mercadopago-sdk 3.2.0 → 3.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d3eb3c15c909d8872d5810ac30966353a794f2c70bfcd983824898a93e2adf96
-  data.tar.gz: cd2bbac8379dcedaae481d4f4715130e21f88f819dc34a73779c238575e98f3b
+  metadata.gz: 7dfcf7186c9d72f9b02200699acf4807a80aee9014b0c8b1905097850b6ed5fe
+  data.tar.gz: 3cb25341c72de1d3686fe217c7fb81e3ec0bfa87a74cf80cee163b1c3ec6a0d6
 SHA512:
-  metadata.gz: 0ec0c57a6703933698e7fb99643274658a871ac3bb3738bcefa756ffde307ac9037d54ddd36f585c5a8b60f90f9bb7c433b7b97047a0f4f5ded2bf3aafbf9a94
-  data.tar.gz: 3379ec1633e23f25eae001deea156c96010e345298b0f8c58113d30916d644d0a263078261ad6bc9d9aff3d65ba2a488bc723d906db7a8196d0aca514d6f0d02
+  metadata.gz: c446ae477af4b97192b150ac3618b2e363d0d98dc8cb060aa08a26f4dc13811612fa69d6f618180fcd315f77cdd83757872f4c052b6689a86ab533411a7fd8bb
+  data.tar.gz: '086a6f76e544b588f0f09a55d59946bd68f9eb373dbd3328841fe977168273e2b5a2d35d9e30cf0b9672d81fd31947b8fcdc1bfaca17d21a1b6529e55adbad7b'

data/.github/workflows/ci.yml

@@ -13,13 +13,13 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:
         ref: ${{ github.event.pull_request.head.ref }}
         repository: ${{ github.event.pull_request.head.repo.full_name }}
 
     - name: Cache gems
-      uses: actions/cache@v6
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v6
       with:
         path: vendor/bundle
         key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}

data/.github/workflows/release.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
       - name: Install dependencies
         run: bundle install

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    mercadopago-sdk (3.2.0)
+    mercadopago-sdk (3.2.1)
       faraday (~> 2.0)
       json (~> 2.5)
 
@@ -17,8 +17,8 @@ GEM
     faraday-net_http (3.4.4)
       net-http (~> 0.5)
     io-console (0.8.2)
-    json (2.20.0)
-    language_server-protocol (3.17.0.5)
+    json (2.21.1)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     logger (1.7.0)
     method_source (1.1.0)
@@ -40,7 +40,7 @@ GEM
     regexp_parser (2.12.0)
     reline (0.6.3)
       io-console (~> 0.5)
-    rubocop (1.88.0)
+    rubocop (1.88.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -51,7 +51,7 @@ GEM
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     ruby-progressbar (1.13.0)

data/examples/order/create_checkout_pro.rb

@@ -22,11 +22,18 @@ def create_checkout_pro_order(sdk)
       identification: {
         type: 'CPF',
         number: '12345678909'
-      }
+      },
+      date_created: '2024-01-01T00:00:00Z',
+      authentication_type: 'Gmail',
+      is_prime_user: false,
+      is_first_purchase_online: false,
+      last_purchase: '2024-01-01T00:00:00Z',
+      registration_date: '2023-01-01T00:00:00Z'
     },
     shipment: {
       mode: 'custom',
       local_pickup: false,
+      express_shipment: false,
       cost: '15.00',
       free_shipping: false,
       address: {
@@ -34,7 +41,11 @@ def create_checkout_pro_order(sdk)
         street_name: 'Av. Paulista',
         street_number: '1000',
         neighborhood: 'Bela Vista',
-        city: 'Sao Paulo'
+        city: 'Sao Paulo',
+        state_name: 'Sao Paulo',
+        city_name: 'Sao Paulo',
+        floor: '2',
+        apartment: 'A'
       }
     },
     config: {
@@ -85,7 +96,25 @@ def create_checkout_pro_order(sdk)
         quantity: 1,
         unit_price: '450.00',
         type: 'travel',
-        event_date: '2027-01-15T00:00:00.000-03:00'
+        warranty: false,
+        event_date: '2027-01-15T00:00:00.000-03:00',
+        category_descriptor: {
+          passenger: {
+            first_name: 'John',
+            last_name: 'Smith',
+            identification: {
+              type: 'CPF',
+              number: '12345678909'
+            }
+          },
+          route: {
+            departure: 'SAO',
+            destination: 'RIO',
+            departure_date_time: '2027-01-15T08:00:00.000-03:00',
+            arrival_date_time: '2027-01-15T09:30:00.000-03:00',
+            company: 'LATAM'
+          }
+        }
       },
       {
         external_code: 'ITEM-002',
@@ -96,7 +125,25 @@ def create_checkout_pro_order(sdk)
         quantity: 1,
         unit_price: '50.00',
         type: 'travel',
-        event_date: '2027-01-15T00:00:00.000-03:00'
+        warranty: true,
+        event_date: '2027-01-15T00:00:00.000-03:00',
+        category_descriptor: {
+          passenger: {
+            first_name: 'John',
+            last_name: 'Smith',
+            identification: {
+              type: 'CPF',
+              number: '12345678909'
+            }
+          },
+          route: {
+            departure: 'SAO',
+            destination: 'RIO',
+            departure_date_time: '2027-01-15T08:00:00.000-03:00',
+            arrival_date_time: '2027-01-15T09:30:00.000-03:00',
+            company: 'LATAM'
+          }
+        }
       }
     ]
   }

