stripe 1.27.2 → 5.33.0

data/lib/stripe/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Stripe
-  VERSION = '1.27.2'
+  VERSION = "5.33.0"
 end

data/lib/stripe/webhook.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+module Stripe
+  module Webhook
+    DEFAULT_TOLERANCE = 300
+
+    # Initializes an Event object from a JSON payload.
+    #
+    # This may raise JSON::ParserError if the payload is not valid JSON, or
+    # SignatureVerificationError if the signature verification fails.
+    def self.construct_event(payload, sig_header, secret,
+                             tolerance: DEFAULT_TOLERANCE)
+      Signature.verify_header(payload, sig_header, secret, tolerance: tolerance)
+
+      # It's a good idea to parse the payload only after verifying it. We use
+      # `symbolize_names` so it would otherwise be technically possible to
+      # flood a target's memory if they were on an older version of Ruby that
+      # doesn't GC symbols. It also decreases the likelihood that we receive a
+      # bad payload that fails to parse and throws an exception.
+      data = JSON.parse(payload, symbolize_names: true)
+      Event.construct_from(data)
+    end
+
+    module Signature
+      EXPECTED_SCHEME = "v1"
+
+      # Computes a webhook signature given a time (probably the current time),
+      # a payload, and a signing secret.
+      def self.compute_signature(timestamp, payload, secret)
+        raise ArgumentError, "timestamp should be an instance of Time" \
+          unless timestamp.is_a?(Time)
+        raise ArgumentError, "payload should be a string" \
+          unless payload.is_a?(String)
+        raise ArgumentError, "secret should be a string" \
+          unless secret.is_a?(String)
+
+        timestamped_payload = "#{timestamp.to_i}.#{payload}"
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret,
+                                timestamped_payload)
+      end
+
+      # Generates a value that would be added to a `Stripe-Signature` for a
+      # given webhook payload.
+      #
+      # Note that this isn't needed to verify webhooks in any way, and is
+      # mainly here for use in test cases (those that are both within this
+      # project and without).
+      def self.generate_header(timestamp, signature, scheme: EXPECTED_SCHEME)
+        raise ArgumentError, "timestamp should be an instance of Time" \
+          unless timestamp.is_a?(Time)
+        raise ArgumentError, "signature should be a string" \
+          unless signature.is_a?(String)
+        raise ArgumentError, "scheme should be a string" \
+          unless scheme.is_a?(String)
+
+        "t=#{timestamp.to_i},#{scheme}=#{signature}"
+      end
+
+      # Extracts the timestamp and the signature(s) with the desired scheme
+      # from the header
+      def self.get_timestamp_and_signatures(header, scheme)
+        list_items = header.split(/,\s*/).map { |i| i.split("=", 2) }
+        timestamp = Integer(list_items.select { |i| i[0] == "t" }[0][1])
+        signatures = list_items.select { |i| i[0] == scheme }.map { |i| i[1] }
+        [Time.at(timestamp), signatures]
+      end
+      private_class_method :get_timestamp_and_signatures
+
+      # Verifies the signature header for a given payload.
+      #
+      # Raises a SignatureVerificationError in the following cases:
+      # - the header does not match the expected format
+      # - no signatures found with the expected scheme
+      # - no signatures matching the expected signature
+      # - a tolerance is provided and the timestamp is not within the
+      #   tolerance
+      #
+      # Returns true otherwise
+      def self.verify_header(payload, header, secret, tolerance: nil)
+        begin
+          timestamp, signatures =
+            get_timestamp_and_signatures(header, EXPECTED_SCHEME)
+
+        # TODO: Try to knock over this blanket rescue as it can unintentionally
+        # swallow many valid errors. Instead, try to validate an incoming
+        # header one piece at a time, and error with a known exception class if
+        # any part is found to be invalid. Rescue that class here.
+        rescue StandardError
+          raise SignatureVerificationError.new(
+            "Unable to extract timestamp and signatures from header",
+            header, http_body: payload
+          )
+        end
+
+        if signatures.empty?
+          raise SignatureVerificationError.new(
+            "No signatures found with expected scheme #{EXPECTED_SCHEME}",
+            header, http_body: payload
+          )
+        end
+
+        expected_sig = compute_signature(timestamp, payload, secret)
+        unless signatures.any? { |s| Util.secure_compare(expected_sig, s) }
+          raise SignatureVerificationError.new(
+            "No signatures found matching the expected signature for payload",
+            header, http_body: payload
+          )
+        end
+
+        if tolerance && timestamp < Time.now - tolerance
+          raise SignatureVerificationError.new(
+            "Timestamp outside the tolerance zone (#{Time.at(timestamp)})",
+            header, http_body: payload
+          )
+        end
+
+        true
+      end
+    end
+  end
+end

