xero-ruby 2.4.1 → 3.2.1

data/lib/xero-ruby/api_client.rb

@@ -1,9 +1,8 @@
 =begin
-#Accounting API
+#Xero Accounting API
 
 #No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
 
-The version of the OpenAPI document: 2.6.0
 Contact: api@xero.com
 Generated by: https://openapi-generator.tech
 OpenAPI Generator version: 4.3.1
@@ -16,25 +15,34 @@ require 'logger'
 require 'tempfile'
 require 'find'
 require 'faraday'
+require 'base64'
+require 'cgi'
+require 'json/jwt'
 
 module XeroRuby
   class ApiClient
+    include StringSerialization
+
     # The Configuration object holding settings to be used in the API client.
     attr_accessor :config
 
     # Defines the headers to be used in HTTP requests of all API calls by default.
     #
     # @return [Hash]
-    attr_accessor :default_headers
+    attr_accessor :default_headers, :grant_type
 
     # Initializes the ApiClient
     # @option config [Configuration] Configuration for initializing the object, default to Configuration.default
-    def initialize(config: Configuration.default, credentials: {})
+    def initialize(config: {}, credentials: {})
       @client_id = credentials[:client_id]
       @client_secret = credentials[:client_secret]
       @redirect_uri = credentials[:redirect_uri]
+      @grant_type = credentials[:grant_type] || 'authorization_code'
       @scopes = credentials[:scopes]
-      @config = config
+      @state = credentials[:state]
+      default_config = Configuration.default.clone
+      @config = append_to_default_config(default_config, config)
+
       @user_agent = "xero-ruby-#{VERSION}"
       @default_headers = {
         'Content-Type' => 'application/json',
@@ -42,9 +50,24 @@ module XeroRuby
       }
     end
 
+    def append_to_default_config(default_config, user_config)
+      config = default_config
+      user_config.each{|k,v| config.send("#{k}=", v)}
+      config
+    end
+
     def authorization_url
-      url = "#{@config.login_url}?response_type=code&client_id=#{@client_id}&redirect_uri=#{@redirect_uri}&scope=#{@scopes}"
-      return url
+      url = URI.parse @config.login_url
+      url.query = URI.encode_www_form(
+        {
+          response_type: 'code',
+          client_id: @client_id,
+          redirect_uri: @redirect_uri,
+          scope: @scopes,
+          state: @state
+        }.compact
+      )
+      url.to_s
     end
 
     def accounting_api
@@ -84,68 +107,148 @@ module XeroRuby
 
     # Token Helpers
     def token_set
-      XeroRuby.configure.token_set
+      @config.token_set
     end
 
     def access_token
-      XeroRuby.configure.access_token
+      @config.access_token
+    end
+
+    def id_token
+      @config.id_token
+    end
+
+    def decoded_access_token
+      decode_jwt(@config.access_token, false)
+    end
+
+    def decoded_id_token
+      decode_jwt(@config.id_token, false)
     end
 
     def set_token_set(token_set)
-      # helper to set the token_set on a client once the user has y
-      # has a valid token set ( access_token & refresh_token )
-      XeroRuby.configure.token_set = token_set
-      set_access_token(token_set['access_token'])
+      token_set = token_set.with_indifferent_access
+      @config.token_set = token_set
+
+      set_access_token(token_set[:access_token]) if token_set[:access_token]
+      set_id_token(token_set[:id_token]) if token_set[:id_token]
+      
+      return true
     end
 
     def set_access_token(access_token)
-      XeroRuby.configure.access_token = access_token
+      @config.access_token = access_token
+    end
+
+    def set_id_token(id_token)
+      @config.id_token = id_token
+    end
+
+    def get_client_credentials_token
+      data = {
+        grant_type: @grant_type
+      }
+      token_set = token_request(data, '/token')
+
+      return token_set
     end
 
