stripe 3.3.1 → 5.38.0

data/lib/stripe/webhook.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Stripe
   module Webhook
     DEFAULT_TOLERANCE = 300
@@ -6,7 +8,8 @@ module Stripe
     #
     # This may raise JSON::ParserError if the payload is not valid JSON, or
     # SignatureVerificationError if the signature verification fails.
-    def self.construct_event(payload, sig_header, secret, tolerance: DEFAULT_TOLERANCE)
+    def self.construct_event(payload, sig_header, secret,
+                             tolerance: DEFAULT_TOLERANCE)
       Signature.verify_header(payload, sig_header, secret, tolerance: tolerance)
 
       # It's a good idea to parse the payload only after verifying it. We use
@@ -19,20 +22,47 @@ module Stripe
     end
 
     module Signature
-      EXPECTED_SCHEME = 'v1'
+      EXPECTED_SCHEME = "v1"
+
+      # Computes a webhook signature given a time (probably the current time),
+      # a payload, and a signing secret.
+      def self.compute_signature(timestamp, payload, secret)
+        raise ArgumentError, "timestamp should be an instance of Time" \
+          unless timestamp.is_a?(Time)
+        raise ArgumentError, "payload should be a string" \
+          unless payload.is_a?(String)
+        raise ArgumentError, "secret should be a string" \
+          unless secret.is_a?(String)
 
-      def self.compute_signature(payload, secret)
-        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new('sha256'), secret, payload)
+        timestamped_payload = "#{timestamp.to_i}.#{payload}"
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret,
+                                timestamped_payload)
+      end
+
+      # Generates a value that would be added to a `Stripe-Signature` for a
+      # given webhook payload.
+      #
+      # Note that this isn't needed to verify webhooks in any way, and is
+      # mainly here for use in test cases (those that are both within this
+      # project and without).
+      def self.generate_header(timestamp, signature, scheme: EXPECTED_SCHEME)
+        raise ArgumentError, "timestamp should be an instance of Time" \
+          unless timestamp.is_a?(Time)
+        raise ArgumentError, "signature should be a string" \
+          unless signature.is_a?(String)
+        raise ArgumentError, "scheme should be a string" \
+          unless scheme.is_a?(String)
+
+        "t=#{timestamp.to_i},#{scheme}=#{signature}"
       end
-      private_class_method :compute_signature
 
       # Extracts the timestamp and the signature(s) with the desired scheme
       # from the header
       def self.get_timestamp_and_signatures(header, scheme)
-        list_items = header.split(/,\s*/).map { |i| i.split('=', 2) }
-        timestamp = Integer(list_items.select { |i| i[0] == 't' }[0][1])
+        list_items = header.split(/,\s*/).map { |i| i.split("=", 2) }
+        timestamp = Integer(list_items.select { |i| i[0] == "t" }[0][1])
         signatures = list_items.select { |i| i[0] == scheme }.map { |i| i[1] }
-        [timestamp, signatures]
+        [Time.at(timestamp), signatures]
       end
       private_class_method :get_timestamp_and_signatures
 
@@ -48,31 +78,40 @@ module Stripe
       # Returns true otherwise
       def self.verify_header(payload, header, secret, tolerance: nil)
         begin
-          timestamp, signatures = get_timestamp_and_signatures(header, EXPECTED_SCHEME)
-        rescue
+          timestamp, signatures =
+            get_timestamp_and_signatures(header, EXPECTED_SCHEME)
+
+        # TODO: Try to knock over this blanket rescue as it can unintentionally
+        # swallow many valid errors. Instead, try to validate an incoming
+        # header one piece at a time, and error with a known exception class if
+        # any part is found to be invalid. Rescue that class here.
+        rescue StandardError
           raise SignatureVerificationError.new(
             "Unable to extract timestamp and signatures from header",
-            header, http_body: payload)
+            header, http_body: payload
+          )
         end
 
         if signatures.empty?
           raise SignatureVerificationError.new(
             "No signatures found with expected scheme #{EXPECTED_SCHEME}",
-            header, http_body: payload)
+            header, http_body: payload
+          )
         end
 
-        signed_payload = "#{timestamp}.#{payload}"
-        expected_sig = compute_signature(signed_payload, secret)
-        unless signatures.any? {|s| Util.secure_compare(expected_sig, s)}
+        expected_sig = compute_signature(timestamp, payload, secret)
+        unless signatures.any? { |s| Util.secure_compare(expected_sig, s) }
           raise SignatureVerificationError.new(
             "No signatures found matching the expected signature for payload",
-            header, http_body: payload)
+            header, http_body: payload
+          )
         end
 
