stripe 1.10.1 → 1.11.0

data/lib/stripe.rb

@@ -25,6 +25,7 @@ require 'stripe/account'
 require 'stripe/balance'
 require 'stripe/balance_transaction'
 require 'stripe/customer'
+require 'stripe/certificate_blacklist'
 require 'stripe/invoice'
 require 'stripe/invoice_item'
 require 'stripe/charge'
@@ -47,10 +48,13 @@ require 'stripe/errors/invalid_request_error'
 require 'stripe/errors/authentication_error'
 
 module Stripe
+  DEFAULT_CA_BUNDLE_PATH = File.dirname(__FILE__) + '/data/ca-certificates.crt'
   @api_base = 'https://api.stripe.com'
 
-  @ssl_bundle_path  = File.dirname(__FILE__) + '/data/ca-certificates.crt'
+  @ssl_bundle_path  = DEFAULT_CA_BUNDLE_PATH
   @verify_ssl_certs = true
+  @CERTIFICATE_VERIFIED = false
+
 
   class << self
     attr_accessor :api_key, :api_base, :verify_ssl_certs, :api_version
@@ -83,6 +87,10 @@ module Stripe
                           :ssl_ca_file => @ssl_bundle_path)
     end
 
+    unless @CERTIFICATE_VERIFIED
+      @CERTIFICATE_VERIFIED = CertificateBlacklist.check_ssl_cert(@api_base, @ssl_bundle_path)
+    end
+
     params = Util.objects_to_ids(params)
     url = api_url(url)
 

data/lib/stripe/certificate_blacklist.rb

@@ -0,0 +1,47 @@
+require 'uri'
+require 'digest/sha1'
+
+module Stripe
+  module CertificateBlacklist
+
+    BLACKLIST = {
+      "api.stripe.com" => [
+        '05c0b3643694470a888c6e7feb5c9e24e823dc53',
+      ],
+      "revoked.stripe.com" => [
+        '5b7dc7fbc98d78bf76d4d4fa6f597a0c901fad5c',
+      ]
+    }
+
+
+    def self.check_ssl_cert(uri, ca_file)
+      uri = URI.parse(uri)
+
+      sock = TCPSocket.new(uri.host, uri.port)
+      ctx = OpenSSL::SSL::SSLContext.new
+      ctx.set_params(:verify_mode => OpenSSL::SSL::VERIFY_PEER,
+                     :ca_file => ca_file)
+
+      socket = OpenSSL::SSL::SSLSocket.new(sock, ctx)
+      socket.connect
+
+      certificate = socket.peer_cert.to_der
+      fingerprint = Digest::SHA1.hexdigest(certificate)
+
+      if blacklisted_certs = BLACKLIST[uri.host]
+        if blacklisted_certs.include?(fingerprint)
+          raise APIConnectionError.new(
+            "Invalid server certificate. You tried to connect to a server that" +
+            "has a revoked SSL certificate, which means we cannot securely send" +
+            "data to that server. Please email support@stripe.com if you need" +
+            "help connecting to the correct API server."
+          )
+        end
+      end
+
+      socket.close
+
+      return true
+    end
+  end
+end

data/lib/stripe/customer.rb

@@ -41,6 +41,12 @@ module Stripe
       subscription
     end
 
+    def create_subscription(params)
+      response, api_key = Stripe.request(:post, subscriptions_url, @api_key, params)
+      refresh_from({ :subscription => response }, api_key, true)
+      subscription
+    end
+
     def delete_discount
       Stripe.request(:delete, discount_url, @api_key)
       refresh_from({ :discount => nil }, api_key, true)
@@ -55,5 +61,9 @@ module Stripe
     def subscription_url
       url + '/subscription'
     end
+
+    def subscriptions_url
+      url + '/subscriptions'
+    end
   end
 end

data/lib/stripe/version.rb

@@ -1,3 +1,3 @@
 module Stripe
-  VERSION = '1.10.1'
+  VERSION = '1.11.0'
 end

data/test/stripe/certificate_blacklist_test.rb

@@ -0,0 +1,18 @@
+require File.expand_path('../../test_helper', __FILE__)
+
+module Stripe
+
+  class CertificateBlacklistTest < Test::Unit::TestCase
+    should "not trust revoked certificates" do
+      assert_raises(Stripe::APIConnectionError) {
+        Stripe::CertificateBlacklist.check_ssl_cert("https://revoked.stripe.com:444",
+                                                    Stripe::DEFAULT_CA_BUNDLE_PATH)
+      }
+    end
+
+    should "trust api.stripe.com" do
+      assert_true Stripe::CertificateBlacklist.check_ssl_cert("https://api.stripe.com",
+                                                              Stripe::DEFAULT_CA_BUNDLE_PATH)
+    end
+  end
+end

data/test/stripe/customer_test.rb

@@ -20,10 +20,10 @@ module Stripe
       @mock.expects(:get).once.returns(test_response(test_customer({:mnemonic => "foo"})))
       @mock.expects(:post).once.returns(test_response(test_customer({:mnemonic => "bar"})))
       c = Stripe::Customer.new("test_customer").refresh
-      assert_equal c.mnemonic, "foo"
+      assert_equal "foo", c.mnemonic
       c.mnemonic = "bar"
       c.save
-      assert_equal c.mnemonic, "bar"
+      assert_equal "bar", c.mnemonic
     end
 
     should "create should return a new customer" do
@@ -64,6 +64,18 @@ module Stripe
       c.cancel_subscription
     end
 
