stripe 4.21.3 → 5.52.0

data/lib/stripe/api_resource.rb

@@ -63,22 +63,7 @@ module Stripe
     # adds a `capture` class method to the resource class that, when called,
     # will send a POST request to `/v1/<object_name>/capture`.
     def self.custom_method(name, http_verb:, http_path: nil)
-      unless %i[get post delete].include?(http_verb)
-        raise ArgumentError,
-              "Invalid http_verb value: #{http_verb.inspect}. Should be one " \
-              "of :get, :post or :delete."
-      end
-      http_path ||= name.to_s
-      define_singleton_method(name) do |id, params = {}, opts = {}|
-        unless id.is_a?(String)
-          raise ArgumentError,
-                "id should be a string representing the ID of an API resource"
-        end
-
-        url = "#{resource_url}/#{CGI.escape(id)}/#{CGI.escape(http_path)}"
-        resp, opts = request(http_verb, url, params, opts)
-        Util.convert_to_stripe_object(resp.data, opts)
-      end
+      Util.custom_method self, self, name, http_verb, http_path
     end
 
     def resource_url
@@ -93,7 +78,8 @@ module Stripe
     end
 
     def refresh
-      resp, opts = request(:get, resource_url, @retrieve_params)
+      resp, opts = execute_resource_request(:get, resource_url,
+                                            @retrieve_params)
       initialize_from(resp.data, opts)
     end
 
@@ -103,5 +89,24 @@ module Stripe
       instance.refresh
       instance
     end
+
+    def request_stripe_object(method:, path:, params:, opts: {})
+      resp, opts = execute_resource_request(method, path, params, opts)
+
+      # If we're getting back this thing, update; otherwise, instantiate.
+      if Util.object_name_matches_class?(resp.data[:object], self.class)
+        initialize_from(resp.data, opts)
+      else
+        Util.convert_to_stripe_object(resp.data, opts)
+      end
+    end
+
+    protected def request_stream(method:, path:, params:, opts: {},
+                                 &read_body_chunk_block)
+      resp, = execute_resource_request_stream(
+        method, path, params, opts, &read_body_chunk_block
+      )
+      resp
+    end
   end
 end

data/lib/stripe/api_resource_test_helpers.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Stripe
+  # The base class for nested TestHelpers classes in resource objects.
+  # The APIResourceTestHelpers handles URL generation and custom method
+  # support for test-helper methods.
+  #
+  #  class MyAPIResource < APIResource
+  #    class TestHelpers < APIResourceTestHelpers
+  class APIResourceTestHelpers
+    def initialize(resource)
+      @resource = resource
+    end
+
+    # Adds a custom method to a test helper. This is used to add support for
+    # non-CRUDL API requests, e.g. capturing charges. custom_method takes the
+    # following parameters:
+    # - name: the name of the custom method to create (as a symbol)
+    # - http_verb: the HTTP verb for the API request (:get, :post, or :delete)
+    # - http_path: the path to append to the resource's URL. If not provided,
+    #              the name is used as the path
+    #
+    # For example, this call:
+    #     custom_method :capture, http_verb: post
+    # adds a `capture` class method to the resource class that, when called,
+    # will send a POST request to `/v1/<object_name>/capture`.
+    def self.custom_method(name, http_verb:, http_path: nil)
+      Util.custom_method self::RESOURCE_CLASS, self, name, http_verb, http_path
+    end
+
+    def self.resource_url
+      "/v1/test_helpers/"\
+      "#{self::RESOURCE_CLASS::OBJECT_NAME.downcase.tr('.', '/')}s"
+    end
+
+    def resource_url
+      unless (id = @resource["id"])
+        raise InvalidRequestError.new(
+          "Could not determine which URL to request: #{self.class} instance " \
+          "has invalid ID: #{id.inspect}",
+          "id"
+        )
+      end
+      "#{self.class.resource_url}/#{CGI.escape(id)}"
+    end
+  end
+end

