mixpanel-ruby 3.1.0 → 3.2.0

data/openfeature-provider/lib/mixpanel/openfeature/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Mixpanel
+  module OpenFeature
+    VERSION = '0.1.0'
+  end
+end

data/openfeature-provider/lib/mixpanel/openfeature.rb

@@ -1,3 +1,4 @@
 # frozen_string_literal: true
 
+require_relative 'openfeature/version'
 require_relative 'openfeature/provider'

data/openfeature-provider/mixpanel-ruby-openfeature.gemspec

@@ -1,8 +1,10 @@
 # frozen_string_literal: true
 
+require File.join(File.dirname(__FILE__), 'lib/mixpanel/openfeature/version.rb')
+
 Gem::Specification.new do |spec|
   spec.name = 'mixpanel-ruby-openfeature'
-  spec.version = '0.1.0'
+  spec.version = Mixpanel::OpenFeature::VERSION
   spec.authors = ['Mixpanel']
   spec.email = 'support@mixpanel.com'
   spec.summary = 'OpenFeature provider for Mixpanel feature flags'

data/spec/mixpanel-ruby/consumer_spec.rb

@@ -3,6 +3,7 @@ require 'spec_helper'
 require 'webmock'
 
 require 'mixpanel-ruby/consumer'
+require 'mixpanel-ruby/credentials'
 
 describe Mixpanel::Consumer do
   before { WebMock.reset! }
@@ -95,6 +96,56 @@ describe Mixpanel::Consumer do
     it_behaves_like 'consumer'
   end
 
+  context 'service account credentials' do
+    it 'should send a request to api.mixpanel.com/import with service account credentials' do
+      stub_request(:any, 'https://api.mixpanel.com/import?project_id=test-project-123').to_return({:body => '{"status": 1, "error": null}'})
+      credentials = Mixpanel::ServiceAccountCredentials.new('test-user', 'test-secret', 'test-project-123')
+      consumer = Mixpanel::Consumer.new(nil, nil, nil, nil, credentials: credentials)
+
+      consumer.send!(:import, {'data' => 'TEST EVENT MESSAGE'}.to_json)
+
+      # Should use Basic Auth header with username:secret
+      # Should add project_id as query parameter
+      # Should NOT include credentials in POST body or message
+      expect(WebMock).to have_requested(:post, 'https://api.mixpanel.com/import?project_id=test-project-123').
+        with(
+          :body => {
+            'data' => 'IlRFU1QgRVZFTlQgTUVTU0FHRSI=',
+            'verbose' => '1'
+          },
+          :headers => {
+            'Authorization' => 'Basic ' + Base64.strict_encode64('test-user:test-secret')
+          }
+        )
+    end
+
+    it 'should raise ArgumentError when credentials is not ServiceAccountCredentials' do
+      consumer = Mixpanel::Consumer.new
+
+      expect {
+        consumer.request('https://api.mixpanel.com/import', {'data' => 'test', 'verbose' => '1'}, credentials: 'invalid', type: :import)
+      }.to raise_error(ArgumentError, /credentials must be ServiceAccountCredentials, got String/)
+    end
+
+    it 'should not include api_key when credentials are present' do
+      stub_request(:any, 'https://api.mixpanel.com/import?project_id=test-project').to_return({:body => '{"status": 1, "error": null}'})
+      credentials = Mixpanel::ServiceAccountCredentials.new('user', 'secret', 'test-project')
+      consumer = Mixpanel::Consumer.new(nil, nil, nil, nil, credentials: credentials)
+
+      # Message includes api_key but it should be ignored when credentials are present
+      consumer.send!(:import, {'data' => 'TEST EVENT MESSAGE', 'api_key' => 'SHOULD_BE_IGNORED'}.to_json)
+
+      # api_key should NOT be in the request body (only data and verbose)
+      expect(WebMock).to have_requested(:post, 'https://api.mixpanel.com/import?project_id=test-project').
+        with(
+          :body => {
+            'data' => 'IlRFU1QgRVZFTlQgTUVTU0FHRSI=',
+            'verbose' => '1'
+          }
+        )
+    end
+  end
+
 end
 
 describe Mixpanel::BufferedConsumer do
@@ -205,4 +256,34 @@ describe Mixpanel::BufferedConsumer do
     end
   end
 
