stripe 4.18.1 → 5.42.0

data/lib/stripe/webhook.rb

@@ -22,12 +22,39 @@ module Stripe
     end
 
     module Signature
-      EXPECTED_SCHEME = "v1".freeze
+      EXPECTED_SCHEME = "v1"
 
-      def self.compute_signature(payload, secret)
-        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret, payload)
+      # Computes a webhook signature given a time (probably the current time),
+      # a payload, and a signing secret.
+      def self.compute_signature(timestamp, payload, secret)
+        raise ArgumentError, "timestamp should be an instance of Time" \
+          unless timestamp.is_a?(Time)
+        raise ArgumentError, "payload should be a string" \
+          unless payload.is_a?(String)
+        raise ArgumentError, "secret should be a string" \
+          unless secret.is_a?(String)
+
+        timestamped_payload = "#{timestamp.to_i}.#{payload}"
+        OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new("sha256"), secret,
+                                timestamped_payload)
+      end
+
+      # Generates a value that would be added to a `Stripe-Signature` for a
+      # given webhook payload.
+      #
+      # Note that this isn't needed to verify webhooks in any way, and is
+      # mainly here for use in test cases (those that are both within this
+      # project and without).
+      def self.generate_header(timestamp, signature, scheme: EXPECTED_SCHEME)
+        raise ArgumentError, "timestamp should be an instance of Time" \
+          unless timestamp.is_a?(Time)
+        raise ArgumentError, "signature should be a string" \
+          unless signature.is_a?(String)
+        raise ArgumentError, "scheme should be a string" \
+          unless scheme.is_a?(String)
+
+        "t=#{timestamp.to_i},#{scheme}=#{signature}"
       end
-      private_class_method :compute_signature
 
       # Extracts the timestamp and the signature(s) with the desired scheme
       # from the header
@@ -35,7 +62,7 @@ module Stripe
         list_items = header.split(/,\s*/).map { |i| i.split("=", 2) }
         timestamp = Integer(list_items.select { |i| i[0] == "t" }[0][1])
         signatures = list_items.select { |i| i[0] == scheme }.map { |i| i[1] }
-        [timestamp, signatures]
+        [Time.at(timestamp), signatures]
       end
       private_class_method :get_timestamp_and_signatures
 
@@ -53,6 +80,11 @@ module Stripe
         begin
           timestamp, signatures =
             get_timestamp_and_signatures(header, EXPECTED_SCHEME)
+
+        # TODO: Try to knock over this blanket rescue as it can unintentionally
+        # swallow many valid errors. Instead, try to validate an incoming
+        # header one piece at a time, and error with a known exception class if
+        # any part is found to be invalid. Rescue that class here.
         rescue StandardError
           raise SignatureVerificationError.new(
             "Unable to extract timestamp and signatures from header",
@@ -67,8 +99,7 @@ module Stripe
           )
         end
 
-        signed_payload = "#{timestamp}.#{payload}"
-        expected_sig = compute_signature(signed_payload, secret)
+        expected_sig = compute_signature(timestamp, payload, secret)
         unless signatures.any? { |s| Util.secure_compare(expected_sig, s) }
           raise SignatureVerificationError.new(
             "No signatures found matching the expected signature for payload",
@@ -76,7 +107,7 @@ module Stripe
           )
         end
 
-        if tolerance && timestamp < Time.now.to_f - tolerance
+        if tolerance && timestamp < Time.now - tolerance
           raise SignatureVerificationError.new(
             "Timestamp outside the tolerance zone (#{Time.at(timestamp)})",
             header, http_body: payload

data/lib/stripe.rb

@@ -3,15 +3,16 @@
 # Stripe Ruby bindings
 # API spec at https://stripe.com/docs/api
 require "cgi"
-require "faraday"
 require "json"
 require "logger"
+require "net/http"
 require "openssl"
 require "rbconfig"
 require "securerandom"
 require "set"
 require "socket"
 require "uri"
+require "forwardable"
 