+    should "be able to create a subscription for a customer" do
+      c = Stripe::Customer.new("test_customer")
+
+      @mock.expects(:post).once.with do |url, api_key, params|
+        url == "#{Stripe.api_base}/v1/customers/test_customer/subscriptions" && api_key.nil? && CGI.parse(params) == {'plan' => ['silver']}
+      end.returns(test_response(test_subscription(:plan => 'silver')))
+      s = c.create_subscription({:plan => 'silver'})
+
+      assert_equal 'subscription', s.object
+      assert_equal 'silver', s.plan.identifier
+    end
+
     should "be able to delete a customer's discount" do
       @mock.expects(:get).once.returns(test_response(test_customer))
       c = Stripe::Customer.retrieve("test_customer")

data/test/stripe/invoice_test.rb

@@ -20,7 +20,7 @@ module Stripe
 
       @mock.expects(:post).once.with('https://api.stripe.com/v1/invoices/in_test_invoice/pay', nil, '').returns(test_response(test_paid_invoice))
       i.pay
-      assert_equal i.next_payment_attempt, nil
+      assert_equal nil, i.next_payment_attempt
     end
   end
 end

data/test/stripe/stripe_object_test.rb

@@ -12,9 +12,9 @@ module Stripe
     should "marshal a stripe object correctly" do
       obj = Stripe::StripeObject.construct_from({ :id => 1, :name => 'Stripe' }, 'apikey')
       m = Marshal.load(Marshal.dump(obj))
-      assert_equal m.id, 1
-      assert_equal m.name, 'Stripe'
-      assert_equal m.api_key, 'apikey'
+      assert_equal 1, m.id
+      assert_equal 'Stripe', m.name
+      assert_equal 'apikey', m.api_key
     end
   end
 end

data/test/stripe/subscription_test.rb

@@ -17,7 +17,7 @@ module Stripe
       subscription = customer.subscriptions.first
       subscription.refresh
 
-      assert_equal subscription.id, 'refreshed_subscription'
+      assert_equal 'refreshed_subscription', subscription.id
     end
 
     should "subscriptions should be deletable" do
@@ -38,12 +38,12 @@ module Stripe
 
       customer = Stripe::Customer.retrieve('test_customer')
       subscription = customer.subscriptions.first
-      assert_equal subscription.status, 'trialing'
+      assert_equal 'trialing', subscription.status
 
       subscription.status = 'active'
       subscription.save
 
-      assert_equal subscription.status, 'active'
+      assert_equal 'active', subscription.status
     end
 
     should "create should return a new subscription" do
@@ -52,7 +52,7 @@ module Stripe
 
       customer = Stripe::Customer.retrieve('test_customer')
       subscription = customer.subscriptions.create(:plan => 'silver')
-      assert_equal subscription.id, 'test_new_subscription'
+      assert_equal 'test_new_subscription', subscription.id
     end
 
     should "be able to delete a subscriptions's discount" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: stripe
 version: !ruby/object:Gem::Version
-  version: 1.10.1
+  version: 1.11.0
   prerelease: 
 platform: ruby
 authors:
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-02-04 00:00:00.000000000 Z
+date: 2014-04-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -159,6 +159,7 @@ files:
 - lib/stripe/balance.rb
 - lib/stripe/balance_transaction.rb
 - lib/stripe/card.rb
+- lib/stripe/certificate_blacklist.rb
 - lib/stripe/charge.rb
 - lib/stripe/coupon.rb
 - lib/stripe/customer.rb
@@ -185,6 +186,7 @@ files:
 - test/stripe/account_test.rb
 - test/stripe/api_resource_test.rb
 - test/stripe/application_fee_test.rb
+- test/stripe/certificate_blacklist_test.rb
 - test/stripe/charge_test.rb
 - test/stripe/coupon_test.rb
 - test/stripe/customer_test.rb
@@ -224,6 +226,7 @@ test_files:
 - test/stripe/account_test.rb
 - test/stripe/api_resource_test.rb
 - test/stripe/application_fee_test.rb
+- test/stripe/certificate_blacklist_test.rb
 - test/stripe/charge_test.rb
 - test/stripe/coupon_test.rb
 - test/stripe/customer_test.rb
@@ -234,4 +237,3 @@ test_files:
 - test/stripe/subscription_test.rb
 - test/stripe/util_test.rb
 - test/test_helper.rb
-has_rdoc: