ksef-rb 0.1.0 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eaa5f61dd0f2d3e8f852cb504016268c73b798da5fe1e896a821115ea01fd2a5
-  data.tar.gz: 23df18df8297859a7fdf10fe0546dc03dc49e43b7617236de86837f7d2dbbe43
+  metadata.gz: 7f0036e4b7913536223a5b778902fa2bd69f334494b76772df2cf74dc7a2219d
+  data.tar.gz: 3bf943a76ccb8504b13475b7c0783b5571e46191a94e2f999253d5ebe54fa9d1
 SHA512:
-  metadata.gz: a15c7b19048d06f3328c5e4cb4cbc0a85ce3d7acf4daea6af2c24ec9dc3aee09c83c391071949665fa2a9b81d6f9ac2e9a8285a9e0b582f6e8c45c1d3d764422
-  data.tar.gz: f2b4956065c21bd7ac5dde726ca129664aa04e30efea9c7ffc746cc32900b0d76d523202f63aa74c1a03105108c58b627e0d96abff8e2c54d208f3d41d90fd5b
+  metadata.gz: 7c99c25e305544ff19f78829e1aa696711b8b19d8439c29f5577b03a4e4e6a0ebe81e225452f094ccc75edb1556234a6654970d5c5136090a4d7fed0986c038f
+  data.tar.gz: 642c4bedf0387bc6591b2132f457324b08f413127cba53dca6360d5317b68457fd93622b6fbc6107e0a9f4178ef17e26f16eb066b15aa16a8a45c5eeae9b96f8

data/CHANGELOG.md

@@ -7,6 +7,45 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-07-13
+
+### Fixed
+- Retry middleware: `Faraday::RetriableResponse` was missing from
+  `Connection::RETRY_OPTIONS[:exceptions]`. Because that key overrides the
+  faraday-retry default (which includes it), its absence silently disabled the
+  `retry_statuses: [502, 503, 504]` retries **and** leaked the raw synthetic
+  `Faraday::RetriableResponse` up the stack instead of mapping it to a typed
+  `Ksef::ServerError`. Observed in production as an unretried gateway blip on
+  `POST /auth/challenge` surfacing as `Faraday::RetriableResponse` rather than
+  being absorbed. The class is now included, so 502/503/504 are retried up to
+  `max` and, if still failing, raised as `Ksef::ServerError`. Added regression
+  specs covering both retry-then-recover and retry-then-exhaust paths.
+
+## [0.1.2] - 2026-05-19
+
+### Fixed
+- `/security/public-key-certificates` returns a DER-encoded X.509 certificate,
+  not a bare SPKI. The previous `Internal::TokenEncryptor.normalize_public_key`
+  fed the DER straight into `OpenSSL::PKey::RSA.new`, which raised
+  `OpenSSL::PKey::PKeyError: Neither PUB key nor PRIV key` against the live
+  production endpoint. The normaliser now parses the bytes as an X.509
+  certificate and extracts the public key, falling back to the bare-key code
+  path for backwards compatibility. The spec-helper fixture was updated to
+  return a real self-signed X.509 cert (matching the real KSeF response shape)
+  so the entire session lifecycle exercises this path.
+- `Ksef::InvoiceHeader` now `require`s `"time"` explicitly. It calls
+  `Time.iso8601` to parse `acquisitionDate` / `permanentStorageDate`; the spec
+  suite happened to load `time` transitively via `webmock`, but a bare
+  consumer that only required `"ksef"` got `NoMethodError: undefined method
+  'iso8601' for class Time` the first time they pulled invoice metadata.
+
+## [0.1.1] - 2026-05-19
+
+### Added
+- `lib/ksef-rb.rb` shim so `gem "ksef-rb"` works in any Gemfile without
+  the `require: "ksef"` option. Consumers who already use the explicit
+  `require:` form keep working unchanged.
+
 ## [0.1.0] - 2025-05-18
 
 ### Added

data/README.md

@@ -15,7 +15,7 @@ but additions are expected as more KSeF features land.
 ## Installation
 
 ```ruby
-gem "ksef-rb", require: "ksef"
+gem "ksef-rb"
 ```
 