     def get_token_set_from_callback(params)
       data = {
-        grant_type: 'authorization_code',
+        grant_type: @grant_type,
         code: params['code'],
         redirect_uri: @redirect_uri
       }
-      return token_request(data)
+      token_set = token_request(data, '/token')
+
+      validate_tokens(token_set)
+      validate_state(params)
+      return token_set
+    end
+
+    def validate_tokens(token_set)
+      token_set = token_set.with_indifferent_access
+      id_token = token_set[:id_token]
+      access_token = token_set[:access_token]
+      if id_token || access_token
+        decode_jwt(access_token) if access_token
+        decode_jwt(id_token) if id_token
+      end
+      return true
+    end
+
+    def validate_state(params)
+      if params[:state] != @state
+        raise StandardError.new "WARNING: @config.state: #{@state} and OAuth callback state: #{params['state']} do not match!"
+      end
+      return true
+    end
+
+    def decode_jwt(tkn, verify=true)
+      if verify == true
+        jwks_data = JSON.parse(Faraday.get('https://identity.xero.com/.well-known/openid-configuration/jwks').body)
+        jwk_set = JSON::JWK::Set.new(jwks_data)
+        JSON::JWT.decode(tkn, jwk_set)
+      else
+        JSON::JWT.decode(tkn, :skip_verification)
+      end
+    end
+
+    def token_expired?
+      token_expiry = Time.at(decoded_access_token['exp'])
+      token_expiry < Time.now
     end
 
     def refresh_token_set(token_set)
+      token_set = token_set.with_indifferent_access
       data = {
         grant_type: 'refresh_token',
-        refresh_token: token_set['refresh_token']
+        refresh_token: token_set[:refresh_token]
+      }
+      return token_request(data, '/token')
+    end
+
+    def revoke_token(token_set)
+      token_set = token_set.with_indifferent_access
+      data = {
+        token: token_set[:refresh_token]
       }
-      return token_request(data)
+      return token_request(data, '/revocation')
     end
 
-    def token_request(data)
-      response = Faraday.post(@config.token_url) do |req|
+    def token_request(data, path)
+      response = Faraday.post("#{@config.token_url}#{path}") do |req|
         req.headers['Authorization'] = "Basic " + Base64.strict_encode64("#{@client_id}:#{@client_secret}")
         req.headers['Content-Type'] = 'application/x-www-form-urlencoded'
         req.body = URI.encode_www_form(data)
       end
-      body = JSON.parse(response.body)
-      set_token_set(body)
+      return_error(response) unless response.success?
+      if !response.body.nil? && !response.body.empty?
+        body = JSON.parse(response.body)
+        set_token_set(body)
+      else
+        body = {}
+      end
       return body
     end
 
     # Connection heplers
     def connections
-      response = Faraday.get('https://api.xero.com/connections') do |req|
-        req.headers['Authorization'] = "Bearer #{access_token}" 
-        req.headers['Content-Type'] = 'application/json'
-      end
-      body = JSON.parse(response.body)
-      return body
+      @config.base_url = 'https://api.xero.com'
+      opts = { :header_params => {'Content-Type': 'application/json'}, :auth_names => ['OAuth2'] }
+      response = call_api(:GET, "/connections/", nil, opts)
+      response[0]
+    end
+
+    def last_connection
+      connections.sort { |a,b| DateTime.parse(a['updatedDateUtc']) <=> DateTime.parse(b['updatedDateUtc'])}.first
     end
 
     def disconnect(connection_id)
-      Faraday.delete("https://api.xero.com/connections/#{connection_id}") do |req|
-        req.headers['Authorization'] = "Bearer #{access_token}"
-        req.headers['Content-Type'] = 'application/json'
-      end
-      return connections
+      @config.base_url = 'https://api.xero.com'
+      opts = { :header_params => {'Content-Type': 'application/json'}, :auth_names => ['OAuth2'] }
+      call_api(:DELETE, "/connections/#{connection_id}", nil, opts)
+      connections
     end
 
