assinafy 1.10.1 → 1.11.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8a12972c20d3f42452948edca772428326d37eafaf2354286bd9d3285bb6bf2
-  data.tar.gz: ad4b481584b05d052d7f44cde2a0cc7c99873e127031c30c60662c0a95dbca40
+  metadata.gz: 4c9d44ba9996ee18372b0c965c691f9a74695b98ffd85ebe5e43ae29a4f3b662
+  data.tar.gz: a0313ec17a476c5439eab8fd004936c337b4b99e14323b8dfd864553b68f22d9
 SHA512:
-  metadata.gz: 8990224d37bac65328f95e7bdae28c999381f33fa64f1cfe300f3fffc124e8e98ab4e8e8473802534b1155ec06fc5c8080ffffb8a809118abf8d58cc661ad6a7
-  data.tar.gz: 35be652f65fa20a29cef34f3487f4af98ac9e94d613ec51c816b24ee879ed436b4c168aaeb51f32fef81864a9b7e54824812fa713693b2e7235e424ae407f085
+  metadata.gz: 4a3e1ef28628add0a0e5abfc6f59f09f5ea0fe09c067a6fbb8cb3b767771590479bb8493b525ce389d2a572f15eea8257ed9a1ba47e68e7be1297603777febbd
+  data.tar.gz: 159e300170cd02a74d7668084362b5c80f5e99eea2653e2fd5f9faa0a838446b3987f9d5cd9df131cf0f2feba6a0dd50fdae0de4351ebba213c92e942ea3d529

data/CHANGELOG.md

@@ -2,6 +2,69 @@
 
 All notable changes to the `assinafy` Ruby gem are documented here.
 
+## [1.11.1] - 2026-10-12
+
+### Added
+
+- `Assinafy::ApiError#rate_limit` returns `{ limit:, remaining:, reset: }` from the `X-Rate-Limit-*` headers, and
+  `#retry_after` returns the `Retry-After` seconds of a `429 Too Many Requests`.
+- `SignerDocumentResource#list_as_workspace` and `#search_as_workspace` list and search a signer's documents with
+  the workspace API key or token.
+
+### Changed
+
+- `DocumentResource#send_token` always sends `{ "channel": "email", "recipient": "<signer email>" }`, as the API
+  requires, and returns `{ document, channel, recipient }`. `recipient:` (or the earlier `email:`) must be an email
+  address; calls without a recipient, with a `whatsapp` channel, or with a phone number now raise
+  `ValidationError`.
+- `SignerDocumentResource#list` and `#search` require the signer access code and never send workspace
+  credentials. Calls that relied on omitting the code to use the API key now raise `ValidationError`; switch them
+  to `#list_as_workspace` / `#search_as_workspace`.
+- `FieldResource#validate` and `#validate_multiple` raise `ValidationError` for an explicit `signer_access_code:
+  nil` instead of falling back to workspace credentials. Omitting the keyword still uses workspace credentials.
+- `AssignmentResource#estimate_cost` accepts payloads without `signers` or `entries`, which the API treats as
+  optional.
+- `DocumentResource#search` and `SignerDocumentResource#search` accept a `nil` search term and omit `search`.
+- `FieldResource#create` sends an explicit `regex: nil` as JSON `null`.
+- `DocumentResource#rename` rejects names longer than 255 characters before sending.
+
+## 1.11.0
+
+### Added
+
+- Webhook endpoints: `WebhookResource#list_endpoints`, `#create_endpoint`, `#get_endpoint`, `#update_endpoint`,
+  `#delete_endpoint`, `#endpoint_secret`, and `#rotate_endpoint_secret`. An account can have 1 endpoint, or up to 3
+  on paid plans, each with its own URL, events, and signing setting. Secrets cannot be read or rotated by OAuth
+  applications.
+- `WebhookResource#list_dispatches` accepts an `endpoint_id` filter.
+- `Assinafy::Support::WebhookVerifier#verify_delivery` verifies Assinafy's Standard Webhooks signatures
+  (`webhook-id`, `webhook-timestamp`, `webhook-signature`) with the endpoint's `whsec_` secret and rejects
+  timestamps more than 5 minutes off. It accepts Rails `request.headers`, a Rack env, or a plain Hash.
+- Two-factor authentication: `AuthResource#verify_mfa` completes a login that answered with an `mfa_token`, and
+  `#mfa_methods`, `#start_totp_enrollment`, `#confirm_totp_enrollment`, `#regenerate_recovery_codes`, and
+  `#delete_mfa_method` manage authenticator methods and recovery codes.
+- `SignerResource#create`, `#validate_create!`, and `Client#upload_and_request_signatures` send `government_id`,
+  so a `DigitalCertificate` signer can be created in one call.
+
+### Changed
+
+- `WebhookResource#register`, `#get`, and `#inactivate` act on the account's oldest webhook endpoint, and
+  `#register` rejects keys other than `url`, `email`, `events`, and `is_active`.
+- `WebhookVerifier#verify` remains for receivers whose own gateway signs bodies with a hex HMAC-SHA256.
+- `DocumentResource#upload` no longer takes a `name` option; the document is named after the uploaded file. Use
+  `#rename` to change it.
+- `DocumentResource#list` joins an Array `tags` filter into comma-separated tag IDs.
+- `TemplateResource#create` enforces the 25 MB upload limit.
+- `UserResource#stats` and `AccountResource#stats` validate `granularity` (`monthly` or `daily`) and `month`
+  (`YYYY-MM`) before sending.
+- `OAuthResource#authorization_server_metadata` accepts only absolute HTTPS URL overrides.
+- `Configuration#base_url=` and `#timeout=` validate their values like the constructor. The `User-Agent` header
+  is set on each request.
+- `DigitalCertificate` is documented at 0.5 credits per signer on top of its notification (breakdown code
+  `SignatureDigitalCertificate`), with verification and notification methods inferred from each other.
+- The guides cover the complete flow in order, including the two-factor login, OAuth refresh under a
+  per-connection lock, and a webhook receiver for Rails and Rack.
+
 ## 1.10.1
 
 - Update the pinned Ruby setup action to support Ruby 4.0.7 in CI and release workflows.
@@ -89,8 +152,7 @@ All notable changes to the `assinafy` Ruby gem are documented here.
   value as a `422` only after the request has been sent — and after any signers created for that
   assignment already exist.
 
-- `spec/fixtures/api_contract.json` tracks the current upstream contract (93 operations, 39
-  schemas), including the four OAuth operations.
+- `spec/fixtures/api_contract.json` tracks the upstream contract, including the four OAuth operations.
 
 ### Removed
 
@@ -176,8 +238,7 @@ All notable changes to the `assinafy` Ruby gem are documented here.
 
 - `SignerResource#accept_terms` and `#verify_email` now send `signer-access-code` as
   the documented query parameter (the `signerAccessCode` security scheme is `in: query`),
-  consistent with every other signer-authenticated endpoint. Previously it was sent
-  only in the request body.
+  consistent with every other signer-authenticated endpoint.
 - `TemplateResource#create` now performs the required `multipart/form-data` file
   upload. The previous JSON body was rejected by the API (HTTP 400) and never worked.
   Its signature is now `create(source, options = {}, account_id_override = nil)`.
@@ -219,8 +280,8 @@ documentation at <https://api.assinafy.com.br/v1/docs>.
   method, sourced from the live API and the docs.
 - Behavioral coverage: `spec/api_coverage_spec.rb` now also fails CI when a public
   endpoint wrapper is missing a matrix row, and asserts documented aliases still
-  resolve to their canonical methods. Behavioral WebMock specs were added for the
-  previously untested methods and for `Client#upload_and_request_signatures`.
+  resolve to their canonical methods. Behavioral WebMock specs cover the remaining
+  methods and `Client#upload_and_request_signatures`.
 
 ### Fixed