api-sdk-rb 1.11.66 → 1.11.111

data/spec/api/partners_api_spec.rb

@@ -32,9 +32,24 @@ describe 'PartnersApi' do
     end
   end
 
+  # unit tests for confirm_partner_adapter_connection_0
+  # Confirm a partner's adapter address with the code that was emailed to it
+  # Some credentials are an email address Widgetic sends a widget's messages to (`confirmation: email_code` in `getPartnerAdapterConnections`). Saving one with `setPartnerAdapterConnection` emails a six-digit code to it; this gives the code back. Only then is the address used: until it is confirmed, the widgets of the partner's customers that need it are not charged and their visitors are told the feature is unavailable.  The code works for 30 minutes and for five wrong tries. After that, save the address again and a new code is emailed (not sooner than a minute after the last one). A code that is not made of digits is refused without counting as a try.  Confirming an address that is already confirmed answers 200 with the same state, so a retry of a request that went through is harmless. Saving a different address, or the same one before it was confirmed, starts again.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. 
+  # @param partner_id The partner that keeps the address
+  # @param adapter_id The adapter the address is for
+  # @param credential_key The credential's name within the adapter
+  # @param confirm_adapter_connection_request 
+  # @param [Hash] opts the optional parameters
+  # @return [SetUserAdapterConnection200Response]
+  describe 'confirm_partner_adapter_connection_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for create_partner_extra_credits_invoice_0
   # Buy extra credits for a partner
-  # Asks Widgetic for an invoice for extra credits, on top of the credits of the contract. Name the dollars; the invoice is for the most whole credits they buy at the **list price** of a credit (the price a contract may lower belongs to the contract), so it is never for more than you asked: 12.34 buys 123 credits and the invoice says 12.30. The smallest purchase is 10 dollars and one request buys at most 100000 (ask Widgetic for an invoice for more).  Pay the invoice with the link in the answer. When it is paid the credits are added **once, for good**, to the account of the person who administers the partner, which is the account everything the partner builds is charged to (`getPartnerCreditBalance` shows it). Extra credits **do not expire**, unlike the credits of a contract period, which end with it. Nothing is added before the invoice is paid, and an unpaid invoice for extra credits never stops the partner: only an unpaid invoice of the contract does (`payment_arrears`).  Allowed whatever the partner's standing: a partner that has run out of credits, or is stopped for an unpaid contract invoice, can still buy. No contract is needed.  An `Idempotency-Key` is required, and it is what makes a retry safe: the same key with the same body returns the invoice already issued, the same key with a different body is refused with 422, and a duplicate that arrives while the first is still running is refused with 409. Use one key per purchase you mean to make, and a new key for the next one. At most 10 requests an hour.  Who may ask: the person who administers the partner, or a Widgetic administrator. A key limited to scopes needs `billing:write`. 
+  # Asks Widgetic for an invoice for extra credits, on top of the credits of the contract. Name the dollars; the invoice is for the most whole credits they buy at the **list price** of a credit (the price a contract may lower belongs to the contract), so it is never for more than you asked: 12.34 buys 123 credits and the invoice says 12.30. The smallest purchase is 10 dollars and one request buys at most 100000 (ask Widgetic for an invoice for more).  Pay the invoice with the link in the answer. When it is paid the credits are added **once, for good**, to the account of the person who administers the partner, which is the account everything the partner builds is charged to (`getPartnerCreditBalance` shows it). Extra credits **do not expire**, unlike the credits of a contract period, which end with it. Nothing is added before the invoice is paid, and an unpaid invoice for extra credits never stops the partner: only an unpaid invoice of the contract does (`payment_arrears`).  Available only to partners that have an active paid contract in force with Widgetic (`NO_PAID_CONTRACT` when none is in force) and no overdue contract invoice (`CONTRACT_INVOICE_OVERDUE` while a contract invoice is past its due day). A partner that has run out of credits during its period can buy more at the list price.  An `Idempotency-Key` is required, and it is what makes a retry safe: the same key with the same body returns the invoice already issued, the same key with a different body is refused with 422, and a duplicate that arrives while the first is still running is refused with 409. Use one key per purchase you mean to make, and a new key for the next one. At most 10 requests an hour.  Who may ask: the person who administers the partner, or a Widgetic administrator. A key limited to scopes needs `billing:write`. 
   # @param partner_id Partner ID
   # @param idempotency_key A key of your own for this purchase, so that a retry cannot make a second invoice
   # @param request_extra_credits 
@@ -297,6 +312,18 @@ describe 'PartnersApi' do
     end
   end
 