data/lib/stripe/connection_manager.rb

@@ -0,0 +1,200 @@
+# frozen_string_literal: true
+
+module Stripe
+  # Manages connections across multiple hosts which is useful because the
+  # library may connect to multiple hosts during a typical session (main API,
+  # Connect, Uploads). Ruby doesn't provide an easy way to make this happen
+  # easily, so this class is designed to track what we're connected to and
+  # manage the lifecycle of those connections.
+  #
+  # Note that this class in itself is *not* thread safe. We expect it to be
+  # instantiated once per thread.
+  class ConnectionManager
+    # Timestamp (in seconds procured from the system's monotonic clock)
+    # indicating when the connection manager last made a request. This is used
+    # by `StripeClient` to determine whether a connection manager should be
+    # garbage collected or not.
+    attr_reader :last_used
+    attr_reader :config
+
+    def initialize(config = Stripe.config)
+      @config = config
+      @active_connections = {}
+      @last_used = Util.monotonic_time
+
+      # A connection manager may be accessed across threads as one thread makes
+      # requests on it while another is trying to clear it (either because it's
+      # trying to garbage collect the manager or trying to clear it because a
+      # configuration setting has changed). That's probably thread-safe already
+      # because of Ruby's GIL, but just in case the library's running on JRuby
+      # or the like, use a mutex to synchronize access in this connection
+      # manager.
+      @mutex = Mutex.new
+    end
+
+    # Finishes any active connections by closing their TCP connection and
+    # clears them from internal tracking.
+    def clear
+      @mutex.synchronize do
+        @active_connections.each do |_, connection|
+          connection.finish
+        end
+        @active_connections = {}
+      end
+    end
+
+    # Gets a connection for a given URI. This is for internal use only as it's
+    # subject to change (we've moved between HTTP client schemes in the past
+    # and may do it again).
+    #
+    # `uri` is expected to be a string.
+    def connection_for(uri)
+      @mutex.synchronize do
+        u = URI.parse(uri)
+        connection = @active_connections[[u.host, u.port]]
+
+        if connection.nil?
+          connection = create_connection(u)
+          connection.start
+
+          @active_connections[[u.host, u.port]] = connection
+        end
+
+        connection
+      end
+    end
+
+    # Executes an HTTP request to the given URI with the given method. Also
+    # allows a request body, headers, and query string to be specified.
+    def execute_request(method, uri, body: nil, headers: nil, query: nil,
+                        &block)
+      # Perform some basic argument validation because it's easy to get
+      # confused between strings and hashes for things like body and query
+      # parameters.
+      raise ArgumentError, "method should be a symbol" \
+        unless method.is_a?(Symbol)
+      raise ArgumentError, "uri should be a string" \
+        unless uri.is_a?(String)
+      raise ArgumentError, "body should be a string" \
+        if body && !body.is_a?(String)
+      raise ArgumentError, "headers should be a hash" \
+        if headers && !headers.is_a?(Hash)
+      raise ArgumentError, "query should be a string" \
+        if query && !query.is_a?(String)
+
+      @last_used = Util.monotonic_time
+
+      connection = connection_for(uri)
+
+      u = URI.parse(uri)
+      path = if query
+               u.path + "?" + query
+             else
+               u.path
+             end
+
+      method_name = method.to_s.upcase
+      has_response_body = method_name != "HEAD"
+      request = Net::HTTPGenericRequest.new(
+        method_name,
+        (body ? true : false),
+        has_response_body,
+        path,
+        headers
+      )
+
+      Util.log_debug("ConnectionManager starting request",
+                     method_name: method_name,
+                     path: path,
+                     process_id: Process.pid,
+                     thread_object_id: Thread.current.object_id,
+                     connection_manager_object_id: object_id,
+                     connection_object_id: connection.object_id,
+                     log_timestamp: Util.monotonic_time)
+
+      resp = @mutex.synchronize do
+        # The block parameter is special here. If a block is provided, the block
+        # is invoked with the Net::HTTPResponse. However, the body will not have
+        # been read yet in the block, and can be streamed by calling
+        # HTTPResponse#read_body.
+        connection.request(request, body, &block)
+      end
+
+      Util.log_debug("ConnectionManager request complete",
+                     method_name: method_name,
+                     path: path,
+                     process_id: Process.pid,
+                     thread_object_id: Thread.current.object_id,
+                     connection_manager_object_id: object_id,
+                     connection_object_id: connection.object_id,
+                     response_object_id: resp.object_id,
+                     log_timestamp: Util.monotonic_time)
+
+      resp
+    end
+
+    #
+    # private
+    #
+
+    # `uri` should be a parsed `URI` object.
+    private def create_connection(uri)
+      # These all come back as `nil` if no proxy is configured.
+      proxy_host, proxy_port, proxy_user, proxy_pass = proxy_parts
+
+      connection = Net::HTTP.new(uri.host, uri.port,
+                                 proxy_host, proxy_port,
+                                 proxy_user, proxy_pass)
+
+      # Time in seconds within which Net::HTTP will try to reuse an already
+      # open connection when issuing a new operation. Outside this window, Ruby
+      # will transparently close and re-open the connection without trying to
+      # reuse it.
+      #
+      # Ruby's default of 2 seconds is almost certainly too short. Here I've
+      # reused Go's default for `DefaultTransport`.
+      connection.keep_alive_timeout = 30
+
+      connection.open_timeout = config.open_timeout
+      connection.read_timeout = config.read_timeout
+      if connection.respond_to?(:write_timeout=)
+        connection.write_timeout = config.write_timeout
+      end
+
+      connection.use_ssl = uri.scheme == "https"
+
+      if config.verify_ssl_certs
+        connection.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        connection.cert_store = config.ca_store
+      else
+        connection.verify_mode = OpenSSL::SSL::VERIFY_NONE
+        warn_ssl_verify_none
+      end
+
+      connection
+    end
+
+    # `Net::HTTP` somewhat awkwardly requires each component of a proxy URI
+    # (host, port, etc.) rather than the URI itself. This method simply parses
+    # out those pieces to make passing them into a new connection a little less
+    # ugly.
+    private def proxy_parts
+      if config.proxy.nil?
+        [nil, nil, nil, nil]
+      else
+        u = URI.parse(config.proxy)
+        [u.host, u.port, u.user, u.password]
+      end
+    end
+
+    private def warn_ssl_verify_none
+      return if @verify_ssl_warned
+
+      @verify_ssl_warned = true
+      warn("WARNING: Running without SSL cert verification. " \
+        "You should never do this in production. " \
+        "Execute `Stripe.verify_ssl_certs = true` to enable " \
+        "verification.")
+    end
+  end
+end