data/examples/preference/create_with_industry_fields.rb

@@ -0,0 +1,137 @@
+# Example: Create a Checkout Preference with industry-specific fields.
+# Demonstrates payer authentication info, item category descriptors,
+# passenger/route details, and shipment address enrichment.
+
+require_relative '../../lib/mercadopago'
+
+sdk = Mercadopago::SDK.new('<ACCESS_TOKEN>')
+
+def create_preference_with_industry_fields(sdk)
+  request = {
+    payer: {
+      name: 'John',
+      surname: 'Smith',
+      email: '<PAYER_EMAIL>',
+      phone: {
+        area_code: '11',
+        number: '999998888'
+      },
+      identification: {
+        type: 'CPF',
+        number: '12345678909'
+      },
+      address: {
+        zip_code: '01310-100',
+        street_name: 'Av. Paulista',
+        street_number: 1000
+      },
+      date_created: '2024-01-01T00:00:00Z',
+      authentication_type: 'Gmail',
+      is_prime_user: false,
+      is_first_purchase_online: false,
+      last_purchase: '2024-01-01T00:00:00Z',
+      registration_date: '2023-01-01T00:00:00Z'
+    },
+    items: [
+      {
+        id: 'ITEM-001',
+        title: 'Flight SAO-RIO',
+        description: 'Round trip, economy class',
+        category_id: 'travels',
+        picture_url: 'https://example.com/img.jpg',
+        quantity: 1,
+        currency_id: 'BRL',
+        unit_price: 450.00,
+        warranty: false,
+        event_date: '2027-01-15T00:00:00.000-03:00',
+        category_descriptor: {
+          passenger: {
+            first_name: 'John',
+            last_name: 'Smith',
+            identification: {
+              type: 'CPF',
+              number: '12345678909'
+            }
+          },
+          route: {
+            departure: 'SAO',
+            destination: 'RIO',
+            departure_date_time: '2027-01-15T08:00:00.000-03:00',
+            arrival_date_time: '2027-01-15T09:30:00.000-03:00',
+            company: 'LATAM'
+          }
+        }
+      },
+      {
+        id: 'ITEM-002',
+        title: 'Travel insurance',
+        description: 'Basic coverage during trip',
+        category_id: 'travels',
+        picture_url: 'https://example.com/insurance.jpg',
+        quantity: 1,
+        currency_id: 'BRL',
+        unit_price: 50.00,
+        warranty: true,
+        event_date: '2027-01-15T00:00:00.000-03:00',
+        category_descriptor: {
+          passenger: {
+            first_name: 'John',
+            last_name: 'Smith',
+            identification: {
+              type: 'CPF',
+              number: '12345678909'
+            }
+          },
+          route: {
+            departure: 'SAO',
+            destination: 'RIO',
+            departure_date_time: '2027-01-15T08:00:00.000-03:00',
+            arrival_date_time: '2027-01-15T09:30:00.000-03:00',
+            company: 'LATAM'
+          }
+        }
+      }
+    ],
+    shipments: {
+      mode: 'custom',
+      local_pickup: false,
+      express_shipment: false,
+      cost: 15.0,
+      free_shipping: false,
+      receiver_address: {
+        zip_code: '01310-100',
+        street_name: 'Av. Paulista',
+        street_number: 1000,
+        state_name: 'Sao Paulo',
+        city_name: 'Sao Paulo',
+        floor: '2',
+        apartment: 'A'
+      }
+    },
+    back_urls: {
+      success: 'https://example.com/success',
+      failure: 'https://example.com/failure',
+      pending: 'https://example.com/pending'
+    },
+    auto_return: 'approved',
+    external_reference: 'MP0001',
+    notification_url: 'https://example.com/notifications',
+    statement_descriptor: 'MYSTORE'
+  }
+
+  custom_headers = {
+    'X-Idempotency-Key': '<SOME_UNIQUE_VALUE>'
+  }
+  custom_request_options = Mercadopago::RequestOptions.new(custom_headers: custom_headers)
+
+  result = sdk.preference.create(request, request_options: custom_request_options)
+  preference = result[:response]
+
+  puts "Preference id: #{preference['id']}"
+  puts "Init point: #{preference['init_point']}"
+
+rescue StandardError => e
+  puts e.message
+end
+
+create_preference_with_industry_fields(sdk)