+  context 'with service account credentials' do
+    it 'should pass credentials to consumer when using BufferedConsumer' do
+      stub_request(:any, 'https://api.mixpanel.com/import?project_id=buffered-project').to_return({:body => '{"status": 1, "error": null}'})
+      credentials = Mixpanel::ServiceAccountCredentials.new('buffered-user', 'buffered-secret', 'buffered-project')
+      consumer = Mixpanel::BufferedConsumer.new(nil, nil, nil, 2, credentials: credentials)
+
+      # Import messages are not buffered - they're sent immediately
+      consumer.send!(:import, {'data' => 'EVENT 1'}.to_json)
+
+      # Verify credentials were used in the request
+      expect(WebMock).to have_requested(:post, 'https://api.mixpanel.com/import?project_id=buffered-project').
+        with(
+          :headers => {
+            'Authorization' => 'Basic ' + Base64.strict_encode64('buffered-user:buffered-secret')
+          }
+        ).once
+    end
+  end
+
+end
+
+describe 'Connection error handling' do
+  it 'should raise ConnectionError when network error occurs' do
+    stub_request(:any, 'https://api.mixpanel.com/track').to_raise(StandardError.new('Network timeout'))
+    consumer = Mixpanel::Consumer.new
+
+    expect {
+      consumer.send!(:event, {'data' => 'TEST EVENT MESSAGE'}.to_json)
+    }.to raise_error(Mixpanel::ConnectionError, /Could not connect to Mixpanel, with error "Network timeout"/)
+  end
 end

data/spec/mixpanel-ruby/credentials_security_spec.rb

@@ -0,0 +1,108 @@
+require 'mixpanel-ruby'
+require 'json'
+
+describe 'Credentials Security' do
+  describe 'import with constructor credentials (recommended)' do
+    it 'should NOT include credentials in message payload' do
+      messages = []
+      credentials = Mixpanel::ServiceAccountCredentials.new('test-user', 'test-secret', 'test-project')
+
+      # Create tracker with credentials in constructor
+      tracker = Mixpanel::Tracker.new('TOKEN', nil, credentials: credentials) do |type, message|
+        messages << [type, message]
+      end
+
+      # Call import with nil api_key (recommended pattern)
+      tracker.import(nil, 'user123', 'Test Event', {'prop' => 'value'})
+
+      # Verify message was sent
+      expect(messages.length).to eq(1)
+      type, message_json = messages[0]
+      expect(type).to eq(:import)
+
+      # Parse the message
+      message = JSON.parse(message_json)
+
+      # CRITICAL: Credentials should NOT be in the message
+      expect(message).not_to have_key('credentials')
+      expect(message_json).not_to include('test-secret')
+      expect(message_json).not_to include('test-user')
+
+      # Message should only contain data
+      expect(message).to have_key('data')
+      expect(message['data']).to have_key('event')
+      expect(message['data']['event']).to eq('Test Event')
+    end
+
+    it 'should NOT include credentials in buffered messages' do
+      messages = []
+      credentials = Mixpanel::ServiceAccountCredentials.new('test-user', 'test-secret', 'test-project')
+
+      # Create buffered consumer with credentials
+      consumer = Mixpanel::BufferedConsumer.new(nil, nil, nil, 5, credentials: credentials) do |type, message|
+        messages << [type, message]
+      end
+
+      # Send multiple event messages (events are buffered, imports are not)
+      5.times do |i|
+        consumer.send!(:event, {'data' => {'event' => "Event #{i}"}}.to_json)
+      end
+
+      # Verify batched message was sent (auto-flushed when buffer reaches max_length)
+      expect(messages.length).to eq(1)
+      type, message_json = messages[0]
+
+      # CRITICAL: Credentials should NOT be in the batched message
+      expect(message_json).not_to include('credentials')
+      expect(message_json).not_to include('test-secret')
+      expect(message_json).not_to include('test-user')
+    end
+  end
+
+  describe 'tracking events' do
+    it 'should never include credentials in event messages' do
+      messages = []
+      credentials = Mixpanel::ServiceAccountCredentials.new('test-user', 'test-secret', 'test-project')
+
+      tracker = Mixpanel::Tracker.new('TOKEN', nil, credentials: credentials) do |type, message|
+        messages << [type, message]
+      end
+
+      # Track a regular event
+      tracker.track('user123', 'Test Event', {'prop' => 'value'})
+
+      # Verify message
+      expect(messages.length).to eq(1)
+      type, message_json = messages[0]
+      expect(type).to eq(:event)
+
+      # Credentials should NEVER be in event messages
+      expect(message_json).not_to include('credentials')
+      expect(message_json).not_to include('test-secret')
+    end
+  end
+
+  describe 'legacy API key pattern' do
+    it 'should include api_key in message but not credentials' do
+      messages = []
+      tracker = Mixpanel::Tracker.new('TOKEN') do |type, message|
+        messages << [type, message]
+      end
+
+      # Use legacy API key pattern
+      tracker.import('MY_API_KEY', 'user123', 'Test Event', {'prop' => 'value'})
+
+      # Verify message
+      expect(messages.length).to eq(1)
+      type, message_json = messages[0]
+      message = JSON.parse(message_json)
+
+      # API key should be in message (legacy pattern)
+      expect(message).to have_key('api_key')
+      expect(message['api_key']).to eq('MY_API_KEY')
+
+      # But credentials should NOT be
+      expect(message).not_to have_key('credentials')
+    end
+  end
+end

