assinafy 1.9.0 → 1.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c202496157dd16d5ae51e1e6416ca30ab0d6ec3665ffa6dead88219214c82b8
-  data.tar.gz: 9c07ecf32a3c9e9e94d964d56f6f38dc8c670d2cc011059d4c14409e79972b9e
+  metadata.gz: 97dcce395cbee3bd4a632650550becfd07d6fa291da434678d1a31de4488d103
+  data.tar.gz: 4cde25cfc6221e23378892c4fa19d7779046b65642bc33dc734756f712c2aab8
 SHA512:
-  metadata.gz: 4bd51928265eb56100d62653932be2145442efb23e4708007070a027aeaff0e96678014c4d2a5b39ca2a9dcb37c6a13e5caf3b16798e28b6ad2ad535ef937068
-  data.tar.gz: 7c1c6a6f07f0794b685b414195161f9832c74e9e196adff5f8713b26b44d7b94c188651184144af0b7393ad8bfea97d601a0e350c7165d2a4709356bcda0743a
+  metadata.gz: 437fad120c4ec641767a2241f0e03589e14ea31b3407b603c85e7284476526711cd8d8f8732573d2ab4348aa9387cbfa077e43061ff91e1728eeda766b6c51f2
+  data.tar.gz: 9c2e1b81591e038d449145fa3f97f7b2b90f98fbfede435f01cd14fbfbb6b9d62805df762e39a01c0e9de7a8d9e729371d3b88e63b5049fb7ac29b0c10d01b88

data/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 All notable changes to the `assinafy` Ruby gem are documented here.
 
+## 1.11.0
+
+### Added
+
+- Webhook endpoints: `WebhookResource#list_endpoints`, `#create_endpoint`, `#get_endpoint`, `#update_endpoint`,
+  `#delete_endpoint`, `#endpoint_secret`, and `#rotate_endpoint_secret`. An account can have 1 endpoint, or up to 3
+  on paid plans, each with its own URL, events, and signing setting. Secrets cannot be read or rotated by OAuth
+  applications.
+- `WebhookResource#list_dispatches` accepts an `endpoint_id` filter.
+- `Assinafy::Support::WebhookVerifier#verify_delivery` verifies Assinafy's Standard Webhooks signatures
+  (`webhook-id`, `webhook-timestamp`, `webhook-signature`) with the endpoint's `whsec_` secret and rejects
+  timestamps more than 5 minutes off. It accepts Rails `request.headers`, a Rack env, or a plain Hash.
+- Two-factor authentication: `AuthResource#verify_mfa` completes a login that answered with an `mfa_token`, and
+  `#mfa_methods`, `#start_totp_enrollment`, `#confirm_totp_enrollment`, `#regenerate_recovery_codes`, and
+  `#delete_mfa_method` manage authenticator methods and recovery codes.
+- `SignerResource#create`, `#validate_create!`, and `Client#upload_and_request_signatures` send `government_id`,
+  so a `DigitalCertificate` signer can be created in one call.
+
+### Changed
+
+- `WebhookResource#register`, `#get`, and `#inactivate` act on the account's oldest webhook endpoint, and
+  `#register` rejects keys other than `url`, `email`, `events`, and `is_active`.
+- `WebhookVerifier#verify` remains for receivers whose own gateway signs bodies with a hex HMAC-SHA256.
+- `DocumentResource#upload` no longer takes a `name` option; the document is named after the uploaded file. Use
+  `#rename` to change it.
+- `DocumentResource#list` joins an Array `tags` filter into comma-separated tag IDs.
+- `TemplateResource#create` enforces the 25 MB upload limit.
+- `UserResource#stats` and `AccountResource#stats` validate `granularity` (`monthly` or `daily`) and `month`
+  (`YYYY-MM`) before sending.
+- `OAuthResource#authorization_server_metadata` accepts only absolute HTTPS URL overrides.
+- `Configuration#base_url=` and `#timeout=` validate their values like the constructor. The `User-Agent` header
+  is set on each request.
+- `DigitalCertificate` is documented at 0.5 credits per signer on top of its notification (breakdown code
+  `SignatureDigitalCertificate`), with verification and notification methods inferred from each other.
+- The guides cover the complete flow in order, including the two-factor login, OAuth refresh under a
+  per-connection lock, and a webhook receiver for Rails and Rack.
+
+## 1.10.1
+
+- Update the pinned Ruby setup action to support Ruby 4.0.7 in CI and release workflows.
+
+## 1.10.0
+
+- Support the RFC 8693 token-exchange grant for Assinafy-provisioned internal service clients.
+- Validate OAuth grant parameters, PKCE challenges, authorization URLs, and token response shapes.
+- Validate assignment deadlines, notification and verification method combinations, and signing steps before requests.
+- Validate template role and signer IDs, distinct role assignments, and editor field payloads before document creation.
+- Validate contact addresses, scalar payload fields, decline-reason lengths, and finite polling intervals consistently.
+- Expand the document workflow guides, OAuth integration instructions, and API schema reference.
+- Use Ruby 4.0.7 for the development and release toolchain.
+
 ## 1.9.0
 
 - `OAuthResource#refresh`, and `#token` with the `refresh_token` grant, raise `Assinafy::Error` instead of
@@ -75,8 +126,7 @@ All notable changes to the `assinafy` Ruby gem are documented here.
   value as a `422` only after the request has been sent — and after any signers created for that
   assignment already exist.
 
-- `spec/fixtures/api_contract.json` tracks the current upstream contract (93 operations, 39
-  schemas), including the four OAuth operations.
+- `spec/fixtures/api_contract.json` tracks the upstream contract, including the four OAuth operations.
 
 ### Removed
 
@@ -162,8 +212,7 @@ All notable changes to the `assinafy` Ruby gem are documented here.
 
 - `SignerResource#accept_terms` and `#verify_email` now send `signer-access-code` as
   the documented query parameter (the `signerAccessCode` security scheme is `in: query`),
-  consistent with every other signer-authenticated endpoint. Previously it was sent
-  only in the request body.
+  consistent with every other signer-authenticated endpoint.
 - `TemplateResource#create` now performs the required `multipart/form-data` file
   upload. The previous JSON body was rejected by the API (HTTP 400) and never worked.
   Its signature is now `create(source, options = {}, account_id_override = nil)`.
@@ -205,8 +254,8 @@ documentation at <https://api.assinafy.com.br/v1/docs>.
   method, sourced from the live API and the docs.
 - Behavioral coverage: `spec/api_coverage_spec.rb` now also fails CI when a public
   endpoint wrapper is missing a matrix row, and asserts documented aliases still
-  resolve to their canonical methods. Behavioral WebMock specs were added for the
-  previously untested methods and for `Client#upload_and_request_signatures`.
+  resolve to their canonical methods. Behavioral WebMock specs cover the remaining
+  methods and `Client#upload_and_request_signatures`.
 
 ### Fixed