data/lib/mercadopago/core/mp_base.rb

@@ -1,6 +1,8 @@
 # typed: false
 # frozen_string_literal: true
 
+require 'cgi'
+
 module Mercadopago
   # Abstract base class for every API resource (Payment, Customer, Order, etc.).
   #
@@ -61,6 +63,11 @@ module Mercadopago
       headers
     end
 
+    # Encodes a dynamic URL path segment before interpolation.
+    def _path_param(value)
+      CGI.escape(value.to_s).gsub('+', '%20')
+    end
+
     # Performs a GET request against the MercadoPago API.
     #
     # @param uri [String] API path (e.g. "/v1/payments/123")

data/lib/mercadopago/resources/advanced_payment.rb

@@ -29,7 +29,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with payment details
     def get(advanced_payment_id, request_options: nil)
-      _get(uri: "/v1/advanced_payments/#{advanced_payment_id}", request_options: request_options)
+      _get(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}", request_options: request_options)
     end
 
     # Creates a new advanced payment with split disbursements.
@@ -54,7 +54,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with the captured payment
     def capture(advanced_payment_id, request_options: nil)
       capture_data = { capture: true }
-      _put(uri: "/v1/advanced_payments/#{advanced_payment_id}", data: capture_data, request_options: request_options)
+      _put(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}", data: capture_data, request_options: request_options)
     end
 
     # Updates an existing advanced payment.
@@ -67,7 +67,7 @@ module Mercadopago
     def update(advanced_payment_id, advanced_payment_data, request_options: nil)
       raise TypeError, 'Param advanced_payment_data must be a Hash' unless advanced_payment_data.is_a?(Hash)
 
-      _put(uri: "/v1/advanced_payments/#{advanced_payment_id}", data: advanced_payment_data,
+      _put(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}", data: advanced_payment_data,
            request_options: request_options)
     end
 
@@ -78,7 +78,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with the cancelled payment
     def cancel(advanced_payment_id, request_options: nil)
       cancel_data = { status: 'cancelled' }
-      _put(uri: "/v1/advanced_payments/#{advanced_payment_id}", data: cancel_data, request_options: request_options)
+      _put(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}", data: cancel_data, request_options: request_options)
     end
 
     # Changes the money release date for an advanced payment's disbursements.
@@ -89,7 +89,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+
     def update_release_date(advanced_payment_id, release_date, request_options: nil)
       disbursement_data = { money_release_date: release_date.strftime('%Y-%m-%d %H:%M:%S.%f') }
-      _post(uri: "/v1/advanced_payments/#{advanced_payment_id}/disburses", data: disbursement_data,
+      _post(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}/disburses", data: disbursement_data,
             request_options: request_options)
     end
   end

data/lib/mercadopago/resources/card.rb

@@ -18,7 +18,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with card details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-api/cards/get-card/get
     def get(customer_id, card_id, request_options: nil)
-      _get(uri: "/v1/customers/#{customer_id}/cards/#{card_id}", request_options: request_options)
+      _get(uri: "/v1/customers/#{_path_param(customer_id)}/cards/#{_path_param(card_id)}", request_options: request_options)
     end
 