+  # unit tests for list_partner_workflow_presets_0
+  # List the workflows a partner offers as places to start
+  # The partner's starting points, ordered by `position` and then by `key`: the published workflows it offers its managed users when they make a new workflow. Each says whether people can start from it now and, when they cannot, why. The list is the same for every managed user, and a managed user is shown only what is available.  A starting point is one of the partner account's own published workflows, built from compositions the account made for itself (not for a customer or a team) and from widgets the partner already offers as presets (`setPartnerPreset`), and it uses at most 10 widgets. A partner offers up to 50.  The caller must be the person who administers the partner (an API key of that account works), or a Widgetic administrator. 
+  # @param partner_id The partner whose starting points to list
+  # @param [Hash] opts the optional parameters
+  # @return [ListPartnerWorkflowPresets200Response]
+  describe 'list_partner_workflow_presets_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for remove_partner_adapter_connection_0
   # Remove an adapter key from a partner
   # Removes a key an adapter was given. The adapter stops working for the widgets of the partner's customers that need it: their visitors are told the feature is unavailable. Nothing else of the widgets changes, and connecting a key again brings them back.  Removing a key that is not connected answers 200 with `removed: false`: the state asked for is the state it is in. A key of an adapter that has since been retired from the catalog can still be removed.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. 
@@ -348,6 +375,19 @@ describe 'PartnersApi' do
     end
   end
 
+  # unit tests for remove_partner_workflow_preset_0
+  # Stop offering a workflow as a place to start
+  # Removes the starting point under `key`. The workflow itself is not touched, and neither are the workflows people already started from it.  Removing a starting point the partner does not offer is not an error: the answer is `removed: false`. 
+  # @param partner_id The partner whose starting point to remove
+  # @param key The key of the starting point to remove
+  # @param [Hash] opts the optional parameters
+  # @return [RemovePartnerWorkflowPreset200Response]
+  describe 'remove_partner_workflow_preset_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for replay_partner_notification_delivery_0
   # Send a webhook delivery again
   # Sends one earlier **webhook** delivery again to your **current** webhook address, with the same event `id` (`webhook-id`) as the original notification so a receiver that remembers ids can ignore a duplicate, and a new `createdAt` and signature made with your current secret. The attempt is recorded in the delivery log as a new row that points at the delivery you replayed.  Set a webhook address (and secret) under notification settings before you replay. Changing the settings needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. 
@@ -404,7 +444,7 @@ describe 'PartnersApi' do
 
