && !refund[:id].nil?
-      charge
-    end
+      when Jamm::OpenAPI::EventType::CHARGE_FAIL
+        out.content = Jamm::OpenAPI::ChargeMessage.new(json[:content])
+        return out
 
-    # Coerce a raw webhook value into the shape the generated model expects,
-    # based on the field's openapi type: numeric enums become their string
-    # constant, nested models become typed instances, and `Array<T>` elements are
-    # coerced by `T`. Anything else passes through untouched.
-    def self.coerce(type, value)
-      return value if value.nil?
-
-      inner = array_inner_type(type)
-      return coerce_array(inner, value) unless inner.nil?
-
-      klass = openapi_const(type)
-      return value if klass.nil?
-
-      if klass.respond_to?(:all_vars)
-        resolve_enum(klass, value)
-      elsif klass.respond_to?(:openapi_types) && value.is_a?(Hash)
-        build(klass, value)
-      else
-        value
+      when Jamm::OpenAPI::EventType::CONTRACT_ACTIVATED
+        out.content = Jamm::OpenAPI::ContractMessage.new(json[:content])
+        return out
       end
-    end
-
-    # Coerce each element of an `Array<T>` field by its inner type `T`.
-    def self.coerce_array(inner_type, value)
-      return value unless value.is_a?(Array)
 
-      value.map { |element| coerce(inner_type, element) }
-    end
-
-    # Extract `T` from an `Array<T>` openapi type, or nil when not an array type.
-    def self.array_inner_type(type)
-      match = type.to_s.match(/\AArray<(.+)>\z/)
-      match && match[1]
-    end
-
-    # Map a numeric enum wire value onto its string enum constant. A value that
-    # is already a string (REST-style) passes through untouched.
-    def self.resolve_enum(enum, value)
-      return value unless value.is_a?(Integer)
-
-      vars = enum.all_vars
-      # Guard the bounds explicitly: Ruby maps negative indices from the end of
-      # the array, so any unexpected wire value must fall back to the *_UNSPECIFIED
-      # member (index 0) rather than silently selecting the wrong constant.
-      value.between?(0, vars.length - 1) ? vars[value] : vars[0]
-    end
-
-    # Resolve an openapi_types entry (e.g. :ChargeMessageApiSource, :RefundInfo)
-    # to its generated class, or nil when the type is a primitive (String,
-    # Integer, ...) or otherwise unresolvable.
-    def self.openapi_const(type)
-      return nil if type.nil?
-
-      name = type.to_s
-      return nil unless Jamm::OpenAPI.const_defined?(name)
-
-      Jamm::OpenAPI.const_get(name)
-    rescue NameError
-      nil
-    end
-
-    # Recursively convert Hash keys to symbols so parsing is robust regardless of
-    # how the caller decoded the webhook JSON.
-    def self.deep_symbolize_keys(value)
-      case value
-      when Hash
-        value.each_with_object({}) { |(k, v), acc| acc[k.to_sym] = deep_symbolize_keys(v) }
-      when Array
-        value.map { |v| deep_symbolize_keys(v) }
-      else
-        value
-      end
+      raise 'Unknown event type'
     end
 
     # Verify message.
@@ -181,6 +63,118 @@ module Jamm
       raise Jamm::InvalidSignatureError, 'Digests do not match'
     end
 
