assinafy 1.5.1 → 1.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae7a039c9b9f51e0926dbd829524cd2f419896b16f1fdfce360ec6cabc967e8b
-  data.tar.gz: de10da88b9213af201bc2e9fa12a72ef314fec4dd3ca67002c84d7a47fe08198
+  metadata.gz: 37dc8933996b9192a9f12896d772d4d5f745169fcaf0bb13b06cd199e4650bcd
+  data.tar.gz: 70fe0b92c876f387aeb3656f18b0e78d3cbc09d41dbefc73bba96bb6177b423b
 SHA512:
-  metadata.gz: 12555ae0c37c4105795b3187261023fd90da12c5f2cd07f2d95f0512100ad1d2ffe4fa568a9c5166cc61ae0ee3a293c8297462c3cb7c77e8344cda517d76ba04
-  data.tar.gz: 7e4f03a2f86ed9a0257de5585b01a4e08fa2e534d65ce9fb56b137c6ab14da1cdb237031d02e0f39061c5eefe0a7bb2d5057ca9f5cc64e36ddb3fa3cc053b3f9
+  metadata.gz: 5bd2d4cfc525e22c84d4de1cc232f4666b769bcdd66e21d56397ad1c4a61bc1c482a7a9b183dcadfde1bd098e624ada2776f847e2c55fcf65e43d20f89437d34
+  data.tar.gz: 4586c42fc917ef30c6e7eef7718310fd583ce2817acecdf2de5f3f972b405e8986c9a474aa5dbdd9f3c476b2651a700c641471c8154d710e85f2ba4c7c7ebbc1

data/CHANGELOG.md

@@ -2,6 +2,25 @@
 
 All notable changes to the `assinafy` Ruby gem are documented here.
 
+## 1.5.2
+
+### Fixed
+
+- `base_url` must now be an absolute `http`/`https` URL with a host. Other schemes, scheme-less
+  hosts, and relative paths raise `Assinafy::ValidationError` at construction instead of sending
+  credentials to them or surfacing a raw `URI::InvalidURIError`.
+- `AssignmentResource.build_payload` now rejects a non-String `message` or `expires_at` and a
+  `copy_receivers` value that is not an array of non-empty signer IDs, instead of forwarding them
+  to the API verbatim.
+- `Client#upload_and_request_signatures` validates the whole assignment body before uploading, so
+  malformed `message`, `expires_at`, or `copy_receivers` values no longer leave an uploaded
+  document and freshly created signers behind.
+
+### Changed
+
+- Authentication and API-key operations route through the shared resource request helpers used by
+  every other resource.
+
 ## 1.5.1
 
 ### Added

data/README.md

@@ -84,9 +84,12 @@ client = Assinafy::Client.new(
 - `token:` sends `Authorization: Bearer ...` (legacy session token).
 - Configure exactly one credential. If both are supplied, the SDK sends only `X-Api-Key`.
 - A client can also be created with no credentials for authentication and public/signer endpoints.
+- `base_url:` must be an absolute `http`/`https` URL. Anything else — a scheme-less host, a relative path, or
+  another scheme — raises `Assinafy::ValidationError` instead of attaching your credentials to it. A trailing
+  slash is stripped.
 - Account-scoped methods document a per-call account override for multi-workspace tenants.
 - Provide a `Logger`-compatible `logger:` to observe upload/assignment/webhook lifecycle messages.
-- Requests send `User-Agent: Assinafy-Ruby-SDK/v1.5.1`; the suffix always follows `Assinafy::VERSION`.
+- Requests send `User-Agent: Assinafy-Ruby-SDK/v<Assinafy::VERSION>`; the suffix always follows the gem version.
 
 `Client.from_config(hash)` accepts string- or symbol-keyed hashes (e.g. parsed YAML).
 

data/docs/API_REFERENCE.md

@@ -168,6 +168,23 @@ environment before making these operations part of a critical workflow.
 | DELETE | `/v1/accounts/{account_id}/templates/{template_id}` | `TemplateResource#delete` | Bearer token or `X-Api-Key` | No request body; returns `nil` on success. |
 | GET | `/v1/accounts/{account_id}/templates/{template_id}/pages/{page_id}/download` | `TemplateResource#download_page` | Bearer token or `X-Api-Key` | No request body; returns binary image bytes. |
 