-        if tolerance && timestamp < Time.now.to_f - tolerance
+        if tolerance && timestamp < Time.now - tolerance
           raise SignatureVerificationError.new(
             "Timestamp outside the tolerance zone (#{Time.at(timestamp)})",
-            header, http_body: payload)
+            header, http_body: payload
+          )
         end
 
         true

data/lib/stripe.rb

@@ -1,108 +1,92 @@
+# frozen_string_literal: true
+
 # Stripe Ruby bindings
 # API spec at https://stripe.com/docs/api
-require 'cgi'
-require 'logger'
-require 'openssl'
-require 'rbconfig'
-require 'set'
-require 'socket'
-
-require 'faraday'
-require 'json'
+require "cgi"
+require "json"
+require "logger"
+require "net/http"
+require "openssl"
+require "rbconfig"
+require "securerandom"
+require "set"
+require "socket"
+require "uri"
+require "forwardable"
 
 # Version
-require 'stripe/version'
+require "stripe/version"
 
 # API operations
-require 'stripe/api_operations/create'
-require 'stripe/api_operations/save'
-require 'stripe/api_operations/delete'
-require 'stripe/api_operations/list'
-require 'stripe/api_operations/request'
+require "stripe/api_operations/create"
+require "stripe/api_operations/delete"
+require "stripe/api_operations/list"
+require "stripe/api_operations/nested_resource"
+require "stripe/api_operations/request"
+require "stripe/api_operations/save"
 
 # API resource support classes
-require 'stripe/errors'
-require 'stripe/util'
-require 'stripe/stripe_client'
-require 'stripe/stripe_object'
-require 'stripe/stripe_response'
-require 'stripe/list_object'
-require 'stripe/api_resource'
-require 'stripe/singleton_api_resource'
-require 'stripe/webhook'
+require "stripe/errors"
+require "stripe/object_types"
+require "stripe/util"
+require "stripe/connection_manager"
+require "stripe/multipart_encoder"
+require "stripe/stripe_client"
+require "stripe/stripe_object"
+require "stripe/stripe_response"
+require "stripe/list_object"
+require "stripe/error_object"
+require "stripe/api_resource"
+require "stripe/singleton_api_resource"
+require "stripe/webhook"
+require "stripe/stripe_configuration"
 
 # Named API resources
-require 'stripe/account'
-require 'stripe/alipay_account'
-require 'stripe/apple_pay_domain'
-require 'stripe/application_fee'
-require 'stripe/application_fee_refund'
-require 'stripe/balance'
-require 'stripe/balance_transaction'
-require 'stripe/bank_account'
-require 'stripe/bitcoin_receiver'
-require 'stripe/bitcoin_transaction'
-require 'stripe/card'
-require 'stripe/charge'
-require 'stripe/country_spec'
-require 'stripe/coupon'
-require 'stripe/customer'
-require 'stripe/dispute'
-require 'stripe/ephemeral_key'
-require 'stripe/event'
-require 'stripe/file_upload'
-require 'stripe/invoice'
-require 'stripe/invoice_item'
-require 'stripe/invoice_line_item'
-require 'stripe/login_link'
-require 'stripe/order'
-require 'stripe/order_return'
-require 'stripe/payout'
-require 'stripe/plan'
-require 'stripe/product'
-require 'stripe/recipient'
-require 'stripe/recipient_transfer'
-require 'stripe/refund'
-require 'stripe/reversal'
-require 'stripe/sku'
-require 'stripe/source'
-require 'stripe/subscription'
-require 'stripe/subscription_item'
-require 'stripe/three_d_secure'
-require 'stripe/token'
-require 'stripe/transfer'
+require "stripe/resources"
 
 # OAuth
-require 'stripe/oauth'
+require "stripe/oauth"
 
 module Stripe
-  DEFAULT_CA_BUNDLE_PATH = File.dirname(__FILE__) + '/data/ca-certificates.crt'
-
-  @app_info = nil
-
-  @api_base = 'https://api.stripe.com'
-  @connect_base = 'https://connect.stripe.com'
-  @uploads_base = 'https://uploads.stripe.com'
-
-  @log_level = nil
-  @logger = nil
+  DEFAULT_CA_BUNDLE_PATH = __dir__ + "/data/ca-certificates.crt"
 