   # unit tests for set_partner_adapter_connection_0
   # Connect an adapter key to a partner
-  # Gives an adapter the key it needs to act through a service the partner has an account with, for the widgets of the customers the partner manages. Take the `adapterId` and `credentialKey` from `getPartnerAdapterConnections`. Saving a key that is already connected replaces it.  **What Widgetic does with it.** The key is stored encrypted, bound to this partner, this adapter and this credential, so that a stored value cannot be moved to another. It is never returned, never logged and never shown to a visitor of a widget or to your customers. A server of Widgetic opens it for the one call a widget makes through the adapter, uses it to call the provider on the partner's behalf, and discards it. To cut that off, remove the key here, or revoke it with the provider.  **What is checked.** That the adapter exists and takes this credential, that a partner may keep it (some are for an owner only) and that the text is one line of at most 2048 characters. Whether the provider accepts the key is not checked here: it shows the first time a widget uses it.  A widget whose adapter has no key connected is not charged and does not run that adapter: its visitors are told the feature is unavailable, and the partner is told once a day what to connect.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. A retry is harmless: saving the same key twice only refreshes when it was set. 
+  # Gives an adapter the key it needs to act through a service the partner has an account with, for the widgets of the customers the partner manages. Take the `adapterId` and `credentialKey` from `getPartnerAdapterConnections`. Saving a key that is already connected replaces it.  **What Widgetic does with it.** The key is stored encrypted, bound to this partner, this adapter and this credential, so that a stored value cannot be moved to another. It is never returned, never logged and never shown to a visitor of a widget or to your customers. A server of Widgetic opens it for the one call a widget makes through the adapter, uses it to call the provider on the partner's behalf, and discards it. To cut that off, remove the key here, or revoke it with the provider.  **What is checked.** That the adapter exists and takes this credential, that a partner may keep it (some are for an owner only) and that the text is one line of at most 2048 characters. Whether the provider accepts the key is not checked here: it shows the first time a widget uses it.  **An address that has to be confirmed.** Some credentials are not a key but the email address Widgetic sends a widget's messages to (`confirmation: email_code` in `getPartnerAdapterConnections`). Saving one checks that it is one email address and emails a six-digit code to it; the answer says `awaitingConfirmation: true`, and nothing is sent to the address until the code is given back with `confirmPartnerAdapterConnection`. Saving the same address again before it is confirmed emails a new code (not sooner than a minute after the last); saving the address that is already confirmed changes nothing. If the code cannot be emailed, nothing is saved.  A widget whose adapter has no key connected, or whose address is not confirmed yet, is not charged and does not run that adapter: its visitors are told the feature is unavailable, and the partner is told once a day what to do.  This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. A retry is harmless: saving the same key twice only refreshes when it was set. 
   # @param partner_id The partner that keeps the key
   # @param adapter_id The adapter the key is for
   # @param credential_key The key's name within the adapter
@@ -470,6 +510,20 @@ describe 'PartnersApi' do
     end
   end
 
+  # unit tests for set_partner_workflow_preset_0
+  # Offer a workflow as a place to start, or replace what a key offers
+  # Offers one of the partner account's own published workflows to its managed users under `key`. If the partner already offers something under that key it is replaced, so sending the same request twice is safe. Saving replaces the whole starting point: a `title`, `description` or `position` you leave out goes back to its default.  Keys are 1 to 64 characters: lowercase letters, digits, hyphens and underscores, the first a letter or a digit.  A workflow is offered once. What people get is the workflow's live version as it is when they start, so publishing the workflow changes what new starts get; workflows people already started are never touched. The offer is refused, and `error.details.reason` says why, when the workflow:  - is not the partner account's own (a workflow of a team or of a customer, or of somebody else), or does not exist:   404, the same for both; - is archived (409 `workflow_archived`), or was never published (409 `workflow_not_published`); - shows no composition (422 `workflow_empty`), or a block shows a composition made for a customer or a team   (422 `composition_not_own`); - chains more than 10 widgets (422 `too_many_widgets`), or a widget that the partner does not offer as a preset   (422 `widget_not_preset`; `error.details.widgets` lists them, each with its `id` and `name`, so they can be offered   first with `setPartnerPreset`); - is already offered under another key (409 `workflow_already_offered`; `error.details.key` says which), or the   partner already offers 50 (409 `too_many_presets`).  The caller must be the person who administers the partner (an API key of that account works), or a Widgetic administrator, who offers the partner's workflow on its behalf. 
+  # @param partner_id The partner whose starting point to set
+  # @param key The name your code and the picker use for the starting point
+  # @param offer_workflow_preset_request 
+  # @param [Hash] opts the optional parameters
+  # @return [SetPartnerWorkflowPreset200Response]
+  describe 'set_partner_workflow_preset_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for update_partner_entry_context_signing_0
   # Require a signed context, or stop requiring it
   # Chooses what the gateway does with an entry whose `context` carries no valid signature.  With `required: false` (the default) an entry that carries a signature is checked and refused when the signature is wrong or out of date, and an entry that carries none is accepted, as it always was. With `required: true` an entry without a valid signature is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`: use it once every page of yours that embeds a composition signs its context.  Signatures cannot be required before you have made a secret (`rotatePartnerEntryContextSecret`): the answer is 409, so that you cannot lock your own compositions out of taking entries. The change reaches every part of the gateway within a minute.  Saving the same choice twice leaves the same state, so a retry is harmless and `Idempotency-Key` is optional. This needs an API key with full access. The caller must be the person who administers the partner, or a Widgetic administrator. 

