api-sdk-rb 1.11.66

data/spec/api/public_embed_api_spec.rb

@@ -0,0 +1,115 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for ApiSdkRb::PublicEmbedApi
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'PublicEmbedApi' do
+  before do
+    # run before each test
+    @api_instance = ApiSdkRb::PublicEmbedApi.new
+  end
+
+  after do
+    # run after each test
+  end
+
+  describe 'test an instance of PublicEmbedApi' do
+    it 'should create an instance of PublicEmbedApi' do
+      expect(@api_instance).to be_instance_of(ApiSdkRb::PublicEmbedApi)
+    end
+  end
+
+  # unit tests for call_public_composition_adapter_0
+  # Call a gateway operation of an adapter a published widget uses
+  # The door a widget's adapter module calls, from the visitor's browser, for the operations that cannot run in the browser: anything with a secret, a charge in credits or the owner's storage behind it. A widget that uses such an adapter is handed the address of this route as `adapters.url` in its `widgetic:host` message (see the host bridge contract) and calls `{adapters.url}/{adapterId}/{operation}`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/{adapterId}/{operation}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **What it serves.** Only an adapter, and a version of it, that the widget's LIVE manifest (what the version that is published uses) lists, and only an operation that runs on the gateway. Anything else is one 404 `ADAPTER_NOT_AVAILABLE`, whatever the reason, so the route is no way to ask what a widget contains. An adapter an administrator stopped offering to NEW widgets keeps serving the widgets that already use it. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner's own platform). Page script cannot forge it. A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. When the partner of the owner signs the host context, a context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`. **Cost and retries.** An operation priced in credits is charged to the owner of the widget (for a customer a partner manages, to the partner's administrator, within the monthly credits set for that customer), once for each `requestId`, before it runs, and given back if it does not answer. A `requestId` that was charged and not given back is 409 `REQUEST_ALREADY_USED` and the operation is NOT run a second time; one whose charge was given back may be tried again with the same `requestId`. A visitor never sees an owner's balance: a feature that cannot be used because its owner has no credits left, because the customer's monthly credits are spent, or because an administrator stopped the adapter, is the same 503 `ADAPTER_UNAVAILABLE` as every other \"not right now\". The owner is told through a notice. **Limits.** In front of everything, 120 calls a minute for each visitor address and composition and 600 a minute for a composition (429 `RATE_LIMITED`). Then, for each operation of a widget, a rate for each visitor address a minute and a cap for the widget a day: 30 and 5000 for an operation that is free, 10 and 500 for one that costs credits, unless the adapter says otherwise (never above 120 and 100000). A visitor over the rate is 429 `RATE_LIMITED`; a widget over its cap is 429 `WIDGET_LIMIT_REACHED`. Both carry a `Retry-After` header. The body is at most 64 KiB (413 `PAYLOAD_TOO_LARGE`) and JSON (415 `UNSUPPORTED_MEDIA_TYPE`); an operation has 30 seconds to answer (504 `ADAPTER_TIMEOUT`, and the charge is given back).
+  # @param composition_id 
+  # @param adapter_id The id of the adapter, the name its module is known by, for example `upload`.
+  # @param operation The name of one operation of the adapter, as its documentation gives it.
+  # @param public_adapter_call_request 
+  # @param [Hash] opts the optional parameters
+  # @return [PublicAdapterCallResult]
+  describe 'call_public_composition_adapter_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for create_public_composition_entry_0
+  # Append a visitor entry through the gateway
+  # Public append-only write into a published composition database. No API key. The browser must send a permitted `Origin` header (the artifact iframe origin or a website the owner allowed). When the request comes from the shared artifact origin, it must also carry the per-composition write token (`X-Widgetic-Write-Token` header or `writeToken` body field, handed to the widget in `widgetic:host` as `entries.writeToken` and returned as `entryWriteToken` on `getPublicCompositionEmbed`). Host `context` is stored for partner attribution; it is not authenticated unless the partner signs it (see **Signed context**). Request bodies are limited to 16 KB before parsing. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/entries/{table}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Signed context.** A partner that wants to trust `context` (to bill a customer by it, say) makes a signing secret (`rotatePartnerEntryContextSecret`), and its server signs the context it hands to the embed. The signature travels inside `context` as two reserved keys, `widgetic_exp` (UTC seconds, at most seven days ahead) and `widgetic_sig`. The gateway checks them after the `Origin` and before anything else is judged, stored or announced, and keeps and announces the context WITHOUT them. A context that is not signed as the partner requires is refused with 403 `CONTEXT_SIGNATURE_REQUIRED`, `CONTEXT_SIGNATURE_INVALID` or `CONTEXT_SIGNATURE_EXPIRED`; when the check cannot be made just now the answer is a retryable 503 `CONTEXT_SIGNATURE_UNAVAILABLE`, never an unchecked entry. Until a partner makes a secret nothing changes: the two keys are dropped and the rest is taken as it came. A signature is good until its `widgetic_exp` and may be used again until then, so a partner that must count each submission once keeps a unique value of its own (a `submissionId`, say) in the context. The recipe and a test vector are in the description of `rotatePartnerEntryContextSecret`.