data/lib/stripe/error_object.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Stripe
+  # Represents an error object as returned by the API.
+  #
+  # @see https://stripe.com/docs/api/errors
+  class ErrorObject < StripeObject
+    # Unlike other objects, we explicitly declare getter methods here. This
+    # is because the API doesn't return `null` values for fields on this
+    # object, rather the fields are omitted entirely. Not declaring the getter
+    # methods would cause users to run into `NoMethodError` exceptions and
+    # get in the way of generic error handling.
+
+    # For card errors, the ID of the failed charge.
+    def charge
+      @values[:charge]
+    end
+
+    # For some errors that could be handled programmatically, a short string
+    # indicating the error code reported.
+    def code
+      @values[:code]
+    end
+
+    # For card errors resulting from a card issuer decline, a short string
+    # indicating the card issuer's reason for the decline if they provide one.
+    def decline_code
+      @values[:decline_code]
+    end
+
+    # A URL to more information about the error code reported.
+    def doc_url
+      @values[:doc_url]
+    end
+
+    # A human-readable message providing more details about the error. For card
+    # errors, these messages can be shown to your users.
+    def message
+      @values[:message]
+    end
+
+    # If the error is parameter-specific, the parameter related to the error.
+    # For example, you can use this to display a message near the correct form
+    # field.
+    def param
+      @values[:param]
+    end
+
+    # The PaymentIntent object for errors returned on a request involving a
+    # PaymentIntent.
+    def payment_intent
+      @values[:payment_intent]
+    end
+
+    # The PaymentMethod object for errors returned on a request involving a
+    # PaymentMethod.
+    def payment_method
+      @values[:payment_method]
+    end
+
+    # The SetupIntent object for errors returned on a request involving a
+    # SetupIntent.
+    def setup_intent
+      @values[:setup_intent]
+    end
+
+    # The source object for errors returned on a request involving a source.
+    def source
+      @values[:source]
+    end
+
+    # The type of error returned. One of `api_error`, `card_error`,
+    # `idempotency_error`, or `invalid_request_error`.
+    def type
+      @values[:type]
+    end
+  end
+
+  # Represents on OAuth error returned by the OAuth API.
+  #
+  # @see https://stripe.com/docs/connect/oauth-reference#post-token-errors
+  class OAuthErrorObject < StripeObject
+    # A unique error code per error type.
+    def error
+      @values[:error]
+    end
+
+    # A human readable description of the error.
+    def error_description
+      @values[:error_description]
+    end
+  end
+end