data/spec/api/public_embed_api_spec.rb

@@ -34,7 +34,7 @@ describe 'PublicEmbedApi' do
 
   # unit tests for call_public_composition_adapter_0
   # Call a gateway operation of an adapter a published widget uses
-  # The door a widget's adapter module calls, from the visitor's browser, for the operations that cannot run in the browser: anything with a secret, a charge in credits or the owner's storage behind it. A widget that uses such an adapter is handed the address of this route as `adapters.url` in its `widgetic:host` message (see the host bridge contract) and calls `{adapters.url}/{adapterId}/{operation}`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/{adapterId}/{operation}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **What it serves.** Only an adapter, and a version of it, that the widget's LIVE manifest (what the version that is published uses) lists, and only an operation that runs on the gateway. Anything else is one 404 `ADAPTER_NOT_AVAILABLE`, whatever the reason, so the route is no way to ask what a widget contains. An adapter an administrator stopped offering to NEW widgets keeps serving the widgets that already use it. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner's own platform). Page script cannot forge it. A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. When the partner of the owner signs the host context, a context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`. **Cost and retries.** An operation priced in credits is charged to the owner of the widget (for a customer a partner manages, to the partner's administrator, within the monthly credits set for that customer), once for each `requestId`, before it runs, and given back if it does not answer. A `requestId` that was charged and not given back is 409 `REQUEST_ALREADY_USED` and the operation is NOT run a second time; one whose charge was given back may be tried again with the same `requestId`. A visitor never sees an owner's balance: a feature that cannot be used because its owner has no credits left, because the customer's monthly credits are spent, or because an administrator stopped the adapter, is the same 503 `ADAPTER_UNAVAILABLE` as every other \"not right now\". The owner is told through a notice. **Limits.** In front of everything, 120 calls a minute for each visitor address and composition and 600 a minute for a composition (429 `RATE_LIMITED`). Then, for each operation of a widget, a rate for each visitor address a minute and a cap for the widget a day: 30 and 5000 for an operation that is free, 10 and 500 for one that costs credits, unless the adapter says otherwise (never above 120 and 100000). A visitor over the rate is 429 `RATE_LIMITED`; a widget over its cap is 429 `WIDGET_LIMIT_REACHED`. Both carry a `Retry-After` header. The body is at most 64 KiB (413 `PAYLOAD_TOO_LARGE`) and JSON (415 `UNSUPPORTED_MEDIA_TYPE`); an operation has 30 seconds to answer (504 `ADAPTER_TIMEOUT`, and the charge is given back).
+  # The door a widget's adapter module calls, from the visitor's browser, for the operations that cannot run in the browser: anything with a secret, a charge in credits or the owner's storage behind it. A widget that uses such an adapter is handed the address of this route as `adapters.url` in its `widgetic:host` message (see the host bridge contract) and calls `{adapters.url}/{adapterId}/{operation}`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/{adapterId}/{operation}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **What it serves.** Only an adapter, and a version of it, that the widget's LIVE manifest (what the version that is published uses) lists, and only an operation that runs on the gateway. Anything else is one 404 `ADAPTER_NOT_AVAILABLE`, whatever the reason, so the route is no way to ask what a widget contains. An adapter an administrator stopped offering to NEW widgets keeps serving the widgets that already use it. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or any website when the owner has not restricted the allowed websites (when the owner has, one of the websites the owner listed, Widgetic's own sites, the visitor's own machine or the owner's own platform). Page script cannot forge it. A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. When the partner of the owner signs the host context, a context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`. **Cost and retries.** An operation priced in credits is charged to the owner of the widget (for a customer a partner manages, to the partner's administrator, within the monthly credits set for that customer), once for each `requestId`, before it runs, and given back if it does not answer. A `requestId` that was charged and not given back is 409 `REQUEST_ALREADY_USED` and the operation is NOT run a second time; one whose charge was given back may be tried again with the same `requestId`. A visitor never sees an owner's balance: a feature that cannot be used because its owner has no credits left, because the customer's monthly credits are spent, or because an administrator stopped the adapter, is the same 503 `ADAPTER_UNAVAILABLE` as every other \"not right now\". The owner is told through a notice. **Limits.** In front of everything, 120 calls a minute for each visitor address and composition and 600 a minute for a composition (429 `RATE_LIMITED`). Then, for each operation of a widget, a rate for each visitor address a minute and a cap for the widget a day: 30 and 5000 for an operation that is free, 10 and 500 for one that costs credits, unless the adapter says otherwise (never above 120 and 100000). A visitor over the rate is 429 `RATE_LIMITED`; a widget over its cap is 429 `WIDGET_LIMIT_REACHED`. Both carry a `Retry-After` header. The body is at most 64 KiB (413 `PAYLOAD_TOO_LARGE`) and JSON (415 `UNSUPPORTED_MEDIA_TYPE`); an operation has 30 seconds to answer (504 `ADAPTER_TIMEOUT`, and the charge is given back).
   # @param composition_id 
   # @param adapter_id The id of the adapter, the name its module is known by, for example `upload`.
   # @param operation The name of one operation of the adapter, as its documentation gives it.
@@ -49,12 +49,13 @@ describe 'PublicEmbedApi' do
 