+  # @param composition_id 
+  # @param table 
+  # @param public_composition_entry_request 
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :x_widgetic_write_token Signed per-composition write token handed to the widget in `widgetic:host` as `entries.writeToken` (and returned by `GET /embed/compositions/{compositionId}` as `entryWriteToken`). Required when the request comes from the shared Widgetic artifact origin; verified whenever present.
+  # @return [PublicCompositionEntryCreated]
+  describe 'create_public_composition_entry_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_public_composition_embed_0
+  # Resolve a composition UUID to a published widget URL
+  # Public customer embed lookup. No API key. Used by embed-sdk.js on third-party sites. If the composition's owner listed the websites it may appear on (the workspace's domain list, or the `allowedDomains` of a partner the owner administers), a request from any other website is refused with 403 `DOMAIN_NOT_ALLOWED`. The website is read from the `Origin` header, or the host of `Referer` when there is no `Origin`; a request that names neither (a server, a tool) is not refused. An owner who listed nothing is not restricted, and a page on the visitor's own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed. So is the website where a partner integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), for the widgets of that partner: a partner's list never has to name it. The list stops other websites from showing the embed in a visitor's browser; it does not hide the published content from someone who holds the composition ID. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** 500 calls for each visitor address and browser in one counting window, shared with the frame and the status routes. Over it the answer is 429 `RATE_LIMITED` with a `Retry-After` header. 
+  # @param composition_id 
+  # @param [Hash] opts the optional parameters
+  # @return [GetPublicCompositionEmbed200Response]
+  describe 'get_public_composition_embed_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_public_composition_iframe_0
+  # Embed a published composition with its saved values
+  # Public HTML wrapper with an inner published artifact iframe. No API key or SDK required. If the composition's owner listed the websites it may appear on, the page is sent with `Content-Security-Policy: frame-ancestors` naming those websites (and Widgetic's own, and the website where the partner the owner administers integrates Widgetic, with its subdomains), so a browser refuses to show it inside any other website whatever `Referer` policy that website uses. Opening the address directly still works. An owner who listed nothing is not restricted. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/frame`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. 
+  # @param composition_id 
+  # @param [Hash] opts the optional parameters
+  # @return [String]
+  describe 'get_public_composition_iframe_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for post_public_composition_embed_status_0
+  # Batch-check whether compositions are currently served for embed
+  # Public batch health check for embed-sdk.js. No API key. Uses the same serving gate and domain policy as `GET /embed/compositions/{compositionId}`: the caller's website is read from `Origin`, or the host of `Referer` when there is no `Origin`. A request that names neither (a server or tool) is not refused for domain reasons. **Address.** `https://api.widgetic.com/embed/compositions/status`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **Limit.** The route counts against the same limit as the lookup and the frame routes: 500 calls for each visitor address and browser in one counting window. A call is ONE hit whatever the number of `ids` it carries (up to 100), so a server that checks many compositions spends one call for each hundred of them. A visitor who is over the limit gets 429 `RATE_LIMITED` for the WHOLE call, with a `Retry-After` header and no state for any id: there is no per-composition rate-limit state in the answer.
+  # @param post_public_composition_embed_status_request 
+  # @param [Hash] opts the optional parameters
+  # @return [PostPublicCompositionEmbedStatus200Response]
+  describe 'post_public_composition_embed_status_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for upload_public_composition_adapter_file_0
+  # Send the file a visitor chose through the upload adapter of a published widget
+  # The second of the two calls the `upload` adapter's module makes from the visitor's browser (the first, the `begin-upload` operation of `callPublicCompositionAdapter`, answers with the ticket this route takes). The module sends the file itself, as the body, with its media type as the `Content-Type`. It is not meant to be called by hand, and it takes no API key. **Address.** `https://api.widgetic.com/embed/compositions/{compositionId}/adapters/upload/files/{ticket}`: the root of the API host, NOT under `/v1`. A client generated from this description for `https://api.widgetic.com/v1` must be given the base address `https://api.widgetic.com` for the calls of the `Public Embed` tag. **The ticket.** Single-use and valid for ten minutes, given for one file: its name, its media type and its exact size are what the visitor said when the ticket was asked for, after the widget's owner's settings (the kinds of file they take, the largest size) were applied. The `Content-Type` and the `Content-Length` of this request must be those, and the body must be exactly that many bytes (400 `UPLOAD_FILE_CHANGED` otherwise). The gateway never believes the type it was told: the first bytes of the file must be a file of that type and one the owner accepts (422 otherwise). A ticket whose file was stored and is sent again is answered with the same file, so a visitor whose connection dropped after the file landed does not store it twice; a ticket whose attempt failed is spent, and the module asks for a new one. **What it stores.** The file goes to the widget owner's storage: Widgetic's, or the partner's own bucket for a widget of a customer a partner manages. It counts against the owner's storage allowance and is filed in the folder the owner chose, as a file sent by a visitor, which the owner's own file list leaves out. A full allowance, a partner's storage that cannot be used and a stopped feature are all the same 503 `UPLOAD_UNAVAILABLE` to a visitor, and the owner is told through a notice. **Who may call.** The same rule as the entry route: a permitted `Origin` header, which is the artifact origin the widget runs from or a website the owner allowed (or the owner's own platform). A request without a permitted `Origin` is 403 `ORIGIN_NOT_ALLOWED`. A composition that is not served (unpublished, or its owner's plan does not serve it) is 404, with the codes of the other public embed routes. **Limits.** 30 requests a minute for each visitor address and composition and 240 a minute for a composition (429 `RATE_LIMITED`, with a `Retry-After` header); at most 10 MB for a file, and only so many files held in memory at once on each gateway process (503 `UPLOAD_BUSY`, with a `Retry-After`). A file that does not arrive within two minutes is 408 `UPLOAD_TIMEOUT`. Every answer but a success closes the connection, so a client that is refused before it has sent the file reads the answer and stops.
