savon 2.17.3 → 2.17.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cde79beaab26839d499267e94eee281c4f35f34906fd6dfdd4fc4590dc2c710a
-  data.tar.gz: 93f661f0156d8331a68e440176d9aaef92d2744974858ee4f866e63f14a210a1
+  metadata.gz: 2bba4a9ced6c62286d20de586b56ce7263413fa5e4b51771e87fded4c2433f39
+  data.tar.gz: 9327a65ee629c258691084a822b635738b4d31ea38c5bd38f8e3399f11b16cd9
 SHA512:
-  metadata.gz: 3f7436bc2d8c53b89a96a373ab015ce7461b86501549034b99a5ae585a8f25d113bd7e1d1897acc613360d8487bb198eeccf5d0cf4835be7e8f8e44dd4b637a3
-  data.tar.gz: 8e45f5f6494c8256878b54b4092f7a253686ddc5c9ea1f98cd372c9ed4b0c784a4b7c885604c70036a1398fe0ac5ff08847a13def8ed931c8ce7d5da6f7475df
+  metadata.gz: a1d50a4b5f588cc1e094189f41aada85a2bbecf7b6dbf92b27c6041d7b3eb882808ec69c0d2f0e907cc572cea73c17bad18f82d74c400e4019836200ce1255e9
+  data.tar.gz: 9a61b3a21ae8a2c16761fb851c85355cd3e2575e540447ec7ac0fa5cbd42ae5bfa456c26813a5dce907fb9924f2cd6dece545f841f65a970a87445123fe90005

data/CHANGELOG.md

@@ -5,12 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [2.17.3] - 2026-06-23
+## [2.17.4] - 2026-07-03
+
+**Restore WS-Addressing headers and fix `:wsse_signature` resolution**
 
 ### Fixed
 
+* **WS-Addressing headers are populated from the WSDL again** ([#1057](https://github.com/savonrb/savon/issues/1057)). With `use_wsa_headers: true` and no explicit `:soap_action` or `:endpoint`, Savon emitted empty `<wsa:Action xsi:nil="true"/>` and `<wsa:To xsi:nil="true"/>` elements instead of the operation's SOAPAction and service endpoint. Up to 2.16.0 those values were populated as a side effect of building the HTTP request. The 2.17.0 transport refactor removed that step.
+* **A global `:host` override no longer rewrites the WSDL's endpoint.** Resolving the request endpoint with `:host` set replaced host and port of the parsed WSDL address in place, visible as a permanently changed `client.wsdl.endpoint` after the first call. Endpoint and SOAPAction resolution moved into `Savon::EffectiveOptions`, which applies the override to a copy and never touches the WSDL document.
+* **A local `:wsse_signature` no longer crashes when set to `false`.** Passing `wsse_signature: false` to a call raised `NoMethodError: undefined method 'have_document?' for false` while building the WSSE header. The envelope builder and the SOAP header also resolved the option with different rules, so they could disagree on which signature applies. Both now read it through `Savon::EffectiveOptions`, the one place that resolves options settable in both the global and the local scope. A falsy local `:wsse_signature` falls back to the global one. Setting a signature object in either scope is unaffected.
+
+### Deprecated
+
+* **`Savon::Builder::WSA_NAMESPACE`.** WS-Addressing emission moved into `Savon::Addressing`, which owns the namespace as `Savon::Addressing::NAMESPACE`. The constant on `Savon::Builder` stays available as an alias and will be removed in Savon 3.
+
+## [2.17.3] - 2026-06-23
+
 **Fix Savon::HTTPError compatibility with Faraday transport**
 
+### Fixed
+
 * **`Savon::HTTPError` works with the Faraday transport** ([#1050](https://github.com/savonrb/savon/issues/1050)). When a the WSDL could not be fetched under `transport: :faraday`, `Savon::HTTPError#to_s` and `#to_hash` raised `NoMethodError: undefined method 'code'` because they were handed a raw `Faraday::Response`, which exposes `#status` rather than `#code`. Transports now normalize adapter-specific response objects into `Savon::Transport::Response` before they reach `Savon::HTTPError`.
 