-  @max_network_retries = 0
-  @max_network_retry_delay = 2
-  @initial_network_retry_delay = 0.5
+  # map to the same values as the standard library's logger
+  LEVEL_DEBUG = Logger::DEBUG
+  LEVEL_ERROR = Logger::ERROR
+  LEVEL_INFO = Logger::INFO
 
-  @ca_bundle_path = DEFAULT_CA_BUNDLE_PATH
-  @ca_store = nil
-  @verify_ssl_certs = true
+  @app_info = nil
 
-  @open_timeout = 30
-  @read_timeout = 80
+  @config = Stripe::StripeConfiguration.setup
 
   class << self
-    attr_accessor :stripe_account, :api_key, :api_base, :verify_ssl_certs, :api_version, :client_id, :connect_base, :uploads_base,
-                  :open_timeout, :read_timeout
-
-    attr_reader :max_network_retry_delay, :initial_network_retry_delay
+    extend Forwardable
+
+    attr_reader :config
+
+    # User configurable options
+    def_delegators :@config, :api_key, :api_key=
+    def_delegators :@config, :api_version, :api_version=
+    def_delegators :@config, :stripe_account, :stripe_account=
+    def_delegators :@config, :api_base, :api_base=
+    def_delegators :@config, :uploads_base, :uploads_base=
+    def_delegators :@config, :connect_base, :connect_base=
+    def_delegators :@config, :open_timeout, :open_timeout=
+    def_delegators :@config, :read_timeout, :read_timeout=
+    def_delegators :@config, :write_timeout, :write_timeout=
+    def_delegators :@config, :proxy, :proxy=
+    def_delegators :@config, :verify_ssl_certs, :verify_ssl_certs=
+    def_delegators :@config, :ca_bundle_path, :ca_bundle_path=
+    def_delegators :@config, :log_level, :log_level=
+    def_delegators :@config, :logger, :logger=
+    def_delegators :@config, :max_network_retries, :max_network_retries=
+    def_delegators :@config, :enable_telemetry=, :enable_telemetry?
+    def_delegators :@config, :client_id=, :client_id
+
+    # Internal configurations
+    def_delegators :@config, :max_network_retry_delay
+    def_delegators :@config, :initial_network_retry_delay
+    def_delegators :@config, :ca_store
   end
 
   # Gets the application for a plugin that's identified some. See
@@ -115,115 +99,19 @@ module Stripe
     @app_info = info
   end
 
-  # The location of a file containing a bundle of CA certificates. By default
-  # the library will use an included bundle that can successfully validate
-  # Stripe certificates.
-  def self.ca_bundle_path
-    @ca_bundle_path
-  end
-
-  def self.ca_bundle_path=(path)
-    @ca_bundle_path = path
-
-    # empty this field so a new store is initialized
-    @ca_store = nil
-  end
-
-  # A certificate store initialized from the the bundle in #ca_bundle_path and
-  # which is used to validate TLS on every request.
-  #
-  # This was added to the give the gem "pseudo thread safety" in that it seems
-  # when initiating many parallel requests marshaling the certificate store is
-  # the most likely point of failure (see issue #382). Any program attempting
-  # to leverage this pseudo safety should make a call to this method (i.e.
-  # `Stripe.ca_store`) in their initialization code because it marshals lazily
-  # and is itself not thread safe.
-  def self.ca_store
-    @ca_store ||= begin
-      store = OpenSSL::X509::Store.new
-      store.add_file(ca_bundle_path)
-      store
-    end
-  end
-
-  # map to the same values as the standard library's logger
-  LEVEL_DEBUG = Logger::DEBUG
-  LEVEL_ERROR = Logger::ERROR
-  LEVEL_INFO = Logger::INFO
-
-  # When set prompts the library to log some extra information to $stdout and
-  # $stderr about what it's doing. For example, it'll produce information about
-  # requests, responses, and errors that are received. Valid log levels are
-  # `debug` and `info`, with `debug` being a little more verbose in places.
-  #
-  # Use of this configuration is only useful when `.logger` is _not_ set. When
-  # it is, the decision what levels to print is entirely deferred to the logger.
-  def self.log_level
-    @log_level
-  end
-
-  def self.log_level=(val)
-    # Backwards compatibility for values that we briefly allowed
-    if val == "debug"
-      val = LEVEL_DEBUG
-    elsif val == "info"
-      val = LEVEL_INFO
-    end
-
-    if val != nil && ![LEVEL_DEBUG, LEVEL_ERROR, LEVEL_INFO].include?(val)
-      raise ArgumentError, "log_level should only be set to `nil`, `debug` or `info`"
-    end
-    @log_level = val
-  end
-
-  # Sets a logger to which logging output will be sent. The logger should
-  # support the same interface as the `Logger` class that's part of Ruby's
-  # standard library (hint, anything in `Rails.logger` will likely be
-  # suitable).
-  #
-  # If `.logger` is set, the value of `.log_level` is ignored. The decision on
-  # what levels to print is entirely deferred to the logger.
-  def self.logger
-    @logger
-  end
-
-  def self.logger=(val)
-    @logger = val
-  end
-
-  def self.max_network_retries
-    @max_network_retries
-  end
-
-  def self.max_network_retries=(val)
-    @max_network_retries = val.to_i
-  end
-
   # Sets some basic information about the running application that's sent along
   # with API requests. Useful for plugin authors to identify their plugin when
   # communicating with Stripe.
   #
-  # Takes a name and optional version and plugin URL.
-  def self.set_app_info(name, version: nil, url: nil)
+  # Takes a name and optional  partner program ID, plugin URL, and version.
+  def self.set_app_info(name, partner_id: nil, url: nil, version: nil)
     @app_info = {
       name: name,
+      partner_id: partner_id,
       url: url,
       version: version,
     }
   end
-
-  private
-
-  # DEPRECATED. Use `Util#encode_parameters` instead.
-  def self.uri_encode(params)
-    Util.encode_parameters(params)
-  end
-  class << self
-    extend Gem::Deprecate
-    deprecate :uri_encode, "Stripe::Util#encode_parameters", 2016, 01
-  end
 end
 
