paddle 2.9 → 3.0

data/lib/paddle/webhook.rb

@@ -0,0 +1,65 @@
+require "json"
+require "openssl"
+
+module Paddle
+  # Verifies the Paddle-Signature header sent with Billing webhooks.
+  # https://developer.paddle.com/webhooks/signature-verification
+  class Webhook
+    class SignatureVerificationError < Paddle::Error; end
+
+    # Paddle's SDKs reject webhooks with a timestamp more than 5 seconds from the current time
+    DEFAULT_TOLERANCE = 5
+
+    class << self
+      # payload must be the raw request body, before any JSON parsing. secret is the
+      # endpoint secret key for the notification destination. Pass tolerance: nil to
+      # skip the timestamp check, e.g. when replaying a stored webhook in tests.
+      def verify!(payload:, signature:, secret:, tolerance: DEFAULT_TOLERANCE)
+        raise SignatureVerificationError, "Missing Paddle-Signature header" if signature.nil? || signature.empty?
+        raise SignatureVerificationError, "Missing webhook secret" if secret.nil? || secret.empty?
+
+        timestamp, signatures = parse_signature(signature)
+
+        if tolerance && (Time.now.to_i - timestamp).abs > tolerance
+          raise SignatureVerificationError, "Timestamp is outside the tolerance of #{tolerance} seconds"
+        end
+
+        expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}:#{payload}")
+
+        # During secret rotation Paddle sends more than one h1, so any match is valid
+        unless signatures.any? { |h1| OpenSSL.secure_compare(expected, h1) }
+          raise SignatureVerificationError, "Signature doesn't match the payload"
+        end
+
+        true
+      end
+
+      def valid?(**args)
+        verify!(**args)
+      rescue SignatureVerificationError
+        false
+      end
+
+      # Verifies the signature, then returns the payload as a Paddle::Event
+      def construct_event(payload:, signature:, secret:, tolerance: DEFAULT_TOLERANCE)
+        verify!(payload: payload, signature: signature, secret: secret, tolerance: tolerance)
+        Event.new(JSON.parse(payload))
+      end
+
+      private
+
+      # Parses "ts=1671552777;h1=eb4d0dc8..." into the timestamp and a list of h1 signatures
+      def parse_signature(header)
+        parts = header.split(";").map { |part| part.split("=", 2) }
+        timestamp = parts.find { |key, _| key == "ts" }&.last
+        signatures = parts.select { |key, _| key == "h1" }.map(&:last).compact
+
+        unless timestamp&.match?(/\A\d+\z/) && signatures.any?
+          raise SignatureVerificationError, "Paddle-Signature header is malformed"
+        end
+
+        [ timestamp.to_i, signatures ]
+      end
+    end
+  end
+end

data/lib/paddle.rb

@@ -14,19 +14,41 @@ module Paddle
   autoload :ErrorFactory, "paddle/error_generator"
 
   autoload :Object, "paddle/object"
+  autoload :Webhook, "paddle/webhook"
 
   class << self
     attr_writer :config
   end
 
+  # Configures the global config, even inside a with_config block
   def self.configure
-    yield(config) if block_given?
+    yield(global_config) if block_given?
   end
 
+  # The config for the current request: the with_config override if there is one, or the global config
   def self.config
+    Fiber[:paddle_config] || global_config
+  end
+
+  def self.global_config
     @config ||= Paddle::Configuration.new
   end
 
+  # Uses a different API key, environment or version for everything in the block, e.g. to make
+  # requests for another Paddle account. The override is stored in fiber storage, so it only
+  # applies to the current thread or fiber, and to threads and fibers started inside the block.
+  #
+  #   Paddle.with_config(api_key: account.paddle_api_key) do
+  #     Paddle::Subscription.list
+  #   end
+  def self.with_config(**options)
+    previous = Fiber[:paddle_config]
+    Fiber[:paddle_config] = config.merge(**options)
+    yield
+  ensure
+    Fiber[:paddle_config] = previous
+  end
+
   # Load Billing APIs
   autoload :Product, "paddle/models/product"
   autoload :Price, "paddle/models/price"
@@ -51,10 +73,14 @@ module Paddle
   autoload :PortalSession, "paddle/models/portal_session"
   autoload :PaymentMethod, "paddle/models/payment_method"
   autoload :ClientToken, "paddle/models/client_token"
+  autoload :Metric, "paddle/models/metric"
+  autoload :ExploreEntity, "paddle/models/explore_entity"
+  autoload :ExploreResult, "paddle/models/explore_result"
 
   autoload :NotificationLog, "paddle/models/notification_log"
   autoload :CreditBalance, "paddle/models/credit_balance"
   autoload :CustomerAuthToken, "paddle/models/customer_auth_token"
+  autoload :SubscriptionHistory, "paddle/models/subscription_history"
 