+### Assignment listing
+
+`GET /v1/assignments` needs an account context that the machine contract does not list. The SDK supplies it as
+the camelCase `accountId` query parameter (`AssignmentResource#list`), taken from the client default or the
+per-call override.
+
+### Assignment optional fields
+
+`message` and `expires_at` must be strings, and `copy_receivers` must be an array of non-empty signer IDs.
+`AssignmentResource.build_payload` rejects other shapes locally, so `Client#upload_and_request_signatures`
+fails before it uploads a document or creates signers.
+
+### Base URL
+
+`base_url` must be an absolute `http`/`https` URL with a host. Other schemes, scheme-less hosts, and relative
+paths raise `Assinafy::ValidationError` at construction rather than sending credentials to them.
+
 ### Document tags
 
 `DocumentResource#replace_tags` and `#append_tags` accept arrays of tag IDs. The deployed sandbox also accepts

data/lib/assinafy/client.rb

@@ -193,6 +193,13 @@ module Assinafy
                                       copy_receivers: nil, account_id: nil)
       validate_signature_workflow!(signers, wait_for_ready)
 
+      # Placeholder IDs stand in for the signers created below, so the whole
+      # assignment body is validated before anything is uploaded or created.
+      assignment_payload = { method: 'virtual', signers: Array.new(signers.length, 'preflight'),
+                             message: message, expires_at: expires_at,
+                             copy_receivers: copy_receivers }
+      Resources::AssignmentResource.build_payload(assignment_payload)
+
       @logger.info("Starting upload and signature workflow for #{signers.length} signer(s)")
 
       upload_opts = account_id.nil? ? {} : { account_id: account_id }
@@ -205,10 +212,7 @@ module Assinafy
           signer_ids << signer_id!(@signers.create(signer, account_id))
         end
 
-        assignment_payload = { method: 'virtual', signers: signer_ids,
-                               message: message, expires_at: expires_at,
-                               copy_receivers: copy_receivers }
-        assignment = @assignments.create(document['id'], assignment_payload)
+        assignment = @assignments.create(document['id'], assignment_payload.merge(signers: signer_ids))
         created_resource_id!(assignment, 'Assignment')
 
         @logger.info("Upload and signature workflow completed for document #{document['id']}")

data/lib/assinafy/configuration.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'uri'
+
 require_relative 'errors'
 
 module Assinafy
@@ -24,6 +26,9 @@ module Assinafy
     DEFAULT_BASE_URL = 'https://api.assinafy.com.br/v1'
     # Default Faraday open/read timeout, in seconds.
     DEFAULT_TIMEOUT  = 30
+    # Schemes accepted for {#base_url}. Credentials are attached to every request
+    # sent to this host, so anything that is not absolute HTTP(S) is rejected.
+    BASE_URL_SCHEMES = %w[http https].freeze
 
     # @!attribute [rw] api_key
     #   @return [String, nil] sent as `X-Api-Key`
@@ -65,17 +70,17 @@ module Assinafy
     # @example Trailing slash on base_url is stripped
     #   Assinafy::Configuration.new(base_url: 'https://api.assinafy.com.br/v1/').base_url
     #   # => "https://api.assinafy.com.br/v1"
+    #
+    # @example A base_url that is not an absolute http(s) URL is rejected
+    #   Assinafy::Configuration.new(base_url: 'api.assinafy.com.br/v1')
+    #   # raises Assinafy::ValidationError ("Base URL must be an absolute http(s) URL")
     def initialize(api_key: nil, token: nil, account_id: nil,
                    base_url: DEFAULT_BASE_URL, webhook_secret: nil,
                    timeout: DEFAULT_TIMEOUT, logger: nil)
       @api_key        = api_key
       @token          = token
       @account_id     = account_id
-      raise ValidationError.new('Base URL is required') unless base_url.is_a?(String)
-
-      @base_url = base_url.strip.sub(%r{/+\z}, '')
-      raise ValidationError.new('Base URL is required') if @base_url.empty?
-
+      @base_url       = normalize_base_url(base_url)
       @webhook_secret = webhook_secret
       @timeout        = normalize_timeout(timeout)
       @logger         = logger
@@ -146,6 +151,25 @@ module Assinafy
 
     private
 
+    # Strip the trailing slash and require an absolute http(s) URL with a host.
+    # Without this the SDK would happily attach `X-Api-Key` to an `ftp:` or
+    # scheme-less base, or surface a raw URI::InvalidURIError from Faraday.
+    def normalize_base_url(value)
+      raise ValidationError.new('Base URL is required') unless value.is_a?(String)
+
+      url = value.strip.sub(%r{/+\z}, '')
+      raise ValidationError.new('Base URL is required') if url.empty?
+
+      uri = URI.parse(url)
+      unless BASE_URL_SCHEMES.include?(uri.scheme) && !uri.host.to_s.empty?
+        raise ValidationError.new('Base URL must be an absolute http(s) URL', { base_url: value })
+      end
+
+      url
+    rescue URI::InvalidURIError => e
+      raise ValidationError.new("Base URL is not a valid URL: #{e.message}", { base_url: value })
+    end
+
     def normalize_timeout(value)
       raw = value.nil? ? DEFAULT_TIMEOUT : value
       seconds = Integer(raw, exception: false) if raw.is_a?(Integer) || raw.is_a?(String)

data/lib/assinafy/resources/assignment_resource.rb

@@ -79,6 +79,7 @@ module Assinafy
           method  = (p[:method] || 'virtual').to_s
 
           validate_method!(method, signers, entries, p)
+          validate_optional_fields!(p)
 
           result = { method: method }
           result[:signers] = signers.map { |ref| normalise_signer_ref(ref, options) } unless signers.empty?
@@ -106,6 +107,28 @@ module Assinafy
           raise ValidationError.new('entries are required for collect assignments')
         end
 
+        # `message`/`expires_at`/`copy_receivers` are forwarded verbatim, so a
+        # wrong type here would only fail server-side — after the caller has
+        # already uploaded a document and created signers.
+        def validate_optional_fields!(payload)
+          %i[message expires_at].each do |key|
+            value = payload[key]
+            next if value.nil? || value.is_a?(String)
+
+            raise ValidationError.new("#{key} must be a String", { key => value })
+          end
+
+          receivers = payload[:copy_receivers]
+          return if receivers.nil?
+
+          unless receivers.is_a?(Array) && receivers.all? { |id| id.is_a?(String) && !id.strip.empty? }
+            raise ValidationError.new(
+              'copy_receivers must be an Array of signer IDs',
+              { copy_receivers: receivers }
+            )
+          end
+        end
+
         def extract_signer_refs(payload)
           return payload[:signers] if payload[:signers].is_a?(Array) && !payload[:signers].empty?
 

data/lib/assinafy/resources/auth_resource.rb

@@ -98,7 +98,7 @@ module Assinafy
       #   # => nil
       def link_social_login(provider:, token:)
         call('Failed to link social login') do
-          @connection.post('auth/link-social-login', body_params(provider: provider, token: token))
+          http_post('auth/link-social-login', body_params(provider: provider, token: token))
         end
       end
 
@@ -122,7 +122,7 @@ module Assinafy
       #   # { "api_key" => "api-key-created-once" }
       def create_api_key(password:)
         call('Failed to create API key') do
-          @connection.post('users/api-keys', body_params(password: password))
+          http_post('users/api-keys', body_params(password: password))
         end
       end
 
@@ -146,7 +146,7 @@ module Assinafy
       #   resource.get_api_key # => nil
       def get_api_key
         call('Failed to get API key') do
-          @connection.get('users/api-keys')
+          http_get('users/api-keys')
         end
       end
 
@@ -168,7 +168,7 @@ module Assinafy
       #   # => nil
       def delete_api_key
         call_void('Failed to delete API key') do
-          @connection.delete('users/api-keys')
+          http_delete('users/api-keys')
         end
       end
 
@@ -192,7 +192,7 @@ module Assinafy
       #   # { "email" => "user@example.com" }
       def change_password(email:, password:, new_password:)
         call('Failed to change password') do
-          @connection.put(
+          http_put(
             'authentication/change-password',
             body_params(email: email, password: password, new_password: new_password)
           )

data/lib/assinafy/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Assinafy
-  VERSION = '1.5.1'
+  VERSION = '1.5.2'
   USER_AGENT = "Assinafy-Ruby-SDK/v#{VERSION}".freeze
 end

data/sig/assinafy.rbs

@@ -68,6 +68,7 @@ module Assinafy
   class Configuration
     DEFAULT_BASE_URL: String
     DEFAULT_TIMEOUT: Integer
+    BASE_URL_SCHEMES: Array[String]
 
     attr_accessor api_key: String?
     attr_accessor token: String?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: assinafy
 version: !ruby/object:Gem::Version
-  version: 1.5.1
+  version: 1.5.2
 platform: ruby
 authors:
 - Assinafy SDK Contributors