 # Version
 require "stripe/version"
@@ -26,91 +27,22 @@ require "stripe/api_operations/save"
 
 # API resource support classes
 require "stripe/errors"
+require "stripe/object_types"
 require "stripe/util"
+require "stripe/connection_manager"
+require "stripe/multipart_encoder"
 require "stripe/stripe_client"
 require "stripe/stripe_object"
 require "stripe/stripe_response"
 require "stripe/list_object"
+require "stripe/error_object"
 require "stripe/api_resource"
 require "stripe/singleton_api_resource"
 require "stripe/webhook"
+require "stripe/stripe_configuration"
 
 # Named API resources
-require "stripe/account"
-require "stripe/account_link"
-require "stripe/alipay_account"
-require "stripe/apple_pay_domain"
-require "stripe/application_fee"
-require "stripe/application_fee_refund"
-require "stripe/balance"
-require "stripe/balance_transaction"
-require "stripe/bank_account"
-require "stripe/bitcoin_receiver"
-require "stripe/bitcoin_transaction"
-require "stripe/capability"
-require "stripe/card"
-require "stripe/charge"
-require "stripe/checkout/session"
-require "stripe/country_spec"
-require "stripe/coupon"
-require "stripe/credit_note"
-require "stripe/customer"
-require "stripe/discount"
-require "stripe/dispute"
-require "stripe/ephemeral_key"
-require "stripe/event"
-require "stripe/exchange_rate"
-require "stripe/file"
-require "stripe/file_link"
-require "stripe/invoice"
-require "stripe/invoice_item"
-require "stripe/invoice_line_item"
-require "stripe/issuer_fraud_record"
-require "stripe/issuing/authorization"
-require "stripe/issuing/card"
-require "stripe/issuing/card_details"
-require "stripe/issuing/cardholder"
-require "stripe/issuing/dispute"
-require "stripe/issuing/transaction"
-require "stripe/login_link"
-require "stripe/order"
-require "stripe/order_return"
-require "stripe/payment_intent"
-require "stripe/payment_method"
-require "stripe/payout"
-require "stripe/person"
-require "stripe/plan"
-require "stripe/product"
-require "stripe/radar/early_fraud_warning"
-require "stripe/radar/value_list"
-require "stripe/radar/value_list_item"
-require "stripe/recipient"
-require "stripe/recipient_transfer"
-require "stripe/refund"
-require "stripe/reporting/report_run"
-require "stripe/reporting/report_type"
-require "stripe/reversal"
-require "stripe/review"
-require "stripe/sigma/scheduled_query_run"
-require "stripe/sku"
-require "stripe/source"
-require "stripe/source_transaction"
-require "stripe/subscription"
-require "stripe/subscription_item"
-require "stripe/subscription_schedule"
-require "stripe/subscription_schedule_revision"
-require "stripe/tax_id"
-require "stripe/tax_rate"
-require "stripe/terminal/connection_token"
-require "stripe/terminal/location"
-require "stripe/terminal/reader"
-require "stripe/three_d_secure"
-require "stripe/token"
-require "stripe/topup"
-require "stripe/transfer"
-require "stripe/usage_record"
-require "stripe/usage_record_summary"
-require "stripe/webhook_endpoint"
+require "stripe/resources"
 
 # OAuth
 require "stripe/oauth"
@@ -118,36 +50,43 @@ require "stripe/oauth"
 module Stripe
   DEFAULT_CA_BUNDLE_PATH = __dir__ + "/data/ca-certificates.crt"
 
-  @app_info = nil
-
-  @api_base = "https://api.stripe.com"
-  @connect_base = "https://connect.stripe.com"
-  @uploads_base = "https://files.stripe.com"
-
-  @log_level = nil
-  @logger = nil
-
-  @proxy = nil
-
-  @max_network_retries = 0
-  @max_network_retry_delay = 2
-  @initial_network_retry_delay = 0.5
-
-  @ca_bundle_path = DEFAULT_CA_BUNDLE_PATH
-  @ca_store = nil
-  @verify_ssl_certs = true
+  # map to the same values as the standard library's logger
+  LEVEL_DEBUG = Logger::DEBUG
+  LEVEL_ERROR = Logger::ERROR
+  LEVEL_INFO = Logger::INFO
 