data/lib/stripe/errors.rb

@@ -11,6 +11,7 @@ module Stripe
     attr_accessor :response
 
     attr_reader :code
+    attr_reader :error
     attr_reader :http_body
     attr_reader :http_headers
     attr_reader :http_status
@@ -24,9 +25,24 @@ module Stripe
       @http_status = http_status
       @http_body = http_body
       @http_headers = http_headers || {}
+      @idempotent_replayed = @http_headers["idempotent-replayed"] == "true"
       @json_body = json_body
       @code = code
-      @request_id = @http_headers[:request_id]
+      @request_id = @http_headers["request-id"]
+      @error = construct_error_object
+    end
+
+    def construct_error_object
+      return nil if @json_body.nil? || !@json_body.key?(:error)
+
+      ErrorObject.construct_from(@json_body[:error])
+    end
+
+    # Whether the error was the result of an idempotent replay, meaning that it
+    # originally occurred on a previous request and is being replayed back
+    # because the user sent the same idempotency key for this one.
+    def idempotent_replayed?
+      @idempotent_replayed
     end
 
     def to_s
@@ -59,8 +75,7 @@ module Stripe
   class CardError < StripeError
     attr_reader :param
 
-    # TODO: make code a keyword arg in next major release
-    def initialize(message, param, code, http_status: nil, http_body: nil,
+    def initialize(message, param, code: nil, http_status: nil, http_body: nil,
                    json_body: nil, http_headers: nil)
       super(message, http_status: http_status, http_body: http_body,
                      json_body: json_body, http_headers: http_headers,
@@ -119,6 +134,12 @@ module Stripe
                            json_body: json_body, http_headers: http_headers,
                            code: code)
       end
+
+      def construct_error_object
+        return nil if @json_body.nil?
+
+        OAuthErrorObject.construct_from(@json_body)
+      end
     end
 
     # InvalidClientError is raised when the client doesn't belong to you, or

data/lib/stripe/instrumentation.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Stripe
+  class Instrumentation
+    # Event emitted on `request_begin` callback.
+    class RequestBeginEvent
+      attr_reader :method
+      attr_reader :path
+
+      # Arbitrary user-provided data in the form of a Ruby hash that's passed
+      # from subscribers on `request_begin` to subscribers on `request_end`.
+      # `request_begin` subscribers can set keys which will then be available
+      # in `request_end`.
+      #
+      # Note that all subscribers of `request_begin` share the same object, so
+      # they must be careful to set unique keys so as to not conflict with data
+      # set by other subscribers.
+      attr_reader :user_data
+
+      def initialize(method:, path:, user_data:)
+        @method = method
+        @path = path
+        @user_data = user_data
+        freeze
+      end
+    end
+
+    # Event emitted on `request_end` callback.
+    class RequestEndEvent
+      attr_reader :duration
+      attr_reader :http_status
+      attr_reader :method
+      attr_reader :num_retries
+      attr_reader :path
+      attr_reader :request_id
+
+      # Arbitrary user-provided data in the form of a Ruby hash that's passed
+      # from subscribers on `request_begin` to subscribers on `request_end`.
+      # `request_begin` subscribers can set keys which will then be available
+      # in `request_end`.
+      attr_reader :user_data
+
+      def initialize(duration:, http_status:, method:, num_retries:, path:,
+                     request_id:, user_data: nil)
+        @duration = duration
+        @http_status = http_status
+        @method = method
+        @num_retries = num_retries
+        @path = path
+        @request_id = request_id
+        @user_data = user_data
+        freeze
+      end
+    end
+
+    # This class was renamed for consistency. This alias is here for backwards
+    # compatibility.
+    RequestEvent = RequestEndEvent
+
+    # Returns true if there are a non-zero number of subscribers on the given
+    # topic, and false otherwise.
+    def self.any_subscribers?(topic)
+      !subscribers[topic].empty?
+    end
+
+    def self.subscribe(topic, name = rand, &block)
+      subscribers[topic][name] = block
+      name
+    end
+
+    def self.unsubscribe(topic, name)
+      subscribers[topic].delete(name)
+    end
+
+    def self.notify(topic, event)
+      subscribers[topic].each_value { |subscriber| subscriber.call(event) }
+    end
+
+    def self.subscribers
+      @subscribers ||= Hash.new { |hash, key| hash[key] = {} }
+    end
+    private_class_method :subscribers
+  end
+end