     # Saves a new card for a customer using a previously generated card token.
@@ -32,7 +32,7 @@ module Mercadopago
     def create(customer_id, card_data, request_options: nil)
       raise TypeError, 'Param card_data must be a Hash' if card_data.nil? || !card_data.is_a?(Hash)
 
-      _post(uri: "/v1/customers/#{customer_id}/cards/", data: card_data, request_options: request_options)
+      _post(uri: "/v1/customers/#{_path_param(customer_id)}/cards/", data: card_data, request_options: request_options)
     end
 
     # Deletes a saved card from a customer.
@@ -43,7 +43,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-api/cards/delete-card/delete
     def delete(customer_id, card_id, request_options: nil)
-      _delete(uri: "/v1/customers/#{customer_id}/cards/#{card_id}", request_options: request_options)
+      _delete(uri: "/v1/customers/#{_path_param(customer_id)}/cards/#{_path_param(card_id)}", request_options: request_options)
     end
 
     # Lists all saved cards for a customer.
@@ -53,7 +53,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with an array of cards
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-api/cards/get-customer-cards/get
     def list(customer_id, request_options: nil)
-      _get(uri: "/v1/customers/#{customer_id}/cards", request_options: request_options)
+      _get(uri: "/v1/customers/#{_path_param(customer_id)}/cards", request_options: request_options)
     end
   end
 end

data/lib/mercadopago/resources/card_token.rb

@@ -16,7 +16,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with token details
     def get(card_token_id, request_options: nil)
-      _get(uri: "/v1/card_tokens/#{card_token_id}", request_options: request_options)
+      _get(uri: "/v1/card_tokens/#{_path_param(card_token_id)}", request_options: request_options)
     end
 
     # Creates a new card token from raw card data.

data/lib/mercadopago/resources/chargeback.rb

@@ -17,7 +17,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with the full chargeback object
     # @see https://www.mercadopago.com.br/developers/en/reference/chargebacks/
     def get(chargeback_id, request_options: nil)
-      _get(uri: "/v1/chargebacks/#{chargeback_id}", request_options: request_options)
+      _get(uri: "/v1/chargebacks/#{_path_param(chargeback_id)}", request_options: request_options)
     end
 
     # Searches chargebacks matching the given filters.

data/lib/mercadopago/resources/customer.rb

@@ -26,7 +26,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with customer details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-api/customers/get-customer/get
     def get(customer_id, request_options: nil)
-      _get(uri: "/v1/customers/#{customer_id}", request_options: request_options)
+      _get(uri: "/v1/customers/#{_path_param(customer_id)}", request_options: request_options)
     end
 
     # Creates a new customer.
@@ -53,7 +53,7 @@ module Mercadopago
     def update(customer_id, customer_data, request_options: nil)
       raise TypeError, 'Param customer_data must be a Hash' unless customer_data.is_a?(Hash)
 
-      _put(uri: "/v1/customers/#{customer_id}", data: customer_data, request_options: request_options)
+      _put(uri: "/v1/customers/#{_path_param(customer_id)}", data: customer_data, request_options: request_options)
     end
 
     # Deletes a customer permanently.
@@ -62,7 +62,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+
     def delete(customer_id, request_options: nil)
-      _delete(uri: "/v1/customers/#{customer_id}", request_options: request_options)
+      _delete(uri: "/v1/customers/#{_path_param(customer_id)}", request_options: request_options)
     end
   end
 end

data/lib/mercadopago/resources/disbursement_refund.rb

@@ -14,7 +14,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with an array of refunds
     def list(advanced_payment_id, request_options: nil)
-      _get(uri: "/v1/advanced_payments/#{advanced_payment_id}/refunds", request_options: nil)
+      _get(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}/refunds", request_options: nil)
     end
 
