stripe 20.2.0.pre.beta.1 → 21.0.0

data/lib/stripe/stripe_event_notification_handler.rb

@@ -1203,14 +1203,6 @@ module Stripe
       register("v2.core.account[configuration.merchant].updated", &callback)
     end
 
-    def on_v2_core_account_including_configuration_money_manager_capability_status_updated(&callback)
-      register("v2.core.account[configuration.money_manager].capability_status_updated", &callback)
-    end
-
-    def on_v2_core_account_including_configuration_money_manager_updated(&callback)
-      register("v2.core.account[configuration.money_manager].updated", &callback)
-    end
-
     def on_v2_core_account_including_configuration_recipient_capability_status_updated(&callback)
       register("v2.core.account[configuration.recipient].capability_status_updated", &callback)
     end
@@ -1251,142 +1243,10 @@ module Stripe
       register("v2.core.account_person.updated", &callback)
     end
 
-    def on_v2_core_approval_request_approved(&callback)
-      register("v2.core.approval_request.approved", &callback)
-    end
-
-    def on_v2_core_approval_request_canceled(&callback)
-      register("v2.core.approval_request.canceled", &callback)
-    end
-
-    def on_v2_core_approval_request_created(&callback)
-      register("v2.core.approval_request.created", &callback)
-    end
-
-    def on_v2_core_approval_request_expired(&callback)
-      register("v2.core.approval_request.expired", &callback)
-    end
-
-    def on_v2_core_approval_request_failed(&callback)
-      register("v2.core.approval_request.failed", &callback)
-    end
-
-    def on_v2_core_approval_request_rejected(&callback)
-      register("v2.core.approval_request.rejected", &callback)
-    end
-
-    def on_v2_core_approval_request_succeeded(&callback)
-      register("v2.core.approval_request.succeeded", &callback)
-    end
-
-    def on_v2_core_batch_job_batch_failed(&callback)
-      register("v2.core.batch_job.batch_failed", &callback)
-    end
-
-    def on_v2_core_batch_job_canceled(&callback)
-      register("v2.core.batch_job.canceled", &callback)
-    end
-
-    def on_v2_core_batch_job_completed(&callback)
-      register("v2.core.batch_job.completed", &callback)
-    end
-
-    def on_v2_core_batch_job_created(&callback)
-      register("v2.core.batch_job.created", &callback)
-    end
-
-    def on_v2_core_batch_job_ready_for_upload(&callback)
-      register("v2.core.batch_job.ready_for_upload", &callback)
-    end
-
-    def on_v2_core_batch_job_timeout(&callback)
-      register("v2.core.batch_job.timeout", &callback)
-    end
-
-    def on_v2_core_batch_job_updated(&callback)
-      register("v2.core.batch_job.updated", &callback)
-    end
-
-    def on_v2_core_batch_job_upload_timeout(&callback)
-      register("v2.core.batch_job.upload_timeout", &callback)
-    end
-
-    def on_v2_core_batch_job_validating(&callback)
-      register("v2.core.batch_job.validating", &callback)
-    end
-
-    def on_v2_core_batch_job_validation_failed(&callback)
-      register("v2.core.batch_job.validation_failed", &callback)
-    end
-
     def on_v2_core_event_destination_ping(&callback)
       register("v2.core.event_destination.ping", &callback)
     end
 