     # Call an API with given options.
@@ -161,7 +264,26 @@ module XeroRuby
         :client_key => @config.ssl_client_key
       }
 
-      connection = Faraday.new(:url => config.base_url, :ssl => ssl_options) do |conn|
+      case api_client
+      when "AccountingApi"
+        method_base_url = @config.accounting_url
+      when "AssetApi"
+        method_base_url = @config.asset_url
+      when "FilesApi"
+       method_base_url = @config.files_url
+      when "PayrollAuApi"
+        method_base_url = @config.payroll_au_url
+      when "PayrollNzApi"
+        method_base_url = @config.payroll_nz_url
+      when "PayrollUkApi"
+        method_base_url = @config.payroll_uk_url
+      when "ProjectApi"
+        method_base_url = @config.project_url
+      else
+        method_base_url = @config.accounting_url
+      end
+
+      connection = Faraday.new(:url => method_base_url, :ssl => ssl_options) do |conn|
         conn.basic_auth(config.username, config.password)
         if opts[:header_params]["Content-Type"] == "multipart/form-data"
           conn.request :multipart
@@ -179,18 +301,7 @@ module XeroRuby
           @config.logger.debug "HTTP response body ~BEGIN~\n#{response.body}\n~END~\n"
         end
 
-        unless response.success?
-          if response.status == 0
-            # Errors from libcurl will be made visible here
-            fail ApiError.new(:code => 0,
-                              :message => response.return_message)
-          else
-            fail ApiError.new(:code => response.status,
-                              :response_headers => response.headers,
-                              :response_body => response.body),
-                 response.reason_phrase
-          end
-        end
+        return_error(response) unless response.success?
       rescue Faraday::TimeoutError
         fail ApiError.new('Connection timed out')
       end
@@ -198,12 +309,27 @@ module XeroRuby
       if opts[:return_type]
         prepare_file(response) if opts[:return_type] == 'File'
         data = deserialize(response, opts[:return_type], api_client)
+      elsif !response.body.empty?
+        data = JSON.parse(response.body)
       else
         data = nil
       end
       return data, response.status, response.headers
     end
 
+    def return_error(response)
+      if response.status == 0
+        # Errors from libcurl will be made visible here
+        fail ApiError.new(:code => 0,
+                          :message => response.return_message)
+      else
+        fail ApiError.new(:code => response.status,
+                          :response_headers => response.headers,
+                          :response_body => response.body),
+              response.reason_phrase
+      end
+    end
+
     # Builds the HTTP request
     #
     # @param [String] http_method HTTP method/verb (e.g. POST)
@@ -240,6 +366,8 @@ module XeroRuby
         end
       end
       request.headers = header_params
+      timeout = @config.timeout
+      request.options.timeout = timeout if timeout > 0
       request.body = req_body
       request.url url
       request.params = query_params
@@ -416,9 +544,13 @@ module XeroRuby
     end
 
     def build_request_url(path)
-      # Add leading and trailing slashes to path
-      path = "/#{path}".gsub(/\/+/, '/')
-      @config.base_url + path
+      if @config.base_url
+        # Add leading and trailing slashes to path
+        path = "/#{path}".gsub(/\/+/, '/')
+        @config.base_url + path
+      else
+        path
+      end
     end
 
     # Update hearder and query params based on authentication settings.
@@ -492,55 +624,6 @@ module XeroRuby
       end
     end
 
