bump Faraday, add Appraisals

Change-Id: Ice2d4c9978095fbbe163af41b5b2a6339579dd39
Reviewed-on: https://gerrit.instructure.com/c/footrest/+/414729
Reviewed-by: Caleb Siebach <caleb.siebach@instructure.com>
Tested-by: Ethan Knapp <eknapp@instructure.com>
QA-Review: Ethan Knapp <eknapp@instructure.com>
Product-Review: Ethan Knapp <eknapp@instructure.com>

Author: Matchlighter

.github/workflows/ci.yml

@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+
+jobs:
+  test:
+    name: rspec (ruby ${{ matrix.ruby }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        ruby: ["2.7", "3.0", "3.2", "3.3"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Ruby ${{ matrix.ruby }}
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      # Generate the per-Faraday gemfiles from Appraisals (not committed),
+      # install each, then run the suite across all of them.
+      - name: Install appraisal gemfiles
+        run: bundle exec appraisal install
+
+      - name: Run specs across Faraday versions
+        run: bundle exec appraisal rspec

Appraisals

@@ -0,0 +1,11 @@
+# Test matrix for the supported Faraday major versions.
+# Regenerate the gemfiles after editing: bundle exec appraisal generate
+# Run the suite across versions:        bundle exec appraisal rspec
+
+appraise "faraday-1" do
+  gem "faraday", "~> 1.10"
+end
+
+appraise "faraday-2" do
+  gem "faraday", "~> 2.0"
+end

footrest.gemspec

@@ -25,9 +25,11 @@ Gem::Specification.new do |gem|
   gem.add_development_dependency "webmock"
   gem.add_development_dependency "pry"
   gem.add_development_dependency "byebug"
-  gem.add_development_dependency "faraday", ">1.0.0", "< 2"
+  gem.add_development_dependency "appraisal", "~> 2.5"
+  gem.add_development_dependency "faraday", ">= 1.0", "< 3"
 
-  gem.add_dependency "faraday", ">= 0.9.0", "< 2"
+  gem.add_dependency "faraday", ">= 1.0", "< 3"
+  gem.add_dependency "faraday-multipart", "~> 1.0"
   gem.add_dependency "activesupport", ">= 3.0.0"
 
   # Parses Link headers formatted according to RFC 5988 draft spec

lib/footrest.rb

@@ -4,18 +4,3 @@
 
 module Footrest
 end
-
-module Faraday
-  class Response::Logger < Response::Middleware
-    private
-
-    SENSITIVE_HEADERS = %w{Authorization}
-    def dump_headers(headers)
-      return "empty headers" unless headers
-      headers.map { |k, v|
-        message = "#{k}: "
-        message << (SENSITIVE_HEADERS.include?(k) ? "[filtered]" : v.inspect)
-      }.join("\n")
-    end
-  end
-end

lib/footrest/connection.rb

@@ -1,4 +1,5 @@
 require 'faraday'
+require 'faraday/multipart'
 require 'footrest/http_error'
 require 'footrest/pagination'
 require 'footrest/follow_redirects'
@@ -14,10 +15,14 @@ def set_connection(config)
       @connection = Faraday.new(url: config[:prefix]) do |faraday|
         faraday.request                     :multipart
         faraday.request                     :url_encoded
-        if config[:logger] == true
-          faraday.response :logger
-        elsif config[:logger]
-          faraday.use Faraday::Response::Logger, config[:logger]
+        if config[:logger]
+          logger = config[:logger] == true ? nil : config[:logger]
+          faraday.response :logger, logger do |formatter|
+            # Keep bearer tokens out of the logs. Faraday logs request headers
+            # by default, and dump_headers lives on the formatter in both 1.x
+            # and 2.x, so filter here rather than monkeypatching the logger.
+            formatter.filter(/(Authorization:\s*).*/i, '\1[FILTERED]')
+          end
         end
         faraday.use                         Footrest::FollowRedirects
         faraday.use                         Footrest::ParseJson, :content_type => /\bjson$/

lib/footrest/http_error.rb

@@ -70,7 +70,7 @@ def truncated_authorization_value
     end
   end
 
-  class RaiseFootrestErrors < Faraday::Response::Middleware
+  class RaiseFootrestErrors < Faraday::Middleware
     ERROR_MAP = {
       400 => Footrest::HttpError::BadRequest,
       401 => Footrest::HttpError::Unauthorized,

lib/footrest/pagination.rb

@@ -1,7 +1,10 @@
+require 'faraday'
 require 'link_header'
 
 module Footrest
-  class Pagination < Faraday::Response::Middleware
+  # Faraday 2.x removed Faraday::Response::Middleware; the on_complete hook now
+  # lives on the unified Faraday::Middleware base (also present in 1.x).
+  class Pagination < Faraday::Middleware
     Links = Struct.new(:first, :prev, :current, :next, :last) do
       alias_method :previous, :prev
       alias_method :prevous=, :prev=

lib/footrest/parse_json.rb

@@ -1,12 +1,10 @@
 require 'footrest/response_middleware'
 
+require 'json'
+
 module Footrest
   # Public: Parse response bodies as JSON.
   class ParseJson < ResponseMiddleware
-    dependency do
-      require 'json' unless defined?(::JSON)
-    end
-
     define_parser do |body|
       ::JSON.parse body unless body.strip.empty?
     end

lib/footrest/version.rb

@@ -1,3 +1,3 @@
 module Footrest
-  VERSION = '0.5.8' unless defined?(Footrest::VERSION)
+  VERSION = '0.6.0' unless defined?(Footrest::VERSION)
 end

spec/footrest/logger_spec.rb

@@ -0,0 +1,26 @@
+require_relative '../spec_helper'
+require 'logger'
+require 'stringio'
+
+describe "Footrest request logging" do
+  let(:io) { StringIO.new }
+  let(:client) do
+    Footrest::Client.new(
+      prefix: "http://domain.test",
+      token: "s3cr3t~deadbeef",
+      logger: ::Logger.new(io)
+    )
+  end
+
+  before do
+    stub_request(:get, "http://domain.test/page").
+      to_return(status: 200, body: "{}", headers: { content_type: "application/json" })
+  end
+
+  it "redacts the Authorization bearer token from the logs" do
+    client.get("/page")
+
+    expect(io.string).to include("Authorization: [FILTERED]")
+    expect(io.string).not_to include("s3cr3t~deadbeef")
+  end
+end