   # unit tests for create_public_composition_entry_0
   # Append a visitor entry through the gateway
-  # Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). When the request comes from the shared artifact origin, it must also carry the per-composition write token (`X-Widgetic-Write-Token` header or `writeToken` body field, handed to the widget in `widgetic:host` as `entries.writeToken` and returned as `entryWriteToken` on `getPublicCompositionEmbed`). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
+  # Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header: the artifact iframe origin, or any website when the owner has not restricted the allowed websites (when the owner has, one of the websites the owner listed, Widgetic's own sites, the visitor's own machine or the owner's own platform). When the request comes from the shared artifact origin, it must also carry the per-composition write token (`X-Widgetic-Write-Token` header or `writeToken` body field, handed to the widget in `widgetic:host` as `entries.writeToken` and returned as `entryWriteToken` on `getPublicCompositionEmbed`). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
   # @param composition_id 
   # @param table 
   # @param public_composition_entry_request 
   # @param [Hash] opts the optional parameters
   # @option opts [String] :x_widgetic_write_token Signed per-composition write token handed to the widget in `widgetic:host` as `entries.writeToken` (and returned by `GET /embed/compositions/{compositionId}` as `entryWriteToken`). Required when the request comes from the shared Widgetic artifact origin; verified whenever present.
+  # @option opts [String] :x_widgetic_visitor_id A random id the widget's browser makes once and keeps (16 to 64 characters of `A-Za-z0-9_-`), sent so a table's per-visitor `limit` (declared in the widget database file) can count this browser. Not an identity and not a secret. Without it, or with a malformed value, the limit counts only by network address.
   # @return [PublicCompositionEntryCreated]
   describe 'create_public_composition_entry_0 test' do
     it 'should work' do
@@ -86,6 +87,43 @@ describe 'PublicEmbedApi' do
     end
   end
 