-    # START - Re-serializes snake_cased params to PascalCase required by XeroAPI
-    def to_camel_keys(value = self)
-      case value
-      when Array
-        value.map { |v| to_camel_keys(v) }
-      when Hash
-        Hash[value.map { |k, v| [camelize_key(k), to_camel_keys(v)] }]
-      else
-        value
-      end
-    end
-
-    def camelize_key(key, first_upper = true)
-      if key.is_a? Symbol
-        camelize(key.to_s, first_upper).to_sym
-      elsif key.is_a? String
-        camelize(key, first_upper)
-      else
-        key # can't camelize anything except strings and symbols
-      end
-    end
-
-    def camelize(word, first_upper = true)
-      if first_upper
-        str = word.to_s
-        str = gsubbed(str, /(?:^|_)([^_\s]+)/)
-        str = gsubbed(str, %r{/([^/]*)}, "::")
-        str
-      else
-        parts = word.split("_", 2)
-        parts[0] << camelize(parts[1]) if parts.size > 1
-        parts[0] || ""
-      end
-    end
-
-    def gsubbed(str, pattern, extra = "")
-      key_map_scronyms = {}
-      str = str.gsub(pattern) do
-        extra + (key_map_scronyms[Regexp.last_match(1)] || capitalize_first(Regexp.last_match(1)))
-      end
-      str
-    end
-
-    def capitalize_first(word)
-      split = word.split('')
-      "#{split[0].capitalize}#{split[1..-1].join}"
-    end
-    # END - Re-serializes snake_cased params to PascalCase required by XeroAPI
-
     # Build parameter value according to the given collection format.
     # @param [String] collection_format one of :csv, :ssv, :tsv, :pipes and :multi
     def build_collection_param(param, collection_format)
@@ -562,36 +645,7 @@ module XeroRuby
     end
 
     def parameterize_where(where_opts)
-      where_opts.map do |k,v|
-        case v
-        when Array
-          operator = v.first
-          query = v.last
-          if query.is_a?(Date)
-            "#{camelize_key(k)} #{operator} DateTime(#{query.strftime("%Y,%m,%d")})"
-          elsif [Float, Integer].member?(query.class)
-            %{#{camelize_key(k)} #{operator} #{query}}
-          elsif [true, false].member?(query)
-            %{#{camelize_key(k)} #{operator} #{query}}
-          else
-            if k == :contact_id
-              %{Contact.ContactID #{operator} guid("#{query}")}
-            elsif k == :contact_number
-              %{Contact.ContactNumber #{operator} "#{query}"}
-            else
-              %{#{camelize_key(k)} #{operator} "#{query}"}
-            end
-          end
-        when Range
-          if v.first.is_a?(DateTime) || v.first.is_a?(Date) || v.first.is_a?(Time)
-            "#{camelize_key(k)} >= DateTime(#{v.first.strftime("%Y,%m,%d")}) AND #{camelize_key(k)} <= DateTime(#{v.last.strftime("%Y,%m,%d")})" 
-          else
-            "#{camelize_key(k)} >= #{v.first} AND #{camelize_key(k)} <= #{v.last}"
-          end
-        else
-          %{#{camelize_key(k)} #{v}}
-        end
-      end.join(' AND ')
+      Where.new(where_opts).to_param
     end
   end
 end

data/lib/xero-ruby/api_error.rb

@@ -1,9 +1,8 @@
 =begin
-#Accounting API
+#Xero Accounting API
 
 #No description provided (generated by Openapi Generator https://github.com/openapitools/openapi-generator)
 
-The version of the OpenAPI document: 2.6.0
 Contact: api@xero.com
 Generated by: https://openapi-generator.tech
 OpenAPI Generator version: 4.3.1
@@ -21,8 +20,8 @@ module XeroRuby
     #   ApiError.new(:code => 404, :message => "Not Found")
     def initialize(arg = nil)
       if arg.is_a? Hash
-        if arg.key?(:message) || arg.key?('message')
-          super(arg[:message] || arg['message'])
+        if arg.key?(:message) || arg.key?('message') || arg.key?(:Message) || arg.key?('Message')
+          super(arg[:message] || arg['message'] || arg.key?(:Message) || arg.key?('Message'))
         else
           super arg
         end
@@ -31,6 +30,7 @@ module XeroRuby
           instance_variable_set "@#{k}", v
         end
       else
+        @message = arg
         super arg
       end
     end