 ## [2.17.2] - 2026-06-10
@@ -1248,6 +1262,8 @@ Pay attention to the following list and read the updated Wiki: http://wiki.githu
 
 * Complete rewrite and public release.
 
+[2.17.4]: https://github.com/savonrb/savon/compare/v2.17.3...v2.17.4
+[2.17.3]: https://github.com/savonrb/savon/compare/v2.17.2...v2.17.3
 [2.17.2]: https://github.com/savonrb/savon/compare/v2.17.1...v2.17.2
 [2.17.1]: https://github.com/savonrb/savon/compare/v2.17.0...v2.17.1
 [2.17.0]: https://github.com/savonrb/savon/compare/v2.16.0...v2.17.0

data/lib/savon/addressing.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "gyoku"
+require "securerandom"
+
+module Savon
+  # Emits the WS-Addressing message addressing properties of a request
+  # (WS-Addressing 1.0 - Core §3.2): +wsa:Action+, +wsa:To+ and +wsa:MessageID+.
+  #
+  # This object owns everything Savon knows about WS-Addressing: the namespace,
+  # whether the headers are emitted at all, and how the resolved SOAPAction and
+  # endpoint map onto the addressing properties. It works on plain values.
+  # {Savon::Header} resolves them via {Savon::EffectiveOptions} and constructs
+  # this object, keeping option resolution and WSA emission separate.
+  class Addressing
+    # The WS-Addressing 1.0 namespace,
+    # https://www.w3.org/TR/ws-addr-core/#namespaces.
+    NAMESPACE = "http://www.w3.org/2005/08/addressing"
+
+    # @param enabled [Object] whether the headers are emitted, any truthy value
+    #   counts (the +:use_wsa_headers+ global)
+    # @param action [String, nil] the resolved SOAPAction, emitted as
+    #   +wsa:Action+, or +nil+ when the caller disabled it
+    # @param to [URI, String, nil] the resolved endpoint, emitted as +wsa:To+
+    def initialize(enabled:, action: nil, to: nil)
+      @enabled = enabled
+      @action  = action
+      @to      = to
+    end
+
+    # @return [Boolean] whether the WS-Addressing headers are emitted
+    def enabled?
+      !!@enabled
+    end
+
+    # Returns the namespace declaration the enclosing Header element needs.
+    # The +wsa+ prefix is declared once on the Header, not on each child.
+    #
+    # @return [Hash{String => String}] +{"xmlns:wsa" => NAMESPACE}+, or an
+    #   empty Hash when disabled
+    def namespace_attributes
+      enabled? ? { "xmlns:wsa" => NAMESPACE } : {}
+    end
+
+    # Renders the three addressing properties, each rendering with a freshly
+    # generated +wsa:MessageID+. A +nil+ action or destination is emitted as
+    # an +xsi:nil+ element rather than being dropped.
+    #
+    # @return [String] the header elements, or an empty String when disabled
+    def to_xml
+      return "" unless enabled?
+
+      Gyoku.xml(
+        "wsa:Action"    => @action,
+        "wsa:To"        => @to,
+        "wsa:MessageID" => "urn:uuid:#{SecureRandom.uuid}"
+      )
+    end
+  end
+end

data/lib/savon/builder.rb

@@ -1,12 +1,22 @@
 # frozen_string_literal: true
 
+require "savon/addressing"
 require "savon/header"
 require "savon/message"
+require "savon/effective_options"
 require "nokogiri"
 require "builder"
 require "gyoku"
 
 module Savon
+  # Builds the SOAP request for an operation: the XML envelope, or
+  # a multipart/related message when the request carries attachments
+  # (SOAP with Attachments, https://www.w3.org/TR/SOAP-attachments).
+  #
+  # It owns the envelope structure, its namespace declarations, and the body,
+  # and signs the document when a WSSE signature is present. Message-body
+  # serialization is delegated to {Savon::Message}, the Header element to
+  # {Savon::Header}, and Hash-to-XML conversion to Gyoku.
   class Builder
     attr_reader :multipart
 