data/stripe.gemspec

@@ -1,27 +1,41 @@
-$:.unshift(File.join(File.dirname(__FILE__), 'lib'))
+# frozen_string_literal: true
 
-require 'stripe/version'
+$LOAD_PATH.unshift(::File.join(::File.dirname(__FILE__), "lib"))
 
-spec = Gem::Specification.new do |s|
-  s.name = 'stripe'
-  s.version = Stripe::VERSION
-  s.summary = 'Ruby bindings for the Stripe API'
-  s.description = 'Stripe is the easiest way to accept payments online.  See https://stripe.com for details.'
-  s.authors = ['Ross Boucher', 'Greg Brockman']
-  s.email = ['boucher@stripe.com', 'gdb@stripe.com']
-  s.homepage = 'https://stripe.com/api'
-  s.license = 'MIT'
+require "stripe/version"
 
-  s.add_dependency('rest-client', '~> 1.4')
-  s.add_dependency('json', '~> 1.8.1')
+Gem::Specification.new do |s|
+  s.name = "stripe"
+  s.version = Stripe::VERSION
+  s.required_ruby_version = ">= 2.3.0"
+  s.summary = "Ruby bindings for the Stripe API"
+  s.description = "Stripe is the easiest way to accept payments online.  " \
+                  "See https://stripe.com for details."
+  s.author = "Stripe"
+  s.email = "support@stripe.com"
+  s.homepage = "https://stripe.com/docs/api/ruby"
+  s.license = "MIT"
 
-  s.add_development_dependency('mocha', '~> 0.13.2')
-  s.add_development_dependency('shoulda', '~> 3.4.0')
-  s.add_development_dependency('test-unit')
-  s.add_development_dependency('rake')
+  s.metadata = {
+    "bug_tracker_uri" => "https://github.com/stripe/stripe-ruby/issues",
+    "changelog_uri" =>
+      "https://github.com/stripe/stripe-ruby/blob/master/CHANGELOG.md",
+    "documentation_uri" => "https://stripe.com/docs/api/ruby",
+    "github_repo" => "ssh://github.com/stripe/stripe-ruby",
+    "homepage_uri" => "https://stripe.com/docs/api/ruby",
+    "source_code_uri" => "https://github.com/stripe/stripe-ruby",
+  }
 
-  s.files = `git ls-files`.split("\n")
-  s.test_files    = `git ls-files -- test/*`.split("\n")
-  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
-  s.require_paths = ['lib']
+  ignored = Regexp.union(
+    /\A\.editorconfig/,
+    /\A\.git/,
+    /\A\.rubocop/,
+    /\A\.travis.yml/,
+    /\A\.vscode/,
+    /\Atest/
+  )
+  s.files = `git ls-files`.split("\n").reject { |f| ignored.match(f) }
+  s.executables   = `git ls-files -- bin/*`.split("\n")
+                                           .map { |f| ::File.basename(f) }
+  s.require_paths = ["lib"]
 end

