tcat 0.3.5 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f40a1e40fc125273e5928860f2afa18f22ad88a22a2b02d63f441b9197b0153d
-  data.tar.gz: 6e9d0c2f7bf65f9cc81a9764761092b76dce77faedc57836f3d9f4866b327b00
+  metadata.gz: 588b8dd9b49b05b35d28384cb85c3bc4e87b38852a04c3da8ce5b35ce59739bc
+  data.tar.gz: cd704ade306674058f6fd4c8de240d7570f54dba29ad7e1dfe30afb3b0119d40
 SHA512:
-  metadata.gz: c402bffc3cc32eb481d930958107d08e278b362390cc4d6f62bbe9b8357ebc5501e74dfce68ca1326040a32ef9bc51274b8853c9b57e6cd7b0b98ca19c52cbf4
-  data.tar.gz: 83fb6ec4ec1e9731fbd7d8fc0288221676afd14904101c3063304ae687cb54cc83112a9baf28eb616251d3618452976e0e7bc6ba284ef49d3a49d20b19a4b6e9
+  metadata.gz: 8617ad7c2b5bec16c3d7c94fd39175b45417a869feb6a74f0a1fab3590860c44d4a7e61a49b908982ae65f4b856504de3e61c9f96ba082c0ef0736cf936a59ca
+  data.tar.gz: '059ea7b7711cae4a2d146a23470016048edfb6e5c5d8951822ba17be8bd792355b1f9d29a73cc1b40e604884b332ac1548e453fb66f3cc22cff6c43198c510c7'

data/README.md

@@ -64,11 +64,16 @@ Tcat.configure do |config|
   config.secret_key = 'your_secret_key'
 end
 
-# Create a query instance
-query = Tcat::Query.new('your_tracking_number')
+# Two equivalent shapes — pick whichever fits your code:
 
-# Get shipment status
+# A) tracking number bound at construction (one-shot)
+query = Tcat::Query.new('your_tracking_number')
 status = query.status_code
+
+# B) tracking number per call (reuse one client for many lookups,
+#    matches Tcat::WorkerClient's shape)
+query = Tcat::Query.new
+status = query.status_code('your_tracking_number')
 # Returns one of the following:
 # :done           - Successfully delivered
 # :delivering     - Out for delivery
@@ -265,6 +270,19 @@ This gem is available as open source under the terms of the [MIT License](https:
 
 ## Changelog
 
+### 0.4.1
+
+- Security hardening: `Tcat::Query` now uses `SecureRandom` (CSPRNG) instead of `rand` for the per-request freshness component embedded in the encrypted `secret` payload
+- Encryption: `Tcat::EncryptionService` explicitly disables OpenSSL's built-in cipher padding so the manually applied PKCS#7 padding cannot be double-applied if the cipher pipeline ever changes
+- `Tcat::WorkerClient` warns when `worker_url` uses `http://` against a non-localhost host so a misconfigured deployment cannot silently leak the Bearer token over plaintext
+- Worker: added `[observability.logs]` (`enabled = false`, `invocation_logs = true`) to `wrangler.toml`
+
+### 0.4.0
+
+- `Tcat::Query#status_code`, `#history`, `#latest_status` now accept an optional tracking-number argument, mirroring `Tcat::WorkerClient`'s shape
+- `Tcat::Query.new` may be called without a tracking number for stateless reuse: `Tcat::Query.new.status_code('1234567890')`
+- Existing one-shot construction (`Tcat::Query.new(tn).status_code`) is still supported
+
 ### 0.3.5
 
 - Added optional `worker_url` and `worker_token` to `Tcat.configure`; explicit `Tcat::WorkerClient.new(url, token:)` arguments still take precedence

data/lib/tcat/encryption_service.rb

@@ -34,6 +34,9 @@ module Tcat
     def setup_cipher
       cipher = OpenSSL::Cipher.new(CIPHER_ALGORITHM)
       cipher.encrypt
+      # PKCS#7 padding is applied manually in #pad_message; turn off OpenSSL's
+      # built-in padding so a future cipher.final call cannot double-pad.
+      cipher.padding = 0
       cipher.key = @secret_key
       cipher
     end

data/lib/tcat/query.rb

@@ -2,6 +2,7 @@
 
 require 'net/http'
 require 'base64'
+require 'securerandom'
 require 'ox'
 require_relative 'http_client'
 require_relative 'encryption_service'
@@ -11,7 +12,11 @@ module Tcat
   class Query
     DeliveryItem = Struct.new(:status, :status_code, :time, :office, :last_update, keyword_init: true)
 
-    def initialize(tracking_number)
+    # @param tracking_number [String, nil] Default tracking number used when
+    #   the per-call methods are invoked without an explicit argument. Pass nil
+    #   to construct a stateless client and supply the tracking number on each
+    #   call (matching Tcat::WorkerClient's shape).
+    def initialize(tracking_number = nil)
       @secret_string = Tcat.configuration.secret_string
       @secret_key = Tcat.configuration.secret_key
       validate_secrets!
@@ -25,22 +30,27 @@ module Tcat
     end
 
     # Get current delivery status code
+    # @param tracking_number [String, nil] Overrides the constructor value.
     # @return [Symbol] Status code (:done, :delivering, :collected, :in_transit, :unknown)
-    def status_code
-      response_body = @http_client.post(data)
+    def status_code(tracking_number = nil)
+      tn = resolve_tracking_number(tracking_number)
+      response_body = @http_client.post(data(tn))
       parse_status_code(response_body) if response_body
-    rescue HttpClient::RequestError => e
+    rescue HttpClient::RequestError
       # Log error or handle it appropriately
       nil
     end
 
     # Get complete delivery history
+    # @param tracking_number [String, nil] Overrides the constructor value.
     # @return [Array<DeliveryItem>] Array of delivery status items, sorted by time (newest first)
-    def history
-      response_body = @http_client.post(data)
+    def history(tracking_number = nil)
+      tn = resolve_tracking_number(tracking_number)
+      response_body = @http_client.post(data(tn))
       if response_body
         result = Ox.load(response_body, mode: :hash, with_cdata: true)
         return [] if result.dig(:Result, :Status) != '0'
+
         extract_delivery_history(result)
       end
     rescue StandardError => e
@@ -49,10 +59,12 @@ module Tcat
     end
 
     # Get latest delivery status with details
+    # @param tracking_number [String, nil] Overrides the constructor value.
     # @return [DeliveryItem, nil] Latest delivery status or nil if no history
-    def latest_status
-      items = history
+    def latest_status(tracking_number = nil)
+      items = history(tracking_number)
       return nil if items.empty?
+
       items.first
     end
 
@@ -75,9 +87,16 @@ module Tcat
       warn e.backtrace.first(5).join("\n") if $DEBUG
     end
 
-    def data
+    def resolve_tracking_number(arg)
+      tn = arg || @tracking_number
+      raise ArgumentError, 'tracking number required' if tn.nil? || tn.to_s.empty?
+
+      tn
+    end
+
+    def data(tracking_number)
       {
-        ConsignmentNo: @tracking_number,
+        ConsignmentNo: tracking_number,
         f: 5,
         isForeign: 'N',
         secret: generate_secret,
@@ -90,7 +109,8 @@ module Tcat
     end
 
     def random
-      rand(10_000..99_999).to_s
+      # CSPRNG so the per-request freshness component is unpredictable.
+      (SecureRandom.random_number(90_000) + 10_000).to_s
     end
 
     def source_string

data/lib/tcat/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Tcat
-  VERSION = '0.3.5'
+  VERSION = '0.4.1'
 end

data/lib/tcat/worker_client.rb

@@ -99,15 +99,29 @@ module Tcat
 
     private
 
+    LOCAL_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
+    private_constant :LOCAL_HOSTS
+
     def validate_url!
       uri = URI.parse(@worker_url)
       unless %w[http https].include?(uri.scheme)
         raise ArgumentError, 'Invalid Worker URL: must be http or https'
       end
+
+      warn_if_insecure(uri)
     rescue URI::InvalidURIError => e
       raise ArgumentError, "Invalid Worker URL: #{e.message}"
     end
 
+    def warn_if_insecure(uri)
+      return if uri.scheme == 'https'
+      return if LOCAL_HOSTS.include?(uri.host)
+
+      warn '[Tcat::WorkerClient] WARNING: worker_url uses http://; ' \
+           'requests and any Authorization token will be sent in plaintext. ' \
+           'Use https:// in production.'
+    end
+
     def make_request(uri)
       response = setup_http(uri).request(build_request(uri))
       raise APIError, "HTTP #{response.code}: #{response.message}" unless response.is_a?(Net::HTTPSuccess)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: tcat
 version: !ruby/object:Gem::Version
-  version: 0.3.5
+  version: 0.4.1
 platform: ruby
 authors:
 - Zac