@@ -20,15 +30,23 @@ module Savon
       2 => "http://www.w3.org/2003/05/soap-envelope"
     }.freeze
 
-    WSA_NAMESPACE = "http://www.w3.org/2005/08/addressing"
+    # @deprecated Use {Savon::Addressing::NAMESPACE} instead. This alias will
+    #   be removed in Savon 3.0.
+    WSA_NAMESPACE = Addressing::NAMESPACE
 
+    # @param operation_name [Symbol] the SOAP operation being called
+    # @param wsdl [Wasabi::Document] the parsed WSDL, or an empty document when
+    #   the client was configured without one
+    # @param globals [Savon::GlobalOptions] client-level options
+    # @param locals [Savon::LocalOptions] per-request options
     def initialize(operation_name, wsdl, globals, locals)
       @operation_name = operation_name
 
       @wsdl      = wsdl
       @globals   = globals
       @locals    = locals
-      @signature = @locals[:wsse_signature] || @globals[:wsse_signature]
+      @effective = EffectiveOptions.new(operation_name, wsdl, globals, locals)
+      @signature = @effective.wsse_signature
 
       @types = convert_type_definitions_to_hash
       @used_namespaces = convert_type_namespaces_to_hash
@@ -62,8 +80,12 @@ module Savon
       end
     end
 
+    # Returns the XML attributes of the envelope's Header element, provided
+    # by the header's sections.
+    #
+    # @return [Hash{String => String}]
     def header_attributes
-      @globals[:use_wsa_headers] ? { 'xmlns:wsa' => WSA_NAMESPACE } : {}
+      header.attributes
     end
 
     def body_attributes
@@ -139,7 +161,7 @@ module Savon
     end
 
     def header
-      @header ||= Header.new(@globals, @locals)
+      @header ||= Header.new(@globals, @effective)
     end
 
