roistat 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc3ca5eb2fe6830464f24590db99766e8c47a187446b3d796893e4ef4baf2701
-  data.tar.gz: bcbb3c3a15ec149839e00c6ec9cc30f428c7ad285230d3190c93bb271b9af085
+  metadata.gz: 9873e205875775701ebef069abc68ec70b403bac27fb3e264af27a66f0305b38
+  data.tar.gz: 89b775556fc61133d16453a1482ae1e369c98da2c81210ff497f98e51fdbfdcf
 SHA512:
-  metadata.gz: e09ebca699583d9c4d35cd9a9fdeb7c6c788041c58172589590c3ebffec1427b0919304fbe52d479d3362ab6d4635651b81c2ce34c8dac78bc51578d4b787f85
-  data.tar.gz: 99a0d714445b30a106af7350d006913b1b9ae937c53ad9da276e20dde24bd9e28e8a5c5cf9a6a5e75bea43bae0aef55202d2260fa346a6ff4d41ca818d451f1d
+  metadata.gz: 4f86543be62749ddb2f4f57a9bc3a67634d69438c83f9878dc5be52ac03e450bccd9383fde491086ea7b08a1d2ce81b79109e0379399b27217716b0ebe668042
+  data.tar.gz: eaffd7ee92d8e4ef316e2a0bb910ea1ae20ff381459b475148b225172256309194dd0f252e5516e471fdbc695f8130780769f23e01f15508602b47bfb4a674b5

data/CHANGELOG.md

@@ -1,3 +1,14 @@
+## [0.1.1] — 2026-07-23
+
+### Fixed
+
+- Escape IDs interpolated into request paths (`orders`, `dashboards`, `calltracking`, `events`, `indicators`, `emailtracking`, `proxy_leads`, `widgets`) so values containing `/`, `?`, `#`, or spaces can't corrupt the request path or inject query parameters
+- `widgets.data(method: :get)` now forwards extra keyword arguments as query params instead of silently dropping them
+
+### Changed
+
+- Centralized empty-body handling in `Roistat::Client#request`; resource classes now call `client.post` directly instead of a per-class `post`/`post_optional_body` helper
+
 ## [0.1.0] — 2026-07-22
 
 ### Added

data/README.md

@@ -2,7 +2,7 @@
 
 Ruby wrapper for the [Roistat REST API](https://help-ru.roistat.com/API/methods/about/).
 
-**[Документация на русском](docs/ru/README.md)**
+**[Документация на русском](docs/ru/README.md)** · **[Demo](https://github.com/alec-c4/roistat_demo)**
 
 The gem sends every request with the `Api-key` header (never as a `key` query param). Project-scoped calls also send `project` in the query string.
 
@@ -741,10 +741,13 @@ Interactive console:
 bin/console
 ```
 
+Read-only playground: [roistat_demo](https://github.com/alec-c4/roistat_demo).
+
 Release:
 
