mpp-rb 0.1.3 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cfa6aaca1aa33a23ec690b0c9cae8e04fe54ed71891fb82fd59703af067ec41e
-  data.tar.gz: 05fc8e20c0213027578d160f2b80fd953a4ea0e2d2ddd89bb6e1a78c971bfb11
+  metadata.gz: c71efa5e58021d08e4ed10c0156ed9b140923b0f3ebeb5ce6b42839594c27dd6
+  data.tar.gz: d40e3c4994086eea6f2c11023f47fda635637ae6815dc263d63c12ca10235ae8
 SHA512:
-  metadata.gz: d1649fad2a0269ba907e5dd59bbcbc3072b26d40f2951cbda262eede6156b97fd75547b8675cbb7d0c89a426a41983adb50276805b9acc048d542b7615f941d9
-  data.tar.gz: ddbe4e28550e8d428843907be443c0f6e67864e9d598f6cb217eb47b4af8501559284b3f2806a583cbd7363e7f858da79995aafa469c0067b5f183427ede7b1f
+  metadata.gz: af6ba306f236fb01dd140f63ce51c764fdee655a7f1282d7adad87d8586e4838d43f096ca79a4053dbab703afdc6fa1806d3e20ea6b6afa75c7c70bf6d3885f3
+  data.tar.gz: db9bc204d61dcdb4c3e9d0b8f9034f935dd38d4291b71b37e61a29889240b27667400e5c48333d2cf39e2d6513b5af70368a354a8a20fd5a543558b07b68f700

data/lib/mpp/challenge.rb

@@ -58,19 +58,29 @@ module Mpp
       Mpp::Parsing.parse_www_authenticate(header)
     end
 
-    # Parse multiple Payment challenges from a merged WWW-Authenticate header.
-    # Handles RFC 9110 §11.6.1 comma-separated authentication schemes.
-    def self.from_www_authenticate_list(header)
+    # Split a merged WWW-Authenticate header value into the individual
+    # `Payment ...` challenge chunks it contains, handling RFC 9110 §11.6.1
+    # comma-separated authentication schemes. Returns the raw chunk strings so
+    # callers can parse each challenge independently; a malformed chunk then
+    # does not prevent the remaining chunks from being considered.
+    def self.www_authenticate_chunks(header)
       payment_scheme_indices(header).map do |start_idx|
         # End each chunk at the next scheme boundary of any kind, so an
         # interleaved non-Payment scheme (e.g. "Payment ..., Bearer ...,
         # Payment ...") is not folded into the preceding Payment challenge.
         end_idx = next_auth_scheme_index(header, start_idx + "Payment".length) || header.length
-        chunk = T.must(header[start_idx...end_idx]).sub(/,\s*$/, "")
-        from_www_authenticate(chunk)
+        T.must(header[start_idx...end_idx]).sub(/,\s*$/, "")
       end
     end
 
+    # Parse every Payment challenge from a merged WWW-Authenticate header.
+    # Raises Mpp::ParseError on the first malformed chunk; callers that need to
+    # tolerate a malformed challenge among valid ones should iterate
+    # `www_authenticate_chunks` and parse each chunk independently instead.
+    def self.from_www_authenticate_list(header)
+      www_authenticate_chunks(header).map { |chunk| from_www_authenticate(chunk) }
+    end
+
     def self.payment_scheme_indices(header)
       indices = []
       each_auth_scheme_index(header) do |index, scheme|

data/lib/mpp/client/transport.rb

@@ -205,12 +205,13 @@ module Mpp
       sig { params(www_auth_headers: T.untyped, input: T.untyped, response: T.untyped).returns(T::Array[T.untyped]) }
       def find_matching_challenge(www_auth_headers, input: nil, response: nil)
         www_auth_headers.each do |header|
-          next unless header.downcase.start_with?("payment ")
-
-          begin
-            parsed = Mpp::Challenge.from_www_authenticate(header)
+          Mpp::Challenge.www_authenticate_chunks(header).each do |chunk|
+            parsed = Mpp::Challenge.from_www_authenticate(chunk)
             return [parsed, @methods[parsed.method]] if @methods.key?(parsed.method)
           rescue Mpp::ParseError => e
+            # Skip a malformed challenge but keep scanning the rest: a bad chunk
+            # earlier in a merged value must not hide a supported challenge that
+            # follows it.
             if @events.has_handlers?(Mpp::Events::PAYMENT_FAILED)
               @events.emit(Mpp::Events::PAYMENT_FAILED, {
                 error: e,

data/lib/mpp/server/middleware.rb

@@ -5,34 +5,37 @@ require "stringio"
 
 module Mpp
   module Server
-    # Rack middleware that intercepts requests requiring payment.
+    # Rack middleware that gates endpoints behind payment verification.
     #
-    # The downstream app signals payment is needed by setting env["mpp.charge"]
-    # to a hash with at least :amount, and optionally :currency, :recipient,
-    # :description, :expires, etc.
+    # The pricing proc determines which requests require payment and at what
+    # price. It receives the Rack env and must return a charge options hash
+    # (with at least :amount) or nil for free endpoints. The pricing proc
+    # MUST NOT produce side effects.
     #
-    # Example:
-    #   use Mpp::Server::Middleware, handler: my_handler
+    # Payment is verified BEFORE the downstream app runs — if verification
+    # fails, the app never executes and a 402 challenge is returned.
     #
-    #   # In your app:
-    #   env["mpp.charge"] = { amount: "1.00" }
+    # Example:
+    #   use Mpp::Server::Middleware,
+    #       handler: my_handler,
+    #       pricing: ->(env) { {amount: "1.00"} if env["PATH_INFO"] == "/paid" }
     class Middleware
       extend T::Sig
 
-      sig { params(app: T.untyped, handler: Mpp::Server::MppHandler).void }
-      def initialize(app, handler:)
+      sig { params(app: T.untyped, handler: Mpp::Server::MppHandler, pricing: T.untyped).void }
+      def initialize(app, handler:, pricing:)
         @app = T.let(app, T.untyped)
         @handler = T.let(handler, Mpp::Server::MppHandler)
+        @pricing = T.let(pricing, T.untyped)
       end
 
       sig { params(env: T.untyped).returns(T::Array[T.untyped]) }
       def call(env)
+        charge_opts = @pricing.call(env)
+        return @app.call(env) unless charge_opts
+
         authorization = env["HTTP_AUTHORIZATION"]
         body_capture = capture_request_body(env)
-        status, headers, body = @app.call(env)
-
-        charge_opts = env["mpp.charge"]
-        return [status, headers, body] unless charge_opts
 
         request_body = body_capture&.materialize
         env["rack.input"] = StringIO.new(request_body || "") if body_capture
@@ -49,6 +52,7 @@ module Mpp
         end
 
         _credential, receipt = result
+        status, headers, body = @app.call(env)
         headers["Payment-Receipt"] = receipt.to_payment_receipt
         self.class.mark_authorization_bound_response(headers)
 

data/lib/mpp/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module Mpp
-  VERSION = "0.1.3"
+  VERSION = "0.1.4"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mpp-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.4
 platform: ruby
 authors:
 - Stripe