ksef-rb 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eaa5f61dd0f2d3e8f852cb504016268c73b798da5fe1e896a821115ea01fd2a5
-  data.tar.gz: 23df18df8297859a7fdf10fe0546dc03dc49e43b7617236de86837f7d2dbbe43
+  metadata.gz: 540290ac5d524843c717ea5d92bba806eda1e4720926d61d5afd5545265d722b
+  data.tar.gz: dbbed4846d2ede6b17eed4813373f2a1d5acce75f49cc54524d9b6131722b9a3
 SHA512:
-  metadata.gz: a15c7b19048d06f3328c5e4cb4cbc0a85ce3d7acf4daea6af2c24ec9dc3aee09c83c391071949665fa2a9b81d6f9ac2e9a8285a9e0b582f6e8c45c1d3d764422
-  data.tar.gz: f2b4956065c21bd7ac5dde726ca129664aa04e30efea9c7ffc746cc32900b0d76d523202f63aa74c1a03105108c58b627e0d96abff8e2c54d208f3d41d90fd5b
+  metadata.gz: 669073ea7e384dc08459e1ac3aeb0dbc0c7c3ab3256617e13fe3c5bab9efc3cd3c06ffbfb529edac7fbcaaab87400e99de05c23c4ec3f1a99961f6b217f4a4f0
+  data.tar.gz: ee6e786a4d08f53330c4e46fceb4d5e1ff443a5d0555a89c314fdc782cfb6bc2d307a46c0da069a44cd3a77a81e022149b2319207ca7822699f4828c945b8982

data/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.2] - 2026-05-19
+
+### Fixed
+- `/security/public-key-certificates` returns a DER-encoded X.509 certificate,
+  not a bare SPKI. The previous `Internal::TokenEncryptor.normalize_public_key`
+  fed the DER straight into `OpenSSL::PKey::RSA.new`, which raised
+  `OpenSSL::PKey::PKeyError: Neither PUB key nor PRIV key` against the live
+  production endpoint. The normaliser now parses the bytes as an X.509
+  certificate and extracts the public key, falling back to the bare-key code
+  path for backwards compatibility. The spec-helper fixture was updated to
+  return a real self-signed X.509 cert (matching the real KSeF response shape)
+  so the entire session lifecycle exercises this path.
+- `Ksef::InvoiceHeader` now `require`s `"time"` explicitly. It calls
+  `Time.iso8601` to parse `acquisitionDate` / `permanentStorageDate`; the spec
+  suite happened to load `time` transitively via `webmock`, but a bare
+  consumer that only required `"ksef"` got `NoMethodError: undefined method
+  'iso8601' for class Time` the first time they pulled invoice metadata.
+
+## [0.1.1] - 2026-05-19
+
+### Added
+- `lib/ksef-rb.rb` shim so `gem "ksef-rb"` works in any Gemfile without
+  the `require: "ksef"` option. Consumers who already use the explicit
+  `require:` form keep working unchanged.
+
 ## [0.1.0] - 2025-05-18
 
 ### Added

data/README.md

@@ -15,7 +15,7 @@ but additions are expected as more KSeF features land.
 ## Installation
 
 ```ruby
-gem "ksef-rb", require: "ksef"
+gem "ksef-rb"
 ```
 
 ## Quick start
@@ -37,7 +37,8 @@ client.sessions.with_interactive do |_session|
   headers = client.invoices.query(
     subject_type: :recipient,
     date_from:    Time.now.utc - (7 * 24 * 3600),
-    date_to:      Time.now.utc
+    date_to:      Time.now.utc,
+    date_type:    :issue  # :permanent_storage (default), :invoicing, or :issue
   )
 
   headers.each do |h|
@@ -49,6 +50,28 @@ client.sessions.with_interactive do |_session|
 end
 ```
 
+`#query` returns at most `page_size` headers per call (default 100, max 250).
+Paginate by bumping `page_offset` until a short page comes back:
+
+```ruby
+all = []
+offset = 0
+loop do
+  page = client.invoices.query(
+    subject_type: :recipient,
+    date_from:    Date.new(2026, 4, 1),
+    date_to:      Date.new(2026, 5, 31),
+    date_type:    :issue,
+    page_size:    250,
+    page_offset:  offset
+  )
+  all.concat(page)
+  break if page.size < 250
+
+  offset += 1
+end
+```
+
 `Ksef::InvoiceHeader` exposes (among others):
 `ksef_reference_number`, `invoice_number`, `issuer_nip`, `issuer_name`,
 `recipient_nip`, `recipient_name`, `issued_on`, `gross_amount`, `net_amount`,

data/lib/ksef/internal/token_encryptor.rb

@@ -34,13 +34,20 @@ module Ksef
         Base64.strict_encode64(ciphertext)
       end
 
-      # Convenience wrapper that handles raw DER-encoded (base64) keys returned
-      # by the public-key endpoint, falling back to PEM if the input already
-      # contains BEGIN markers.
+      # Normalizes whatever `/security/public-key-certificates` hands us into a
+      # PEM-encoded RSA public key suitable for {.encrypt}.
+      #
+      # KSeF returns the `certificate` field as a base64-encoded DER X.509
+      # certificate (not a bare public key), so we parse it as a cert first
+      # and extract the SPKI. PEM-armored inputs and bare-key DER blobs are
+      # also accepted as a courtesy.
       def normalize_public_key(raw)
-        return raw if raw.to_s.include?("BEGIN")
+        text = raw.to_s
+        return text if text.include?("BEGIN")
 
-        der = Base64.decode64(raw.to_s)
+        der = Base64.decode64(text)
+        OpenSSL::X509::Certificate.new(der).public_key.to_pem
+      rescue OpenSSL::X509::CertificateError
         OpenSSL::PKey::RSA.new(der).to_pem
       end
     end

data/lib/ksef/invoice_header.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "date"
+require "time"
 
 module Ksef
   # Lightweight value object describing an invoice as returned by

data/lib/ksef/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ksef
-  VERSION = "0.1.0"
+  VERSION = "0.1.2"
 end

data/lib/ksef-rb.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Bundler's default for `gem "ksef-rb"` is `require "ksef-rb"`. This shim
+# makes that resolve to the canonical entry point without forcing every
+# consumer to add `, require: "ksef"`.
+require_relative "ksef"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ksef-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - Michał Siwek
@@ -91,6 +91,7 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
+- lib/ksef-rb.rb
 - lib/ksef.rb
 - lib/ksef/client.rb
 - lib/ksef/configuration.rb