     def namespaced_message_tag

data/lib/savon/effective_options.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "gyoku"
+require "uri"
+
+module Savon
+  # Resolves the effective value of options whose answer combines more than
+  # one source: the per-request options, the client options, the WSDL
+  # document, and built-in defaults.
+  #
+  # {Savon::GlobalOptions} and {Savon::LocalOptions} store what the caller
+  # said. EffectiveOptions answers what the request uses. It owns the
+  # precedence rules and exposes one reader per resolvable option, so every
+  # consumer of an option resolves it identically. Resolution is a pure read.
+  # It never mutates the options or the WSDL document.
+  class EffectiveOptions
+    # @param operation_name [Symbol] the SOAP operation being called
+    # @param wsdl [Wasabi::Document] the parsed WSDL, or an empty document
+    #   when the client was configured without one
+    # @param globals [Savon::GlobalOptions] the client-level options
+    # @param locals [Savon::LocalOptions] the per-request options
+    def initialize(operation_name, wsdl, globals, locals)
+      @operation_name = operation_name
+      @wsdl           = wsdl
+      @globals        = globals
+      @locals         = locals
+    end
+
+    # Resolves the SOAPAction of the request (SOAP 1.1 §6.1.1).
+    #
+    # An explicit local +:soap_action+ wins. A local +false+ or +nil+ disables
+    # the action, so no SOAPAction HTTP header is sent and an enabled
+    # +wsa:Action+ header stays empty. Without a local value the WSDL provides
+    # the soapAction of the operation. Without a WSDL document the operation
+    # name is converted to an XML tag as a best-effort default.
+    #
+    # @return [String, nil] the action, or +nil+ when explicitly disabled
+    def soap_action
+      return if @locals.include?(:soap_action) && !@locals[:soap_action]
+
+      @locals[:soap_action] ||
+        (@wsdl.document? && @wsdl.soap_action(@operation_name.to_sym)) ||
+        Gyoku.xml_tag(@operation_name, key_converter: @globals[:convert_request_keys_to])
+    end
+
+    # Resolves the endpoint URL the request is sent to.
+    #
+    # A global +:endpoint+ wins over the service address of the WSDL. The
+    # global +:host+ option replaces host and port of the WSDL address and
+    # keeps scheme, path and query. The override is applied to a copy. The
+    # WSDL document keeps its parsed address.
+    #
+    # @return [URI, String, nil] the endpoint as provided by the winning source
+    def endpoint
+      return @globals[:endpoint] if @globals[:endpoint]
+      return @wsdl.endpoint unless @globals[:host]
+
+      host_url = URI.parse(@globals[:host])
+      url      = @wsdl.endpoint.dup
+      url.host = host_url.host
+      url.port = host_url.port
+      url
+    end
+
+    # Resolves the WSSE auth credentials passed to Akami. A local value takes
+    # precedence over the global one. A local +false+ disables auth even when a
+    # global value is set. A local +nil+ leaves the option unset and falls
+    # through to the global value.
+    #
+    # @return [Array<String>, false, nil] the credentials, +false+ to disable,
+    #   or +nil+ when unset in both scopes
+    def wsse_auth
+      prefer_local(:wsse_auth)
+    end
+
+    # Resolves whether Akami emits a +wsu:Timestamp+ header, using the same
+    # local-over-global rule as {#wsse_auth}. A local +false+ disables it and a
+    # local +nil+ keeps the global value.
+    #
+    # @return [Boolean, nil]
+    def wsse_timestamp
+      prefer_local(:wsse_timestamp)
+    end
+
+    # Resolves the WSSE signature used to sign the request. This option is a
+    # signature object or +nil+ and has no "disable" value, so any falsy local
+    # value falls back to the global one. {Savon::Builder} and {Savon::Header}
+    # both read it and must resolve it identically.
+    #
+    # @return [Akami::WSSE::Signature, nil]
+    def wsse_signature
+      @locals[:wsse_signature] || @globals[:wsse_signature]
+    end
+
+    # Resolves the SOAP header content. When both scopes provide a Hash the two
+    # are merged and local keys win. Otherwise the local value is preferred and
+    # falls back to the global one. A Hash is rendered to XML by Gyoku. A String,
+    # or any object responding to +#to_s+, is used verbatim.
+    #
+    # @return [Hash, String, nil]
+    def soap_header
+      global = @globals[:soap_header]
+      local  = @locals[:soap_header]
+
+      if global.is_a?(Hash) && local.is_a?(Hash)
+        global.merge(local)
+      else
+        local || global
+      end
+    end
+
+    private
+
+    # Resolves an option where a local +false+ is meaningful and disables it.
+    # Only a local +nil+ falls through to the global value. Contrast with
+    # {#wsse_signature}, which treats any falsy local as unset.
+    #
+    # @param key [Symbol] the option name
+    # @return [Object, nil] the local value unless it is +nil+, else the global
+    def prefer_local(key)
+      @locals[key].nil? ? @globals[key] : @locals[key]
+    end
+  end
+end

data/lib/savon/header.rb

@@ -2,71 +2,113 @@
 
 require "akami"
 require "gyoku"
-require "securerandom"
+require "savon/addressing"
 