 ## Quick start
@@ -37,7 +37,8 @@ client.sessions.with_interactive do |_session|
   headers = client.invoices.query(
     subject_type: :recipient,
     date_from:    Time.now.utc - (7 * 24 * 3600),
-    date_to:      Time.now.utc
+    date_to:      Time.now.utc,
+    date_type:    :issue  # :permanent_storage (default), :invoicing, or :issue
   )
 
   headers.each do |h|
@@ -49,6 +50,28 @@ client.sessions.with_interactive do |_session|
 end
 ```
 
+`#query` returns at most `page_size` headers per call (default 100, max 250).
+Paginate by bumping `page_offset` until a short page comes back:
+
+```ruby
+all = []
+offset = 0
+loop do
+  page = client.invoices.query(
+    subject_type: :recipient,
+    date_from:    Date.new(2026, 4, 1),
+    date_to:      Date.new(2026, 5, 31),
+    date_type:    :issue,
+    page_size:    250,
+    page_offset:  offset
+  )
+  all.concat(page)
+  break if page.size < 250
+
+  offset += 1
+end
+```
+
 `Ksef::InvoiceHeader` exposes (among others):
 `ksef_reference_number`, `invoice_number`, `issuer_nip`, `issuer_name`,
 `recipient_nip`, `recipient_name`, `issued_on`, `gross_amount`, `net_amount`,

data/lib/ksef/internal/connection.rb

@@ -18,10 +18,17 @@ module Ksef
         backoff_factor:      2,
         retry_statuses:      [502, 503, 504],
         methods:             %i[get head post delete put patch],
+        # `Faraday::RetriableResponse` MUST stay in this list: faraday-retry
+        # raises it internally to trigger a `retry_statuses` retry. Because we
+        # override `exceptions` (rather than inheriting the middleware default,
+        # which includes it), omitting it silently disables 502/503/504 retries
+        # *and* leaks the raw synthetic exception past `check!` instead of
+        # mapping it to a typed `Ksef::ServerError`.
         exceptions:          [
           Errno::ETIMEDOUT,
           Faraday::TimeoutError,
-          Faraday::ConnectionFailed
+          Faraday::ConnectionFailed,
+          Faraday::RetriableResponse
         ]
       }.freeze
 
@@ -134,7 +141,7 @@ module Ksef
       end
 
       def parse_retry_after(value)
-        return nil if value.nil?
+        return if value.nil?
 
         Integer(value)
       rescue ArgumentError, TypeError

data/lib/ksef/internal/token_encryptor.rb

@@ -34,13 +34,20 @@ module Ksef
         Base64.strict_encode64(ciphertext)
       end
 
-      # Convenience wrapper that handles raw DER-encoded (base64) keys returned
-      # by the public-key endpoint, falling back to PEM if the input already
-      # contains BEGIN markers.
+      # Normalizes whatever `/security/public-key-certificates` hands us into a
+      # PEM-encoded RSA public key suitable for {.encrypt}.
+      #
+      # KSeF returns the `certificate` field as a base64-encoded DER X.509
+      # certificate (not a bare public key), so we parse it as a cert first
+      # and extract the SPKI. PEM-armored inputs and bare-key DER blobs are
+      # also accepted as a courtesy.
       def normalize_public_key(raw)
-        return raw if raw.to_s.include?("BEGIN")
+        text = raw.to_s
+        return text if text.include?("BEGIN")
 
-        der = Base64.decode64(raw.to_s)
+        der = Base64.decode64(text)
+        OpenSSL::X509::Certificate.new(der).public_key.to_pem
+      rescue OpenSSL::X509::CertificateError
         OpenSSL::PKey::RSA.new(der).to_pem
       end
     end

data/lib/ksef/invoice_header.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "date"
+require "time"
 
 module Ksef
   # Lightweight value object describing an invoice as returned by
@@ -56,7 +57,7 @@ module Ksef
     private
 
     def parse_date(value)
-      return nil if value.nil? || value.empty?
+      return if value.nil? || value.empty?
 
       Date.iso8601(value)
     rescue ArgumentError
@@ -64,7 +65,7 @@ module Ksef
     end
 
     def parse_time(value)
-      return nil if value.nil? || value.empty?
+      return if value.nil? || value.empty?
 
       Time.iso8601(value)
     rescue ArgumentError

data/lib/ksef/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Ksef
-  VERSION = "0.1.0"
+  VERSION = "0.1.3"
 end

data/lib/ksef-rb.rb

@@ -0,0 +1,6 @@
+# frozen_string_literal: true
+
+# Bundler's default for `gem "ksef-rb"` is `require "ksef-rb"`. This shim
+# makes that resolve to the canonical entry point without forcing every
+# consumer to add `, require: "ksef"`.
+require_relative "ksef"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ksef-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.3
 platform: ruby
 authors:
 - Michał Siwek
@@ -91,6 +91,7 @@ files:
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
+- lib/ksef-rb.rb
 - lib/ksef.rb
 - lib/ksef/client.rb
 - lib/ksef/configuration.rb