-    def on_v2_core_health_event_generation_failure_resolved(&callback)
-      register("v2.core.health.event_generation_failure.resolved", &callback)
-    end
-
-    def on_v2_data_query_run_created(&callback)
-      register("v2.data.query_run.created", &callback)
-    end
-
-    def on_v2_data_query_run_failed(&callback)
-      register("v2.data.query_run.failed", &callback)
-    end
-
-    def on_v2_data_query_run_succeeded(&callback)
-      register("v2.data.query_run.succeeded", &callback)
-    end
-
-    def on_v2_data_query_run_updated(&callback)
-      register("v2.data.query_run.updated", &callback)
-    end
-
-    def on_v2_data_report_run_created(&callback)
-      register("v2.data.report_run.created", &callback)
-    end
-
-    def on_v2_data_report_run_failed(&callback)
-      register("v2.data.report_run.failed", &callback)
-    end
-
-    def on_v2_data_report_run_succeeded(&callback)
-      register("v2.data.report_run.succeeded", &callback)
-    end
-
-    def on_v2_data_report_run_updated(&callback)
-      register("v2.data.report_run.updated", &callback)
-    end
-
-    def on_v2_data_reporting_query_run_created(&callback)
-      register("v2.data.reporting.query_run.created", &callback)
-    end
-
-    def on_v2_data_reporting_query_run_failed(&callback)
-      register("v2.data.reporting.query_run.failed", &callback)
-    end
-
-    def on_v2_data_reporting_query_run_succeeded(&callback)
-      register("v2.data.reporting.query_run.succeeded", &callback)
-    end
-
-    def on_v2_data_reporting_query_run_updated(&callback)
-      register("v2.data.reporting.query_run.updated", &callback)
-    end
-
-    def on_v2_extend_workflow_run_failed(&callback)
-      register("v2.extend.workflow_run.failed", &callback)
-    end
-
-    def on_v2_extend_workflow_run_started(&callback)
-      register("v2.extend.workflow_run.started", &callback)
-    end
-
-    def on_v2_extend_workflow_run_succeeded(&callback)
-      register("v2.extend.workflow_run.succeeded", &callback)
-    end
-
     def on_v2_money_management_adjustment_created(&callback)
       register("v2.money_management.adjustment.created", &callback)
     end
@@ -1459,34 +1319,6 @@ module Stripe
       register("v2.money_management.outbound_payment.updated", &callback)
     end
 
-    def on_v2_money_management_outbound_transfer_canceled(&callback)
-      register("v2.money_management.outbound_transfer.canceled", &callback)
-    end
-
-    def on_v2_money_management_outbound_transfer_created(&callback)
-      register("v2.money_management.outbound_transfer.created", &callback)
-    end
-
-    def on_v2_money_management_outbound_transfer_failed(&callback)
-      register("v2.money_management.outbound_transfer.failed", &callback)
-    end
-
-    def on_v2_money_management_outbound_transfer_posted(&callback)
-      register("v2.money_management.outbound_transfer.posted", &callback)
-    end
-
-    def on_v2_money_management_outbound_transfer_returned(&callback)
-      register("v2.money_management.outbound_transfer.returned", &callback)
-    end
-
-    def on_v2_money_management_outbound_transfer_under_review(&callback)
-      register("v2.money_management.outbound_transfer.under_review", &callback)
-    end
-
-    def on_v2_money_management_outbound_transfer_updated(&callback)
-      register("v2.money_management.outbound_transfer.updated", &callback)
-    end
-
     def on_v2_money_management_payout_intent_canceled(&callback)
       register("v2.money_management.payout_intent.canceled", &callback)
     end
@@ -1539,26 +1371,6 @@ module Stripe
       register("v2.money_management.received_credit.succeeded", &callback)
     end
 
-    def on_v2_money_management_received_debit_canceled(&callback)
-      register("v2.money_management.received_debit.canceled", &callback)
-    end
-
-    def on_v2_money_management_received_debit_failed(&callback)
-      register("v2.money_management.received_debit.failed", &callback)
-    end
-
-    def on_v2_money_management_received_debit_pending(&callback)
-      register("v2.money_management.received_debit.pending", &callback)
-    end
-
-    def on_v2_money_management_received_debit_succeeded(&callback)
-      register("v2.money_management.received_debit.succeeded", &callback)
-    end
-
-    def on_v2_money_management_received_debit_updated(&callback)
-      register("v2.money_management.received_debit.updated", &callback)
-    end
-
     def on_v2_money_management_recipient_verification_created(&callback)
       register("v2.money_management.recipient_verification.created", &callback)
     end
@@ -1574,34 +1386,6 @@ module Stripe
     def on_v2_money_management_transaction_updated(&callback)
       register("v2.money_management.transaction.updated", &callback)
     end
-
-    def on_v2_orchestrated_commerce_agreement_confirmed(&callback)
-      register("v2.orchestrated_commerce.agreement.confirmed", &callback)
-    end
-
-    def on_v2_orchestrated_commerce_agreement_created(&callback)
-      register("v2.orchestrated_commerce.agreement.created", &callback)
-    end
-
-    def on_v2_orchestrated_commerce_agreement_partially_confirmed(&callback)
-      register("v2.orchestrated_commerce.agreement.partially_confirmed", &callback)
-    end
-
-    def on_v2_orchestrated_commerce_agreement_terminated(&callback)
-      register("v2.orchestrated_commerce.agreement.terminated", &callback)
-    end
-
-    def on_v2_signals_account_evaluation_complete(&callback)
-      register("v2.signals.account_evaluation.complete", &callback)
-    end
-
-    def on_v2_signals_account_signal_fraudulent_merchant_ready(&callback)
-      register("v2.signals.account_signal.fraudulent_merchant_ready", &callback)
-    end
-
-    def on_v2_signals_account_signal_fraudulent_website_ready(&callback)
-      register("v2.signals.account_signal.fraudulent_website_ready", &callback)
-    end
     # event-handler-methods: The end of the section generated from our OpenAPI spec
   end
 

data/lib/stripe/stripe_object.rb

@@ -256,6 +256,11 @@ module Stripe
 
       # TODO: (major) Remove the :client option. This is not explicitly supported as a user-specified option.
       opts.delete(:client)
+
+      # Serialized objects often land in caches and queues that aren't
+      # protected like secrets, so never write the API key out. Nested
+      # StripeObjects are dumped through this method too.
+      opts[:api_key] = RequestOptions::API_KEY_SERIALIZATION_CONSTANT
       [@values, opts]
     end
 
@@ -267,6 +272,60 @@ module Stripe
       initialize_from(values, opts, api_mode: api_mode, requestor: @requestor)
     end
 
+    # Implements custom encoding for YAML (Psych). Without it, Psych dumps
+    # every instance variable, including the API key in @opts and the
+    # requestor's configuration.
+    def encode_with(coder)
+      values, opts = marshal_dump
+      coder["values"] = values
+      coder["opts"] = opts
+    end
+
+    # Implements custom decoding for YAML (Psych). Consumes data that's
+    # produced by #encode_with.
+    def init_with(coder)
+      marshal_load([coder["values"], coder["opts"]])
+    end
+
+    # Attaches credentials to an object restored from Marshal or YAML, and to
+    # any nested objects that were restored without credentials. Each object
+    # keeps its saved connected account and API version.
+    def reattach_api_key(api_key)
+      unless @opts[:api_key] == RequestOptions::API_KEY_SERIALIZATION_CONSTANT
+        raise ArgumentError,
+              "API credentials can only be reattached to a deserialized " \
+              "object that has not already been reattached."
+      end
+      if !api_key.is_a?(String) || api_key.strip.empty? ||
+         api_key == RequestOptions::API_KEY_SERIALIZATION_CONSTANT
+        raise ArgumentError, "api_key must be a non-empty, valid API key."
+      end
+
+      reattach_api_key_to(self, api_key, {}.compare_by_identity)
+      self
+    end
+
+    # Identity-based `seen` because StripeObject#hash and #== compare values,
+    # and restored objects can contain cycles.
+    private def reattach_api_key_to(value, api_key, seen)
+      case value
+      when StripeObject
+        return if seen.key?(value)
+
+        seen[value] = true
+        opts = value.instance_variable_get(:@opts)
+        if opts[:api_key] == RequestOptions::API_KEY_SERIALIZATION_CONSTANT
+          value.instance_variable_set(:@opts, opts.merge(api_key: api_key))
+        end
+        value.instance_variable_get(:@values).each_value { |v| reattach_api_key_to(v, api_key, seen) }
+        value.instance_variable_get(:@original_values).each_value { |v| reattach_api_key_to(v, api_key, seen) }
+      when Hash
+        value.each_value { |v| reattach_api_key_to(v, api_key, seen) }
+      when Array
+        value.each { |v| reattach_api_key_to(v, api_key, seen) }
+      end
+    end
+
     def serialize_params(options = {})
       update_hash = {}
 
@@ -368,7 +427,7 @@ module Stripe
       end
     end
 
-    protected def add_accessors(keys, values)
+    protected def add_accessors(keys, values) # rubocop:todo Metrics/PerceivedComplexity
       # not available in the #instance_eval below
       protected_fields = self.class.protected_fields
 

data/lib/stripe/stripe_service.rb

@@ -10,15 +10,6 @@ module Stripe
 
     def request(method:, path:, base_address:, params: {}, opts: {})
       params = params.to_h if params.is_a?(RequestParams)
-      if method == :post &&
-         path.split("?", 2).first.start_with?("/v2/") &&
-         path.split("?", 2).first.end_with?("/search") &&
-         (params.key?(:limit) || params.key?("limit"))
-        params = params.dup
-        limit = params.delete(:limit) || params.delete("limit")
-        separator = path.include?("?") ? "&" : "?"
-        path = "#{path}#{separator}limit=#{URI.encode_www_form_component(limit)}"
-      end
       @requestor.execute_request(
         method,
         path,
@@ -29,6 +20,19 @@ module Stripe
       )
     end
 
+    # V2 search uses POST but sends limit in the URL, not the JSON body. Rebuild
+    # the initial query from params; pagination uses the ordinary request path.
+    def request_v2_search(method:, path:, base_address:, params: {}, opts: {})
+      params = params.to_h if params.is_a?(RequestParams)
+      params = params.dup
+      limit = params.delete(:limit)
+      string_limit = params.delete("limit")
+      limit ||= string_limit
+      path = path.split("?", 2).first
+      path = "#{path}?limit=#{URI.encode_www_form_component(limit)}" unless limit.nil?
+      request(method: method, path: path, base_address: base_address, params: params, opts: opts)
+    end
+
     def request_stream(method:, path:, base_address:, params: {}, opts: {}, &read_body_chunk_block)
       @requestor.execute_request_stream(
         method,

data/lib/stripe/util.rb

@@ -317,13 +317,7 @@ module Stripe
       when String
         { api_key: opts }
       when Hash
-        # If the user is using request signing for authentication,
-        # no need to check the api_key per request.
-        if !(opts.key?(:client) &&
-           opts.fetch(:client).config.authenticator) &&
-           opts.key?(:api_key)
-          check_api_key!(opts.fetch(:api_key))
-        end
+        check_api_key!(opts.fetch(:api_key)) if opts.key?(:api_key)
         # Explicitly use dup here instead of clone to avoid preserving freeze
         # state on input params.
         opts.dup

data/lib/stripe/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Stripe
-  VERSION = "20.2.0-beta.1"
+  VERSION = "21.0.0"
 end

data/lib/stripe/webhook.rb

@@ -44,7 +44,13 @@ module Stripe
     private_class_method :_build_v1_event
 
     def self._maybe_extract_from_cloud_provider_envelope(payload)
-      payload = payload.encode("utf-8") if payload.respond_to?(:encode)
+      if payload.respond_to?(:encode)
+        payload = if payload.encoding == Encoding::BINARY
+                    payload.dup.force_encoding(Encoding::UTF_8)
+                  else
+                    payload.encode(Encoding::UTF_8)
+                  end
+      end
       data = JSON.parse(payload, symbolize_names: true)
 
       # Could add as many checks as we want here, but we'll start simple
@@ -70,6 +76,8 @@ module Stripe
 
     module Signature
       EXPECTED_SCHEME = "v1"
+      DebugMetadata = Struct.new(:secret, :destination, :payload)
+      private_constant :DebugMetadata
 
       # Computes a webhook signature given a time (probably the current time),
       # a payload, and a signing secret.
@@ -104,7 +112,7 @@ module Stripe
       def self.get_timestamp_and_signatures(header, scheme)
         list_items = header.split(/,\s*/).map { |i| i.split("=", 2) }
         timestamp = Integer(list_items.select { |i| i[0] == "t" }[0][1])
-        signatures = list_items.select { |i| i[0] == scheme }.map { |i| i[1] }
+        signatures = list_items.select { |i| i[0] == scheme }.map { |i| i[1] }.compact
         [Time.at(timestamp), signatures]
       end
       private_class_method :get_timestamp_and_signatures
@@ -146,7 +154,7 @@ module Stripe
         expected_sig = compute_signature(timestamp, payload, secret)
         unless signatures.any? { |s| Util.secure_compare(expected_sig, s) }
           raise SignatureVerificationError.new(
-            "No signatures found matching the expected signature for payload",
+            signature_error_message(header, payload, secret),
             header, http_body: payload
           )
         end
@@ -161,6 +169,63 @@ module Stripe
 
         true
       end
+
+      private_class_method def self.signature_error_message(header, payload, secret)
+        debug_metadata = signature_debug_metadata(header)
+
+        # If metadata has an asterisk-masked secret, compare against its length and last four characters
+        masked_secret = debug_metadata.secret || ""
+        masked_suffix = masked_secret[-4, 4]
+        secret_suffix = secret[-4, 4] || secret
+        if masked_secret&.include?("*") && (secret.length != masked_secret.length || secret_suffix != masked_suffix)
+          dashboard_url = "https://dashboard.stripe.com/webhooks"
+          dashboard_url += "/#{CGI.escape(debug_metadata.destination)}" if debug_metadata.destination
+          return "Webhook signature verification failed. This request may not have originated from Stripe.\n\n" \
+                 "The signing secret you provided is #{secret.length} characters long " \
+                 "and ends in `#{secret_suffix}`. " \
+                 "However, the signing secret for this destination is #{masked_secret.length} characters long " \
+                 "and looks like `#{masked_secret}`. Ensure you're using the signing secret for this " \
+                 "destination, as shown on the Dashboard: #{dashboard_url}\n\n" \
+                 "Learn more: https://docs.stripe.com/webhooks/signature"
+        end
+
+        # If metadata includes the truncated payload hash, compare with the payload passed in
+        if debug_metadata.payload&.match?(/\A[0-9a-fA-F]{8}\z/)
+          expected_hash = debug_metadata.payload.downcase
+          actual_hash = OpenSSL::Digest::SHA256.hexdigest(payload)[-8, 8]
+          if expected_hash != actual_hash
+            return "Webhook signature verification failed.\n\n" \
+                   "The request body you passed to this function differs from the request body sent by Stripe " \
+                   "to this webhook destination.\n" \
+                   "The SHA-256 hash of the body should end in `#{expected_hash}`. However, " \
+                   "the SHA-256 hash of the body you provided ends in `#{actual_hash}`.\n\n" \
+                   "Make sure your code does not reformat or otherwise alter the raw HTTP request body " \
+                   "before passing it to this function.\n\n" \
+                   "Learn more: https://docs.stripe.com/webhooks/signature"
+          end
+        end
+
+        # Fall back to the generic message if no debug metadata available
+        "No signatures found matching the expected signature for payload"
+      end
+
+      # Extract metadata from the stripe-signature header value to help debug verification failures
+      private_class_method def self.signature_debug_metadata(header)
+        # For each metadata key, extract the first value found in the header
+        metadata = DebugMetadata.new
+        list_items = header.b.split(/,\s*/).map { |item| item.split("=", 2) }
+        DebugMetadata.members.each do |key|
+          value = list_items.assoc(key.to_s)&.[](1)
+          value&.force_encoding(header.encoding)
+          metadata[key] = safe_metadata_value?(value) ? value : nil
+        end
+        metadata
+      end
+
+      private_class_method def self.safe_metadata_value?(value)
+        # Ignore overly long, potentially attacker-provided metadata values
+        value && value.length <= 100 && value.valid_encoding?
+      end
     end
   end
 end

data/lib/stripe.rb

@@ -121,7 +121,6 @@ module Stripe
 
     # User configurable options
     def_delegators :@config, :api_key, :api_key=
-    def_delegators :@config, :authenticator, :authenticator=
     def_delegators :@config, :api_version, :api_version=
     def_delegators :@config, :stripe_account, :stripe_account=
     def_delegators :@config, :api_base, :api_base=
@@ -186,58 +185,6 @@ module Stripe
       version: version,
     }
   end
-
-  def self.add_beta_version(beta_name, version)
-    unless version.start_with?("v") && version[1..].to_i.to_s == version[1..]
-      raise ArgumentError, "Version must be in the format 'v' followed by a number (e.g., 'v3')"
-    end
-
-    if (index = api_version.index("; #{beta_name}="))
-      start_index = index + "; #{beta_name}=".length
-      end_index = api_version.index(";", start_index) || api_version.length
-      current_version = api_version[start_index...end_index][1..].to_i
-      new_version = version[1..].to_i
-      return if new_version <= current_version # Keep the higher version, no update needed
-
-      self.api_version = api_version[0...index] + "; #{beta_name}=#{version}" + api_version[end_index..]
-    else
-      self.api_version = "#{api_version}; #{beta_name}=#{version}"
-    end
-  end
-
-  class RawRequest
-    def initialize
-      @opts = {}
-    end
-
-    def execute(method, url, base_address: :api, params: {}, opts: {}, usage: [])
-      opts = Util.normalize_opts(opts)
-      req_opts = RequestOptions.extract_opts_from_hash(opts)
-
-      requestor = APIRequestor.active_requestor
-      resp, = requestor.send(:execute_request_internal, method, url, base_address, params, req_opts,
-                             usage)
-
-      requestor.interpret_response(resp)
-    end
-  end
-
-  # Sends a request to Stripe REST API
-  def self.raw_request(method, url, params = {}, opts = {}, base_address: :api)
-    req = RawRequest.new
-    req.execute(method, url, base_address: base_address, params: params, opts: opts,
-                             usage: ["raw_request"])
-  end
-
-  def self.deserialize(data, api_mode: :v1)
-    data = JSON.parse(data) if data.is_a?(String)
-    Util.convert_to_stripe_object(data, {}, api_mode: api_mode)
-  end
-  class << self
-    extend Gem::Deprecate
-    deprecate :raw_request, "StripeClient#raw_request", 2024, 9
-    deprecate :deserialize, "StripeClient#deserialize", 2024, 9
-  end
 end
 
 Stripe.log_level = ENV["STRIPE_LOG"] unless ENV["STRIPE_LOG"].nil?

data/rbi/stripe/resources/v2/core/event_base.rbi

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+# typed: true
+
+module Stripe
+  module V2
+    module Core
+      class EventBase < APIResource
+      end
+    end
+  end
+end

data/rbi/stripe/resources/v2/core/event_notification.rbi

@@ -1,6 +1,4 @@
-# File copied from our code generator; changes here will be overwritten.
 # frozen_string_literal: true
-
 # typed: true
 
 module Stripe