paystack_sdk 0.4.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da9c2a9982f9eb4ec639e53651b7a54a20e0adda1d0f3f21b2add3bcf51194b2
-  data.tar.gz: 12bc63e0ebc8e8448f2a73cbabe2230af8c0f783857b3931dc72973dfcb3581a
+  metadata.gz: 4d2f7a168f41486d2df726ca96f7f6ff1864e4f66b46a019a3894385c5a74a16
+  data.tar.gz: d2f63d9282c6fd568c8e9c16d7b91bbb65fe874fea489420af92f0336f9431e2
 SHA512:
-  metadata.gz: ebf5ddb53f888f1d9aaa017b4aa9af1542f28aa563654f13de77ffc78f83043073c7aa2134e030853695e06dcc98ee88e5688d1e682462c4036df239e8605f26
-  data.tar.gz: 2f7b2710265dcab7de4367ab68da1e7112e963d6a165ed3024f7881b81dc44032b0c706afddf896d52a4c0e5999208c397ae55c78ad07c5c5fefc2af13bc865d
+  metadata.gz: 9470f85d1e68ec70caa4b50e02c3ab001eef9490d2f562294c1067316ca12b43c6f6f74e876750b1ef8da6d2f88c88b56f0d2eeb234e95d92162fd4e09afd6ec
+  data.tar.gz: 92d8ddbc6768188517ad0dc39b36b64adb0faac6c13fa4a3c1b8bd29f6c8977f028b18c3ef892bd7e483c801eed68783a4e35607acf2cbd51fb3ac349cb1a70f

data/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [0.4.1] - 2026-10-10
+
+### Security
+
+- The secret key no longer appears when a `Client`, a resource (`client.transactions`...) or the Faraday connection is inspected. Ruby's default `inspect` and `pp` printed every instance variable, and the connection holds the key in its `Authorization` header, so `puts client`, `Rails.logger.info(client)`, an error page, or an error tracker that serialises locals wrote the key out. `Client#inspect` and `Resources::Base#inspect` now return only the class name, and the connection built by the SDK (and its `headers`) inspect without the key. The key is still sent. Errors raised by the SDK, their causes and `Response` never contained the key (checked). Affects every version before 0.4.1 (0.0.x to 0.4.0): if you may have logged one of these objects, rotate the key. A connection you pass in yourself (`Client.new(connection)`) is yours, and its own `inspect` is unchanged.
+
 ## [0.4.0] - 2026-10-09
 
 ### Added

data/lib/paystack_sdk/client.rb

@@ -344,6 +344,15 @@ module PaystackSdk
       @terminals ||= Resources::Terminals.new(@connection)
     end
 
+    # A short description that never includes the secret key. Ruby's default `inspect` prints every
+    # instance variable, and the connection holds the key in its `Authorization` header, so logging,
+    # `pp`, an error page or an error tracker would otherwise write the key out.
+    #
+    # @return [String]
+    def inspect
+      "#<#{self.class.name}>"
+    end
+
     private
 
     # The secret key a connection sends, read from its Authorization header.

data/lib/paystack_sdk/resources/base.rb

@@ -35,6 +35,13 @@ module PaystackSdk
         @connection = initialize_connection(connection, secret_key: secret_key, **options)
       end
 
+      # A short description that never includes the secret key; see {PaystackSdk::Client#inspect}.
+      #
+      # @return [String]
+      def inspect
+        "#<#{self.class.name}>"
+      end
+
       private
 
       # Handles the API response, wrapping it in a Response object.

data/lib/paystack_sdk/utils/connection_utils.rb

@@ -92,7 +92,7 @@ module PaystackSdk
         retry_non_idempotent: false)
         validate_connection_options!(timeout:, open_timeout:, max_retries:, retry_interval:)
 
-        Faraday.new(url: BASE_URL, request: {timeout:, open_timeout:}) do |conn|
+        connection = Faraday.new(url: BASE_URL, request: {timeout:, open_timeout:}) do |conn|
           conn.use Middleware::TransportErrors
           if max_retries > 0
             conn.request :retry, retry_options(max_retries, retry_interval, retry_non_idempotent)
@@ -104,10 +104,21 @@ module PaystackSdk
           conn.headers["User-Agent"] = "paystack_sdk/#{PaystackSdk::VERSION}"
           conn.adapter Faraday.default_adapter
         end
+        redact_secret_key(connection)
       end
 
       private
 
+      # Faraday's default `inspect` prints the headers, and so the secret key. Replace it, on the
+      # connection and on its headers, so logging or `pp` of either never writes the key out.
+      def redact_secret_key(connection)
+        connection.define_singleton_method(:inspect) { "#<#{self.class.name} #{url_prefix}>" }
+        connection.headers.define_singleton_method(:inspect) do
+          to_h.merge("Authorization" => "[REDACTED]").inspect
+        end
+        connection
+      end
+
       def validate_connection_options!(timeout:, open_timeout:, max_retries:, retry_interval:)
         {timeout:, open_timeout:}.each do |name, value|
           raise ArgumentError, "#{name} must be a positive number" unless value.is_a?(Numeric) && value > 0

data/lib/paystack_sdk/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module PaystackSdk
-  VERSION = "0.4.0"
+  VERSION = "0.4.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: paystack_sdk
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Maxwell Nana Forson (theLazyProgrammer)