swoosh 0.2.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 5e1ff99da9824d739c402761ed91dc9ce7bdccc560d6c5dbb90b6c30165e8938
+  data.tar.gz: ef0293add94df86faba164c06f1c89dde456051546e4eab6e36814089f2a3f3e
+SHA512:
+  metadata.gz: 857fe5ebeebdf6361f6a9c0463c42c31e353b0a8c4aff520a1e859861fa427d70698d136b293e52e7ffaa85c0217a2fc92dabefd23b8035d08c1e43a577dcfc6
+  data.tar.gz: cec84320121d5e938c06ebb1af0ca12b197a572bd9d39e47e28c4a41a984275da8c421be6f71a0428c67d2fe7dcdcc03f4b65882bb1460108c00e6e6dc00f487

data/.rubocop.yml

@@ -0,0 +1,51 @@
+plugins:
+  - rubocop-minitest
+  - rubocop-rake
+
+AllCops:
+  TargetRubyVersion: 3.2
+  NewCops: enable
+  SuggestExtensions: false
+  Exclude:
+    - "bin/**/*"
+    - "public/**/*"
+    - "log/**/*"
+    - "tmp/**/*"
+    - "vendor/**/*"
+    # Rails-generated scaffolding; follows rails-omakase, not this gem's style.
+    - "test/dummy/**/*"
+    - "db/schema.rb"
+    - "db/migrate/**/*"
+
+Layout/LineLength:
+  Max: 120
+
+Metrics/AbcSize:
+  Max: 20
+
+Metrics/MethodLength:
+  Max: 16
+
+Metrics/BlockLength:
+  Max: 30
+
+# A public API's signature is its documentation: `generate_payment(amount, **)`
+# tells a caller nothing about what it accepts.
+Style/ArgumentsForwarding:
+  Enabled: false
+
+Style/Documentation:
+  Enabled: false
+
+# A test that reads back several fields of one payload is one behaviour, not
+# four; splitting it would obscure what it checks.
+Minitest/MultipleAssertions:
+  Max: 5
+
+Style/StringLiterals:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  Enabled: true
+  EnforcedStyle: double_quotes

data/.tool-versions

@@ -0,0 +1 @@
+4.0.7

data/AGENTS.md

@@ -0,0 +1,13 @@
+# Swoosh
+
+We're building and maintaining a gem for Swedish Swish payments. Its goals:
+
+1. A nice and ergonomic API for creating and querying payments through Swish
+2. First-class Rails support via railties etc
+3. Other ruby frameworks and servers such as Sinatra or Hanami should be able to use it
+
+Rules:
+
+- Use minitest for tests
+- Tests should be exercised both for the gem itself and its usage through a Rails app
+- Never commit code, I'll do that