+  # unit tests for get_public_workflow_0
+  # Read the published Workflow of an embed
+  # Public read of a workflow for the embed that carries `workflow-id`. No API key. The answer is the live version (its graph, the composition a new visitor starts on, the time zone, the languages its compositions can be shown in, and the token that lets the browser report counts), or `status: paused` with nothing else, in which case the embed shows only its first composition. A workflow that is a draft, archived or unknown answers 404, and the embed then behaves as a plain embed of its `composition-id`. So does a workflow whose owner is not being served (a plan that lapsed, a partner whose agreement is not in force): the answer is the one the compositions of that owner give. **Address.** `https://api.widgetic.com/embed/workflows/{workflowId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. The answer may be reused for a few seconds (`Cache-Control: public, max-age=15`), so a publish or a pause reaches visitors within moments. The graph is readable by anyone who has the workflow's id: its rules run in the visitor's browser, so a rule must never hold a secret.
+  # @param workflow_id 
+  # @param [Hash] opts the optional parameters
+  # @return [GetPublicWorkflow200Response]
+  describe 'get_public_workflow_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_public_workflow_frame_0
+  # Show a published Workflow in a page of its own
+  # A page that runs a published workflow, for a place that can only be given an address or an iframe: a chat messenger, a link page, a site builder, a blog that follows oEmbed. No API key, no SDK to add. The page holds the Embed SDK and the same tag a website carries (`<widgetic workflow-id composition-id>`), so a visitor moves from one composition to the next in place, by the same rules, exactly as on a website. A paused workflow shows its first composition alone, as its embeds do. **What the frame can count.** Only what happens inside it: entries, a widget's goals and actions, and waits. The page events a website can send to a workflow (`widgetic:workflow-event`) are events of the page around the embed, and they do not cross an iframe, so a connection that waits for one never fires from a frame. A workflow that is a draft, is archived, or does not exist, and one whose owner is not being served, answers 404 with a short page that gives no reason. If the owner of the workflow's first composition listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic's own), so a browser refuses to show it inside any other website. Opening the address directly still works. An owner who listed nothing is not restricted. The page links its oEmbed card, so a site that follows oEmbed turns the address of the frame into an embed. **Address.** `https://api.widgetic.com/embed/workflows/{workflowId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+  # @param workflow_id 
+  # @param [Hash] opts the optional parameters
+  # @return [String]
+  describe 'get_public_workflow_frame_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_public_workflow_version_0
+  # Read one published version of a Workflow
+  # Public read of one version of a workflow, for a visitor who started on it before a newer one was published: they finish on the version they started on (for up to 30 days; after that they get the latest). The graph of a version never changes once published; the languages its compositions can be shown in (`translations`) are read each time, as for the live version. Like the read of the live version, it answers `status: paused` with nothing else while the workflow is paused, and 404 when the workflow is a draft or archived, or has no such version. **Address.** `https://api.widgetic.com/embed/workflows/{workflowId}/versions/{versionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+  # @param workflow_id 
+  # @param version_id 
+  # @param [Hash] opts the optional parameters
+  # @return [GetPublicWorkflow200Response]
+  describe 'get_public_workflow_version_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for post_public_composition_embed_status_0
   # Batch-check whether compositions are currently served for embed
   # Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller's website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
@@ -98,9 +136,22 @@ describe 'PublicEmbedApi' do
     end
   end
 