+  # @param composition_id 
+  # @param ticket The ticket the `begin-upload` operation answered with.
+  # @param body 
+  # @param [Hash] opts the optional parameters
+  # @return [PublicAdapterFileResult]
+  describe 'upload_public_composition_adapter_file_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/api/tokens_api_spec.rb

@@ -0,0 +1,45 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for ApiSdkRb::TokensApi
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'TokensApi' do
+  before do
+    # run before each test
+    @api_instance = ApiSdkRb::TokensApi.new
+  end
+
+  after do
+    # run after each test
+  end
+
+  describe 'test an instance of TokensApi' do
+    it 'should create an instance of TokensApi' do
+      expect(@api_instance).to be_instance_of(ApiSdkRb::TokensApi)
+    end
+  end
+
+  # unit tests for validate_token_0
+  # Validate current authentication token
+  # @param [Hash] opts the optional parameters
+  # @return [ValidateToken200Response]
+  describe 'validate_token_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/api/uploads_api_spec.rb

@@ -0,0 +1,101 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for ApiSdkRb::UploadsApi
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'UploadsApi' do
+  before do
+    # run before each test
+    @api_instance = ApiSdkRb::UploadsApi.new
+  end
+
+  after do
+    # run after each test
+  end
+
+  describe 'test an instance of UploadsApi' do
+    it 'should create an instance of UploadsApi' do
+      expect(@api_instance).to be_instance_of(ApiSdkRb::UploadsApi)
+    end
+  end
+
+  # unit tests for uploads_get_0
+  # List the account's uploads
+  # The files the account has uploaded, newest first. Deleted files are not listed. Returns at most `limit` files and has no further pages: a client that needs more narrows the list instead, for example to one managed user's files with `managedUserId` or `managedUserExternalId`. The files that visitors sent through a widget's upload adapter (`source` is `widget-visitor-upload`) are not part of this list, so that a popular widget does not push the account's own files out of it; naming one widget with `widgetId` lists what visitors sent to that widget as well. 
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :limit Maximum number of files to return
+  # @option opts [String] :managed_user_id List only the files uploaded for this managed user (Widgetic's id for the user). Send this or `managedUserExternalId`, not both.
+  # @option opts [String] :managed_user_external_id List only the files uploaded for the managed user you registered with this `externalId` (your own identifier for the user). Send this or `managedUserId`, not both.
+  # @return [UploadsGet200Response]
+  describe 'uploads_get_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for uploads_id_delete_0
+  # Delete an upload
+  # Removes the stored file and the upload row. A file in Widgetic's own storage gives back the space it took from your storage allowance; a file in your own bucket is removed from your bucket. Deleting an upload that is already gone succeeds the same way as the first delete. An upload that belongs to another account is not found. If the storage cannot be reached the call fails and nothing is marked deleted, so it can be repeated. 
+  # @param id 
+  # @param [Hash] opts the optional parameters
+  # @return [UploadsIdDelete200Response]
+  describe 'uploads_id_delete_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for uploads_id_get_0
+  # Get an upload by id
+  # The details of one of the account's uploads. An upload that belongs to another account is not found.
+  # @param id The upload to read
+  # @param [Hash] opts the optional parameters
+  # @return [UploadResponse]
+  describe 'uploads_id_get_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for uploads_limits_get_0
+  # Upload size limits and accepted file types
+  # The size limit and the accepted file types of the upload endpoints. Read them from here rather than hard-coding thresholds: they are configuration and can change. The limits are the same for every account, whatever its plan: `multipart_max_bytes` for a file sent in one request (10 MB) and `tus_max_bytes` for a resumable upload (250 MB). 
