pay 11.6.1 → 11.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b562e4a4f9648149c46c4932ad4c770cb6c9f93bc424b84ba8619cb7282170bc
-  data.tar.gz: c8328e7c5b1d4770131515d56fcd8b8a6170f6d427bbda29159d00d8dd8244f3
+  metadata.gz: d601b9570c286a5518fad5444be12f07069b6d0b8afe8a879089040f77c7f7be
+  data.tar.gz: 1b81304fce9611e742d5cc2c8638a51634f174b9f68a319c47956329c8e7e183
 SHA512:
-  metadata.gz: 272d38c42d2be1bfaf55929c429b15164c2dd2f64eca8571f4d868a0df0262f8599b5ac81c23539cf24c8a263b5bc8670b7f075871d79abdae1fa4983474ded4
-  data.tar.gz: d56318ddb06905b38bf3869b8dea5415ff8159b0a1b70d0e228389e1f23cc060a8fbe153028f682e7b6775688aae82a7d2514b560ea965e089b6076a339acb16
+  metadata.gz: de12f02fef6df24c30a05bf5e42b8905cac6ecdd258015d63e9b58e1985c930c5deae3f6992d92d3efd7b3cdae0f37a7ec8309c4fb85bb5956685c9f84374abe
+  data.tar.gz: f81848b21ebb2b75511aa6ed8fdd7df9f68449a8ac497669690de7310e2c3a3a5a4b795fce6017e11494dc2138b12b7829675ae5f9e8533a3cf63ce9d6f7358c

data/app/controllers/pay/webhooks/paddle_billing_controller.rb

@@ -36,7 +36,8 @@ module Pay
         digest = OpenSSL::Digest.new("sha256")
 
         hmac = OpenSSL::HMAC.hexdigest(digest, key, data)
-        hmac == h1
+        return false if h1.nil? || hmac.bytesize != h1.bytesize
+        ActiveSupport::SecurityUtils.secure_compare(hmac, h1)
       end
 
       def verify_params

data/app/mailers/pay/user_mailer.rb

@@ -2,7 +2,7 @@ module Pay
   class UserMailer < Pay.parent_mailer.constantize
     def receipt
       if params[:pay_charge].respond_to? :receipt
-        attachments[params[:pay_charge].filename] = params[:pay_charge].receipt
+        attachments[params[:pay_charge].receipt_filename] = params[:pay_charge].receipt
       end
 
       mail mail_arguments

data/app/models/pay/stripe/customer.rb

@@ -175,7 +175,7 @@ module Pay
         }
 
         # Hosted (the default) checkout sessions require a success_url and cancel_url
-        if ["", "hosted"].include? options[:ui_mode].to_s
+        if ["", "hosted_page"].include?(options[:ui_mode].to_s)
           args[:success_url] = merge_session_id_param(options.delete(:success_url) || root_url)
           args[:cancel_url] = merge_session_id_param(options.delete(:cancel_url) || root_url)
         end

data/app/models/pay/stripe/subscription.rb

@@ -334,7 +334,7 @@ module Pay
 
       # Retries the latest invoice for a Past Due subscription and attempts to pay it
       def retry_failed_payment(payment_intent_id: nil)
-        payment_intent_id ||= api_record.latest_invoice.payment_intent.id
+        payment_intent_id ||= api_record.latest_invoice.payments.first.payment.payment_intent
         payment_intent = ::Stripe::PaymentIntent.retrieve({id: payment_intent_id}, stripe_options)
 
         payment_intent = if payment_intent.status == "requires_payment_method"

data/app/models/pay/subscription.rb

@@ -3,7 +3,7 @@ module Pay
     STATUSES = %w[incomplete incomplete_expired trialing active past_due canceled unpaid paused]
 
     # Associations
-    belongs_to :customer
+    belongs_to :customer, touch: true
     belongs_to :payment_method, optional: true, primary_key: :processor_id
     has_many :charges
 

data/lib/pay/stripe.rb

@@ -43,6 +43,15 @@ module Pay
     def self.setup
       ::Stripe.api_key = private_key
 
+      # When private_key is a Stripe Organizations API key (sk_org_...),
+      # every request must identify the target account with the
+      # Stripe-Context header. stripe-ruby applies this configuration to all
+      # requests automatically. Regular account keys set no context and are
+      # unaffected. https://docs.stripe.com/keys/organization-api-keys
+      # (Assigned through Stripe.config: the Stripe module delegates
+      # stripe_account but not stripe_context.)
+      ::Stripe.config.stripe_context = context if context
+
       # Used by Stripe to identify Pay for support
       ::Stripe.set_app_info("PayRails", partner_id: "pp_partner_IqhY0UExnJYLxg", version: Pay::VERSION, url: "https://github.com/pay-rails/pay")
 
@@ -60,6 +69,14 @@ module Pay
       find_value_by_name(:stripe, :private_key)
     end
 
+    # Optional. The account (acct_...) that API requests should act on when
+    # using a Stripe Organizations API key. Resolved like every other Stripe
+    # credential: ENV["STRIPE_CONTEXT"], then env-scoped, then unscoped
+    # Rails credentials.
+    def self.context
+      find_value_by_name(:stripe, :context)
+    end
+
     def self.signing_secret
       find_value_by_name(:stripe, :signing_secret)
     end
@@ -115,6 +132,7 @@ module Pay
         # If a customer's payment source was deleted in Stripe, we should update as well
         events.subscribe "stripe.payment_method.attached", Pay::Stripe::Webhooks::PaymentMethodAttached.new
         events.subscribe "stripe.payment_method.updated", Pay::Stripe::Webhooks::PaymentMethodUpdated.new
+        events.subscribe "stripe.payment_method.automatically_updated", Pay::Stripe::Webhooks::PaymentMethodUpdated.new
         events.subscribe "stripe.payment_method.card_automatically_updated", Pay::Stripe::Webhooks::PaymentMethodUpdated.new
         events.subscribe "stripe.payment_method.detached", Pay::Stripe::Webhooks::PaymentMethodDetached.new
 

data/lib/pay/version.rb

@@ -1,3 +1,3 @@
 module Pay
-  VERSION = "11.6.1"
+  VERSION = "11.7.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pay
 version: !ruby/object:Gem::Version
-  version: 11.6.1
+  version: 11.7.0
 platform: ruby
 authors:
 - Jason Charnes
@@ -189,7 +189,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.17
 specification_version: 4
 summary: Payments engine for Ruby on Rails
 test_files: []