recurly 2.0.14 → 2.1.0

data/README.markdown

@@ -12,7 +12,7 @@ Recurly is packaged as a Ruby gem. We recommend you install it with
 [Bundler](http://gembundler.com/) by adding the following line to your Gemfile:
 
 ``` ruby
-gem 'recurly', '~> 2.0.13'
+gem 'recurly', '~> 2.1.0'
 ```
 
 Recurly will automatically use [Nokogiri](http://nokogiri.org/) (for a nice
@@ -62,7 +62,7 @@ Instructions and examples are available on
 [Recurly's documentation site](http://docs.recurly.com/api/basics).
 
 Recurly's gem API is available
-[here](http://rubydoc.info/gems/recurly/2.0.10/frames).
+[here](http://rubydoc.info/gems/recurly/2.1.0/frames).
 
 
 ## Contributing

data/bin/recurly

@@ -18,8 +18,12 @@ options = {}
 OptionParser.new do |opts|
   opts.banner = 'Usage: recurly [options] -- [irb options]'
 
-  opts.on '-k', '--api-key [api key]', 'Your API key' do |api_key|
-    options[:api_key] = api_key
+  opts.on '-k', '--api-key [api key]', 'Your API key' do |key|
+    options[:api_key] = key
+  end
+
+  opts.on '-K', '--private-key [private key]', 'Your Recurly.js private key' do |key|
+    options[:private_key] = key
   end
 
   opts.on '-v', '--verbose', 'Show full request/response log' do |verbose|
@@ -47,6 +51,7 @@ end.parse!
 
 require 'recurly/all'
 Recurly.api_key = options[:api_key] || ENV['RECURLY_API_KEY']
+Recurly.js.private_key = options[:private_key] || ENV['RECURLY_JS_PRIVATE_KEY']
 include Recurly
 
 require 'logger'

data/lib/recurly.rb

@@ -57,8 +57,6 @@ module Recurly
     end
 
     # Assigns a logger to log requests/responses and more.
-    # The logger can only be set if the environment variable
-    # `RECURLY_INSECURE_DEBUG` equals `true`.
     #
     # @return [Logger, nil]
     # @example
@@ -70,26 +68,10 @@ module Recurly
     #   Recurly.logger = nil # Or Recurly.logger = Logger.new nil
     attr_accessor :logger
 
-    def logger=(logger)
-      if ENV['RECURLY_INSECURE_DEBUG'].to_s.downcase == 'true'
-        @logger = logger
-        puts <<-MSG
-        [WARNING] Recurly logger enabled. The logger has the potential to leak
-        PII and should never be used in production environments.
-        MSG
-      else
-        puts <<-MSG
-        [WARNING] Recurly logger has been disabled. If you wish to use it,
-        only do so in a non-production environment and make sure
-        the `RECURLY_INSECURE_DEBUG` environment variable is set to `true`.
-        MSG
-      end
-    end
-
     # Convenience logging method includes a Logger#progname dynamically.
     # @return [true, nil]
     def log level, message
-      logger and logger.send(level, name) { message }
+      logger.send(level, name) { message }
     end
   end
 end

data/lib/recurly/api.rb

@@ -15,7 +15,6 @@ module Recurly
     require 'recurly/api/errors'
 
     @@base_uri = "https://api.recurly.com/v2/"
-    @@valid_domains = [".recurly.com"]
 
     class << self
       # @return [String]
@@ -56,13 +55,6 @@ module Recurly
         URI.parse @@base_uri
       end
 
-      def validate_uri!(uri)
-        domain = @@valid_domains.detect { |d| uri.host.end_with?(d) }
-        unless domain
-          raise ArgumentError, "URI #{uri} is invalid. You may only make requests to a Recurly domain."
-        end
-      end
-
       # @return [String]
       def user_agent
         "Recurly/#{Version}; #{RUBY_DESCRIPTION}"

data/lib/recurly/api/net_http_adapter.rb

@@ -39,9 +39,8 @@ module Recurly
           if options[:params] && !options[:params].empty?
             uri += "?#{options[:params].map { |k, v| "#{k}=#{v}" }.join '&' }"
           end
-          self.validate_uri!(uri)
           request = METHODS[method].new uri.request_uri, head
-          request.basic_auth Recurly.api_key, nil
+          request.basic_auth(*[Recurly.api_key, nil].flatten[0, 2])
           if options[:body]
             head['Content-Type'] = content_type
             request.body = options[:body]

data/lib/recurly/helper.rb

@@ -36,6 +36,13 @@ module Recurly
       indifferent
     end
 
+    def stringify_keys! hash
+      hash.keys.each do |key|
+        stringify_keys! hash[key] if hash[key].is_a? Hash
+        hash[key.to_s] = hash.delete key if key.is_a? Symbol
+      end
+    end
+
     extend self
   end
 end

data/lib/recurly/js.rb

@@ -1,4 +1,5 @@
 require 'openssl'
+require 'base64'
 
 module Recurly
   # A collection of helper methods to use to verify
@@ -8,8 +9,8 @@ module Recurly
     class RequestForgery < Error
     end
 
