stripe 1.57.0 → 1.57.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9fe4d3fd367bcbfca810fc12cef79b4867c6a55f
-  data.tar.gz: a04ff21db27f43fe765bedc7cb204dcd82dc7549
+  metadata.gz: cc1cb05bfb9a08a00e144b883b27f19adecd393a
+  data.tar.gz: ba84a7e8456dc66a137cb149a8dc8ca36962e2d3
 SHA512:
-  metadata.gz: 5008004f4e7c44636190e87b9435e80abf7d7bf04c2a581a63c7f89fd6985794c6abd03a90db8166e35908ebf808ae3bbb1016b3a86da1cbc6b9faef7ee932c8
-  data.tar.gz: 136522a91f1a78340136450a7735d3debc92649d7da8475ae0c26147985e690e6d840c1dc958128a1d0e30310fca607a21742c078a7d13c4adc3b80fb0f60d2f
+  metadata.gz: f023b3c00e55b05fc9a7eb84dc2d876c9b518a51ce445f0c78f03e82158a544c2f2a7d825953bd80228f527fd7cd6db14a88f87913d4a6309ff26b423b57ebcb
+  data.tar.gz: 125b78e32aebaaaee71f8d22afd33a10f90d899f8a4ff1bf9352ed2fd8dd35549186b2ef96c943670cd17dcbaa95c1d0f7ce3c6808fa0a690529ba42b716f037

data/History.txt

@@ -1,3 +1,7 @@
+=== 1.57.1 2016-11-28
+
+* Disallow sending protected fields along with API resource `.update`
+
 === 1.57.0 2016-11-21
 
 * Add retrieve method for 3-D Secure resources

data/VERSION

@@ -1 +1 @@
-1.57.0
+1.57.1

data/lib/stripe/account.rb

@@ -79,7 +79,7 @@ module Stripe
       update_hash
     end
 
-    def protected_fields
+    def self.protected_fields
       [:legal_entity]
     end
 

data/lib/stripe/api_operations/save.rb

@@ -15,6 +15,12 @@ module Stripe
         #   idempotency_key to be passed in the request headers, or for the
         #   api_key to be overwritten. See {APIOperations::Request.request}.
         def update(id, params={}, opts={})
+          params.each do |k, v|
+            if self.protected_fields.include?(k)
+              raise ArgumentError, "Cannot update protected field: #{k}"
+            end
+          end
+
           response, opts = request(:post, "#{resource_url}/#{id}", params, opts)
           Util.convert_to_stripe_object(response, opts)
         end

data/lib/stripe/stripe_object.rb

@@ -194,19 +194,24 @@ module Stripe
 
     protected
 
-    def metaclass
-      class << self; self; end
+    # A protected field is one that doesn't get an accessor assigned to it
+    # (i.e. `obj.public = ...`) and one which is not allowed to be updated via
+    # the class level `Model.update(id, { ... })`.
+    def self.protected_fields
+      []
     end
 
-    def protected_fields
-      []
+    def metaclass
+      class << self; self; end
     end
 
     def remove_accessors(keys)
-      f = protected_fields
+      # not available in the #instance_eval below
+      protected_fields = self.class.protected_fields
+
       metaclass.instance_eval do
         keys.each do |k|
-          next if f.include?(k)
+          next if protected_fields.include?(k)
           next if @@permanent_attributes.include?(k)
 
           # Remove methods for the accessor's reader and writer.
@@ -220,10 +225,12 @@ module Stripe
     end
 
     def add_accessors(keys, values)
-      f = protected_fields
+      # not available in the #instance_eval below
+      protected_fields = self.class.protected_fields
+
       metaclass.instance_eval do
         keys.each do |k|
-          next if f.include?(k)
+          next if protected_fields.include?(k)
           next if @@permanent_attributes.include?(k)
 
           define_method(k) { @values[k] }

data/lib/stripe/version.rb

@@ -1,3 +1,3 @@
 module Stripe
-  VERSION = '1.57.0'
+  VERSION = '1.57.1'
 end

data/test/stripe/account_test.rb

@@ -96,26 +96,15 @@ module Stripe
     should "be updatable" do
       resp = {
         :id => 'acct_foo',
-        :legal_entity => {
-          :first_name => 'Bob',
-          :address => {
-            :line1 => '2 Three Four'
-          }
-        }
+        :business_name => 'ACME Corp',
       }
       @mock.expects(:post).
         once.
-        with('https://api.stripe.com/v1/accounts/acct_foo', nil, 'legal_entity[first_name]=Bob&legal_entity[address][line1]=2+Three+Four').
+        with('https://api.stripe.com/v1/accounts/acct_foo', nil, 'business_name=ACME+Corp').
         returns(make_response(resp))
 
-      a = Stripe::Account.update('acct_foo', :legal_entity => {
-        :first_name => 'Bob',
-        :address => {
-          :line1 => '2 Three Four'
-        }
-      })
-      assert_equal('Bob', a.legal_entity.first_name)
-      assert_equal('2 Three Four', a.legal_entity.address.line1)
+      a = Stripe::Account.update('acct_foo', :business_name => "ACME Corp")
+      assert_equal('ACME Corp', a.business_name)
     end
 
     should 'disallow direct overrides of legal_entity' do

data/test/stripe/api_operations_test.rb

@@ -3,18 +3,29 @@ require File.expand_path('../../test_helper', __FILE__)
 
 module Stripe
   class ApiOperationsTest < Test::Unit::TestCase
-    class Updater < APIResource
+    class UpdateableResource < APIResource
       include Stripe::APIOperations::Save
+
+      def self.protected_fields
+        [:protected]
+      end
     end
 
-    should "the Update API operation should post the correct parameters to the resource URL" do
-      @mock.expects(:post).once.
-        with("#{Stripe.api_base}/v1/updaters/id", nil, 'foo=bar').
-        returns(make_response({foo: 'bar'}))
-      resource = Updater::update("id", {foo: "bar"})
-      assert_equal('bar', resource.foo)
+    context ".update" do
+      should "post the correct parameters to the resource URL" do
+        @mock.expects(:post).once.
+          with("#{Stripe.api_base}/v1/updateableresources/id", nil, 'foo=bar').
+          returns(make_response({foo: 'bar'}))
+        resource = UpdateableResource::update("id", { foo: "bar" })
+        assert_equal('bar', resource.foo)
+      end
+
+      should "error on protected fields" do
+        e = assert_raises do
+          UpdateableResource::update("id", { protected: "bar" })
+        end
+        assert_equal "Cannot update protected field: protected", e.message
+      end
     end
   end
 end
-
-

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stripe
 version: !ruby/object:Gem::Version
-  version: 1.57.0
+  version: 1.57.1
 platform: ruby
 authors:
 - Stripe
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-11-22 00:00:00.000000000 Z
+date: 2016-11-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client