-  @open_timeout = 30
-  @read_timeout = 80
+  @app_info = nil
 
-  @enable_telemetry = false
+  @config = Stripe::StripeConfiguration.setup
 
   class << self
-    attr_accessor :stripe_account, :api_key, :api_base, :verify_ssl_certs,
-                  :api_version, :client_id, :connect_base, :uploads_base,
-                  :open_timeout, :read_timeout, :proxy
-
-    attr_reader :max_network_retry_delay, :initial_network_retry_delay
+    extend Forwardable
+
+    attr_reader :config
+
+    # User configurable options
+    def_delegators :@config, :api_key, :api_key=
+    def_delegators :@config, :api_version, :api_version=
+    def_delegators :@config, :stripe_account, :stripe_account=
+    def_delegators :@config, :api_base, :api_base=
+    def_delegators :@config, :uploads_base, :uploads_base=
+    def_delegators :@config, :connect_base, :connect_base=
+    def_delegators :@config, :open_timeout, :open_timeout=
+    def_delegators :@config, :read_timeout, :read_timeout=
+    def_delegators :@config, :write_timeout, :write_timeout=
+    def_delegators :@config, :proxy, :proxy=
+    def_delegators :@config, :verify_ssl_certs, :verify_ssl_certs=
+    def_delegators :@config, :ca_bundle_path, :ca_bundle_path=
+    def_delegators :@config, :log_level, :log_level=
+    def_delegators :@config, :logger, :logger=
+    def_delegators :@config, :max_network_retries, :max_network_retries=
+    def_delegators :@config, :enable_telemetry=, :enable_telemetry?
+    def_delegators :@config, :client_id=, :client_id
+
+    # Internal configurations
+    def_delegators :@config, :max_network_retry_delay
+    def_delegators :@config, :initial_network_retry_delay
+    def_delegators :@config, :ca_store
   end
 
   # Gets the application for a plugin that's identified some. See
@@ -160,99 +99,6 @@ module Stripe
     @app_info = info
   end
 