     # Refunds all disbursements of an advanced payment at once.
@@ -23,7 +23,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with refund details
     def create_all(advanced_payment_id, request_options: nil)
-      _post(uri: "/v1/advanced_payments/#{advanced_payment_id}/refunds", request_options: request_options)
+      _post(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}/refunds", request_options: request_options)
     end
 
     # Refunds a single disbursement (full or partial).
@@ -39,7 +39,7 @@ module Mercadopago
     def create(advanced_payment_id, disbursement_id, amount: nil, request_options: nil)
       disbursement_refund_data = amount.nil? ? nil : { amount: amount }
 
-      _post(uri: "/v1/advanced_payments/#{advanced_payment_id}/disbursements/#{disbursement_id}/refunds",
+      _post(uri: "/v1/advanced_payments/#{_path_param(advanced_payment_id)}/disbursements/#{_path_param(disbursement_id)}/refunds",
             data: disbursement_refund_data, request_options: request_options)
     end
   end

data/lib/mercadopago/resources/invoice.rb

@@ -19,7 +19,7 @@ module Mercadopago
     #   including +:status+, +:transaction_amount+, +:preapproval_id+, and +:payment+ details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/subscriptions/get-authorized-payment/get
     def get(invoice_id, request_options: nil)
-      _get(uri: "/authorized_payments/#{invoice_id}", request_options: request_options)
+      _get(uri: "/authorized_payments/#{_path_param(invoice_id)}", request_options: request_options)
     end
 
     # Searches invoices matching the given filters.

data/lib/mercadopago/resources/merchant_order.rb

@@ -30,7 +30,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with order details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-pro/merchant_orders/get-merchant-order/get
     def get(merchant_order_id, request_options: nil)
-      _get(uri: "/merchant_orders/#{merchant_order_id}", request_options: request_options)
+      _get(uri: "/merchant_orders/#{_path_param(merchant_order_id)}", request_options: request_options)
     end
 
     # Creates a new merchant order.
@@ -57,7 +57,7 @@ module Mercadopago
     def update(merchant_order_id, merchant_order_data, request_options: nil)
       raise TypeError, 'Param merchant_orders_object must be a Hash' unless merchant_order_data.is_a?(Hash)
 
-      _put(uri: "/merchant_orders/#{merchant_order_id}", data: merchant_order_data,
+      _put(uri: "/merchant_orders/#{_path_param(merchant_order_id)}", data: merchant_order_data,
            request_options: request_options)
     end
   end

data/lib/mercadopago/resources/order.rb

@@ -99,7 +99,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with order details
     def get(order_id, request_options: nil)
-      _get(uri: "/v1/orders/#{order_id}", request_options: request_options)
+      _get(uri: "/v1/orders/#{_path_param(order_id)}", request_options: request_options)
     end
 
     # Processes (confirms) an order, triggering payment execution.
@@ -108,7 +108,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with the processed order
     def process(order_id, request_options: nil)
-      _post(uri: "/v1/orders/#{order_id}/process", data: nil, request_options: request_options)
+      _post(uri: "/v1/orders/#{_path_param(order_id)}/process", data: nil, request_options: request_options)
     end
 
     # Refunds an order (full or partial).
@@ -124,7 +124,7 @@ module Mercadopago
     def refund(order_id, refund_data: nil, request_options: nil)
       raise TypeError, 'Param refund_data must be a Hash' unless refund_data.nil? || refund_data.is_a?(Hash)
 
-      _post(uri: "/v1/orders/#{order_id}/refund", data: refund_data, request_options: request_options)
+      _post(uri: "/v1/orders/#{_path_param(order_id)}/refund", data: refund_data, request_options: request_options)
     end
 
     # Cancels an order that has not yet been captured.
@@ -133,7 +133,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with the cancelled order
     def cancel(order_id, request_options: nil)
-      _post(uri: "/v1/orders/#{order_id}/cancel", data: nil, request_options: request_options)
+      _post(uri: "/v1/orders/#{_path_param(order_id)}/cancel", data: nil, request_options: request_options)
     end
 
     # Captures a previously authorized order.
@@ -142,7 +142,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with the captured order
     def capture(order_id, request_options: nil)
-      _post(uri: "/v1/orders/#{order_id}/capture", data: nil, request_options: request_options)
+      _post(uri: "/v1/orders/#{_path_param(order_id)}/capture", data: nil, request_options: request_options)
     end
 