 ```bash
-mise release
+mise release            # build gem, create tag, push gem + tag
+mise github-release     # create GitHub Release for v$VERSION (needs gh + existing tag)
 # or: bundle exec rake release
 ```
 

data/docs/ru/README.md

@@ -4,6 +4,8 @@ How-to для разработчиков, которые подключают г
 
 **Предпосылки:** Ruby 3+, ключ API Roistat, id проекта. Полные таблицы методов — в [корневом README](../../README.md) (английский).
 
+Демо с read-only вызовами: [roistat_demo](https://github.com/alec-c4/roistat_demo).
+
 Официальные справочники Roistat:
 
 - [help-ru](https://help-ru.roistat.com/API/methods/about/) — основная инвентаризация путей
@@ -139,4 +141,6 @@ bundle exec rake
 
 Интерактивная консоль гема: `bin/console`.
 
+Демо-репозиторий: [roistat_demo](https://github.com/alec-c4/roistat_demo).
+
 Багрепорты и PR: https://github.com/alec-c4/roistat

data/lib/roistat/client.rb

@@ -73,7 +73,7 @@ class Roistat::Client
     }
 
     options = {params: stringify_keys(query), headers: headers}
-    if body
+    if present_body?(body)
       headers["Content-Type"] = "application/json"
       options[:json] = body
     end
@@ -193,6 +193,10 @@ class Roistat::Client
     value.nil? || value.to_s.strip.empty?
   end
 
+  def present_body?(body)
+    body && !(body.respond_to?(:empty?) && body.empty?)
+  end
+
   def url_for(path)
     "#{base_url.to_s.chomp("/")}/#{path.to_s.delete_prefix("/")}"
   end

data/lib/roistat/resources/analytics.rb

@@ -3,7 +3,7 @@
 class Roistat::Resources::Analytics < Roistat::Resources::Base
   # POST /project/analytics/data
   def data(**body)
-    post_optional_body("project/analytics/data", body)
+    client.post("project/analytics/data", body: body)
   end
 
   # POST /project/analytics/data/export/excel
@@ -13,27 +13,27 @@ class Roistat::Resources::Analytics < Roistat::Resources::Base
 
   # POST /project/analytics/metrics-new
   def metrics_new(**body)
-    post_optional_body("project/analytics/metrics-new", body)
+    client.post("project/analytics/metrics-new", body: body)
   end
 
   # POST /project/analytics/dimensions
   def dimensions(**body)
-    post_optional_body("project/analytics/dimensions", body)
+    client.post("project/analytics/dimensions", body: body)
   end
 
   # POST /project/analytics/dimension-values
   def dimension_values(**body)
-    post_optional_body("project/analytics/dimension-values", body)
+    client.post("project/analytics/dimension-values", body: body)
   end
 
   # POST /project/analytics/attribution-models
   def attribution_models(**body)
-    post_optional_body("project/analytics/attribution-models", body)
+    client.post("project/analytics/attribution-models", body: body)
   end
 
   # POST /project/analytics/list-orders
   def list_orders(**body)
-    post_optional_body("project/analytics/list-orders", body)
+    client.post("project/analytics/list-orders", body: body)
   end
 
   # GET /project/analytics/metrics/custom/list
@@ -43,7 +43,7 @@ class Roistat::Resources::Analytics < Roistat::Resources::Base
 
   # POST /project/analytics/metrics/custom/manual/value/list
   def custom_manual_value_list(**body)
-    post_optional_body("project/analytics/metrics/custom/manual/value/list", body)
+    client.post("project/analytics/metrics/custom/manual/value/list", body: body)
   end
 
   # POST /project/analytics/metrics/custom/manual/value/add
@@ -58,7 +58,7 @@ class Roistat::Resources::Analytics < Roistat::Resources::Base
 
   # POST /project/reports/funnel/data
   def funnel_data(**body)
-    post_optional_body("project/reports/funnel/data", body)
+    client.post("project/reports/funnel/data", body: body)
   end
 
   # POST /project/analytics/event/add

data/lib/roistat/resources/base.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "erb"
+
 class Roistat::Resources::Base
   attr_reader :client
 
@@ -21,11 +23,10 @@ class Roistat::Resources::Base
     )
   end
 
-  def post_optional_body(path, body)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
+  # Escapes a value for safe interpolation into a URL path segment (IDs may
+  # be arbitrary external strings, e.g. CRM order ids), so characters like
+  # "/", "?", "#" can't alter the request path or inject query parameters.
+  def escape_path_segment(value)
+    ERB::Util.url_encode(value.to_s)
   end
 end

data/lib/roistat/resources/calltracking.rb

@@ -3,7 +3,7 @@
 class Roistat::Resources::Calltracking < Roistat::Resources::Base
   # POST /project/calltracking/script/list
   def script_list(**body)
-    post("project/calltracking/script/list", body: body)
+    client.post("project/calltracking/script/list", body: body)
   end
 
   # POST /project/calltracking/script/create
@@ -23,12 +23,12 @@ class Roistat::Resources::Calltracking < Roistat::Resources::Base
 