data/spec/mixpanel-ruby/credentials_spec.rb

@@ -0,0 +1,54 @@
+require 'mixpanel-ruby'
+
+describe Mixpanel::ServiceAccountCredentials do
+  describe '#initialize' do
+    it 'creates credentials with valid parameters' do
+      credentials = Mixpanel::ServiceAccountCredentials.new('user', 'secret', 'project123')
+      expect(credentials.username).to eq('user')
+      expect(credentials.secret).to eq('secret')
+      expect(credentials.project_id).to eq('project123')
+    end
+
+    it 'raises ArgumentError when username is nil' do
+      expect {
+        Mixpanel::ServiceAccountCredentials.new(nil, 'secret', 'project123')
+      }.to raise_error(ArgumentError, 'username is required')
+    end
+
+    it 'raises ArgumentError when username is empty' do
+      expect {
+        Mixpanel::ServiceAccountCredentials.new('', 'secret', 'project123')
+      }.to raise_error(ArgumentError, 'username is required')
+    end
+
+    it 'raises ArgumentError when secret is nil' do
+      expect {
+        Mixpanel::ServiceAccountCredentials.new('user', nil, 'project123')
+      }.to raise_error(ArgumentError, 'secret is required')
+    end
+
+    it 'raises ArgumentError when secret is empty' do
+      expect {
+        Mixpanel::ServiceAccountCredentials.new('user', '', 'project123')
+      }.to raise_error(ArgumentError, 'secret is required')
+    end
+
+    it 'raises ArgumentError when project_id is nil' do
+      expect {
+        Mixpanel::ServiceAccountCredentials.new('user', 'secret', nil)
+      }.to raise_error(ArgumentError, 'project_id is required')
+    end
+
+    it 'raises ArgumentError when project_id is empty' do
+      expect {
+        Mixpanel::ServiceAccountCredentials.new('user', 'secret', '')
+      }.to raise_error(ArgumentError, 'project_id is required')
+    end
+
+    it 'accepts integer project_id and converts to string' do
+      credentials = Mixpanel::ServiceAccountCredentials.new('user', 'secret', 12345)
+      expect(credentials.project_id).to eq('12345')
+    end
+  end
+
+end

data/spec/mixpanel-ruby/events_spec.rb

@@ -3,6 +3,7 @@ require 'time'
 
 require 'mixpanel-ruby/events.rb'
 require 'mixpanel-ruby/version.rb'
+require 'mixpanel-ruby/credentials.rb'
 