data/lib/stripe/list_object.rb

@@ -7,7 +7,7 @@ module Stripe
     include Stripe::APIOperations::Request
     include Stripe::APIOperations::Create
 
-    OBJECT_NAME = "list".freeze
+    OBJECT_NAME = "list"
 
     # This accessor allows a `ListObject` to inherit various filters that were
     # given to a predecessor. This allows for things like consistent limits,
@@ -51,6 +51,16 @@ module Stripe
     # Iterates through each resource in all pages, making additional fetches to
     # the API as necessary.
     #
+    # The default iteration direction is forwards according to Stripe's API
+    # "natural" ordering direction -- newer objects first, and moving towards
+    # older objects.
+    #
+    # However, if the initial list object was fetched using an `ending_before`
+    # cursor (and only `ending_before`, `starting_after` cannot also be
+    # included), the method assumes that the user is trying to iterate
+    # backwards compared to natural ordering and returns results that way --
+    # older objects first, and moving towards newer objects.
+    #
     # Note that this method will make as many API calls as necessary to fetch
     # all resources. For more granular control, please see +each+ and
     # +next_page+.
@@ -59,8 +69,18 @@ module Stripe
 
       page = self
       loop do
-        page.each(&blk)
-        page = page.next_page
+        # Backward iterating activates if we have an `ending_before` constraint
+        # and _just_ an `ending_before` constraint. If `starting_after` was
+        # also used, we iterate forwards normally.
+        if filters.include?(:ending_before) &&
+           !filters.include?(:starting_after)
+          page.reverse_each(&blk)
+          page = page.previous_page
+        else
+          page.each(&blk)
+          page = page.next_page
+        end
+
         break if page.empty?
       end
     end
@@ -72,8 +92,8 @@ module Stripe
 
     def retrieve(id, opts = {})
       id, retrieve_params = Util.normalize_id(id)
-      resp, opts = request(:get, "#{resource_url}/#{CGI.escape(id)}",
-                           retrieve_params, opts)
+      url = "#{resource_url}/#{CGI.escape(id)}"
+      resp, opts = execute_resource_request(:get, url, retrieve_params, opts)
       Util.convert_to_stripe_object(resp.data, opts)
     end
 
@@ -83,6 +103,7 @@ module Stripe
     # was given, the default limit will be fetched again.
     def next_page(params = {}, opts = {})
       return self.class.empty_list(opts) unless has_more
+
       last_id = data.last.id
 
       params = filters.merge(starting_after: last_id).merge(params)
@@ -95,6 +116,8 @@ module Stripe
     # This method will try to respect the limit of the current page. If none
     # was given, the default limit will be fetched again.
     def previous_page(params = {}, opts = {})
+      return self.class.empty_list(opts) unless has_more
+
       first_id = data.first.id
 
       params = filters.merge(ending_before: first_id).merge(params)
@@ -106,5 +129,11 @@ module Stripe
       url ||
         raise(ArgumentError, "List object does not contain a 'url' field.")
     end
+
+    # Iterates through each resource in the page represented by the current
+    # `ListObject` in reverse.
+    def reverse_each(&blk)
+      data.reverse_each(&blk)
+    end
   end
 end