+  # unit tests for report_public_workflow_events_0
+  # Report what visitors did in a Workflow, as counts
+  # Public report of counts for a workflow, sent by the embed. No API key. Each event is one id and a number: a visitor reached a block (`n`), took a connection (`e`), or could not be moved on (`f`). Nothing else is kept: no visitor, no value a visitor typed, no address. A batch carries at most 100 events and 16 KB. The same report may carry `heights`: how tall a step settled at in the browser, which the embed code of the workflow uses to start its box at a real height (a composition, a whole number of pixels, nothing about the visitor). A report is accepted only with the `token` the workflow's own read handed out for that `versionId`, so a page that never read the workflow cannot raise its numbers. An expired token (`EVENT_TOKEN_EXPIRED`) is refused with 401: read the workflow again for a new one. Counts for ids that are not in that version, or for a workflow that is not live, are not recorded and the answer says so (`recorded: false`) with 200: the visitor's page has nothing to fix. The body is JSON, sent as `application/json` or as `text/plain` (a \"simple\" cross-origin request, which is what lets a report leave a page that is being closed). **Address.** `https://api.widgetic.com/embed/workflows/{workflowId}/events`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag.
+  # @param workflow_id 
+  # @param public_workflow_events_request 
+  # @param [Hash] opts the optional parameters
+  # @return [ReportPublicWorkflowEvents200Response]
+  describe 'report_public_workflow_events_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for upload_public_composition_adapter_file_0
   # Send the file a visitor chose through the upload adapter of a published widget
-  # The second of the two calls the `upload` adapter's module makes from the visitor's browser (the first, the `begin-upload` operation of `callPublicCompositionAdapter`, answers with the ticket this route takes). The module sends the file itself, as the body, with its media type as the `Content-Type`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/upload/files/{ticket}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **The ticket.** Single-use and valid for ten minutes, given for one file: its name, its media type and its exact size are what the visitor said when the ticket was asked for, after the widget's owner's settings (the kinds of file they take, the largest size) were applied. The `Content-Type` and the `Content-Length` of this request must be those, and the body must be exactly that many bytes (400 `UPLOAD_FILE_CHANGED` otherwise). The gateway never believes the type it was told: the first bytes of the file must be a file of that type and one the owner accepts (422 otherwise). A ticket whose file was stored and is sent again is answered with the same file, so a visitor whose connection dropped after the file landed does not store it twice; a ticket whose attempt failed is spent, and the module asks for a new one. **What it stores.** The file goes to the widget owner's storage: Widgetic's, or the partner's own bucket for a widget of a customer a partner manages. It counts against the owner's storage allowance and is filed in the folder the owner chose, as a file sent by a visitor, which the owner's own file list leaves out. A full allowance, a partner's storage that cannot be used and a stopped feature are all the same 503 `UPLOAD_UNAVAILABLE` to a visitor, and the owner is told through a notice. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner's own platform). A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. **Limits.** 30 requests a minute for each visitor address and composition and 240 a minute for a composition (429 `RATE_LIMITED`, with a `Retry-After` header); at most 10 MB for a file, and only so many files held in memory at once on each gateway process (503 `UPLOAD_BUSY`, with a `Retry-After`). A file that does not arrive within two minutes is 408 `UPLOAD_TIMEOUT`. Every answer but a success closes the connection, so a client that is refused before it has sent the file reads the answer and stops.
+  # The second of the two calls the `upload` adapter's module makes from the visitor's browser (the first, the `begin-upload` operation of `callPublicCompositionAdapter`, answers with the ticket this route takes). The module sends the file itself, as the body, with its media type as the `Content-Type`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/upload/files/{ticket}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **The ticket.** Single-use and valid for ten minutes, given for one file: its name, its media type and its exact size are what the visitor said when the ticket was asked for, after the widget's owner's settings (the kinds of file they take, the largest size) were applied. The `Content-Type` and the `Content-Length` of this request must be those, and the body must be exactly that many bytes (400 `UPLOAD_FILE_CHANGED` otherwise). The gateway never believes the type it was told: the first bytes of the file must be a file of that type and one the owner accepts (422 otherwise). A ticket whose file was stored and is sent again is answered with the same file, so a visitor whose connection dropped after the file landed does not store it twice; a ticket whose attempt failed is spent, and the module asks for a new one. **The virus check.** Before anything is stored, the file is checked for viruses, wherever it would be kept (Widgetic's storage or a partner's own bucket). A file that fails the check is refused with 422 `UPLOAD_FILE_UNSAFE` and nothing is stored. When the check cannot be done, nothing is stored either, and the answer is the same neutral 503 `UPLOAD_UNAVAILABLE` as for any other cause the visitor is not told. The ticket of a refused file is spent. **What it stores.** The file goes to the widget owner's storage: Widgetic's, or the partner's own bucket for a widget of a customer a partner manages. It counts against the owner's storage allowance and is filed in the folder the owner chose, as a file sent by a visitor, which the owner's own file list leaves out. A full allowance, a partner's storage that cannot be used and a stopped feature are all the same 503 `UPLOAD_UNAVAILABLE` to a visitor, and the owner is told through a notice. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or any website when the owner has not restricted the allowed websites (when the owner has, one of the websites the owner listed, Widgetic's own sites, the visitor's own machine or the owner's own platform). A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. **Limits.** 30 requests a minute for each visitor address and composition and 240 a minute for a composition (429 `RATE_LIMITED`, with a `Retry-After` header); at most 10 MB for a file, and only so many files held in memory at once on each gateway process (503 `UPLOAD_BUSY`, with a `Retry-After`). A file that does not arrive within two minutes is 408 `UPLOAD_TIMEOUT`. Every answer but a success closes the connection, so a client that is refused before it has sent the file reads the answer and stops.
   # @param composition_id 
   # @param ticket The ticket the `begin-upload` operation answered with.
   # @param body 