     # Searches orders matching the given filters.

data/lib/mercadopago/resources/order_transaction.rb

@@ -20,7 +20,7 @@ module Mercadopago
     def create(order_id, order_transaction_data, request_options: nil)
       raise TypeError, 'Param order_transaction_data must be a Hash' unless order_transaction_data.is_a?(Hash)
 
-      _post(uri: "/v1/orders/#{order_id}/transactions", data: order_transaction_data, request_options: request_options)
+      _post(uri: "/v1/orders/#{_path_param(order_id)}/transactions", data: order_transaction_data, request_options: request_options)
     end
 
     # Updates an existing transaction within an order.
@@ -34,7 +34,8 @@ module Mercadopago
     def update(order_id, transaction_id, order_transaction_data, request_options: nil)
       raise TypeError, 'Param order_transaction_data must be a Hash' unless order_transaction_data.is_a?(Hash)
 
-      _put(uri: "/v1/orders/#{order_id}/transactions/#{transaction_id}", data: order_transaction_data, request_options: request_options)
+      _put(uri: "/v1/orders/#{_path_param(order_id)}/transactions/#{_path_param(transaction_id)}",
+           data: order_transaction_data, request_options: request_options)
     end
 
     # Removes a transaction from an order.
@@ -44,7 +45,7 @@ module Mercadopago
     # @param request_options [RequestOptions, nil] per-call configuration override
     # @return [Hash{Symbol => Object}] +:status+ and +:response+
     def delete(order_id, transaction_id, request_options: nil)
-      _delete(uri: "/v1/orders/#{order_id}/transactions/#{transaction_id}", request_options: request_options)
+      _delete(uri: "/v1/orders/#{_path_param(order_id)}/transactions/#{_path_param(transaction_id)}", request_options: request_options)
     end
   end
 end

data/lib/mercadopago/resources/payment.rb

@@ -29,7 +29,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with payment details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-api-payments/get-payment/get
     def get(payment_id, request_options: nil)
-      _get(uri: "/v1/payments/#{payment_id}", request_options: request_options)
+      _get(uri: "/v1/payments/#{_path_param(payment_id)}", request_options: request_options)
     end
 
     # Creates a new payment.
@@ -56,7 +56,7 @@ module Mercadopago
     def update(payment_id, payment_data, request_options: nil)
       raise TypeError, 'Param payment_data must be a Hash' unless payment_data.is_a?(Hash)
 
-      _put(uri: "/v1/payments/#{payment_id}", data: payment_data, request_options: request_options)
+      _put(uri: "/v1/payments/#{_path_param(payment_id)}", data: payment_data, request_options: request_options)
     end
   end
 end

data/lib/mercadopago/resources/point.rb

@@ -43,7 +43,7 @@ module Mercadopago
       raise TypeError, 'Param payment_intent_data must be a Hash' unless payment_intent_data.is_a?(Hash)
 
       _post(
-        uri: "/point/integration-api/devices/#{device_id}/payment-intents",
+        uri: "/point/integration-api/devices/#{_path_param(device_id)}/payment-intents",
         data: payment_intent_data,
         request_options: request_options
       )
@@ -61,7 +61,7 @@ module Mercadopago
     # @see https://www.mercadopago.com/developers/en/reference/in-person-payments/point/orders/get-order/get
     def get(payment_intent_id, request_options: nil)
       _get(
-        uri: "/point/integration-api/payment-intents/#{payment_intent_id}",
+        uri: "/point/integration-api/payment-intents/#{_path_param(payment_intent_id)}",
         request_options: request_options
       )
     end
@@ -78,7 +78,7 @@ module Mercadopago
     # @see https://www.mercadopago.com/developers/en/reference/in-person-payments/point/orders/cancel-order/post
     def cancel(device_id, payment_intent_id, request_options: nil)
       _delete(
-        uri: "/point/integration-api/devices/#{device_id}/payment-intents/#{payment_intent_id}",
+        uri: "/point/integration-api/devices/#{_path_param(device_id)}/payment-intents/#{_path_param(payment_intent_id)}",
         request_options: request_options
       )
     end

data/lib/mercadopago/resources/preapproval.rb

@@ -31,7 +31,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with subscription details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/subscriptions/get-preapproval/get
     def get(preapproval_id, request_options: nil)
-      _get(uri: "/preapproval/#{preapproval_id}", request_options: request_options)
+      _get(uri: "/preapproval/#{_path_param(preapproval_id)}", request_options: request_options)
     end
 