   # POST /project/calltracking/phone/list
   def phone_list(**body)
-    post("project/calltracking/phone/list", body: body)
+    client.post("project/calltracking/phone/list", body: body)
   end
 
   # POST /project/calltracking/phone/prefix/list
   def phone_prefix_list(**body)
-    post("project/calltracking/phone/prefix/list", body: body)
+    client.post("project/calltracking/phone/prefix/list", body: body)
   end
 
   # POST /project/calltracking/phone/create
@@ -53,7 +53,7 @@ class Roistat::Resources::Calltracking < Roistat::Resources::Base
 
   # POST /project/calltracking/call/list
   def call_list(**body)
-    post("project/calltracking/call/list", body: body)
+    client.post("project/calltracking/call/list", body: body)
   end
 
   # POST /project/calltracking/call/update
@@ -68,7 +68,7 @@ class Roistat::Resources::Calltracking < Roistat::Resources::Base
 
   # POST /project/calltracking/call/{callId}/file
   def call_file(call_id:)
-    client.post("project/calltracking/call/#{call_id}/file", parse: :binary)
+    client.post("project/calltracking/call/#{escape_path_segment(call_id)}/file", parse: :binary)
   end
 
   # POST /project/calltracking/call/xls/export
@@ -89,14 +89,4 @@ class Roistat::Resources::Calltracking < Roistat::Resources::Base
   def phone_call(**body)
     client.post("project/phone-call", body: body)
   end
-
-  private
-
-  def post(path, body:)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
-  end
 end

data/lib/roistat/resources/channels.rb

@@ -3,12 +3,12 @@
 class Roistat::Resources::Channels < Roistat::Resources::Base
   # POST /project/analytics/source/list
   def source_list(**body)
-    post_optional_body("project/analytics/source/list", body)
+    client.post("project/analytics/source/list", body: body)
   end
 
   # POST /project/analytics/source/cost/list
   def cost_list(**body)
-    post_optional_body("project/analytics/source/cost/list", body)
+    client.post("project/analytics/source/cost/list", body: body)
   end
 
   # POST /project/analytics/source/cost/add

data/lib/roistat/resources/clients.rb

@@ -3,7 +3,7 @@
 class Roistat::Resources::Clients < Roistat::Resources::Base
   # POST /project/clients
   def list(**body)
-    post("project/clients", body: body)
+    client.post("project/clients", body: body)
   end
 
   # POST /project/clients/import — body is a JSON array
@@ -18,21 +18,11 @@ class Roistat::Resources::Clients < Roistat::Resources::Base
 
   # POST /project/clients/campaign/list
   def campaign_list(**body)
-    post("project/clients/campaign/list", body: body)
+    client.post("project/clients/campaign/list", body: body)
   end
 
   # POST /project/clients/campaign/contact/list
   def campaign_contact_list(**body)
-    post("project/clients/campaign/contact/list", body: body)
-  end
-
-  private
-
-  def post(path, body:)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
+    client.post("project/clients/campaign/contact/list", body: body)
   end
 end

data/lib/roistat/resources/dashboards.rb

@@ -8,6 +8,6 @@ class Roistat::Resources::Dashboards < Roistat::Resources::Base
 
   # GET /project/dashboards/{dashboardId}/widgets
   def widgets(dashboard_id:)
-    client.get("project/dashboards/#{dashboard_id}/widgets")
+    client.get("project/dashboards/#{escape_path_segment(dashboard_id)}/widgets")
   end
 end

data/lib/roistat/resources/emailtracking.rb

@@ -3,13 +3,14 @@
 class Roistat::Resources::Emailtracking < Roistat::Resources::Base
   # POST /project/emailtracking/email/list
   def list(**body)
-    post_optional_body("project/emailtracking/email/list", body)
+    client.post("project/emailtracking/email/list", body: body)
   end
 
   # GET /project/emailtracking/email/{email_id}/attachment/{attachment_id}
   def attachment(email_id:, attachment_id:)
     client.get(
-      "project/emailtracking/email/#{email_id}/attachment/#{attachment_id}",
+      "project/emailtracking/email/#{escape_path_segment(email_id)}/attachment/" \
+      "#{escape_path_segment(attachment_id)}",
       parse: :binary
     )
   end

data/lib/roistat/resources/events.rb

@@ -27,16 +27,6 @@ class Roistat::Resources::Events < Roistat::Resources::Base
 
   # POST /project/events/meta/{eventId}/archive — body is a JSON array
   def archive(event_id:, events:)
-    client.post("project/events/meta/#{event_id}/archive", body: events)
-  end
-
-  private
-
-  def post(path, body:)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
+    client.post("project/events/meta/#{escape_path_segment(event_id)}/archive", body: events)
   end
 end

data/lib/roistat/resources/indicators.rb

@@ -8,6 +8,6 @@ class Roistat::Resources::Indicators < Roistat::Resources::Base
 
   # POST /project/health/indicator/{indicatorId}/run-script
   def run_script(indicator_id:)
-    client.post("project/health/indicator/#{indicator_id}/run-script")