 module Savon
+  # Assembles the SOAP +Header+ element of a request envelope and renders it to
+  # XML.
+  #
+  # A SOAP Header carries a request's out-of-band metadata. This object is
+  # responsible for every header block Savon can emit, concatenated in this
+  # order:
+  #
+  # 1. application headers supplied by the caller (the +soap_header+ option),
+  # 2. the WS-Addressing headers, rendered by {Savon::Addressing},
+  # 3. the WS-Security header with UsernameToken credentials, a +wsu:Timestamp+
+  #    and an XML Signature (OASIS WSS SOAP Message Security 1.1).
+  #
+  # WS-Security markup is delegated to Akami and Hash-to-XML conversion to Gyoku.
   class Header
-    def initialize(globals, locals)
+    # @param globals [Savon::GlobalOptions] client-level options, read for the
+    #   Gyoku key converter (+:convert_request_keys_to+) and the WS-Addressing
+    #   toggle (+:use_wsa_headers+)
+    # @param effective [Savon::EffectiveOptions] resolves the WSSE, soap_header,
+    #   soap_action and endpoint values for the request
+    def initialize(globals, effective)
       @gyoku_options  = { key_converter: globals[:convert_request_keys_to] }
 
-      @wsse_auth      = locals[:wsse_auth].nil? ? globals[:wsse_auth] : locals[:wsse_auth]
-      @wsse_timestamp = locals[:wsse_timestamp].nil? ? globals[:wsse_timestamp] : locals[:wsse_timestamp]
-      @wsse_signature = locals[:wsse_signature].nil? ? globals[:wsse_signature] : locals[:wsse_signature]
+      @wsse_auth      = effective.wsse_auth
+      @wsse_timestamp = effective.wsse_timestamp
+      @wsse_signature = effective.wsse_signature
+      @soap_header    = effective.soap_header
 
-      @global_header  = globals[:soap_header]
-      @local_header   = locals[:soap_header]
+      @addressing = build_addressing(globals, effective)
+      @header     = build
+    end
 
-      @globals        = globals
-      @locals         = locals
+    attr_reader :gyoku_options, :wsse_auth, :wsse_timestamp, :wsse_signature
 
-      @header = build
+    # Returns the XML attributes of the enclosing Header element. Only the
+    # WS-Addressing section declares one, the +xmlns:wsa+ prefix.
+    #
+    # @return [Hash{String => String}]
+    def attributes
+      @addressing.namespace_attributes
     end
 
-    attr_reader :local_header, :global_header, :gyoku_options,
-                :wsse_auth, :wsse_timestamp, :wsse_signature
-
+    # @return [Boolean] whether the rendered header is empty, i.e. there is no
+    #   header content to include in the envelope
     def empty?
       @header.empty?
     end
 
+    # Returns the rendered SOAP header XML. The header is built once during
+    # construction and cached, so this is a cheap, repeatable read.
+    #
+    # @return [String] the header XML (may be empty)
     def to_s
       @header
     end
 
     private
 
+    # Constructs the WS-Addressing section from the resolved request values.
+    # Resolving the endpoint raises without a WSDL document and without a
+    # global +:endpoint+, so action and endpoint are only resolved when the
+    # +:use_wsa_headers+ global asks for the headers.
+    #
+    # @return [Savon::Addressing]
+    def build_addressing(globals, effective)
+      return Addressing.new(enabled: false) unless globals[:use_wsa_headers]
+
+      Addressing.new(
+        enabled: true,
+        action: effective.soap_action,
+        to: effective.endpoint
+      )
+    end
+
+    # Concatenates the three header sections in document order: caller content,
+    # WS-Addressing, then WSSE security.
+    #
+    # @return [String]
     def build
-      build_header + build_wsa_header + build_wsse_header
+      build_header + @addressing.to_xml + build_wsse_header
     end
 
+    # Renders the resolved soap_header. {Savon::EffectiveOptions#soap_header}
+    # merges the global and local values, so there is nothing to combine here.
+    # Hash-to-XML conversion only. Strings pass through.
+    #
+    # @return [String]
     def build_header
-      header =
-        if global_header.is_a?(Hash) && local_header.is_a?(Hash)
-          global_header.merge(local_header)
-        elsif local_header
-          local_header
-        else
-          global_header
-        end
-
-      convert_to_xml(header)
+      convert_to_xml(@soap_header)
     end
 