     # Creates a new subscription.
@@ -58,7 +58,7 @@ module Mercadopago
     def update(preapproval_id, preapproval_data, request_options: nil)
       raise TypeError, 'Param preapproval_data must be a Hash' unless preapproval_data.is_a?(Hash)
 
-      _put(uri: "/preapproval/#{preapproval_id}", data: preapproval_data, request_options: request_options)
+      _put(uri: "/preapproval/#{_path_param(preapproval_id)}", data: preapproval_data, request_options: request_options)
     end
   end
 end

data/lib/mercadopago/resources/preapproval_plan.rb

@@ -30,7 +30,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with plan details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/subscriptions/get-preapproval-plan/get
     def get(preapproval_plan_id, request_options: nil)
-      _get(uri: "/preapproval_plan/#{preapproval_plan_id}", request_options: request_options)
+      _get(uri: "/preapproval_plan/#{_path_param(preapproval_plan_id)}", request_options: request_options)
     end
 
     # Creates a new subscription plan.
@@ -57,7 +57,7 @@ module Mercadopago
     def update(preapproval_plan_id, preapproval_plan_data, request_options: nil)
       raise TypeError, 'Param preapproval_plan_data must be a Hash' unless preapproval_plan_data.is_a?(Hash)
 
-      _put(uri: "/preapproval_plan/#{preapproval_plan_id}", data: preapproval_plan_data, request_options: request_options)
+      _put(uri: "/preapproval_plan/#{_path_param(preapproval_plan_id)}", data: preapproval_plan_data, request_options: request_options)
     end
   end
 end

data/lib/mercadopago/resources/preference.rb

@@ -17,7 +17,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with preference details
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-pro/preferences/get-preference/get
     def get(preference_id, request_options: nil)
-      _get(uri: "/checkout/preferences/#{preference_id}", request_options: request_options)
+      _get(uri: "/checkout/preferences/#{_path_param(preference_id)}", request_options: request_options)
     end
 
     # Creates a new Checkout Pro preference.
@@ -44,7 +44,7 @@ module Mercadopago
     def update(preference_id, preference_data, request_options: nil)
       raise TypeError, 'Param preference_data must be a Hash' unless preference_data.is_a?(Hash)
 
-      _put(uri: "/checkout/preferences/#{preference_id}", data: preference_data, request_options: request_options)
+      _put(uri: "/checkout/preferences/#{_path_param(preference_id)}", data: preference_data, request_options: request_options)
     end
   end
 end

data/lib/mercadopago/resources/refund.rb

@@ -17,7 +17,7 @@ module Mercadopago
     # @return [Hash{Symbol => Object}] +:status+ and +:response+ with an array of refunds
     # @see https://www.mercadopago.com/developers/en/reference/online-payments/checkout-api-payments/get-refunds/get
     def list(payment_id, request_options: nil)
-      _get(uri: "/v1/payments/#{payment_id}/refunds", request_options: request_options)
+      _get(uri: "/v1/payments/#{_path_param(payment_id)}/refunds", request_options: request_options)
     end
 
     # Creates a full or partial refund on a payment.
@@ -34,7 +34,7 @@ module Mercadopago
     def create(payment_id, refund_data: nil, request_options: nil)
       raise TypeError, 'Param refund_data must be a Hash' unless refund_data.nil? || refund_data.is_a?(Hash)
 