 describe Mixpanel::Events do
   before(:each) do
@@ -73,4 +74,155 @@ describe Mixpanel::Events do
         }
     } ]])
   end
+
+  it 'should send a well formed import/ message with service account credentials' do
+    credentials = Mixpanel::ServiceAccountCredentials.new('test-user', 'test-secret', 'test-project-123')
+
+    # Create new Events instance with credentials in constructor
+    events_with_creds = Mixpanel::Events.new('TEST TOKEN', nil, credentials: credentials) do |type, message|
+      @log << [type, JSON.load(message)]
+    end
+
+    # New API: pass nil for api_key, credentials come from instance
+    events_with_creds.import(nil, 'TEST ID', 'Test Event', {
+        'Circumstances' => 'During a test'
+    })
+
+    expect(@log.length).to eq(1)
+    expect(@log[0][0]).to eq(:import)
+
+    message = @log[0][1]
+    # Credentials should NOT be in message (secure API)
+    expect(message).not_to have_key('credentials')
+    expect(message).not_to have_key('api_key')
+    expect(message['data']).to eq({
+        'event' => 'Test Event',
+        'properties' => {
+            'Circumstances' => 'During a test',
+            'distinct_id' => 'TEST ID',
+            'mp_lib' => 'ruby',
+            '$lib_version' => Mixpanel::VERSION,
+            'token' => 'TEST TOKEN',
+            'time' => @time_now.to_i * 1000
+        }
+    })
+  end
+
+  it 'should raise ArgumentError when import is called without authentication' do
+    # Create Events without credentials
+    events = Mixpanel::Events.new('TEST TOKEN') do |type, message|
+      @log << [type, JSON.load(message)]
+    end
+
+    # Try to import with nil api_key and no credentials
+    expect {
+      events.import(nil, 'TEST ID', 'Test Event', {})
+    }.to raise_error(ArgumentError, /import requires authentication/)
+  end
+
+  describe 'import_events' do
+    it 'should send a well formed import/ message with constructor credentials' do
+      credentials = Mixpanel::ServiceAccountCredentials.new('test-user', 'test-secret', 'test-project-123')
+
+      events_with_creds = Mixpanel::Events.new('TEST TOKEN', nil, credentials: credentials) do |type, message|
+        @log << [type, JSON.load(message)]
+      end
+
+      # Clean API - no nil!
+      events_with_creds.import_events('TEST ID', 'Test Event', {
+        'Circumstances' => 'During a test'
+      })
+
+      expect(@log.length).to eq(1)
+      expect(@log[0][0]).to eq(:import)
+
+      message = @log[0][1]
+      # Credentials should NOT be in message
+      expect(message).not_to have_key('credentials')
+      expect(message).not_to have_key('api_key')
+      expect(message['data']).to eq({
+        'event' => 'Test Event',
+        'properties' => {
+          'Circumstances' => 'During a test',
+          'distinct_id' => 'TEST ID',
+          'mp_lib' => 'ruby',
+          '$lib_version' => Mixpanel::VERSION,
+          'token' => 'TEST TOKEN',
+          'time' => @time_now.to_i * 1000
+        }
+      })
+    end
+
+    it 'should raise ArgumentError when called without constructor credentials' do
+      events = Mixpanel::Events.new('TEST TOKEN') do |type, message|
+        @log << [type, JSON.load(message)]
+      end
+
+      expect {
+        events.import_events('TEST ID', 'Test Event', {})
+      }.to raise_error(ArgumentError, /import_events requires credentials in constructor/)
+    end
+  end
+
+  describe 'warnings' do
+    it 'should warn when credentials are passed with a custom block' do
+      credentials = Mixpanel::ServiceAccountCredentials.new('user', 'secret', 'project')
+
+      expect {
+        Mixpanel::Events.new('TEST TOKEN', nil, credentials: credentials) do |type, message|
+          # Custom block
+        end
+      }.to output(/credentials passed to Events\/Tracker are ignored/).to_stderr
+    end
+
+    it 'should not warn when credentials are passed without a block' do
+      credentials = Mixpanel::ServiceAccountCredentials.new('user', 'secret', 'project')
+
+      expect {
+        Mixpanel::Events.new('TEST TOKEN', nil, credentials: credentials)
+      }.not_to output.to_stderr
+    end
+
+    it 'should warn when using deprecated api_key in import' do
+      events = Mixpanel::Events.new('TEST TOKEN') do |type, message|
+        @log << [type, JSON.load(message)]
+      end
+
+      expect {
+        events.import('API_KEY', 'TEST ID', 'Test Event', {})
+      }.to output(/DEPRECATION.*api_key to import\(\) is deprecated/).to_stderr
+
+      # Second call should also warn
+      expect {
+        events.import('API_KEY', 'TEST ID', 'Test Event 2', {})
+      }.to output(/DEPRECATION.*api_key to import\(\) is deprecated/).to_stderr
+    end
+
+    it 'should warn when using import(nil, ...) with credentials' do
+      credentials = Mixpanel::ServiceAccountCredentials.new('user', 'secret', 'project')
+      events = Mixpanel::Events.new('TEST TOKEN', nil, credentials: credentials) do |type, message|
+        @log << [type, JSON.load(message)]
+      end
+
+      expect {
+        events.import(nil, 'TEST ID', 'Test Event', {})
+      }.to output(/DEPRECATION.*import\(nil, \.\.\.\) is deprecated.*import_events/).to_stderr
+
+      # Second call should also warn
+      expect {
+        events.import(nil, 'TEST ID', 'Test Event 2', {})
+      }.to output(/DEPRECATION.*import\(nil, \.\.\.\) is deprecated.*import_events/).to_stderr
+    end
+
+    it 'should not warn when using import_events' do
+      credentials = Mixpanel::ServiceAccountCredentials.new('user', 'secret', 'project')
+      events = Mixpanel::Events.new('TEST TOKEN', nil, credentials: credentials) do |type, message|
+        @log << [type, JSON.load(message)]
+      end
+
+      expect {
+        events.import_events('TEST ID', 'Test Event', {})
+      }.not_to output(/DEPRECATION/).to_stderr
+    end
+  end
 end