data/spec/api/users_api_spec.rb

@@ -45,6 +45,21 @@ describe 'UsersApi' do
     end
   end
 
+  # unit tests for confirm_user_adapter_connection_0
+  # Confirm an adapter address with the code that was emailed to it
+  # Some credentials are an email address Widgetic sends a widget's messages to (`confirmation: email_code` in `getUserAdapterConnections`). Saving one with `setUserAdapterConnection` emails a six-digit code to it; this gives the code back. Only then is the address used: until it is confirmed, the widgets that need it are not charged and their visitors are told the feature is unavailable.  The code works for 30 minutes and for five wrong tries. After that, save the address again and a new code is emailed (not sooner than a minute after the last one). A code that is not made of digits is refused without counting as a try.  Confirming an address that is already confirmed answers 200 with the same state, so a retry of a request that went through is harmless. Saving a different address, or the same one before it was confirmed, starts again.  This needs an API key with full access. The caller must be the account itself or a Widgetic administrator. 
+  # @param user_id The account that keeps the address. For your own, your own user id
+  # @param adapter_id The adapter the address is for
+  # @param credential_key The credential's name within the adapter
+  # @param confirm_adapter_connection_request 
+  # @param [Hash] opts the optional parameters
+  # @return [SetUserAdapterConnection200Response]
+  describe 'confirm_user_adapter_connection_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
   # unit tests for create_user_api_key_0
   # Create an API key
   # Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner's backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. Accounts with API access (Solo, Teams and partner accounts) have no limit on how many keys they hold. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
@@ -151,7 +166,7 @@ describe 'UsersApi' do
 
   # unit tests for set_user_adapter_connection_0
   # Connect an adapter key to an account
-  # Gives an adapter the key it needs to act through a service you have an account with, for the widgets you made. Take the `adapterId` and `credentialKey` from `getUserAdapterConnections`. Saving a key that is already connected replaces it.  **What Widgetic does with it.** The key is stored encrypted, bound to this account, this adapter and this credential, so that a stored value cannot be moved to another. It is never returned, never logged and never shown to a visitor of a widget. A server of Widgetic opens it for the one call a widget makes through the adapter, uses it to call the provider on your behalf, and discards it. To cut that off, remove the key here, or revoke it with the provider.  **What is checked.** That the adapter exists and takes this credential, that an owner may keep it (some are for a partner only) and that the text is one line of at most 2048 characters. Whether the provider accepts the key is not checked here: it shows the first time a widget uses it, and the widget tells its owner.  A widget whose adapter has no key connected is not charged and does not run that adapter: its visitors are told the feature is unavailable, and the owner is told once a day what to connect.  This needs an API key with full access. The caller must be the account itself or a Widgetic administrator. A retry is harmless: saving the same key twice only refreshes when it was set. 
+  # Gives an adapter the key it needs to act through a service you have an account with, for the widgets you made. Take the `adapterId` and `credentialKey` from `getUserAdapterConnections`. Saving a key that is already connected replaces it.  **What Widgetic does with it.** The key is stored encrypted, bound to this account, this adapter and this credential, so that a stored value cannot be moved to another. It is never returned, never logged and never shown to a visitor of a widget. A server of Widgetic opens it for the one call a widget makes through the adapter, uses it to call the provider on your behalf, and discards it. To cut that off, remove the key here, or revoke it with the provider.  **What is checked.** That the adapter exists and takes this credential, that an owner may keep it (some are for a partner only) and that the text is one line of at most 2048 characters. Whether the provider accepts the key is not checked here: it shows the first time a widget uses it, and the widget tells its owner.  **An address that has to be confirmed.** Some credentials are not a key but the email address Widgetic sends a widget's messages to (`confirmation: email_code` in `getUserAdapterConnections`). Saving one checks that it is one email address and emails a six-digit code to it; the answer says `awaitingConfirmation: true`, and nothing is sent to the address until the code is given back with `confirmUserAdapterConnection`. Saving the same address again before it is confirmed emails a new code (not sooner than a minute after the last); saving the address that is already confirmed changes nothing. If the code cannot be emailed, nothing is saved.  A widget whose adapter has no key connected, or whose address is not confirmed yet, is not charged and does not run that adapter: its visitors are told the feature is unavailable, and the owner is told once a day what to do.  This needs an API key with full access. The caller must be the account itself or a Widgetic administrator. A retry is harmless: saving the same key twice only refreshes when it was set. 
   # @param user_id The account that keeps the key. For your own, your own user id
   # @param adapter_id The adapter the key is for
   # @param credential_key The key's name within the adapter