data/CHANGELOG.md

@@ -0,0 +1,68 @@
+## [0.2.0] - 2026-09-21
+
+- Drop the `http` gem and reach Swish with `net/http` from the standard library. Swoosh now has no
+  runtime dependencies.
+- **Verify Swish's server certificate.** The SSL context the gem built set no `verify_mode`, which
+  OpenSSL reads as `VERIFY_NONE`, and pushed the bundled DigiCert root into the *client* chain sent
+  to Swish rather than into a trust store. The server was therefore never authenticated and the
+  merchant certificate would have been handed to anything that answered. `root_ca_path` is now the
+  `ca_file` it is documented to be, under `VERIFY_PEER`.
+- Replace `Certificates#ssl_context` with `Certificates#configure_ssl(http)`, and `Main#ssl_context`
+  with `Main#connection(uri)`: Net::HTTP builds its own context rather than accepting one.
+  `ssl_context` also mutated the memoized `ca_certs` array on every call.
+- Connection failures now raise `Net::HTTP`'s own errors (`Errno::ECONNREFUSED`, `Net::OpenTimeout`,
+  `SocketError`) rather than `HTTP::ConnectionError`. Requests inherit Net::HTTP's 60 second open and
+  read timeouts, where http.rb applied none.
+- Add `Swoosh.cancel_payment, which withdraws a `CREATED` payment request so an abandoned checkout
+  stops occupying the payer's three minutes. Cancelling also drops the stored m-commerce token.
+- Raise `Swoosh::PaymentNotCancellable` (RP07, the payer accepted first) and
+  `Swoosh::PaymentAlreadyCancelled` (RP08, a second cancel) rather than one `RequestError`: Swish
+  reports both as a 422 differing only by a code, and they call for opposite responses.
+- Pick the error class from Swish's errorCode as well as the status, via `ResponseError.for`. An
+  unrecognised code still raises `RequestError`, so a code Swish adds later stays rescuable.
+- Add `TokenStore#delete`, used when a payment can no longer be paid. A store that predates it and
+  answers only `read`/`write` is skipped rather than raising.
+
+- `generate_payment` returns a `Swoosh::Payment` carrying the id and the m-commerce token instead of
+  the response body, which was empty on success.
+- Add `Swoosh.find_payment`, `Payment#app_switch_url`, `Payment#qr_code` and status predicates.
+- Raise `Swoosh::RequestError` / `Swoosh::ServerError` on 4xx/5xx, carrying Swish's errorCode,
+  with `Swoosh::PaymentNotFound` for 404 so a reconciliation sweep can skip what will never resolve.
+- Add `Swoosh::Callback`, a plain module any framework can include, and `Swoosh::Callback::Controller`,
+  the Rails concern that supplies only `request.body.read`.
+- Add an opt-in token store (`Rails.cache` by default) for the m-commerce token, which Swish issues once.
+- Add `swoosh/test` with callback payload builders and WebMock stubs for host applications.
+
+- Build the payment payload from arguments instead of hardcoded Swish test values. `generate_payment`
+  now takes `amount` positionally and the rest as keywords, and omits absent fields rather than
+  sending null.
+- Add `payee_alias`, `callback_url` and `currency` configuration. `payee_alias` is per application
+  with a per-call override; `callback_url` is per call, with an optional configured default.
+
+- Find certificates by name: `swish_test.p12` / `swish_production.p12` in a configurable `cert_dir`.
+  Staging falls back to the certificates bundled with the gem; production raises rather than falling back.
+- Add `Swoosh::Configuration` and `Swoosh.configure`, so the core no longer depends on Rails.
+- Rework the railtie around `config.swoosh.{environment,cert_dir,cert_password,root_ca_path}`, defaulting
+  to staging outside `Rails.env.production?`.
+- Add a dummy Rails application in `test/dummy` and a second suite that drives the gem through it.
+  `rake` now runs `test:gem` (Rails absent) and `test:rails` in separate processes.
+
+- Require Ruby >= 3.2; develop and test against Ruby 4.0.7.
+- Bump `http` to ~> 6.0, and the development dependencies (rake, rubocop, rubocop-minitest, minitest).
+- Replace `pry` with `debug`.
+- Add `vcr` + `webmock`, and record the payment-request flow against the Swish staging playground (MSS)
+  into `test/cassettes/`, so the suite exercises a real 201 response offline.
+- Load `rubocop-minitest` and `rubocop-rake` as RuboCop plugins (they were installed but never enabled).
+- Refresh the bundled Swish test certificates. The previous merchant certificates expired in 2022 and
+  were encrypted with `pbeWithSHA1And40BitRC2-CBC`, which OpenSSL 3 refuses to parse without the legacy
+  provider. The current bundle is valid until 2027-09-11 and uses PBES2/PBKDF2/AES-256-CBC.
+- Replace the `Swish_TLS_RootCA.pem` root CA with DigiCert Global Root G2. Both `mss.cpc.getswish.net`
+  and `cpc.getswish.net` now chain to G2; the previous DigiCert Global Root CA no longer verifies them.
+- Add the Swish technical supplier test certificate (`Swish_TechnicalSupplier_TestCertificate_9870474641`).
+- Fix `Main#generate_payment` to accept the `message` argument it passes on to `#data`.
+- Make the certificate directory, filename and password injectable via `Main.new`.
+- Drop the dead `Main#client` method (it referenced an undefined `Client` and `@private_key`).
+
+## [0.1.0] - 2021-10-22
+
+- Initial release

data/Gemfile

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+# Specify your gem's dependencies in swoosh.gemspec
+gemspec
+
+gem "debug", "~> 1.11"
+gem "minitest", "~> 6.0"
+gem "puma", "~> 7.0"
+gem "rails", "~> 8.1"
+gem "rake", "~> 13.4"
+gem "rubocop", "~> 1.91"
+gem "rubocop-minitest", "~> 0.40"
+gem "rubocop-rake", "~> 0.7"
+gem "vcr", "~> 6.4"
+gem "webmock", "~> 3.26"

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2021 Johan Halse
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,377 @@
+# Swoosh
+
+Swish payments for Ruby, with first-class Rails support.
+
+## Installation
+
+```ruby
+gem "swoosh"
+```
+
+## Certificates
+
+Swish authenticates merchants with a mutual-TLS client certificate issued by your
+bank. Swoosh finds it **by name**, in a directory you choose:
+
+```
+config/certs/
+├── swish_test.p12         # staging (Swish calls this environment MSS)
+└── swish_production.p12   # production
+```
+
+Drop the bundle your bank issued into that directory under the name matching the
+environment it belongs to. Nothing else to configure.
+
+Two conveniences worth knowing:
+
+- **Staging needs no setup at all.** If no `swish_test.p12` is present, Swoosh
+  falls back to the Swish test certificates bundled with the gem, so a fresh app
+  can talk to the staging playground immediately.
+- **Production never falls back.** A missing `swish_production.p12` raises
+  `Swoosh::CertificateError` naming the path it looked in, rather than quietly
+  running against staging.
+
+The DigiCert root CA that signs the Swish endpoints ships with the gem, so you
+don't need to supply one. Override it with `root_ca_path` if that ever changes.
+It is the trust anchor Swoosh verifies *Swish* by, under `VERIFY_PEER` -- the
+merchant certificate authenticates you to them, and this authenticates them to
+you. Point it at the wrong root and the handshake fails rather than falling back
+to the system store.
+
+## Rails
+
+The railtie reads `config.swoosh.*`. Every setting is optional:
+
+```ruby
+# config/environments/development.rb
+Rails.application.configure do
+  # Development and test default to :test (staging). Switch to :production when
+  # you want to exercise real certificates by hand.
+  config.swoosh.environment = :production
+
+  config.swoosh.cert_dir      = Rails.root.join("config/certs")
+  config.swoosh.cert_password = ENV["SWISH_CERT_PASSWORD"]
+end
+```
+
+| Setting | Default |
+| --- | --- |
+| `environment` | `:production` in `Rails.env.production?`, otherwise `:test` |
+| `cert_dir` | `Rails.root.join("config/certs")` |
+| `cert_password` | `"swish"` |
+| `root_ca_path` | the DigiCert root bundled with the gem |
+| `payee_alias` | none -- your Swish merchant number |
+| `callback_url` | none -- see below |
+| `currency` | `"SEK"` |
+| `token_store` | `Rails.cache`; `nil` disables |
+| `token_ttl` | 300 seconds |
+
+`environment` accepts `:test`, `:staging` (an alias for `:test`) and
+`:production`, as symbols or strings. Anything else raises
+`Swoosh::ConfigurationError` at boot.
+
+## Creating a payment
+
+```ruby
+payment = Swoosh.generate_payment(
+  199,
+  callback_url:            swish_callbacks_url,
+  payee_payment_reference: order.ocr,      # your matching key, e.g. "ABC123"
+  message:                 "Order #{order.number}"
+)
+
+order.update!(swish_payment_id: payment.id)   # persist before you render anything
+```
+
+`amount` is the only positional argument. Everything else is a keyword:
+
+| Keyword | |
+| --- | --- |
+| `callback_url` | HTTPS URL Swish posts the result to. Required. |
+| `payee_alias` | overrides the configured merchant number |
+| `message` | shown to the payer |
+| `payer_alias` | the payer's number. **Omit it** for the Swish-app flow, which is what issues a token |