metadata

@@ -1,204 +1,155 @@
 --- !ruby/object:Gem::Specification
 name: stripe
 version: !ruby/object:Gem::Version
-  version: 1.27.2
+  version: 5.33.0
 platform: ruby
 authors:
-- Ross Boucher
-- Greg Brockman
+- Stripe
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-09-25 00:00:00.000000000 Z
-dependencies:
-- !ruby/object:Gem::Dependency
-  name: rest-client
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.4'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.4'
-- !ruby/object:Gem::Dependency
-  name: json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.8.1
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.8.1
-- !ruby/object:Gem::Dependency
-  name: mocha
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.13.2
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 0.13.2
-- !ruby/object:Gem::Dependency
-  name: shoulda
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.4.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 3.4.0
-- !ruby/object:Gem::Dependency
-  name: test-unit
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-- !ruby/object:Gem::Dependency
-  name: rake
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
+date: 2021-05-19 00:00:00.000000000 Z
+dependencies: []
 description: Stripe is the easiest way to accept payments online.  See https://stripe.com
   for details.
-email:
-- boucher@stripe.com
-- gdb@stripe.com
+email: support@stripe.com
 executables:
 - stripe-console
 extensions: []
 extra_rdoc_files: []
 files:
-- ".gitignore"
-- ".travis.yml"
+- CHANGELOG.md
+- CODE_OF_CONDUCT.md
 - CONTRIBUTORS
 - Gemfile
 - History.txt
 - LICENSE
-- README.rdoc
+- README.md
 - Rakefile
 - VERSION
 - bin/stripe-console
-- gemfiles/default-with-activesupport.gemfile
-- gemfiles/json.gemfile
-- gemfiles/yajl.gemfile
 - lib/data/ca-certificates.crt
 - lib/stripe.rb
-- lib/stripe/account.rb
 - lib/stripe/api_operations/create.rb
 - lib/stripe/api_operations/delete.rb
 - lib/stripe/api_operations/list.rb
+- lib/stripe/api_operations/nested_resource.rb
 - lib/stripe/api_operations/request.rb
-- lib/stripe/api_operations/update.rb
+- lib/stripe/api_operations/save.rb
 - lib/stripe/api_resource.rb
-- lib/stripe/application_fee.rb
-- lib/stripe/application_fee_refund.rb
-- lib/stripe/balance.rb
-- lib/stripe/balance_transaction.rb
-- lib/stripe/bank_account.rb
-- lib/stripe/bitcoin_receiver.rb
-- lib/stripe/bitcoin_transaction.rb
-- lib/stripe/card.rb
-- lib/stripe/charge.rb
-- lib/stripe/coupon.rb
-- lib/stripe/customer.rb
-- lib/stripe/dispute.rb
-- lib/stripe/errors/api_connection_error.rb
-- lib/stripe/errors/api_error.rb
-- lib/stripe/errors/authentication_error.rb
-- lib/stripe/errors/card_error.rb
-- lib/stripe/errors/invalid_request_error.rb
-- lib/stripe/errors/rate_limit_error.rb
-- lib/stripe/errors/stripe_error.rb
-- lib/stripe/event.rb
-- lib/stripe/file_upload.rb
-- lib/stripe/invoice.rb
-- lib/stripe/invoice_item.rb
+- lib/stripe/connection_manager.rb
+- lib/stripe/error_object.rb
+- lib/stripe/errors.rb
+- lib/stripe/instrumentation.rb
 - lib/stripe/list_object.rb
-- lib/stripe/order.rb
-- lib/stripe/plan.rb
-- lib/stripe/product.rb
-- lib/stripe/recipient.rb
-- lib/stripe/refund.rb
-- lib/stripe/reversal.rb
+- lib/stripe/multipart_encoder.rb
+- lib/stripe/oauth.rb