-    # Used to prevent strings from being escaped during digest.
-    class SafeString < String
+    # Raised when the timestamp is over an hour old. Prevents replay attacks.
+    class RequestTooOld < RequestForgery
     end
 
     class << self
@@ -22,46 +23,36 @@ module Recurly
       end
       attr_writer :private_key
 
-      # @return [String]
-      def sign_subscription plan_code, account_code, extras = {}
-        sign 'subscriptioncreate', {
-          'plan_code' => plan_code,
-          'account_code' => account_code
-         }, extras
-      end
-
-      # @return [String]
-      def sign_billing_info account_code, extras = {}
-        sign 'billinginfoupdate', { 'account_code' => account_code }, extras
-      end
-
-      # @return [String]
-      def sign_transaction(
-        amount_in_cents, currency = nil, account_code = nil, extras = {}
-      )
-        sign 'transactioncreate', {
-          'amount_in_cents' => amount_in_cents,
-          'currency'        => currency || Recurly.default_currency,
-          'account_code'    => account_code
-        }, extras
-      end
-
-      # @return [true]
-      # @raise [RequestForgery] If verification fails.
-      def verify_subscription! params
-        verify! 'subscriptioncreated', params
-      end
-
-      # @return [true]
-      # @raise [RequestForgery] If verification fails.
-      def verify_billing_info! params
-        verify! 'billinginfoupdated', params
+      # Create a signature for a given hash for Recurly.js
+      # @param Array of objects and hash of data to sign
+      def sign *records
+        data = records.last.is_a?(Hash) ? records.pop.dup : {}
+        records.each do |record|
+          data[record.class.member_name] = record.signable_attributes
+        end
+        Helper.stringify_keys! data
+        data['timestamp'] ||= Time.now.to_i
+        data['nonce'] ||= Base64.encode64(
+          OpenSSL::Random.random_bytes(32)
+        ).gsub(/\W/, '')
+        unsigned = to_query data
+        signed = OpenSSL::HMAC.hexdigest 'sha1', private_key, unsigned
+        [signed, unsigned].join '|'
       end
 
-      # @return [true]
-      # @raise [RequestForgery] If verification fails.
-      def verify_transaction! params
-        verify! 'transactioncreated', params
+      # Fetches a record using a token provided by Recurly.js.
+      # @param [String] Token to look up
+      # @return [BillingInfo, Invoice, Subscription] The record created or
+      #   modified by Recurly.js
+      # @raise [API::NotFound] No record was found for the token provided.
+      # @example
+      #   begin
+      #     Recurly.js.fetch params[:token]
+      #   rescue Recurly::API::NotFound
+      #     # Handle potential tampering here.
+      #   end
+      def fetch token
+        Resource.from_response API.get "recurly_js/result/#{token}"
       end
 
       # @return [String]
@@ -71,61 +62,14 @@ module Recurly
 
       private
 
-      def collect_keypaths extras, prefix = nil
-        if extras.is_a? Hash
-          extras.map { |key, value|
-            collect_keypaths value, prefix ? "#{prefix}.#{key}" : key.to_s
-          }.flatten.sort
-        else
-          prefix
-        end
-      end
-
-      def sign claim, params, extras = {}, timestamp = Time.now
-        hexdigest = OpenSSL::HMAC.hexdigest(
-          OpenSSL::Digest::Digest.new('SHA1'),
-          Digest::SHA1.digest(private_key),
-          digest([timestamp = timestamp.to_i, claim, params.merge(extras)])
-        )
-        ["#{hexdigest}-#{timestamp}", *collect_keypaths(extras)].join '+'
-      end
-
-      def verify! claim, params
-        params = Hash[params.map { |key, value| [key.to_s, value] }]
-        signature = params.delete('signature') or raise(
-          RequestForgery, 'missing signature'
-        )
-        timestamp = signature.split('-').last
-        age = Time.now.to_i - timestamp.to_i
-        unless (-3600..3600).include? age
-          raise RequestForgery, 'stale timestamp'
-        end
-
-        if signature != sign(claim, params, {}, timestamp)
-          raise RequestForgery,
-            "signature can't be verified (invalid request or private key)"
-        end
-
-        true
-      end
-
-      def digest data
-        case data
-        when Array
-          return if data.empty?
-          SafeString.new "[#{data.map { |d| digest d }.compact.join ','}]"
+      def to_query object, key = nil
+        case object
         when Hash
-          data = Hash[data.map { |key, value| [key.to_s, value] }]
-          digest data.keys.sort.map { |key|
-            next unless value = digest(data[key])
-            SafeString.new "#{"#{key}:" unless key =~ /^\d+$/}#{value}"
-          }
-        when SafeString
-          data
-        when String
-          SafeString.new data.gsub(/([\[\]\,\:\\])/, '\\\\\1')
+          object.map { |k, v| to_query v, key ? "#{key}[#{k}]" : k }.sort * '&'
+        when Array
+          object.map { |o| to_query o, "#{key}[]" } * '&'
         else
-          data
+          "#{CGI.escape key.to_s}=#{CGI.escape object.to_s}"
         end
       end
     end