+| `payee_payment_reference` | your own reference: `a-z A-Z 0-9 -_.+*/`, 1-36 characters |
+| `payer_ssn`, `age_limit` | passed through to Swish when given |
+| `currency` | defaults to `SEK` |
+
+Anything left out is omitted from the request rather than sent as null, which
+matters for `payer_alias`: sending it null breaks the Swish-app flow.
+
+A 4xx or 5xx raises `Swoosh::RequestError` / `Swoosh::ServerError`, carrying
+Swish's own code:
+
+```ruby
+rescue Swoosh::RequestError => e
+  e.status        # => 422
+  e.error_code    # => "BE18"
+  e.error_message # => "Payer alias is invalid"
+end
+```
+
+### payee_alias vs callback_url
+
+Your merchant number is the same everywhere, so configure it once. A call can
+still override it if you bill through more than one merchant.
+
+The callback is different: one application usually has several kinds of payment
+that want different endpoints, so **`callback_url` is per call**. Configure
+`callback_url` only if every payment in the app shares one endpoint -- leave it
+unset and Swoosh requires each call to name one.
+
+## Presenting the payment
+
+Both flows use the same token, so you decide at render time, not request time:
+
+```ruby
+# same device -- hand the payer to the Swish app
+redirect_to payment.app_switch_url(return_url: order_url(order))
+
+# other device -- show a QR code
+send_data payment.qr_code(size: 300), type: "image/png"
+```
+
+`qr_code` accepts `size:` (minimum 300, which Swish enforces), `format:` (`png`,
+`jpg`, `svg`), `border:` and `transparent:`. It is served from Swish's public QR
+host, so it needs no certificate.
+
+Supply `payer_alias` instead and Swish notifies that number directly; no token is
+issued and both methods above raise.
+
+The `return_url` is a **UX return only**. It tells you nothing about whether the
+payment succeeded, and in-app browsers drop it routinely.
+
+## Receiving the callback
+
+Swish POSTs the payment to your `callback_url` when it settles. **Swish does not
+sign these**, so anyone who guesses a payment id can post one. Verify before you
+act:
+
+```ruby
+class Swish::CallbacksController < ApplicationController
+  include Swoosh::Callback::Controller
+  skip_forgery_protection
+
+  def create
+    payment = swoosh_verified_payment              # re-fetched from Swish over mTLS
+    Order.find_by!(swish_payment_id: payment.id).settle! if payment.paid?
+    head :ok
+  end
+end
+```
+
+| | |
+| --- | --- |
+| `swoosh_callback` | the POSTed body, parsed. Unauthenticated -- fine for logging |
+| `swoosh_verified_payment` | asks Swish directly. Act on this one |
+
+Outside Rails, include the plain module and say where the body comes from:
+
+```ruby
+class CallbackHandler
+  include Swoosh::Callback
+
+  def initialize(body) = @body = body
+  def swoosh_callback_body = @body
+end
+```
+
+`Swoosh::Callback::Controller` is only that module plus `request.body.read`.
+
+## Cancelling
+
+A payment request the payer never answers occupies the full three minutes.
+Cancel it and the payer's Swish app stops offering it immediately:
+
+```ruby
+Swoosh.cancel_payment(order.swish_payment_id)   # => Payment, status CANCELLED
+```
+
+Only a `CREATED` payment can be cancelled, which makes this an inherently racy
+call: on a page people abandon by paying, the payer often accepts somewhere
+between your decision to cancel and the request landing. Swish reports both
+outcomes as a 422 differing only by a code in the body, so Swoosh gives them
+separate classes:
+
+```ruby
+begin
+  Swoosh.cancel_payment(order.swish_payment_id)
+rescue Swoosh::PaymentAlreadyCancelled
+  # RP08. Already where you wanted it -- usually nothing to do.
+rescue Swoosh::PaymentNotCancellable