+- lib/stripe/object_types.rb
+- lib/stripe/resources.rb
+- lib/stripe/resources/account.rb
+- lib/stripe/resources/account_link.rb
+- lib/stripe/resources/alipay_account.rb
+- lib/stripe/resources/apple_pay_domain.rb
+- lib/stripe/resources/application_fee.rb
+- lib/stripe/resources/application_fee_refund.rb
+- lib/stripe/resources/balance.rb
+- lib/stripe/resources/balance_transaction.rb
+- lib/stripe/resources/bank_account.rb
+- lib/stripe/resources/billing_portal/configuration.rb
+- lib/stripe/resources/billing_portal/session.rb
+- lib/stripe/resources/bitcoin_receiver.rb
+- lib/stripe/resources/bitcoin_transaction.rb
+- lib/stripe/resources/capability.rb
+- lib/stripe/resources/card.rb
+- lib/stripe/resources/charge.rb
+- lib/stripe/resources/checkout/session.rb
+- lib/stripe/resources/country_spec.rb
+- lib/stripe/resources/coupon.rb
+- lib/stripe/resources/credit_note.rb
+- lib/stripe/resources/credit_note_line_item.rb
+- lib/stripe/resources/customer.rb
+- lib/stripe/resources/customer_balance_transaction.rb
+- lib/stripe/resources/discount.rb
+- lib/stripe/resources/dispute.rb
+- lib/stripe/resources/ephemeral_key.rb
+- lib/stripe/resources/event.rb
+- lib/stripe/resources/exchange_rate.rb
+- lib/stripe/resources/file.rb
+- lib/stripe/resources/file_link.rb
+- lib/stripe/resources/identity/verification_report.rb
+- lib/stripe/resources/identity/verification_session.rb
+- lib/stripe/resources/invoice.rb
+- lib/stripe/resources/invoice_item.rb
+- lib/stripe/resources/invoice_line_item.rb
+- lib/stripe/resources/issuing/authorization.rb
+- lib/stripe/resources/issuing/card.rb
+- lib/stripe/resources/issuing/card_details.rb
+- lib/stripe/resources/issuing/cardholder.rb
+- lib/stripe/resources/issuing/dispute.rb
+- lib/stripe/resources/issuing/transaction.rb
+- lib/stripe/resources/line_item.rb
+- lib/stripe/resources/login_link.rb
+- lib/stripe/resources/mandate.rb
+- lib/stripe/resources/order.rb
+- lib/stripe/resources/order_return.rb
+- lib/stripe/resources/payment_intent.rb
+- lib/stripe/resources/payment_method.rb
+- lib/stripe/resources/payout.rb
+- lib/stripe/resources/person.rb
+- lib/stripe/resources/plan.rb
+- lib/stripe/resources/price.rb
+- lib/stripe/resources/product.rb
+- lib/stripe/resources/promotion_code.rb
+- lib/stripe/resources/radar/early_fraud_warning.rb
+- lib/stripe/resources/radar/value_list.rb
+- lib/stripe/resources/radar/value_list_item.rb
+- lib/stripe/resources/recipient.rb
+- lib/stripe/resources/recipient_transfer.rb
+- lib/stripe/resources/refund.rb
+- lib/stripe/resources/reporting/report_run.rb
+- lib/stripe/resources/reporting/report_type.rb
+- lib/stripe/resources/reversal.rb
+- lib/stripe/resources/review.rb
+- lib/stripe/resources/setup_attempt.rb
+- lib/stripe/resources/setup_intent.rb
+- lib/stripe/resources/sigma/scheduled_query_run.rb
+- lib/stripe/resources/sku.rb
+- lib/stripe/resources/source.rb
+- lib/stripe/resources/source_transaction.rb
+- lib/stripe/resources/subscription.rb
+- lib/stripe/resources/subscription_item.rb
+- lib/stripe/resources/subscription_schedule.rb
+- lib/stripe/resources/tax_id.rb
+- lib/stripe/resources/tax_rate.rb
+- lib/stripe/resources/terminal/connection_token.rb
+- lib/stripe/resources/terminal/location.rb
+- lib/stripe/resources/terminal/reader.rb