data/lib/recurly/resource.rb

@@ -1,5 +1,4 @@
 require 'date'
-require 'erb'
 
 module Recurly
   # The base class for all Recurly resources (e.g. {Account}, {Subscription},
@@ -184,7 +183,6 @@ module Recurly
       #   Recurly::Account.member_path "code" # => "accounts/code"
       #   Recurly::Account.member_path nil    # => "accounts"
       def member_path uuid
-        uuid = ERB::Util.url_encode(uuid) if uuid
         [collection_path, uuid].compact.join '/'
       end
 
@@ -321,8 +319,9 @@ module Recurly
           request_options[:head] = { 'If-None-Match' => etag }
         end
 
+        uri = uuid =~ /^http/ ? uuid : member_path(uuid)
         begin
-          from_response API.get(member_path(uuid), {}, options)
+          from_response API.get(uri, {}, request_options)
         rescue API::NotFound => e
           raise NotFound, e.description
         end
@@ -371,7 +370,7 @@ module Recurly
         if xml.name == member_name
           record = new
         elsif Recurly.const_defined?(class_name = Helper.classify(xml.name))
-          record = Recurly.const_get(class_name).new
+          record = Recurly.const_get(class_name).send :new
         elsif root = xml.root and root.elements.empty?
           return XML.cast root
         else
@@ -478,7 +477,7 @@ module Recurly
               attributes = args.shift || {}
               self[member_name] = associated.send(
                 :new, attributes.merge(:uri => "#{path}/#{member_name}")
-              )
+              ).tap { |child| child.attributes[self.class.member_name] = self }
             }
             define_method("create_#{member_name}") { |*args|
               send("build_#{member_name}", *args).tap { |child| child.save }
@@ -552,12 +551,9 @@ module Recurly
         return if response.body.length.zero?
         fresh = self.class.from_response response
       else
-        options = {:etag => (etag unless changed?)}
-        fresh = if @href
-                  self.class.from_response API.get(@href, {}, options)
-                else
-                  self.class.find(to_param, options)
-                end
+        fresh = self.class.find(
+          @href || to_param, :etag => (etag unless changed?)
+        )
       end
       fresh and copy_from fresh
       persist! true
@@ -845,6 +841,10 @@ module Recurly
       raise NotFound, e.description
     end
 
+    def signable_attributes
+      Hash[xml_keys.map { |key| [key, self[key]] }]
+    end
+
     def == other
       other.is_a?(self.class) && other.to_s == to_s
     end

data/lib/recurly/resource/pager.rb

@@ -88,6 +88,12 @@ module Recurly
         load_from links['next'], nil if links.key? 'next'
       end
 
+      # @return [Array, nil] Refreshes the pager's collection of records with
+      #   the previous page.
+      def prev
+        load_from links['prev'], nil if links.key? 'prev'
+      end
+
       # @return [Array, nil] Refreshes the pager's collection of records with
       #   the first page.
       def start
@@ -211,7 +217,7 @@ module Recurly
           load! unless defined? @collection
           return @collection.send name, *args, &block
         end
-        
+
         super
       end
     end

data/lib/recurly/subscription.rb

@@ -38,6 +38,7 @@ module Recurly
       pending_subscription
       subscription_add_ons
       coupon_code
+      total_billing_cycles
     )
     alias to_param uuid
 
@@ -134,5 +135,9 @@ module Recurly
       reload self[:reactivate].call
       true
     end
+
+    def signable_attributes
+      super.merge :plan_code => plan_code
+    end
   end
 end

data/lib/recurly/transaction.rb

@@ -70,6 +70,10 @@ module Recurly
       )
     end
 
+    def signable_attributes
+      super.merge :amount_in_cents => amount_in_cents, :currency => currency
+    end
+
     # @return [String]
     def inspect
       attributes = self.class.attribute_names

data/lib/recurly/version.rb

@@ -1,8 +1,8 @@
 module Recurly
   module Version
     MAJOR   = 2
-    MINOR   = 0
-    PATCH   = 14
+    MINOR   = 1
+    PATCH   = 0
     PRE     = nil
 
     VERSION = [MAJOR, MINOR, PATCH, PRE].compact.join('.').freeze

metadata

@@ -1,58 +1,83 @@
 --- !ruby/object:Gem::Specification
 name: recurly
 version: !ruby/object:Gem::Version
-  version: 2.0.14
+  version: 2.1.0
+  prerelease: 
 platform: ruby
 authors:
 - Recurly
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-05-09 00:00:00.000000000 Z
+date: 2012-03-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70249525629500 !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 0.9.2
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.9.2
+  version_requirements: *70249525629500
 - !ruby/object:Gem::Dependency
   name: minitest
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70249525628300 !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 2.6.1
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 2.6.1
+  version_requirements: *70249525628300
 - !ruby/object:Gem::Dependency
   name: webmock
-  requirement: !ruby/object:Gem::Requirement
+  requirement: &70249525627820 !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
         version: 1.7.6
   type: :development
   prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
+  version_requirements: *70249525627820
+- !ruby/object:Gem::Dependency
+  name: guard-minitest
+  requirement: &70249525627320 !ruby/object:Gem::Requirement
+    none: false
     requirements:
-    - - "~>"
+    - - ~>
       - !ruby/object:Gem::Version
-        version: 1.7.6
-description: 'An API client library for Recurly: http://recurly.com'
+        version: 0.4.0
+  type: :development
+  prerelease: false
+  version_requirements: *70249525627320
+- !ruby/object:Gem::Dependency
+  name: rb-fsevent
+  requirement: &70249525626760 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.4.3.1
+  type: :development
+  prerelease: false
+  version_requirements: *70249525626760
+- !ruby/object:Gem::Dependency
+  name: growl_notify
+  requirement: &70249525626280 !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 0.0.1
+  type: :development
+  prerelease: false
+  version_requirements: *70249525626280
+description: ! 'An API client library for Recurly: http://recurly.com'
 email: support@recurly.com
 executables:
 - recurly
@@ -60,18 +85,15 @@ extensions: []
 extra_rdoc_files:
 - README.markdown
 files:
-- README.markdown
-- bin/recurly
 - lib/rails/generators/recurly/config_generator.rb
 - lib/rails/recurly.rb
-- lib/recurly.rb
 - lib/recurly/account.rb
 - lib/recurly/add_on.rb
 - lib/recurly/adjustment.rb
 - lib/recurly/all.rb
-- lib/recurly/api.rb
 - lib/recurly/api/errors.rb
 - lib/recurly/api/net_http_adapter.rb
+- lib/recurly/api.rb
 - lib/recurly/billing_info.rb
 - lib/recurly/coupon.rb
 - lib/recurly/helper.rb
@@ -80,40 +102,46 @@ files:
 - lib/recurly/money.rb
 - lib/recurly/plan.rb
 - lib/recurly/redemption.rb
-- lib/recurly/resource.rb
 - lib/recurly/resource/pager.rb
-- lib/recurly/subscription.rb
+- lib/recurly/resource.rb
 - lib/recurly/subscription/add_ons.rb
-- lib/recurly/transaction.rb
+- lib/recurly/subscription.rb
 - lib/recurly/transaction/errors.rb
+- lib/recurly/transaction.rb
 - lib/recurly/version.rb
-- lib/recurly/xml.rb
 - lib/recurly/xml/nokogiri.rb
 - lib/recurly/xml/rexml.rb
+- lib/recurly/xml.rb
+- lib/recurly.rb
+- README.markdown
+- !binary |-
+  YmluL3JlY3VybHk=
 homepage: http://github.com/recurly/recurly-client-ruby
 licenses:
 - MIT
-metadata: {}
 post_install_message: 
 rdoc_options:
-- "--main"
+- --main
 - README.markdown
 require_paths:
 - lib
 required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
   requirements:
-  - - ">="
+  - - ! '>='
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 1.8.11
 signing_key: 
-specification_version: 4
+specification_version: 3
 summary: Recurly API Client
 test_files: []
+has_rdoc: true

checksums.yaml

@@ -1,7 +0,0 @@
----
-SHA256:
-  metadata.gz: b504b0f597b977a0b15913cfa563e756f2668f3ccdd9bdd24b5070ac1921039c
-  data.tar.gz: 52b63c17d628a0775239bfa043b4395e8caa1aef4f2e3cb21e97fc07cb4c20d2
-SHA512:
-  metadata.gz: 5c3b9ca3efb027f16030f60c6cc5e4e8994b8a514fcb717d3b7fee675c3a405a569634c287953c5c760fc73df81c7d5c71abd8543f0da5245c4bb462089a438e
-  data.tar.gz: 953ae522e3f47bc0fee546ed9aab5c8ee252f1c337d65491a966e7ab3a13b730f7cd8fc707868ea4aa94b21baa44c4ba9b394c15a7780ba63bebaad409800612