+  # RP07. The payer got there first. This order may be PAID.
+  order.settle!(Swoosh.find_payment(order.swish_payment_id))
+end
+```
+
+**A failed cancel is never licence to treat an order as abandoned.** `RP07`
+means the payment left `CREATED`, and the overwhelmingly likely reason is that
+it was paid. Poll before you decide anything.
+
+One wrinkle worth knowing, because it looks like a bug: a *successful* cancel
+comes back carrying `errorCode` `"RP08"` while its status is `CANCELLED`. Swish
+populates that field on more than failures, so read `status` -- or
+`payment.cancelled?` -- rather than treating a present `error_code` as trouble.
+
+```ruby
+payment = Swoosh.cancel_payment(id)
+payment.cancelled?   # => true
+payment.error?       # => false  -- ERROR is a different status
+payment.error_code   # => "RP08"
+```
+
+Cancelling also drops any stored m-commerce token, so `Swoosh.token_for` won't
+hand back something that still renders a QR nobody can pay.
+
+## Polling
+
+```ruby
+payment = Swoosh.find_payment(order.swish_payment_id)
+payment.paid?      # also declined? cancelled? error?
+payment.pending?   # still CREATED
+payment.error_code # e.g. "TM01" when the payer ran out of time
+```
+
+**Swish delivers each callback exactly once and never retries.** A deploy or a
+brief 502 loses it permanently, so polling is not optional:
+
+- Your waiting page should poll **your** app, reading your own database. Never
+  block a request on Swish.
+- A background job sweeps anything still `CREATED` after ~3 minutes and calls
+  `find_payment`. That closes the gap.
+
+Since the callback controller also ends at a verified `Payment`, both paths run
+the same settling code -- make it idempotent once.
+
+Statuses are `CREATED`, `PAID`, `DECLINED`, `ERROR`, `CANCELLED`. A payer has
+three minutes to accept; after that Swish reports `ERROR` with code `TM01`.
+
+### Reconciliation
+
+Swoosh deliberately ships no sweep: it would need your database and your
+scheduler. It gives you `find_payment` and error classes precise enough to build
+one in a dozen lines.
+
+```ruby
+class ReconcileSwishPayments
+  def call
+    Order.awaiting_swish.where(created_at: ..3.minutes.ago).find_each do |order|
+      settle(order)
+    rescue Swoosh::PaymentNotFound
+      order.record_swish_lookup_miss!   # do NOT treat as "never happened"
+    rescue Swoosh::ServerError
+      next                              # transient; next sweep picks it up
+    end
+  end
+
+  private
+
+  def settle(order)
+    payment = Swoosh.find_payment(order.swish_payment_id)
+    order.settle!(payment) if payment.terminal?
+  end
+end
+```
+
+Rescue per row, not per batch: one bad row shouldn't abort the sweep.
+
+**A 404 is not proof the payment doesn't exist.** The integration guide defines
+it as "the Payment request was not found, *or it was not created by the
+merchant*" -- so polling a real, possibly paid payment with the wrong merchant
+certificate returns exactly the same `Swoosh::PaymentNotFound`.
+
+Retrying won't fix either case, but the right response differs, and you can't
+tell them apart from the response alone. So don't write a 404 off as a payment
+that never happened. Record it and alert when the rate climbs: a handful usually
+means bad rows, while a spike almost always means a certificate or environment
+mismatch, where every one of those payments is real.
+
+`ServerError` (5xx) is separated from `RequestError` (4xx) so you retry the
+failures worth retrying and nothing else.
+
+### Payments don't expire out from under you
+
+The three-minute limit is the payer's deadline to accept, not a retention
+window. A payment request stays queryable long after it settles -- Swish rejects
+an original as too old for refunds only past 13 months. Age alone will not turn a