+- lib/stripe/resources/three_d_secure.rb
+- lib/stripe/resources/token.rb
+- lib/stripe/resources/topup.rb
+- lib/stripe/resources/transfer.rb
+- lib/stripe/resources/usage_record.rb
+- lib/stripe/resources/usage_record_summary.rb
+- lib/stripe/resources/webhook_endpoint.rb
 - lib/stripe/singleton_api_resource.rb
-- lib/stripe/sku.rb
+- lib/stripe/stripe_client.rb
+- lib/stripe/stripe_configuration.rb
 - lib/stripe/stripe_object.rb
-- lib/stripe/subscription.rb
-- lib/stripe/token.rb
-- lib/stripe/transfer.rb
+- lib/stripe/stripe_response.rb
 - lib/stripe/util.rb
 - lib/stripe/version.rb
+- lib/stripe/webhook.rb
 - stripe.gemspec
-- test/stripe/account_test.rb
-- test/stripe/api_resource_test.rb
-- test/stripe/application_fee_refund_test.rb
-- test/stripe/application_fee_test.rb
-- test/stripe/balance_test.rb
-- test/stripe/bitcoin_receiver_test.rb
-- test/stripe/bitcoin_transaction_test.rb
-- test/stripe/charge_refund_test.rb
-- test/stripe/charge_test.rb
-- test/stripe/coupon_test.rb
-- test/stripe/customer_card_test.rb
-- test/stripe/customer_test.rb
-- test/stripe/dispute_test.rb
-- test/stripe/file_upload_test.rb
-- test/stripe/invoice_test.rb
-- test/stripe/list_object_test.rb
-- test/stripe/metadata_test.rb
-- test/stripe/order_test.rb
-- test/stripe/product_test.rb
-- test/stripe/recipient_card_test.rb
-- test/stripe/refund_test.rb
-- test/stripe/reversal_test.rb
-- test/stripe/sku_test.rb
-- test/stripe/stripe_object_test.rb
-- test/stripe/subscription_test.rb
-- test/stripe/transfer_test.rb
-- test/stripe/util_test.rb
-- test/test_data.rb
-- test/test_helper.rb
-homepage: https://stripe.com/api
+homepage: https://stripe.com/docs/api/ruby
 licenses:
 - MIT
-metadata: {}
+metadata:
+  bug_tracker_uri: https://github.com/stripe/stripe-ruby/issues
+  changelog_uri: https://github.com/stripe/stripe-ruby/blob/master/CHANGELOG.md
+  documentation_uri: https://stripe.com/docs/api/ruby
+  github_repo: ssh://github.com/stripe/stripe-ruby
+  homepage_uri: https://stripe.com/docs/api/ruby
+  source_code_uri: https://github.com/stripe/stripe-ruby
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -207,46 +158,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.3.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Ruby bindings for the Stripe API
-test_files:
-- test/stripe/account_test.rb
-- test/stripe/api_resource_test.rb
-- test/stripe/application_fee_refund_test.rb
-- test/stripe/application_fee_test.rb
-- test/stripe/balance_test.rb
-- test/stripe/bitcoin_receiver_test.rb
-- test/stripe/bitcoin_transaction_test.rb
-- test/stripe/charge_refund_test.rb
-- test/stripe/charge_test.rb
-- test/stripe/coupon_test.rb
-- test/stripe/customer_card_test.rb
-- test/stripe/customer_test.rb
-- test/stripe/dispute_test.rb
-- test/stripe/file_upload_test.rb
-- test/stripe/invoice_test.rb
-- test/stripe/list_object_test.rb
-- test/stripe/metadata_test.rb
-- test/stripe/order_test.rb
-- test/stripe/product_test.rb
-- test/stripe/recipient_card_test.rb
-- test/stripe/refund_test.rb
-- test/stripe/reversal_test.rb
-- test/stripe/sku_test.rb
-- test/stripe/stripe_object_test.rb
-- test/stripe/subscription_test.rb
-- test/stripe/transfer_test.rb
-- test/stripe/util_test.rb
-- test/test_data.rb
-- test/test_helper.rb
-has_rdoc: 
+test_files: []