ruby-whatsapp 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1149fca141867e8a80ee6276d8e39ea1a814630964d6d219119fb80c919de35b
-  data.tar.gz: a2d1a15a8a17f9b0065cf36ded985a329b35b9a7e7ef6408b0ba817551d90085
+  metadata.gz: 87f6d35b2ab7e711f12f6b3c6fe0598f0c6d46f6b69c2144827dac7cf1324ab2
+  data.tar.gz: 548dcf049e669ac9d79ef5b7d0b72d1d6324c04f8440b43ddc3849da8976c2cf
 SHA512:
-  metadata.gz: 6bd1b41cd41a1745923e23445d1df5fc4af58bcccf52c3e88346b5064276bcc0d046f25e23a7905987393e5dab13571b04f92fcde7fbf1cd8a2bde6ede839330
-  data.tar.gz: a4e8dbb9bafa710512201d6b1e588c9b0193e64a43f3afc4cb08acec5a5fc45f1ce80ec3f5fe3da98f876b0a4cf26bbf6ef432d9f3305d6cab15ef05502bf14f
+  metadata.gz: edd6bac30de43279bd6a964e724606974eec99c729649b5eb647635ff1088264d1539ecec627bd101ef3599dd96b3536dddfbb212e76ea95894225b860f6c0dc
+  data.tar.gz: a2eb64df9a84e90f0453e96f884a3740942eea31fa73512eea7f8bedb4057314d382ba60da2a36e8ba7cc7a7a2851e23575aa989f8392ab4b784d5a2da13aa7a

data/CHANGELOG.md

@@ -1,5 +1,11 @@
 ## [Unreleased]
 
+## [0.3.1] - 2026-08-13
+
+- Fix `Client#inspect` leaking the raw `api_key` in its default output — and, through it, any object holding a client (`Media#inspect`, `MessageTemplates#inspect`). Now redacted the same way `Configuration#inspect` already was. If a token may have reached an error tracker or console output that captures local variables, rotate it.
+- Fix `Client#path_for` passing IDs into the request path unencoded. A caller-supplied ID (e.g. `template_id`, `media_id`) could inject a query string or redirect an authenticated request to a different Graph API edge. Segments are now percent-encoded.
+- Fix `Webhook::Signature.valid?` raising `TypeError` instead of returning `false` for a `nil` payload.
+
 ## [0.3.0] - 2026-08-05
 
 - Add template management: `Whatsapp::MessageTemplates` provides full CRUD over the templates on a WhatsApp Business Account — `create`, `list`, `find`, `update`, `delete`, plus `upsert` for multi-language authentication templates and `create_from_library` for Meta's pre-written library. Templates are built from validated value objects (`Template`, `ComponentSet`, `Component::*`, `Button::*`) that enforce Meta's documented rules — name format, character limits, placeholder/example matching, quick-reply contiguity, carousel structure, limited-time-offer restrictions — before a request is made, so a rejection costs nothing instead of a review cycle. Covers standard, authentication/OTP, carousel, limited-time-offer, and library templates.

data/README.md

@@ -64,7 +64,7 @@ Whatsapp.configure do |config|
 end
 ```
 
-`api_key`, `app_secret`, and `verify_token` are redacted from `Configuration#inspect`, so they will not leak into logs.
+`api_key`, `app_secret`, and `verify_token` are redacted from `Configuration#inspect` and `Client#inspect`, so they will not leak into logs or error reports.
 
 ## Quick Start
 

data/lib/ruby/whatsapp/client.rb

@@ -5,6 +5,9 @@ module Whatsapp
     # Default request timeout in seconds.
     DEFAULT_TIMEOUT = 30
 
+    # Characters that must be percent-escaped in a path segment (everything except RFC 3986 "unreserved").
+    SEGMENT_UNRESERVED = /[^A-Za-z0-9\-._~]/
+
     # @!attribute [rw] host
     # @return [String]
     attr_accessor :host
@@ -69,14 +72,32 @@ module Whatsapp
       end
     end
 
-    # Builds a versioned request path.
+    # Builds a versioned request path. Segments are percent-encoded so a caller-supplied
+    # ID can't inject a query string or redirect to a different Graph edge.
     # @example
     #   path_for(phone_id, "messages") #=> "/v24.0/<phone_id>/messages"
     #   path_for(media_id)             #=> "/v24.0/<media_id>"
     # @param segments [Array<String>] Path segments appended after the version.
     # @return [String] The full request path.
     def path_for(*segments)
-      "/#{[version, *segments].join('/')}"
+      "/#{[version, *segments].map { |segment| encode_segment(segment) }.join('/')}"
+    end
+
+    # Redacts the api_key so it never leaks into logs or console output.
+    # @return [String]
+    def inspect
+      redacted_api_key = api_key.nil? ? "nil" : "[REDACTED]"
+      "#<#{self.class.name} host=#{host.inspect} version=#{version.inspect} " \
+        "api_key=#{redacted_api_key} phone_id=#{phone_id.inspect} waba_id=#{waba_id.inspect}>"
+    end
+
+  private
+
+    # Percent-encodes one path segment, byte-wise so multibyte input is handled correctly.
+    # @param segment [#to_s] The segment to encode.
+    # @return [String]
+    def encode_segment(segment)
+      segment.to_s.b.gsub(SEGMENT_UNRESERVED) { |byte| format("%%%02X", byte.ord) }
     end
   end
 end

data/lib/ruby/whatsapp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Whatsapp
-  VERSION = "0.3.0"
+  VERSION = "0.3.1"
 end

data/lib/ruby/whatsapp/webhook/signature.rb

@@ -9,13 +9,14 @@ module Whatsapp
       PREFIX = "sha256="
 
       class << self
-        # @param payload [String] The raw (unparsed) request body.
+        # @param payload [String, nil] The raw (unparsed) request body.
         # @param header [String, nil] The `X-Hub-Signature-256` header value.
         # @param app_secret [String, nil] The secret to verify against. Defaults to the
         #   globally configured secret; pass an explicit value for multi-tenant apps where
         #   each account has its own Meta App (and therefore its own secret).
         # @return [Boolean] Whether the header matches the computed signature.
         def valid?(payload:, header:, app_secret: Whatsapp.configuration.app_secret)
+          return false if payload.nil?
           return false if header.nil? || header.empty?
           return false if app_secret.nil? || app_secret.empty?
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-whatsapp
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Raniery