+poll into a 404.
+
+### Staging settles payments for you
+
+MSS moves a payment to `PAID` on its own, with no payer involved. Convenient for
+exercising the happy path, but it means staging never shows you `DECLINED`, and
+never shows you the `ERROR`/`TM01` timeout that a real unanswered payment
+produces. Don't read "it went `PAID` in staging" as proof your flow handles the
+other four statuses.
+
+## What to persist
+
+Just the id:
+
+```ruby
+add_column :orders, :swish_payment_id, :string
+```
+
+Everything else comes back from `find_payment`. The one exception is the
+m-commerce token, which Swish returns once and never again -- so if you need it
+in a later request (a reload, an AJAX-rendered QR), Swoosh can keep it for you:
+
+```ruby
+Swoosh.token_for(order.swish_payment_id)   # => token, or nil
+```
+
+`nil` means "create a fresh payment request", never an error -- whether the token
+expired, was never stored, or was dropped because you cancelled the payment. In
+Rails this is backed by `Rails.cache` by default with a 5 minute TTL, since the
+token dies with the payment window anyway. Set `config.swoosh.token_store = nil` to turn it off.
+Losing a token costs the payer one extra tap; nothing about it is load-bearing.
+
+Statuses are deliberately **not** cached -- caching a `CREATED` would make your
+poller report stale results for a payment that has already settled.
+
+## Dependencies
+
+None. Swoosh talks to Swish with `net/http` from the standard library, so adding
+it to an application pulls in nothing else.
+
+## Without Rails
+
+Nothing in the core depends on Rails, so Sinatra, Hanami and plain Ruby work the
+same way:
+
+```ruby
+Swoosh.configure do |config|
+  config.environment   = :production
+  config.cert_dir      = "config/certs"
+  config.cert_password = ENV["SWISH_CERT_PASSWORD"]
+  config.payee_alias   = "1231181189"
+end
+
+Swoosh.generate_payment(100, callback_url: "https://example.com/swish", message: "Kaffe")
+```
+
+## Development
+
+    $ bin/setup
+    $ bundle exec rake
+
+`rake` runs two suites in separate processes: `rake test:gem` exercises the gem
+with Rails absent from the process, and `rake test:rails` drives it through the
+dummy application in `test/dummy`.
+
+HTTP is recorded with VCR against the Swish staging playground. To re-record,
+delete the cassette in `test/cassettes` and run the suite again.
+
+### The certificate canaries
+
+Four tests in `test/swoosh_test.rb` compare the bundled certificates against the
+real clock, and they are meant to. They fail 30 days before a certificate lapses,
+because a suite that stays green on an expired bundle would ship a staging
+fallback that cannot complete a TLS handshake.
+
+Don't freeze or travel time around them. When one fires, the message tells you
+what to renew and where from. Nothing else in the suite depends on the clock.
+
+## License
+
+[MIT](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rake/testtask"
+
+# Two suites, deliberately in separate processes:
+#
+#   test:gem   - the gem on its own, with Rails absent from the process, which
+#                is what keeps Sinatra/Hanami/plain Ruby usage honest.
+#   test:rails - the same gem driven through the dummy application in test/dummy.
+namespace :test do
+  Rake::TestTask.new(:gem) do |t|
+    t.libs << "test" << "lib"
+    t.test_files = FileList["test/*_test.rb"]
+    t.warning = false
+  end
+
+  Rake::TestTask.new(:rails) do |t|
+    t.libs << "test" << "lib"
+    t.test_files = FileList["test/rails/*_test.rb"]
+    t.warning = false
+  end
+end
+
+desc "Run the gem suite and the Rails suite"
+task test: ["test:gem", "test:rails"]
+
+require "rubocop/rake_task"
+
+RuboCop::RakeTask.new
+
+task default: %i[test rubocop]