-  # The location of a file containing a bundle of CA certificates. By default
-  # the library will use an included bundle that can successfully validate
-  # Stripe certificates.
-  def self.ca_bundle_path
-    @ca_bundle_path
-  end
-
-  def self.ca_bundle_path=(path)
-    @ca_bundle_path = path
-
-    # empty this field so a new store is initialized
-    @ca_store = nil
-  end
-
-  # A certificate store initialized from the the bundle in #ca_bundle_path and
-  # which is used to validate TLS on every request.
-  #
-  # This was added to the give the gem "pseudo thread safety" in that it seems
-  # when initiating many parallel requests marshaling the certificate store is
-  # the most likely point of failure (see issue #382). Any program attempting
-  # to leverage this pseudo safety should make a call to this method (i.e.
-  # `Stripe.ca_store`) in their initialization code because it marshals lazily
-  # and is itself not thread safe.
-  def self.ca_store
-    @ca_store ||= begin
-      store = OpenSSL::X509::Store.new
-      store.add_file(ca_bundle_path)
-      store
-    end
-  end
-
-  # map to the same values as the standard library's logger
-  LEVEL_DEBUG = Logger::DEBUG
-  LEVEL_ERROR = Logger::ERROR
-  LEVEL_INFO = Logger::INFO
-
-  # When set prompts the library to log some extra information to $stdout and
-  # $stderr about what it's doing. For example, it'll produce information about
-  # requests, responses, and errors that are received. Valid log levels are
-  # `debug` and `info`, with `debug` being a little more verbose in places.
-  #
-  # Use of this configuration is only useful when `.logger` is _not_ set. When
-  # it is, the decision what levels to print is entirely deferred to the logger.
-  def self.log_level
-    @log_level
-  end
-
-  def self.log_level=(val)
-    # Backwards compatibility for values that we briefly allowed
-    if val == "debug"
-      val = LEVEL_DEBUG
-    elsif val == "info"
-      val = LEVEL_INFO
-    end
-
-    if !val.nil? && ![LEVEL_DEBUG, LEVEL_ERROR, LEVEL_INFO].include?(val)
-      raise ArgumentError,
-            "log_level should only be set to `nil`, `debug` or `info`"
-    end
-    @log_level = val
-  end
-
-  # Sets a logger to which logging output will be sent. The logger should
-  # support the same interface as the `Logger` class that's part of Ruby's
-  # standard library (hint, anything in `Rails.logger` will likely be
-  # suitable).
-  #
-  # If `.logger` is set, the value of `.log_level` is ignored. The decision on
-  # what levels to print is entirely deferred to the logger.
-  def self.logger
-    @logger
-  end
-
-  def self.logger=(val)
-    @logger = val
-  end
-
-  def self.max_network_retries
-    @max_network_retries
-  end
-
-  def self.max_network_retries=(val)
-    @max_network_retries = val.to_i
-  end
-
-  def self.enable_telemetry?
-    @enable_telemetry
-  end
-
-  def self.enable_telemetry=(val)
-    @enable_telemetry = val
-  end
-
   # Sets some basic information about the running application that's sent along
   # with API requests. Useful for plugin authors to identify their plugin when
   # communicating with Stripe.
@@ -266,16 +112,6 @@ module Stripe
       version: version,
     }
   end
-
-  # DEPRECATED. Use `Util#encode_parameters` instead.
-  def self.uri_encode(params)
-    Util.encode_parameters(params)
-  end
-  private_class_method :uri_encode
-  class << self
-    extend Gem::Deprecate
-    deprecate :uri_encode, "Stripe::Util#encode_parameters", 2016, 1
-  end
 end
 
 Stripe.log_level = ENV["STRIPE_LOG"] unless ENV["STRIPE_LOG"].nil?

data/stripe.gemspec

@@ -7,7 +7,7 @@ require "stripe/version"
 Gem::Specification.new do |s|
   s.name = "stripe"
   s.version = Stripe::VERSION
-  s.required_ruby_version = ">= 2.1.0"
+  s.required_ruby_version = ">= 2.3.0"
   s.summary = "Ruby bindings for the Stripe API"
   s.description = "Stripe is the easiest way to accept payments online.  " \
                   "See https://stripe.com for details."
@@ -16,11 +16,25 @@ Gem::Specification.new do |s|
   s.homepage = "https://stripe.com/docs/api/ruby"
   s.license = "MIT"
 
-  s.add_dependency("faraday", "~> 0.13")
-  s.add_dependency("net-http-persistent", "~> 3.0")
+  s.metadata = {
+    "bug_tracker_uri" => "https://github.com/stripe/stripe-ruby/issues",
+    "changelog_uri" =>
+      "https://github.com/stripe/stripe-ruby/blob/master/CHANGELOG.md",
+    "documentation_uri" => "https://stripe.com/docs/api/ruby",
+    "github_repo" => "ssh://github.com/stripe/stripe-ruby",
+    "homepage_uri" => "https://stripe.com/docs/api/ruby",
+    "source_code_uri" => "https://github.com/stripe/stripe-ruby",
+  }
 
-  s.files = `git ls-files`.split("\n")
-  s.test_files    = `git ls-files -- test/*`.split("\n")
+  ignored = Regexp.union(
+    /\A\.editorconfig/,
+    /\A\.git/,
+    /\A\.rubocop/,
+    /\A\.travis.yml/,
+    /\A\.vscode/,
+    /\Atest/
+  )
+  s.files = `git ls-files`.split("\n").reject { |f| ignored.match(f) }
   s.executables   = `git ls-files -- bin/*`.split("\n")
                                            .map { |f| ::File.basename(f) }
   s.require_paths = ["lib"]