+  # @param [Hash] opts the optional parameters
+  # @return [UploadLimitsResponse]
+  describe 'uploads_limits_get_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for uploads_post_0
+  # Upload a file
+  # Stores one file for the account and returns its public address. This is how a user's own images, video and PDFs reach a widget's content.  Send a `multipart/form-data` request with the file in the field named `file`. The file counts against the storage of the workspace it is uploaded in, and a full workspace is refused with 413 and `QUOTA_STORAGE_EXCEEDED`. For a person signed in on widgetic.com that is the workspace they are currently working in: inside a team, the team's shared storage; inside their own workspace, their own allowance. An organization API key, and a Shopify store's session, always work in that team's shared storage. A personal API key or an SDK token always uses the account's own allowance. The two never add up and one never lends room to the other. A file over the size limit is refused with 413 and `UPLOAD_TOO_LARGE`, and a type that is not accepted with 415 and `UPLOAD_UNSUPPORTED_TYPE`; `uploadsLimitsGet` lists the size limit and the accepted types.  A file is judged by what is in it, not by the type it is sent as. A file that is not the type it claims (a web page sent as `image/png`) is refused with 415 and `UPLOAD_UNSUPPORTED_TYPE`, and a picture sent under the wrong picture type is stored under the type it really is, which `mime_type` in the answer says. An SVG is rewritten as it is stored: script, `foreignObject`, animation and references to other addresses are taken out, it must be UTF-8 and at most 2 MB, and the stored file can be larger or smaller than the one sent. Anything that is not an image, audio or video (a PDF, for example) is served as a download rather than shown in a page.  When the full storage is a Shopify store's team's, extra storage cannot be added through Shopify yet, so the message ends by saying so and what to do instead: delete files, or contact support. On a Solo plan it names the Teams plan (which holds more) and `error.details.planPageUrl` is the address of the plan page on Shopify. `error.suggestedAction` says the same in a few words, instead of the usual \"upgrade your storage plan\". Any other team, and a person's own workspace, get the shorter message.  To upload the file for one of your managed users, send `managedUserId` (Widgetic's id for the user) or `managedUserExternalId` (your own identifier for the user), not both. The file stays in your account and counts against its allowance; the tag lets you list one user's files with `uploadsGet`. The managed user must be yours and active: one that is not yours, or does not exist, is refused with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`, before the file is stored. The tag is set here and does not change afterwards.  Called with an editor session (`createManagedUserEditorSession`), the file is always filed for the session's own managed user and is always media for widget content: naming another managed user is refused with 403 and `MANAGED_USER_SESSION_MISMATCH`, and `contextType`, `source`, `widgetId` and `conversationId` are ignored. A full storage allowance is refused with the same 413 and `QUOTA_STORAGE_EXCEEDED`, but the message only says that it is not available right now (not how much is stored: that is the partner's business) and `error.details.limit` is `storage`.  An account that administers a partner with a storage destination (`setPartnerStorageDestination`) has its files stored in the partner's own bucket instead. Such a file takes none of the allowance, its `url` is served from the partner's public address, and its `storage_key` is the key in the partner's bucket. The file is never stored with Widgetic instead: when the destination cannot be used the upload is refused with 503 and `STORAGE_DESTINATION_UNAVAILABLE`, and when the partner's storage rejects the file with 502 and `STORAGE_DESTINATION_WRITE_FAILED`.  Partner storage is not optional, and it does not depend on how the file arrives. A partner's own uploads (with its API key, an SDK token, or from the Widgetic website, the resumable route and the media library alike) and the uploads of its customers' editor sessions are kept in the partner's own storage or not at all, so a partner with no destination (or one that removed it after the session was made) has them refused with 409 and `PARTNER_STORAGE_REQUIRED`; they are never stored with Widgetic. An editor session's browser is only told that the feature is not available right now. 
+  # @param file The file to store
+  # @param [Hash] opts the optional parameters
+  # @option opts [String] :context_type What the file is for. Send `content-property` for media that becomes widget content (images, video and PDF); the other values are used by Widgetic's own editor. 
+  # @option opts [String] :source Which part of the product, or which client, the file comes from
+  # @option opts [String] :managed_user_id Upload the file for one of your managed users, by Widgetic's id for the user. Send this or `managedUserExternalId`, not both.
+  # @option opts [String] :managed_user_external_id The same, by your own identifier for the user, the `externalId` you gave when you created the managed user. Send this or `managedUserId`, not both.
+  # @option opts [String] :purpose Where in your product you use the file. It is kept with the file, so that a customer's storage can be counted by purpose (`getManagedUserStorageUsage`). Optional; any other value is refused with 400 and `UPLOAD_INVALID_PURPOSE`.