data/bin/console

@@ -0,0 +1,14 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "swoosh"
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# Drop a `binding.break` anywhere in lib/ and run this console to step through it.
+require "debug"
+
+require "irb"
+IRB.start(__FILE__)

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/certs/Swish_Merchant_TestCertificate_1234679304.csr

@@ -0,0 +1,27 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIIEpzCCAo8CAQAwTDELMAkGA1UEBhMCU0UxEzARBgNVBAgMClNvbWUtU3RhdGUx
+EzARBgNVBAoMCjU1NjA5OTc5ODIxEzARBgNVBAMMCjEyMzQ2NzkzMDQwggIiMA0G
+CSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDOic6GesD7N6i2T7STxWEHbiYjucuy
+22WQ3qF2GdB4VmwAUH/Bv7w1tA7FLqqVQSIzLfPAXUSWsGlbmyIu2bBXpSqrT7km
+ng/qjgTVRQnBxPoAD4xh5Y3vmYwMvTLGa3Cllq/4PIrlr486trHbWNxDs4sgp2KZ
+bDaSfGbTBD7jksKZvQZDVvxBKtp3v9Ul7A6PuftYGrAI2MDEeQiWboV++I5e6TtI
+r9aLBrmHZOP9q3X8vBIvJagp4Q73aBrT1oQG51Ob2Ppmtz8Kxwje1+YSmZ2YIl7h
+E3PJjCyxf8pR6VkdZfkkpDKvqn6QHLCGRG9qSIGRu1xlUmP8Q6FdnM+BPBlt3Rhl
+mdsf/+Z2HrqBjLG6fZxYqEr0Jg0xdgYNFjgp29FJwgLIrVD6RCWQd0oYlk/GtKG5
+OfERPY+5ur7RGG+YH6ren1WPkI0RItNLb9BF1KWBwPPyQmUBysMaR94sDYpDNrF+
+HF/F+sNXAowTYHir0159s988IkGl9SSU6Vy6CgmFG6sd7a8XA/XqrUfM5KwGIyOd
+PIm1lROGcL8LMhpXOcukMlOZuUCuXb0yMvKzEgaFANNO5CgPTdF1R4GXy09LjdlS
+9lJbaFGdkGAP4DbT8Kw6nOHtpga0NWtw2CuoQGAwl19oqr9Wqv9agZ40qjC/33sJ
+6YEg830kOV3AyQIDAQABoBYwFAYJKoZIhvcNAQkHMQcMBXN3aXNoMA0GCSqGSIb3
+DQEBCwUAA4ICAQC/q0jw4Wm5uKMhVdsvY1eCfRwUphaNXujhSYpLMsIW0jVvp1LW
+jNcWnc+mBY4U5hGLzRGz7SfMYGyqfshBObj0mZIknP7nw0tpMkRY9RzSvTgEhxIp
+AFv0WpwuwE+UDRugPRxfQe/9Zp2ijIQ0LE/KUKz8X6wyjS30quqBCTHOc7VecUln
+IdYO4RCcTqQSPFtOwgs+JQRHAY0JbUsOS+3JIvLi0dipYdRyPIDWdHjGVV/AMCcQ
+8ReHYQJqEG3iebHYTTDjXU97wh6OAk5vKZKzZk7p9AyR1kbT1hWyi1SzpMZc/ff9
+pAWBzWvwcAvmn0UJE7wAFKChVfQdwINrr0OUXn1pQ0oenqxbKWhsrHUDS88i9BBl
+sewPl3MyEax8Vh6BArSM6KFW4wKZShO2GOdMJAOi+LY/g/osiamlbv6FmIZAIGNe
+4/X2vKXnDbaNbEkmFaMkhz5jj9uN3BbYNHq9QgzGgkOx3SBJIm84TIBf4kHDoI/l
+10smpu2DLW2g5UvNZ7gfqJkXcbsq1VANq95u5evJykjAQyGL5pOr8oDPTAQEzw49
+t2cK2N5PyPU9lDXC5ZOek+oOa14FObqGe34W9a2umzZBHuRrYY2fSiOPEB0kmbHN
+GhF6ugSWfvQ5oxglIlhwOdpSn3Q1v3fXon50uOAKq2QbYprdeRyBdVAu5A==
+-----END CERTIFICATE REQUEST-----