+    # Verify the HMAC signature over the exact received bytes and parse, in one step.
+    #
+    # This is the recommended entry point. The backend signs the raw +content+ bytes it
+    # transmits, produced by Go's JSON encoder which HTML-escapes & < > as & <
+    # >. Re-serializing the parsed content (as +verify+ does via JSON.dump) un-escapes
+    # those characters, so its digest no longer matches. This slices the raw +content+
+    # substring out of +raw_body+ verbatim and HMACs that.
+    def self.verify_and_parse(raw_body)
+      raise ArgumentError, 'raw_body cannot be nil or empty' if raw_body.nil? || raw_body.empty?
+
+      parsed = JSON.parse(raw_body, symbolize_names: true)
+      signature = parsed[:signature]
+      raise ArgumentError, "Webhook body is missing the 'signature' field" if signature.nil? || signature.empty?
+
+      raw_content = extract_raw_content(raw_body)
+      digest = OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), Jamm.client_secret, raw_content)
+      given = "sha256=#{digest}"
+      raise Jamm::InvalidSignatureError, 'Digests do not match' unless secure_compare(given, signature)
+
+      parse(parsed)
+    end
+
+    # Extracts the top-level +content+ value substring from a raw webhook body verbatim,
+    # without decoding or re-serializing it, so the exact signed bytes are recovered.
+    def self.extract_raw_content(raw_body)
+      i = 0
+      n = raw_body.length
+      i += 1 while i < n && raw_body[i].match?(/\s/)
+      raise ArgumentError, 'Webhook body must be a JSON object' unless raw_body[i] == '{'
+
+      i += 1
+      # Scan every top-level key. Duplicate keys are rejected: JSON.parse keeps the LAST
+      # occurrence while this returns the FIRST, so a duplicate `content` could otherwise
+      # verify one payload and parse another (signature bypass).
+      seen = {}
+      content = nil
+      loop do
+        i += 1 while i < n && (raw_body[i].match?(/\s/) || raw_body[i] == ',')
+        break if i >= n || raw_body[i] == '}'
+        raise ArgumentError, 'Malformed webhook JSON' unless raw_body[i] == '"'
+
+        key_start = i
+        i = skip_string(raw_body, i)
+        # Decode the key (not a raw slice): otherwise an escaped duplicate such as
+        # "content" would evade both the duplicate check and the 'content' match below,
+        # while JSON.parse collapses it to `content` and keeps the last value. Normalize a
+        # malformed key to ArgumentError to match the rest of this method.
+        key = begin
+          JSON.parse(raw_body[key_start...i])
+        rescue JSON::ParserError
+          raise ArgumentError, 'Malformed webhook JSON'
+        end
+        raise ArgumentError, "Duplicate top-level key in webhook body: #{key}" if seen.key?(key)
+
+        seen[key] = true
+        i += 1 while i < n && raw_body[i].match?(/\s/)
+        raise ArgumentError, 'Malformed webhook JSON' unless raw_body[i] == ':'
+
+        i += 1
+        i += 1 while i < n && raw_body[i].match?(/\s/)
+        value_start = i
+        i = skip_value(raw_body, i)
+        content = raw_body[value_start...i] if key == 'content'
+      end
+      raise ArgumentError, "Webhook body does not contain 'content' field" if content.nil?
+
+      content
+    end
+
+    # +i+ points at an opening '"'. Returns the index just past the closing '"'.
+    def self.skip_string(str, i)
+      i += 1
+      n = str.length
+      while i < n
+        c = str[i]
+        if c == '\\'
+          i += 2
+          next
+        end
+        return i + 1 if c == '"'
+
+        i += 1
+      end
+      raise ArgumentError, 'Unterminated string in webhook JSON'
+    end
+
+    # +i+ points at the first char of a JSON value. Returns the index just past it.
+    def self.skip_value(str, i)
+      return skip_string(str, i) if str[i] == '"'
+
+      if str[i] == '{' || str[i] == '['
+        depth = 0
+        n = str.length
+        while i < n
+          ch = str[i]
+          if ch == '"'
+            i = skip_string(str, i)
+            next
+          elsif ch == '{' || ch == '['
+            depth += 1
+          elsif ch == '}' || ch == ']'
+            depth -= 1
+            return i + 1 if depth.zero?
+          end
+          i += 1
+        end
+        raise ArgumentError, 'Unterminated object/array in webhook JSON'
+      end
+      i += 1 while i < str.length && !",}] \t\n\r".include?(str[i])
+      i
+    end
+
     # Securely compare two strings of equal length.
     # This method is a port of ActiveSupport::SecurityUtils.secure_compare
     # which works on non-Rails platforms.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: jamm
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.5.0
 platform: ruby
 authors:
 - Jamm
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-24 00:00:00.000000000 Z
+date: 2026-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -84,7 +84,6 @@ files:
 - lib/jamm/api/configuration.rb
 - lib/jamm/api/models/apiv1_error.rb
 - lib/jamm/api/models/apiv1_status.rb
-- lib/jamm/api/models/charge_message_api_source.rb
 - lib/jamm/api/models/customer_service_update_customer_body.rb
 - lib/jamm/api/models/googlerpc_status.rb
 - lib/jamm/api/models/protobuf_any.rb

data/lib/jamm/api/models/charge_message_api_source.rb

@@ -1,42 +0,0 @@
-=begin
-#Jamm API
-
-#No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
-
-The version of the OpenAPI document: 1.0
-
-Generated by: https://openapi-generator.tech
-Generator version: 7.9.0
-
-=end
-
-require 'date'
-require 'time'
-
-module Api
-  class ChargeMessageApiSource
-    UNSPECIFIED = "API_SOURCE_UNSPECIFIED".freeze
-    OFF_SESSION_SYNC = "API_SOURCE_OFF_SESSION_SYNC".freeze
-    OFF_SESSION_ASYNC = "API_SOURCE_OFF_SESSION_ASYNC".freeze
-    ON_SESSION = "API_SOURCE_ON_SESSION".freeze
-
-    def self.all_vars
-      @all_vars ||= [UNSPECIFIED, OFF_SESSION_SYNC, OFF_SESSION_ASYNC, ON_SESSION].freeze
-    end
-
-    # Builds the enum from string
-    # @param [String] The enum value in the form of the string
-    # @return [String] The enum value
-    def self.build_from_hash(value)
-      new.build_from_hash(value)
-    end
-
-    # Builds the enum from string
-    # @param [String] The enum value in the form of the string
-    # @return [String] The enum value
-    def build_from_hash(value)
-      return value if ChargeMessageApiSource.all_vars.include?(value)
-      raise "Invalid ENUM value #{value} for class #ChargeMessageApiSource"
-    end
-  end
-end