-unless ENV["STRIPE_LOG"].nil?
-  Stripe.log_level = ENV["STRIPE_LOG"]
-end
+Stripe.log_level = ENV["STRIPE_LOG"] unless ENV["STRIPE_LOG"].nil?

data/stripe.gemspec

@@ -1,22 +1,41 @@
-$:.unshift(File.join(File.dirname(__FILE__), 'lib'))
+# frozen_string_literal: true
 
-require 'stripe/version'
+$LOAD_PATH.unshift(::File.join(::File.dirname(__FILE__), "lib"))
 
-spec = Gem::Specification.new do |s|
-  s.name = 'stripe'
+require "stripe/version"
+
+Gem::Specification.new do |s|
+  s.name = "stripe"
   s.version = Stripe::VERSION
-  s.required_ruby_version = '>= 1.9.3'
-  s.summary = 'Ruby bindings for the Stripe API'
-  s.description = 'Stripe is the easiest way to accept payments online.  See https://stripe.com for details.'
-  s.author = 'Stripe'
-  s.email = 'support@stripe.com'
-  s.homepage = 'https://stripe.com/docs/api/ruby'
-  s.license = 'MIT'
+  s.required_ruby_version = ">= 2.3.0"
+  s.summary = "Ruby bindings for the Stripe API"
+  s.description = "Stripe is the easiest way to accept payments online.  " \
+                  "See https://stripe.com for details."
+  s.author = "Stripe"
+  s.email = "support@stripe.com"
+  s.homepage = "https://stripe.com/docs/api/ruby"
+  s.license = "MIT"
 
-  s.add_dependency('faraday', '~> 0.9')
+  s.metadata = {
+    "bug_tracker_uri" => "https://github.com/stripe/stripe-ruby/issues",
+    "changelog_uri" =>
+      "https://github.com/stripe/stripe-ruby/blob/master/CHANGELOG.md",
+    "documentation_uri" => "https://stripe.com/docs/api/ruby",
+    "github_repo" => "ssh://github.com/stripe/stripe-ruby",
+    "homepage_uri" => "https://stripe.com/docs/api/ruby",
+    "source_code_uri" => "https://github.com/stripe/stripe-ruby",
+  }
 
-  s.files = `git ls-files`.split("\n")
-  s.test_files    = `git ls-files -- test/*`.split("\n")
-  s.executables   = `git ls-files -- bin/*`.split("\n").map{ |f| File.basename(f) }
-  s.require_paths = ['lib']
+  ignored = Regexp.union(
+    /\A\.editorconfig/,
+    /\A\.git/,
+    /\A\.rubocop/,
+    /\A\.travis.yml/,
+    /\A\.vscode/,
+    /\Atest/
+  )
+  s.files = `git ls-files`.split("\n").reject { |f| ignored.match(f) }
+  s.executables   = `git ls-files -- bin/*`.split("\n")
+                                           .map { |f| ::File.basename(f) }
+  s.require_paths = ["lib"]
 end