+  # @return [UploadResponse]
+  describe 'uploads_post_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/api/users_api_spec.rb

@@ -0,0 +1,195 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for ApiSdkRb::UsersApi
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'UsersApi' do
+  before do
+    # run before each test
+    @api_instance = ApiSdkRb::UsersApi.new
+  end
+
+  after do
+    # run after each test
+  end
+
+  describe 'test an instance of UsersApi' do
+    it 'should create an instance of UsersApi' do
+      expect(@api_instance).to be_instance_of(ApiSdkRb::UsersApi)
+    end
+  end
+
+  # unit tests for add_personal_workspace_domain_0
+  # Allow a website to show your widgets
+  # Adds a website to an account's own list. Give a website name such as `example.com`, or `*.example.com` for a website and all of its subdomains. A scheme, a port, a path, capital letters and a leading `www.` are dropped, so `https://www.Example.com/shop` is kept as `example.com`, and `example.com` covers `www.example.com` too. Something that is not a website name is refused, not stored. Until the first website is added nothing is restricted, and a widget can be shown anywhere. Once the list has one, a widget of the account is shown on the listed websites (and on Widgetic's own) and nowhere else. A page on your own machine (`localhost`, `127.0.0.1` or `[::1]`, on any port) is always allowed, so there is nothing to add to test locally. So is the website where a partner your account administers integrates Widgetic, with every subdomain of it (`platformDomain` in the answer of `GET /partners/mine`), so there is nothing to add for it either and a list can never lock it out. A change can take about 15 seconds to reach every server. The list is a safeguard against other websites showing your widgets in a visitor's browser. It is not access control: anyone who knows a widget's id can still fetch its published content with a plain request that names no website. There is no limit on the list of an account that administers a partner, so a partner can add the website of each of its customers as they publish on their own domain, one call each. Any other account can list at most 50 websites, and the 51st is answered with a 409 (`BUSINESS_STATE_CONFLICT`). A wildcard such as `*.example.com` counts as one website, not one per subdomain, so use it instead of listing each subdomain. A page that frames a widget can name only so many websites to the browser (about fifty of ordinary length). Past that, the browser no longer checks the list for that page; the lookup that the Embed SDK makes for the widget still refuses every website that is not on the list.
+  # @param id The account the list belongs to. For your own, your own user id
+  # @param add_domain_request 
+  # @param [Hash] opts the optional parameters
+  # @return [PersonalWorkspaceDomainResultResponse]
+  describe 'add_personal_workspace_domain_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for create_user_api_key_0
+  # Create an API key
+  # Makes a new API key for an account and returns its secret in `key`. That is the only time the secret is shown: Widgetic keeps a hash, so a key that was not stored cannot be recovered, only replaced. To rotate a key, make the new one, switch the integration over to it, then delete the old one. Only a person signed in on widgetic.com can make a key: a request made with an API key, or with an SDK token, is refused with 403. That way a leaked key cannot be used to make a second one that survives its revocation. Make keys from the dashboard; a key can still list, rename, switch off and delete keys. An `Idempotency-Key` header is required (8 to 50 characters: letters, digits, `-` and `_`). A retry with the same header and the same body returns the same answer instead of making a second key, and the same header with a different body is refused with 422. Make keys one at a time: two requests for the same account that run at the same moment can overwrite each other. A key can be limited to what it needs. Send a `preset` (`read_only`, `content` or `full_access`) or a list of `scopes`, never both. Send neither for a key that can do everything its owner can, as every key made before scopes existed. A limited key is refused with 403 and the code `API_KEY_SCOPE_MISSING` on anything outside its scopes, so a key held by a build server or by a partner's backend can be given only the part of the API it uses. The scopes of a key are fixed when it is made: to widen one, make a new key and delete the old one. A limited key cannot make, change or delete keys, exchange tokens or reach the administration routes. The list of scopes is in the `ApiKeyScope` schema. Accounts with API access (Solo, Teams and partner accounts) have no limit on how many keys they hold. An account on a plan without API access cannot make one (a partner account is not asked about a plan).
+  # @param id The account the key is for. For your own, your own user id
+  # @param idempotency_key Required: a call without it is refused with `400`. A key of your own that names this one request; a UUID is ideal. It is 8 to 50 characters of letters, digits, `-` and `_`. Send the same key again when you retry (after a timeout, a dropped connection or a `5xx`) and the call is carried out once: the retry gets the first answer back, marked `X-Idempotency-Cached: true`. The same key with a different body is refused with `422`, and a retry that arrives while the first call is still running with `409` (see `Retry-After`).
+  # @param create_user_api_key_request 
+  # @param [Hash] opts the optional parameters
+  # @return [CreatedUserApiKeyResponse]
+  describe 'create_user_api_key_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for delete_personal_workspace_domain_0
+  # Stop allowing a website to show your widgets
+  # Removes one entry from an account's own list. When it was the last one, nothing is restricted any more and a widget can be shown anywhere again. A change can take about 15 seconds to reach every server.
+  # @param id The account the list belongs to. For your own, your own user id
+  # @param domain_id The `id` of the entry, as the list shows it
+  # @param [Hash] opts the optional parameters
+  # @return [DeletePersonalWorkspaceDomainResponse]
+  describe 'delete_personal_workspace_domain_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for delete_user_api_key_0
+  # Delete an API key
+  # Deletes a key and the record of what it was used for. The key stops working at once on the server that took the request and within a minute on the others, and cannot be brought back: make a new one instead. To stop a key without losing it, switch it off with `updateUserApiKey`.
+  # @param id The account the key belongs to
+  # @param key_id The `keyId` of the key, as the list shows it
+  # @param [Hash] opts the optional parameters
+  # @return [DeleteUserApiKeyResponse]
+  describe 'delete_user_api_key_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_personal_workspace_domains_0
+  # List the websites allowed to show your widgets
+  # Lists the websites on an account's own list, newest first. It is the list Widgetic checks when a widget of the account is embedded: when it holds at least one website, the widget is shown on those websites (and on Widgetic's own) and nowhere else; when it is empty, the widget can be shown anywhere. If the account administers a partner, the websites set on the partner record by Widgetic are added to them. Widgets that belong to an organization use the organization's list instead. The answer holds the whole list, however long it is: a partner's list has no limit.
+  # @param id The account the list belongs to. For your own, your own user id
+  # @param [Hash] opts the optional parameters
+  # @return [GetPersonalWorkspaceDomains200Response]
+  describe 'get_personal_workspace_domains_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_user_adapter_connections_0
+  # See which adapter keys an account has connected
+  # Widget adapters are capabilities a widget can use, and some of them act through a service the owner has an account with: an adapter that sends email needs the owner's email provider key, one that sends texts needs the owner's SMS provider key. This lists every key an adapter takes from an owner and whether this account has connected it, so a settings page can show what is missing.  An empty list means no adapter takes a key from an owner at the moment. The list never contains a key: only whether one is connected and when it was last set.  Connect a key with `setUserAdapterConnection`; take it away with `removeUserAdapterConnection`. The widgets of customers a partner manages use the partner's keys instead (`getPartnerAdapterConnections`).  The caller must be the account itself (an API key of that account works, with the `account:read` scope), or a Widgetic administrator. 
+  # @param user_id The account whose adapter keys to list. For your own, your own user id
+  # @param [Hash] opts the optional parameters
+  # @return [GetUserAdapterConnections200Response]
+  describe 'get_user_adapter_connections_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_user_api_key_usage_logs_0
+  # Read what an API key was used for
+  # Lists the calls made with one key, newest first: when, which path and method, and the status each ended with. Use it to see whether a key is still in use before deleting it, or to see what a key that should not be in use has been doing.
+  # @param id The account the key belongs to
+  # @param key_id The `keyId` of the key, as the list shows it
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :limit How many calls to return, newest first
+  # @return [GetUserApiKeyUsageLogsResponse]
+  describe 'get_user_api_key_usage_logs_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_user_api_keys_0
+  # List the API keys of an account
+  # Lists the API keys of an account, in the order they were made: name, the first characters of the key, when it was made, when it expires, when it was last used, whether it is switched on and what it is limited to (`scopes` and `preset`). The secret of a key is never part of the list. A caller can list its own account's keys; Widgetic staff can list any account's.
+  # @param id The account the keys belong to. For your own keys, your own user id
+  # @param [Hash] opts the optional parameters
+  # @return [GetUserApiKeys200Response]
+  describe 'get_user_api_keys_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for remove_user_adapter_connection_0
+  # Remove an adapter key from an account
+  # Removes a key an adapter was given. The adapter stops working for the widgets that need it: their visitors are told the feature is unavailable. Nothing else of the widgets changes, and connecting a key again brings them back.  Removing a key that is not connected answers 200 with `removed: false`: the state asked for is the state it is in. A key of an adapter that has since been retired from the catalog can still be removed.  This needs an API key with full access. The caller must be the account itself or a Widgetic administrator. 
+  # @param user_id The account that keeps the key. For your own, your own user id
+  # @param adapter_id The adapter the key is for
+  # @param credential_key The key's name within the adapter
+  # @param [Hash] opts the optional parameters
+  # @return [RemoveUserAdapterConnection200Response]
+  describe 'remove_user_adapter_connection_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for set_user_adapter_connection_0
+  # Connect an adapter key to an account
+  # Gives an adapter the key it needs to act through a service you have an account with, for the widgets you made. Take the `adapterId` and `credentialKey` from `getUserAdapterConnections`. Saving a key that is already connected replaces it.  **What Widgetic does with it.** The key is stored encrypted, bound to this account, this adapter and this credential, so that a stored value cannot be moved to another. It is never returned, never logged and never shown to a visitor of a widget. A server of Widgetic opens it for the one call a widget makes through the adapter, uses it to call the provider on your behalf, and discards it. To cut that off, remove the key here, or revoke it with the provider.  **What is checked.** That the adapter exists and takes this credential, that an owner may keep it (some are for a partner only) and that the text is one line of at most 2048 characters. Whether the provider accepts the key is not checked here: it shows the first time a widget uses it, and the widget tells its owner.  A widget whose adapter has no key connected is not charged and does not run that adapter: its visitors are told the feature is unavailable, and the owner is told once a day what to connect.  This needs an API key with full access. The caller must be the account itself or a Widgetic administrator. A retry is harmless: saving the same key twice only refreshes when it was set. 
+  # @param user_id The account that keeps the key. For your own, your own user id
+  # @param adapter_id The adapter the key is for
+  # @param credential_key The key's name within the adapter
+  # @param set_adapter_connection_request 
+  # @param [Hash] opts the optional parameters
+  # @return [SetUserAdapterConnection200Response]
+  describe 'set_user_adapter_connection_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for update_personal_workspace_domain_0
+  # Change a website on your list
+  # Replaces the website of one entry on an account's own list. The same rules apply as when adding one (`addPersonalWorkspaceDomain`): a website name such as `example.com` or `*.example.com`, kept in its cleaned form, and refused when it is not a website name or is already on the list.
+  # @param id The account the list belongs to. For your own, your own user id
+  # @param domain_id The `id` of the entry, as the list shows it
+  # @param update_domain_request 
+  # @param [Hash] opts the optional parameters
+  # @return [PersonalWorkspaceDomainResultResponse]
+  describe 'update_personal_workspace_domain_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for update_user_api_key_0
+  # Rename an API key, or switch it off or on
+  # Renames a key, or switches it off (`isActive: false`) or back on. A key that is switched off is refused at once by the server that took the request and within a minute by the others, and can be switched on again; deleting is for a key that is not coming back. The secret, the expiry and the scopes of a key cannot be changed. Only a key with full access can make these requests: a key limited to some scopes is refused with 403 and the code `API_KEY_SCOPE_MISSING`. Renaming and switching off can be done with an API key. Switching a key on needs a person signed in on widgetic.com: a request that asks for it with an API key or an SDK token is refused with 403, so a leaked key cannot bring a dormant key back to life.
+  # @param id The account the key belongs to
+  # @param key_id The `keyId` of the key, as the list shows it
+  # @param update_user_api_key_request 
+  # @param [Hash] opts the optional parameters
+  # @return [UserApiKeyResponse]
+  describe 'update_user_api_key_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/api/widgets_api_spec.rb

@@ -0,0 +1,90 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'spec_helper'
+require 'json'
+
+# Unit tests for ApiSdkRb::WidgetsApi
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe 'WidgetsApi' do
+  before do
+    # run before each test
+    @api_instance = ApiSdkRb::WidgetsApi.new
+  end
+
+  after do
+    # run after each test
+  end
+
+  describe 'test an instance of WidgetsApi' do
+    it 'should create an instance of WidgetsApi' do
+      expect(@api_instance).to be_instance_of(ApiSdkRb::WidgetsApi)
+    end
+  end
+
+  # unit tests for create_composition_from_widget_0
+  # Create a composition for a widget in one call
+  # After a managed user publishes a widget from the creator, call this with the widget id, the customer's managed user (when the widget is not already filed under one), and optional content, design, embed settings and locale. Every input is validated before a single insert; a failure never leaves a half-made composition.  When the widget is already tagged with a managed user, you may omit `managedUserId`. When you send it, it must match that tag.  A widget that keeps what visitors send (a form, a vote, a rating) declares its tables in its own source (`src/lib/meta/database.json`); they are made for the composition here, in a schema of its own, as the widget was when it was last published. A widget that keeps nothing leaves the composition without tables. If the tables cannot be made just now, or the widget's file cannot be used, the composition is still created (`201`) and `meta.warnings` says why; the tables are made the next time the widget is generated.  The widget must be published. The `Idempotency-Key` header is required. 
+  # @param id The widget id
+  # @param idempotency_key Required: a call without it is refused with `400`. A key of your own that names this one request; a UUID is ideal. It is 8 to 50 characters of letters, digits, `-` and `_`. Send the same key again when you retry (after a timeout, a dropped connection or a `5xx`) and the call is carried out once: the retry gets the first answer back, marked `X-Idempotency-Cached: true`. The same key with a different body is refused with `422`, and a retry that arrives while the first call is still running with `409` (see `Retry-After`).
+  # @param create_composition_from_widget_request 
+  # @param [Hash] opts the optional parameters
+  # @return [CreateCompositionFromWidget201Response]
+  describe 'create_composition_from_widget_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for create_widget_0
+  # Create Widget
+  # Creates a widget for your account: a named record with a type and some starting content, on a canvas of its own (or one of yours that you name). It costs no credits and has no code yet; the code is generated for it afterwards. The new widget is yours, and you can list it with `getWidgets`. A widget is a draft until you say otherwise (`isDraft: false`).  If a step after the widget was saved does not go through, the widget is still created, and `data.warnings` says what did not. Read it before relying on the widget.  A widget can be placed on one of your canvases (`canvasId`), in a project you can edit (`projectId`) or in an organization where you may create widgets (`organizationId`). Naming anything you cannot use is refused with 403, and the answer is the same whether it exists or not.  To make the widget for one of your managed users, send `managedUserId` or `managedUserExternalId`. The widget stays in your account and is yours to edit; the tag lets you list one user's widgets with `getWidgets`. The managed user must be yours and active: one that is not yours, or does not exist, is answered with 404 and `MANAGED_USER_NOT_FOUND`, and one that is switched off with 409 and `MANAGED_USER_INACTIVE`. The tag is set here and does not change afterwards.  This call has a limit of its own: 120 per minute for each account (ask Widgetic if you need more). Past that the call is answered with 429 and a `Retry-After`. A widget has no database of its own: what the visitors of a composition leave is kept in the tables of that composition, made when the composition is. The `Idempotency-Key` header is required; send the same key when you retry, so one widget is created, not two. 
+  # @param idempotency_key A unique value (a UUID is fine) that makes a retry of this request safe.
+  # @param new_widget 
+  # @param [Hash] opts the optional parameters
+  # @return [CreateWidget201Response]
+  describe 'create_widget_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_widgets_0
+  # List Widgets
+  # Lists the widgets your account owns, newest first. A widget is the reusable piece a composition is made from; this is your own library, not a catalogue of Widgetic's widgets.  Pass `page` (counting from 1) and `size` (1 to 100, 20 when left out) to read the list one page at a time. `meta` then carries `total`, `hasNextPage` and `hasPreviousPage`, so a client can walk the list to its end. A page past the end is an empty list. Without `page` and `size` the call returns the whole list in one response, which only suits an account with a few widgets.  Pass `canvasId` to list only the widgets on one of your canvases. That list is always returned whole, whatever `page` and `size` say.  Pass `managedUserId` (Widgetic's id for one of your managed users) or `managedUserExternalId` (your own identifier for the user) to list only the widgets made for that managed user. The widgets of your other managed users, and your own, are left out. It combines with `page`, `size` and `canvasId`. A managed user that is not yours, or does not exist, is answered with 404 and `MANAGED_USER_NOT_FOUND`. 
+  # @param [Hash] opts the optional parameters
+  # @option opts [Integer] :page Page to return, counting from 1. Giving `page` or `size` turns paging on.
+  # @option opts [Integer] :size How many widgets a page holds (20 when `page` is given without it). Giving `page` or `size` turns paging on.
+  # @option opts [String] :canvas_id List only the widgets on this canvas. The list is returned whole.
+  # @option opts [String] :managed_user_id List only the widgets made for this managed user (Widgetic's id for the user). Send this or `managedUserExternalId`, not both.
+  # @option opts [String] :managed_user_external_id List only the widgets made for the managed user you registered with this `externalId` (your own identifier for the user). Send this or `managedUserId`, not both.
+  # @return [GetWidgets200Response]
+  describe 'get_widgets_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  # unit tests for get_widgets_batch_0
+  # Get Widgets Batch
+  # Retrieves multiple widgets by their IDs in a single request. An id that is not found, or that is not yours, is reported in `errors` exactly like one that does not exist. Called with an editor session, only the widgets made for the session's managed user are returned.
+  # @param get_widgets_batch_request 
+  # @param [Hash] opts the optional parameters
+  # @return [GetWidgetsBatchResponse]
+  describe 'get_widgets_batch_0 test' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end

data/spec/models/account_credit_balance_response_spec.rb

@@ -0,0 +1,48 @@
+=begin
+#Widgetic API Gateway
+
+#API documentation for the Widgetic API Gateway
+
+The version of the OpenAPI document: 1.0.0
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.9.0
+
+=end
+
+require 'spec_helper'
+require 'json'
+require 'date'
+
+# Unit tests for ApiSdkRb::AccountCreditBalanceResponse
+# Automatically generated by openapi-generator (https://openapi-generator.tech)
+# Please update as you see appropriate
+describe ApiSdkRb::AccountCreditBalanceResponse do
+  let(:instance) { ApiSdkRb::AccountCreditBalanceResponse.new }
+
+  describe 'test an instance of AccountCreditBalanceResponse' do
+    it 'should create an instance of AccountCreditBalanceResponse' do
+      # uncomment below to test the instance creation
+      #expect(instance).to be_instance_of(ApiSdkRb::AccountCreditBalanceResponse)
+    end
+  end
+
+  describe 'test attribute "success"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  describe 'test attribute "data"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+  describe 'test attribute "meta"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
+end