+    # Builds the WS-Security header via Akami, or an empty string when no WSSE
+    # content (credentials, timestamp or signature) applies.
+    #
+    # @return [String]
     def build_wsse_header
       wsse_header = akami
       wsse_header.respond_to?(:to_xml) ? wsse_header.to_xml : ""
     end
 
-    def build_wsa_header
-      return '' unless @globals[:use_wsa_headers]
-
-      convert_to_xml({
-        'wsa:Action'    => @locals[:soap_action],
-        'wsa:To'        => @globals[:endpoint],
-        'wsa:MessageID' => "urn:uuid:#{SecureRandom.uuid}"
-      })
-    end
-
+    # Renders a header value to XML. A Hash goes through Gyoku (honouring the
+    # configured key converter), anything else is coerced with +#to_s+.
+    #
+    # @param hash_or_string [Hash, #to_s] the header content
+    # @return [String]
     def convert_to_xml(hash_or_string)
       if hash_or_string.is_a? Hash
         Gyoku.xml(hash_or_string, gyoku_options)
@@ -75,6 +117,11 @@ module Savon
       end
     end
 
+    # Configures an Akami WSSE object from the resolved WSSE options. Sets the
+    # UsernameToken credentials, enables the wsu:Timestamp, and attaches the XML
+    # Signature when a document has been assigned to it.
+    #
+    # @return [Akami::WSSE] configured, not yet serialized
     def akami
       wsse = Akami.wsse
       wsse.credentials(*wsse_auth) if wsse_auth

data/lib/savon/operation.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "savon/options"
+require "savon/effective_options"
 require "savon/block_interface"
 require "savon/builder"
 require "savon/response"
@@ -114,6 +115,13 @@ module Savon
       @locals = locals
     end
 
+    # The effective options view for the current request. Built on demand
+    # instead of being cached, so it always reflects the current per-request
+    # options.
+    def effective_options
+      EffectiveOptions.new(@name, @wsdl, @globals, @locals)
+    end
+
     # Assembles the SOAP-level request headers for the given builder.
     #
     # Our responsibility regardless of transport:
@@ -143,26 +151,16 @@ module Savon
       headers
     end
 
+    # The resolved SOAPAction of the request, used for the HTTP header.
+    # {Savon::EffectiveOptions#soap_action} owns the precedence rules.
     def soap_action
-      # soap_action explicitly set to something falsy
-      return if @locals.include?(:soap_action) && !@locals[:soap_action]
-
-      # get the soap_action from local options
-      @locals[:soap_action] ||
-        # with no local option, but a wsdl, ask it for the soap_action
-        @wsdl.document? && @wsdl.soap_action(@name.to_sym) ||
-        # if there is no soap_action up to this point, fallback to a simple default
-        Gyoku.xml_tag(@name, key_converter: @globals[:convert_request_keys_to])
+      effective_options.soap_action
     end
 
+    # The resolved endpoint URL the request is sent to.
+    # {Savon::EffectiveOptions#endpoint} owns the precedence rules.
     def endpoint
-      @globals[:endpoint] || @wsdl.endpoint.tap do |url|
-        if @globals[:host]
-          host_url = URI.parse(@globals[:host])
-          url.host = host_url.host
-          url.port = host_url.port
-        end
-      end
+      effective_options.endpoint
     end
 
     # Normalizes an observer return value into a Transport::Response.

data/lib/savon/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Savon
-  VERSION = '2.17.3'
+  VERSION = '2.17.4'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: savon
 version: !ruby/object:Gem::Version
-  version: 2.17.3
+  version: 2.17.4
 platform: ruby
 authors:
 - Daniel Harrington
@@ -256,9 +256,11 @@ files:
 - README.md
 - Rakefile
 - lib/savon.rb
+- lib/savon/addressing.rb
 - lib/savon/block_interface.rb
 - lib/savon/builder.rb
 - lib/savon/client.rb
+- lib/savon/effective_options.rb
 - lib/savon/faraday_migration_hint.rb
 - lib/savon/header.rb
 - lib/savon/http_error.rb