+    client.post("project/health/indicator/#{escape_path_segment(indicator_id)}/run-script")
   end
 end

data/lib/roistat/resources/leads.rb

@@ -3,12 +3,12 @@
 class Roistat::Resources::Leads < Roistat::Resources::Base
   # POST /project/leads/lead/list
   def list(**body)
-    post("project/leads/lead/list", body: body)
+    client.post("project/leads/lead/list", body: body)
   end
 
   # POST /project/leads/status/list
   def status_list(**body)
-    post("project/leads/status/list", body: body)
+    client.post("project/leads/status/list", body: body)
   end
 
   # POST /project/leads/lead/create
@@ -20,14 +20,4 @@ class Roistat::Resources::Leads < Roistat::Resources::Base
   def update(**body)
     client.post("project/leads/lead/update", body: body)
   end
-
-  private
-
-  def post(path, body:)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
-  end
 end

data/lib/roistat/resources/managers.rb

@@ -3,7 +3,7 @@
 class Roistat::Resources::Managers < Roistat::Resources::Base
   # POST /project/integration/manager/list
   def list(**body)
-    post("project/integration/manager/list", body: body)
+    client.post("project/integration/manager/list", body: body)
   end
 
   # POST /project/integration/manager/add
@@ -20,14 +20,4 @@ class Roistat::Resources::Managers < Roistat::Resources::Base
   def delete(id:)
     client.post("project/integration/manager/delete", body: {id: id})
   end
-
-  private
-
-  def post(path, body:)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
-  end
 end

data/lib/roistat/resources/mediaplan.rb

@@ -3,7 +3,7 @@
 class Roistat::Resources::Mediaplan < Roistat::Resources::Base
   # POST /project/mediaplan/target/list
   def target_list(**body)
-    post_optional_body("project/mediaplan/target/list", body)
+    client.post("project/mediaplan/target/list", body: body)
   end
 
   # POST /project/mediaplan/target/create

data/lib/roistat/resources/orders.rb

@@ -3,7 +3,7 @@
 class Roistat::Resources::Orders < Roistat::Resources::Base
   # POST /project/integration/order/list
   def list(**body)
-    post("project/integration/order/list", body: body)
+    client.post("project/integration/order/list", body: body)
   end
 
   # POST /project/add-orders — body is a JSON array
@@ -13,17 +13,17 @@ class Roistat::Resources::Orders < Roistat::Resources::Base
 
   # GET /project/orders/{orderId}/info
   def info(order_id:)
-    client.get("project/orders/#{order_id}/info")
+    client.get("project/orders/#{escape_path_segment(order_id)}/info")
   end
 
   # GET /project/orders/{orderId}/external-url
   def external_url(order_id:)
-    client.get("project/orders/#{order_id}/external-url")
+    client.get("project/orders/#{escape_path_segment(order_id)}/external-url")
   end
 
   # POST /project/integration/status/list
   def status_list(**body)
-    post("project/integration/status/list", body: body)
+    client.post("project/integration/status/list", body: body)
   end
 
   # POST /project/set-statuses — body is a JSON array
@@ -33,20 +33,20 @@ class Roistat::Resources::Orders < Roistat::Resources::Base
 
   # POST /project/analytics/order-custom-fields
   def custom_fields(**body)
-    post("project/analytics/order-custom-fields", body: body)
+    client.post("project/analytics/order-custom-fields", body: body)
   end
 
   # POST /project/integration/order/{orderId}/status/update
   def status_update(order_id:, status_id:)
     client.post(
-      "project/integration/order/#{order_id}/status/update",
+      "project/integration/order/#{escape_path_segment(order_id)}/status/update",
       body: {status_id: status_id}
     )
   end
 
   # POST /project/integration/order/{orderId}/goal/update
   def goal_update(order_id:, **body)
-    client.post("project/integration/order/#{order_id}/goal/update", body: body)
+    client.post("project/integration/order/#{escape_path_segment(order_id)}/goal/update", body: body)
   end
 
   # POST /project/integration/order/update
@@ -56,21 +56,11 @@ class Roistat::Resources::Orders < Roistat::Resources::Base
 
   # POST /project/integration/order/{orderId}/delete
   def delete(order_id:)
-    client.post("project/integration/order/#{order_id}/delete")
+    client.post("project/integration/order/#{escape_path_segment(order_id)}/delete")
   end
 
   # POST /project/integration/order/delete
   def delete_many(ids:)
     client.post("project/integration/order/delete", body: {ids: ids})
   end
-
-  private
-
-  def post(path, body:)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
-  end
 end

data/lib/roistat/resources/proxy_leads.rb

@@ -13,6 +13,6 @@ class Roistat::Resources::ProxyLeads < Roistat::Resources::Base
 
   # GET /project/proxy-leads/{proxyLeadId}
   def get(id:)
-    client.get("project/proxy-leads/#{id}")
+    client.get("project/proxy-leads/#{escape_path_segment(id)}")