   # Load Classic APIs
   module Classic

metadata

@@ -1,11 +1,11 @@
 --- !ruby/object:Gem::Specification
 name: paddle
 version: !ruby/object:Gem::Version
-  version: '2.9'
+  version: '3.0'
 platform: ruby
 authors:
 - Dean Perry
-bindir: exe
+bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
@@ -13,58 +13,31 @@ dependencies:
   name: faraday
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '2.11'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '2.11'
-- !ruby/object:Gem::Dependency
-  name: ostruct
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
+        version: 2.14.3
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 0.6.0
+        version: '3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.6.0
-- !ruby/object:Gem::Dependency
-  name: cgi
-  requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
+        version: 2.14.3
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '3'
 email:
-- dean@deanpcmad.com
+- dean@voupe.com
 executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".env.example"
-- ".rubocop.yml"
-- Gemfile
-- Gemfile.lock
+- CHANGELOG.md
+- LICENSE.txt
 - README.md
-- Rakefile
-- bin/console
-- bin/setup
 - lib/paddle.rb
 - lib/paddle/classic/client.rb
 - lib/paddle/classic/collection.rb
@@ -109,6 +82,9 @@ files:
 - lib/paddle/models/discount_group.rb
 - lib/paddle/models/event.rb
 - lib/paddle/models/event_type.rb
+- lib/paddle/models/explore_entity.rb
+- lib/paddle/models/explore_result.rb
+- lib/paddle/models/metric.rb
 - lib/paddle/models/notification.rb
 - lib/paddle/models/notification_log.rb
 - lib/paddle/models/notification_setting.rb
@@ -123,16 +99,18 @@ files:
 - lib/paddle/models/simulation_run_event.rb
 - lib/paddle/models/simulation_type.rb
 - lib/paddle/models/subscription.rb
+- lib/paddle/models/subscription_history.rb
 - lib/paddle/models/transaction.rb
 - lib/paddle/object.rb
 - lib/paddle/version.rb
-- mise.toml
-- paddle.gemspec
-homepage: https://github.com/deanpcmad/paddle
-licenses: []
+- lib/paddle/webhook.rb
+homepage: https://github.com/d34ndev/paddle
+licenses:
+- MIT
 metadata:
-  homepage_uri: https://github.com/deanpcmad/paddle
-  source_code_uri: https://github.com/deanpcmad/paddle
+  homepage_uri: https://github.com/d34ndev/paddle
+  source_code_uri: https://github.com/d34ndev/paddle
+  changelog_uri: https://github.com/d34ndev/paddle/blob/main/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib
@@ -140,14 +118,14 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Ruby library for the Paddle Billing & Classic APIs
 test_files: []

data/.env.example

@@ -1,3 +0,0 @@
-PADDLE_VENDOR_ID=
-PADDLE_VENDOR_AUTH_CODE=
-PADDLE_API_KEY=

data/.rubocop.yml

@@ -1,11 +0,0 @@
-# Omakase Ruby styling for Rails
-inherit_gem: { rubocop-rails-omakase: rubocop.yml }
-
-# Overwrite or add rules to create your own house style
-#
-# # Use `[a, [b, c]]` not `[ a, [ b, c ] ]`
-# Layout/SpaceInsideArrayLiteralBrackets:
-#   Enabled: false
-
-Rails/RefuteMethods:
-  Enabled: false

data/Gemfile

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-source "https://rubygems.org"
-
-# Specify your gem's dependencies in paddle.gemspec
-gemspec
-
-gem "rake", "~> 13.0"
-
-gem "minitest", "~> 5.0"
-gem "dotenv"
-gem "vcr"
-gem "rubocop-rails-omakase", require: false

data/Gemfile.lock

@@ -1,110 +0,0 @@
-PATH
-  remote: .
-  specs:
-    paddle (2.9)
-      cgi
-      faraday (~> 2.11)
-      ostruct (~> 0.6.0)
-
-GEM
-  remote: https://rubygems.org/
-  specs:
-    activesupport (8.1.1)
-      base64
-      bigdecimal
-      concurrent-ruby (~> 1.0, >= 1.3.1)
-      connection_pool (>= 2.2.5)
-      drb
-      i18n (>= 1.6, < 2)
-      json
-      logger (>= 1.4.2)
-      minitest (>= 5.1)
-      securerandom (>= 0.3)
-      tzinfo (~> 2.0, >= 2.0.5)
-      uri (>= 0.13.1)
-    ast (2.4.3)
-    base64 (0.3.0)
-    bigdecimal (3.3.1)
-    cgi (0.5.1)
-    concurrent-ruby (1.3.5)
-    connection_pool (3.0.2)
-    dotenv (3.2.0)
-    drb (2.2.3)
-    faraday (2.14.0)
-      faraday-net_http (>= 2.0, < 3.5)
-      json
-      logger
-    faraday-net_http (3.4.2)
-      net-http (~> 0.5)
-    i18n (1.14.7)
-      concurrent-ruby (~> 1.0)
-    json (2.18.0)
-    language_server-protocol (3.17.0.5)
-    lint_roller (1.1.0)
-    logger (1.7.0)
-    minitest (5.27.0)
-    net-http (0.8.0)
-      uri (>= 0.11.1)
-    ostruct (0.6.3)
-    parallel (1.27.0)
-    parser (3.3.10.0)
-      ast (~> 2.4.1)
-      racc
-    prism (1.6.0)
-    racc (1.8.1)
-    rack (3.2.4)
-    rainbow (3.1.1)
-    rake (13.3.1)
-    regexp_parser (2.11.3)
-    rubocop (1.82.1)
-      json (~> 2.3)
-      language_server-protocol (~> 3.17.0.2)
-      lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
-      parser (>= 3.3.0.2)
-      rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.48.0, < 2.0)
-      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.48.0)
-      parser (>= 3.3.7.2)
-      prism (~> 1.4)
-    rubocop-performance (1.26.1)
-      lint_roller (~> 1.1)
-      rubocop (>= 1.75.0, < 2.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
-    rubocop-rails (2.34.2)
-      activesupport (>= 4.2.0)
-      lint_roller (~> 1.1)
-      rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
-      rubocop-ast (>= 1.44.0, < 2.0)
-    rubocop-rails-omakase (1.1.0)
-      rubocop (>= 1.72)
-      rubocop-performance (>= 1.24)
-      rubocop-rails (>= 2.30)
-    ruby-progressbar (1.13.0)
-    securerandom (0.4.1)
-    tzinfo (2.0.6)
-      concurrent-ruby (~> 1.0)
-    unicode-display_width (3.2.0)
-      unicode-emoji (~> 4.1)
-    unicode-emoji (4.2.0)
-    uri (1.1.1)
-    vcr (6.3.1)
-      base64
-
-PLATFORMS
-  x86_64-linux
-
-DEPENDENCIES
-  dotenv
-  minitest (~> 5.0)
-  paddle!
-  rake (~> 13.0)
-  rubocop-rails-omakase
-  vcr
-
-BUNDLED WITH
-  4.0.3

data/Rakefile

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-require "bundler/gem_tasks"
-require "rake/testtask"
-
-Rake::TestTask.new(:test) do |t|
-  t.libs << "test"
-  t.libs << "lib"
-  t.test_files = FileList["test/**/*_test.rb"]
-end
-
-task default: :test

data/bin/console

@@ -1,25 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require "bundler/setup"
-require "paddle"
-
-# Load environment variables from .env file
-require 'dotenv/load'
-
-# You can add fixtures and/or initialization code here to make experimenting
-# with your gem easier. You can also use a different console, if you like.
-
-# (If you use this, don't forget to add pry to your Gemfile!)
-# require "pry"
-# Pry.start
-
-@client_classic = Paddle::Classic::Client.new(vendor_id: ENV["PADDLE_VENDOR_ID"], vendor_auth_code: ENV["PADDLE_VENDOR_AUTH_CODE"], sandbox: true)
-
-Paddle.configure do |config|
-  config.environment = :sandbox
-  config.api_key = ENV["PADDLE_API_KEY"]
-end
-
-require "irb"
-IRB.start(__FILE__)

data/bin/setup

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-IFS=$'\n\t'
-set -vx
-
-bundle install
-
-# Do any other automated setup that you need to do here

data/mise.toml

@@ -1,2 +0,0 @@
-[tools]
-ruby = "4.0"

data/paddle.gemspec

@@ -1,32 +0,0 @@
-# frozen_string_literal: true
-
-require_relative "lib/paddle/version"
-
-Gem::Specification.new do |spec|
-  spec.name          = "paddle"
-  spec.version       = Paddle::VERSION
-  spec.authors       = [ "Dean Perry" ]
-  spec.email         = [ "dean@deanpcmad.com" ]
-
-  spec.summary       = "Ruby library for the Paddle Billing & Classic APIs"
-  spec.homepage      = "https://github.com/deanpcmad/paddle"
-  spec.required_ruby_version = ">= 2.6.0"
-
-  spec.metadata["homepage_uri"] = spec.homepage
-  spec.metadata["source_code_uri"] = "https://github.com/deanpcmad/paddle"
-
-  # Specify which files should be added to the gem when it is released.
-  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
-  spec.files = Dir.chdir(File.expand_path(__dir__)) do
-    `git ls-files -z`.split("\x0").reject do |f|
-      (f == __FILE__) || f.match(%r{\A(?:(?:test|spec|features)/|\.(?:git|travis|circleci)|appveyor)})
-    end
-  end
-  spec.bindir        = "exe"
-  spec.executables   = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
-  spec.require_paths = [ "lib" ]
-
-  spec.add_dependency "faraday", "~> 2.11"
-  spec.add_dependency "ostruct", "~> 0.6.0"
-  spec.add_dependency "cgi"
-end