-      _post(uri: "/v1/payments/#{payment_id}/refunds", data: refund_data, request_options: request_options)
+      _post(uri: "/v1/payments/#{_path_param(payment_id)}/refunds", data: refund_data, request_options: request_options)
     end
   end
 end

data/mercadopago.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |gem|
   gem.name                  = 'mercadopago-sdk'
-  gem.version               = '3.2.0'
+  gem.version               = '3.2.1'
   gem.required_ruby_version = '>= 3.3.0'
   gem.author                = 'Mercado Pago'
   gem.description           = 'Mercado Pago Ruby SDK'

data/tests/test_path_param.rb

@@ -0,0 +1,14 @@
+# typed: true
+# frozen_string_literal: true
+
+require_relative '../lib/mercadopago'
+
+require 'minitest/autorun'
+
+class TestPathParam < Minitest::Test
+  def test_path_param_escapes_path_traversal
+    base = Mercadopago::MPBase.new(Mercadopago::RequestOptions.new(access_token: 'token'), nil)
+
+    assert_equal '..%2F..%2Fapplications%2F123', base.send(:_path_param, '../../applications/123')
+  end
+end

data/tests/test_payment.rb

@@ -60,15 +60,27 @@ class TestPayment < Minitest::Test
           phone: {
             area_code: '011',
             number: '987654321'
+          },
+          authentication_type: 'WEB',
+          is_prime_user: false,
+          is_first_purchase_online: false,
+          last_purchase: '2024-01-01T00:00:00Z',
+          identification: {
+            type: 'CPF',
+            number: '19119119100'
           }
         },
         shipments: {
+          express_shipment: false,
+          local_pickup: false,
           receiver_address: {
             street_name: 'Av das Nacoes Unidas',
             street_number: 3003,
             zip_code: '06233200',
             city_name: 'Buzios',
-            state_name: 'Rio de Janeiro'
+            state_name: 'Rio de Janeiro',
+            floor: '3',
+            apartment: 'B'
           }
         }
       }
@@ -136,15 +148,27 @@ class TestPayment < Minitest::Test
           phone: {
             area_code: '011',
             number: '987654321'
+          },
+          authentication_type: 'WEB',
+          is_prime_user: false,
+          is_first_purchase_online: false,
+          last_purchase: '2024-01-01T00:00:00Z',
+          identification: {
+            type: 'CPF',
+            number: '19119119100'
           }
         },
         shipments: {
+          express_shipment: false,
+          local_pickup: false,
           receiver_address: {
             street_name: 'Av das Nacoes Unidas',
             street_number: 3003,
             zip_code: '06233200',
             city_name: 'Buzios',
-            state_name: 'Rio de Janeiro'
+            state_name: 'Rio de Janeiro',
+            floor: '3',
+            apartment: 'B'
           }
         }
       }
@@ -208,15 +232,27 @@ class TestPayment < Minitest::Test
           phone: {
             area_code: '011',
             number: '987654321'
+          },
+          authentication_type: 'WEB',
+          is_prime_user: false,
+          is_first_purchase_online: false,
+          last_purchase: '2024-01-01T00:00:00Z',
+          identification: {
+            type: 'CPF',
+            number: '19119119100'
           }
         },
         shipments: {
+          express_shipment: false,
+          local_pickup: false,
           receiver_address: {
             street_name: 'Av das Nacoes Unidas',
             street_number: 3003,
             zip_code: '06233200',
             city_name: 'Buzios',
-            state_name: 'Rio de Janeiro'
+            state_name: 'Rio de Janeiro',
+            floor: '3',
+            apartment: 'B'
           }
         }
       }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mercadopago-sdk
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.2.1
 platform: ruby
 authors:
 - Mercado Pago
@@ -176,6 +176,7 @@ files:
 - examples/order/transaction/update.rb
 - examples/point/create_payment_intent.rb
 - examples/preference/create.rb
+- examples/preference/create_with_industry_fields.rb
 - lib/mercadopago.rb
 - lib/mercadopago/config/config.rb
 - lib/mercadopago/config/request_options.rb
@@ -214,6 +215,7 @@ files:
 - tests/test_oauth.rb
 - tests/test_order.rb
 - tests/test_order_transaction.rb
+- tests/test_path_param.rb
 - tests/test_payment.rb
 - tests/test_payment_methods.rb
 - tests/test_point.rb
@@ -257,6 +259,7 @@ test_files:
 - tests/test_oauth.rb
 - tests/test_order.rb
 - tests/test_order_transaction.rb
+- tests/test_path_param.rb
 - tests/test_payment.rb
 - tests/test_payment_methods.rb
 - tests/test_point.rb