   end
 end

data/lib/roistat/resources/speech.rb

@@ -3,7 +3,7 @@
 class Roistat::Resources::Speech < Roistat::Resources::Base
   # POST /project/speech/call/list
   def call_list(**body)
-    post_optional_body("project/speech/call/list", body)
+    client.post("project/speech/call/list", body: body)
   end
 
   # POST /project/speech/call/list/export/excel
@@ -28,12 +28,12 @@ class Roistat::Resources::Speech < Roistat::Resources::Base
 
   # POST /project/speech/call/transcription/list
   def call_transcription_list(**body)
-    post_optional_body("project/speech/call/transcription/list", body)
+    client.post("project/speech/call/transcription/list", body: body)
   end
 
   # POST /project/speech/dictionary/list
   def dictionary_list(**body)
-    post_optional_body("project/speech/dictionary/list", body)
+    client.post("project/speech/dictionary/list", body: body)
   end
 
   # POST /project/speech/dictionary/custom/create
@@ -53,12 +53,12 @@ class Roistat::Resources::Speech < Roistat::Resources::Base
 
   # POST /project/speech/dictionary/custom/phrase/list
   def dictionary_custom_phrase_list(**body)
-    post_optional_body("project/speech/dictionary/custom/phrase/list", body)
+    client.post("project/speech/dictionary/custom/phrase/list", body: body)
   end
 
   # POST /project/speech/settings/list
   def settings_list(**body)
-    post_optional_body("project/speech/settings/list", body)
+    client.post("project/speech/settings/list", body: body)
   end
 
   # POST /project/speech/settings/update

data/lib/roistat/resources/visits.rb

@@ -3,21 +3,11 @@
 class Roistat::Resources::Visits < Roistat::Resources::Base
   # POST /project/site/visit/list
   def list(**body)
-    post("project/site/visit/list", body: body)
+    client.post("project/site/visit/list", body: body)
   end
 
   # POST /project/site/visit/params/update
   def params_update(**body)
     client.post("project/site/visit/params/update", body: body)
   end
-
-  private
-
-  def post(path, body:)
-    if body.nil? || body.empty?
-      client.post(path)
-    else
-      client.post(path, body: body)
-    end
-  end
 end

data/lib/roistat/resources/vpbx.rb

@@ -3,12 +3,12 @@
 class Roistat::Resources::Vpbx < Roistat::Resources::Base
   # POST /project/vpbx/call/list
   def call_list(**body)
-    post_optional_body("project/vpbx/call/list", body)
+    client.post("project/vpbx/call/list", body: body)
   end
 
   # POST /project/vpbx/operator/list
   def operator_list(**body)
-    post_optional_body("project/vpbx/operator/list", body)
+    client.post("project/vpbx/operator/list", body: body)
   end
 
   # POST /project/vpbx/operator/create
@@ -28,7 +28,7 @@ class Roistat::Resources::Vpbx < Roistat::Resources::Base
 
   # POST /project/vpbx/operator/group/list
   def operator_group_list(**body)
-    post_optional_body("project/vpbx/operator/group/list", body)
+    client.post("project/vpbx/operator/group/list", body: body)
   end
 
   # POST /project/vpbx/operator/group/create
@@ -83,7 +83,7 @@ class Roistat::Resources::Vpbx < Roistat::Resources::Base
 
   # POST /project/vpbx/report/data
   def report_data(**body)
-    post_optional_body("project/vpbx/report/data", body)
+    client.post("project/vpbx/report/data", body: body)
   end
 
   # POST /project/vpbx/settings/update

data/lib/roistat/resources/widgets.rb

@@ -3,13 +3,13 @@
 class Roistat::Resources::Widgets < Roistat::Resources::Base
   # GET|POST /project/widget/{widgetId}/data — help-en; curl usually POSTs.
   def data(widget_id:, method: :post, **body)
-    path = "project/widget/#{widget_id}/data"
+    path = "project/widget/#{escape_path_segment(widget_id)}/data"
 
     case method.to_sym
     when :get
-      client.get(path)
+      client.get(path, params: body)
     when :post
-      post_optional_body(path, body)
+      client.post(path, body: body)
     else
       raise ArgumentError, "method must be :get or :post"
     end

data/lib/roistat/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Roistat
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/mise.toml

@@ -12,3 +12,15 @@ run = "bundle exec rubocop"
 [tasks.release]
 description = "Build and publish the gem (rake release)"
 run = "bundle exec rake release"
+
+[tasks.github-release]
+description = "Create a GitHub Release for the current VERSION tag"
+run = """
+version="$(ruby -e 'require_relative \"lib/roistat/version\"; print Roistat::VERSION')"
+tag="v${version}"
+if ! git rev-parse "${tag}" >/dev/null 2>&1; then
+  echo "Missing tag ${tag}. Create and push it first (or run mise release)." >&2
+  exit 1
+fi
+gh release create "${tag}" --title "${tag}" --generate-notes
+"""

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: roistat
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Alexey Poimtsev