recurly 4.23.0 → 4.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f3425e11a326e6886fe09606f3cd02f155ded5fb774f639d20f47f2a4def65f3
-  data.tar.gz: 39d0917188e796d37e7179a86e78427dab022cf94ea3d6c13b734153d54f2b0c
+  metadata.gz: 5f585c84e359302293e13409b5162b2ad56241f342b0c9e9c2c4200f29782a32
+  data.tar.gz: d8908b9d5e9cefcce7a9fa6cfa0d75b69dcd8b885ac6ce6dacc2ec416f56c1a1
 SHA512:
-  metadata.gz: c06705fdd51268f7f1a298dc6b92ab65c4a972106d32d2e7909ac6852d780ab0024170da9c0f028d43695fe17706371684f93366217bbf3577fd9e1200068854
-  data.tar.gz: 63565f407525519ff2594677070a394675c7500d03565d704c0bd07e4ef7afa94ffb2d9839efd07f527bc65fc9979090d4ab4cf1166d988d7879fcbb757576e9
+  metadata.gz: 3d42081e4d4e095850d9b1158e8c798ab0cc11d9f9d68bb895ba77808a2d6f4f1a0bdfeac2c6394d704ea74add4df4ba63ca2eca70d1c05c1b3499e3c9bbbb76
+  data.tar.gz: 1bb51683c999694c1843c378754ba2fb6556d205db5f50ebf93cde4cb46997548cd31f3062b75f6b1db7d3bb575a3040ddea88276f1172fca424785e96b92304

data/.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 4.23.0
+current_version = 4.24.0
 parse = (?P<major>\d+)
 	\.(?P<minor>\d+)
 	\.(?P<patch>\d+)

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [4.24.0](https://github.com/recurly/recurly-client-ruby/tree/4.24.0) (2022-11-03)
+
+[Full Changelog](https://github.com/recurly/recurly-client-ruby/compare/4.23.0...4.24.0)
+
+
+
+
+
 ## [4.23.0](https://github.com/recurly/recurly-client-ruby/tree/4.23.0) (2022-10-27)
 
 [Full Changelog](https://github.com/recurly/recurly-client-ruby/compare/4.22.0...4.23.0)

data/GETTING_STARTED.md

@@ -5,7 +5,7 @@ This repository houses the official ruby client for Recurly's V3 API.
 In your Gemfile, add `recurly` as a dependency.
 
 ```ruby
-gem 'recurly', '~> 4.23'
+gem 'recurly', '~> 4.24'
 ```
 
 > *Note*: We try to follow [semantic versioning](https://semver.org/) and will only apply breaking changes to major versions.

data/lib/recurly/errors/webhooks_errors.rb

@@ -0,0 +1,5 @@
+module Recurly
+  module Errors
+    class SignatureVerificationError < StandardError; end
+  end
+end

data/lib/recurly/errors.rb

@@ -48,4 +48,5 @@ module Recurly
 
   require_relative "./errors/api_errors"
   require_relative "./errors/network_errors"
+  require_relative "./errors/webhooks_errors"
 end

data/lib/recurly/version.rb

@@ -1,3 +1,3 @@
 module Recurly
-  VERSION = "4.23.0"
+  VERSION = "4.24.0"
 end

data/lib/recurly/webhooks.rb

@@ -0,0 +1,52 @@
+module Recurly
+  module Webhooks
+    DEFAULT_TOLERANCE = 5 * 60 * 1000
+
+    # Verify webhook signature
+    #
+    # @param header [String] recurly-signature header from request
+    # @param secret [String] Shared secret for notification endpoint
+    # @param body [String] Request POST body
+    # @param tolerance [Integer] Allowed notification time drift in milliseconds
+    # @example
+    #   begin
+    #     Recurly::Webhooks.verify_signature(header,
+    #                                        ENV['WEBHOOKS_KEY'],
+    #                                        request.body)
+    #   rescue Recurly::Errors::SignatureVerificationError => e
+    #     puts e.message
+    #   end
+    #
+    def self.verify_signature(header, secret, body, tolerance: DEFAULT_TOLERANCE)
+      s_timestamp, *signatures = header.split(",")
+      timestamp = Integer(s_timestamp)
+      now = (Time.now.to_f * 1000).to_i
+
+      if (now - timestamp).abs > tolerance
+        raise Recurly::Errors::SignatureVerificationError.new(
+          "Notification (#{Time.at(timestamp / 1000.0)}) is more than #{tolerance / 1000.0}s out of date"
+        )
+      end
+
+      expected = OpenSSL::HMAC.hexdigest("sha256", secret, "#{timestamp}.#{body}")
+
+      unless signatures.any? { |s| secure_compare(expected, s) }
+        raise Recurly::Errors::SignatureVerificationError.new(
+          "No matching signatures found for payload"
+        )
+      end
+    end
+
+    # https://github.com/rack/rack/blob/2-2-stable/lib/rack/utils.rb#L374
+    # https://github.com/heartcombo/devise/blob/4-1-stable/lib/devise.rb#L477
+    def self.secure_compare(a, b)
+      return false if a.bytesize != b.bytesize
+      l = a.unpack("C#{a.bytesize}")
+
+      res = 0
+      b.each_byte { |byte| res |= byte ^ l.shift }
+      res == 0
+    end
+    private_class_method :secure_compare
+  end
+end

data/lib/recurly.rb

@@ -9,6 +9,7 @@ require "recurly/http"
 require "recurly/errors"
 require "recurly/connection_pool"
 require "recurly/client"
+require "recurly/webhooks"
 
 module Recurly
   STRICT_MODE = ENV["RECURLY_STRICT_MODE"] && ENV["RECURLY_STRICT_MODE"].downcase == "true"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: recurly
 version: !ruby/object:Gem::Version
-  version: 4.23.0
+  version: 4.24.0
 platform: ruby
 authors:
 - Recurly
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-10-27 00:00:00.000000000 Z
+date: 2022-11-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler
@@ -141,6 +141,7 @@ files:
 - lib/recurly/errors.rb
 - lib/recurly/errors/api_errors.rb
 - lib/recurly/errors/network_errors.rb
+- lib/recurly/errors/webhooks_errors.rb
 - lib/recurly/http.rb
 - lib/recurly/pager.rb
 - lib/recurly/request.rb
@@ -304,6 +305,7 @@ files:
 - lib/recurly/schema/schema_factory.rb
 - lib/recurly/schema/schema_validator.rb
 - lib/recurly/version.rb
+- lib/recurly/webhooks.rb
 - openapi/api.yaml
 - recurly.gemspec
 - scripts/build
@@ -320,7 +322,7 @@ metadata:
   changelog_uri: https://github.com/recurly/recurly-client-ruby/blob/master/CHANGELOG.md
   documentation_uri: https://recurly.github.io/recurly-client-ruby/
   homepage_uri: https://github.com/recurly/recurly-client-ruby
-  source_code_uri: https://github.com/recurly/recurly-client-ruby/tree/4.23.0
+  source_code_uri: https://github.com/recurly/recurly-client-ruby/tree/4.24.0
 post_install_message: 
 rdoc_options: []
 require_paths: