basecamp-sdk 0.10.0 → 0.12.0

data/lib/basecamp/oauth/oauth_error.rb

@@ -4,7 +4,9 @@ module Basecamp
   module Oauth
     # OAuth-specific error class.
     #
-    # @attr type [String] Error type ("validation", "auth", "network", "api_error")
+    # @attr type [String] Error type ("validation", "auth", "network",
+    #   "api_error", or "usage" — the parent type {DeviceFlowError} derives for
+    #   a cancelled device flow)
     # @attr http_status [Integer, nil] HTTP status code if applicable
     # @attr hint [String, nil] Helpful hint for resolving the error
     # @attr retryable [Boolean] Whether the request can be retried

data/lib/basecamp/oauth/refresh_request.rb

@@ -9,19 +9,25 @@ module Basecamp
     # @attr client_id [String, nil] The client identifier (optional)
     # @attr client_secret [String, nil] The client secret (optional)
     # @attr use_legacy_format [Boolean] Use Launchpad's non-standard token format
+    # @attr resource [String, nil] RFC 8707 resource indicator to bind the
+    #   refreshed token to, sent only when set. Echo the stored token's
+    #   resource: BC5 multi-account refresh tokens hard-require it (SPEC §16).
+    #   Appended last so earlier members keep their positions.
     RefreshRequest = Data.define(
       :token_endpoint,
       :refresh_token,
       :client_id,
       :client_secret,
-      :use_legacy_format
+      :use_legacy_format,
+      :resource
     ) do
       def initialize(
         token_endpoint:,
         refresh_token:,
         client_id: nil,
         client_secret: nil,
-        use_legacy_format: false
+        use_legacy_format: false,
+        resource: nil
       )
         super
       end

data/lib/basecamp/oauth/resource.rb

@@ -5,25 +5,28 @@ module Basecamp
     # Fetches RFC 9728 protected-resource metadata (hop 1 of resource-first
     # discovery) and binds the returned +resource+ to the requested origin.
     class Resource
-      # @param http_client [Faraday::Connection, nil] HTTP client (SSRF-hardened default if nil)
-      # @param timeout [Integer] request timeout in seconds (default: 10)
+      # @param http_client [Faraday::Connection, nil] injected Faraday client
+      #   (kept, verified redirect-free); nil selects the default headers-first
+      #   Net::HTTP transport ({Fetcher.stream_http})
+      # @param timeout [Numeric] request timeout in seconds (default: 10); an
+      #   invalid value falls back via {Fetcher.normalize_timeout}
       # @param max_body_bytes [Integer] bounded read cap in bytes
       def initialize(http_client: nil, timeout: 10, max_body_bytes: Fetcher::DEFAULT_MAX_BODY_BYTES)
         Fetcher.ensure_redirects_suppressed!(http_client) if http_client
-        # Normalize before building the client and before the fetch computes its
+        # Normalize before storing (nil selects the headers-first Net::HTTP
+        # transport; an injected client is kept) and before the fetch computes its
         # wall-clock deadline: a non-finite/non-positive timeout must not disable
         # either bound (see Fetcher.normalize_timeout).
         @timeout = Fetcher.normalize_timeout(timeout)
-        @http_client = http_client || Fetcher.build_client(@timeout)
+        # nil selects the headers-first {Fetcher.stream_http} transport (total
+        # wall-clock bound incl. the header phase); an injected connection keeps
+        # the Faraday path, verified redirect-free above.
+        @http_client = http_client
         # Normalize the public cap to a finite non-negative Integer: a nil, float,
         # or Float::INFINITY would otherwise disable the streaming memory bound
         # (an infinite/undefined cap never trips), reintroducing an SSRF/OOM risk.
-        @max_body_bytes =
-          if max_body_bytes.is_a?(Integer) && max_body_bytes >= 0
-            max_body_bytes
-          else
-            Fetcher::DEFAULT_MAX_BODY_BYTES
-          end
+        # Shared with Discovery and the device flow.
+        @max_body_bytes = Fetcher.normalize_body_cap(max_body_bytes)
       end
 
       # Discovers protected-resource metadata from

data/lib/basecamp/oauth/token.rb

@@ -10,13 +10,18 @@ module Basecamp
     # @attr expires_in [Integer, nil] Lifetime of the access token in seconds
     # @attr expires_at [Time, nil] Calculated expiration time
     # @attr scope [String, nil] OAuth scope granted
+    # @attr resource [String, nil] RFC 8707 resource indicator the token is
+    #   bound to (BC5: +urn:bc:account:<id>+). Echo it when refreshing —
+    #   BC5 multi-account refresh tokens reject a refresh without it
+    #   (SPEC §16). Appended last so earlier members keep their positions.
     Token = Data.define(
       :access_token,
       :token_type,
       :refresh_token,
       :expires_in,
       :expires_at,
-      :scope
+      :scope,
+      :resource
     ) do
       def initialize(
         access_token:,
@@ -24,7 +29,8 @@ module Basecamp
         refresh_token: nil,
         expires_in: nil,
         expires_at: nil,
-        scope: nil
+        scope: nil,
+        resource: nil
       )
         # Calculate expires_at from expires_in if not provided
         calculated_expires_at = expires_at || (expires_in ? Time.now + expires_in : nil)
@@ -34,7 +40,8 @@ module Basecamp
           refresh_token: refresh_token,
           expires_in: expires_in,
           expires_at: calculated_expires_at,
-          scope: scope
+          scope: scope,
+          resource: resource
         )
       end
 

data/lib/basecamp/oauth.rb

@@ -133,12 +133,12 @@ module Basecamp
     def self.refresh_token(
       token_endpoint:, refresh_token:,
       client_id: nil, client_secret: nil,
-      use_legacy_format: false, timeout: 30
+      use_legacy_format: false, timeout: 30, resource: nil
     )
       request = RefreshRequest.new(
         token_endpoint: token_endpoint, refresh_token: refresh_token,
         client_id: client_id, client_secret: client_secret,
-        use_legacy_format: use_legacy_format
+        use_legacy_format: use_legacy_format, resource: resource
       )
       Exchange.new(timeout: timeout).refresh(request)
     end
@@ -147,6 +147,51 @@ module Basecamp
       token.expired?(buffer_seconds)
     end
 
+    # Requests an RFC 8628 device/user code pair. Thin delegator to
+    # {DeviceFlow.request_device_authorization}.
+    #
+    # @return [DeviceAuthorization]
+    def self.request_device_authorization(device_authorization_endpoint:, client_id:, scope: nil, timeout: DeviceFlow::DEVICE_REQUEST_TIMEOUT)
+      DeviceFlow.request_device_authorization(
+        device_authorization_endpoint: device_authorization_endpoint,
+        client_id: client_id, scope: scope, timeout: timeout
+      )
+    end
+
+    # Polls the token endpoint for a device grant (RFC 8628 §3.5). Thin delegator
+    # to {DeviceFlow.poll_device_token}; +clock+, +sleeper+, and +cancelled+ are
+    # injectable for tests.
+    #
+    # @return [Token]
+    def self.poll_device_token(
+      token_endpoint:, client_id:, device_code:, interval:, expires_in:,
+      clock: DeviceFlow::DEFAULT_CLOCK, sleeper: DeviceFlow::DEFAULT_SLEEPER,
+      cancelled: DeviceFlow::DEFAULT_CANCELLED, timeout: DeviceFlow::DEVICE_REQUEST_TIMEOUT,
+      deadline_at: nil
+    )
+      DeviceFlow.poll_device_token(
+        token_endpoint: token_endpoint, client_id: client_id,
+        device_code: device_code, interval: interval, expires_in: expires_in,
+        clock: clock, sleeper: sleeper, cancelled: cancelled, timeout: timeout,
+        deadline_at: deadline_at
+      )
+    end
+
+    # Runs the full device authorization grant against an already-selected
+    # {Config} (RFC 8628). Thin delegator to {DeviceFlow.perform_device_login}.
+    #
+    # @return [Token]
+    def self.perform_device_login(
+      config:, client_id:, display:, scope: nil,
+      clock: DeviceFlow::DEFAULT_CLOCK, sleeper: DeviceFlow::DEFAULT_SLEEPER,
+      cancelled: DeviceFlow::DEFAULT_CANCELLED, timeout: DeviceFlow::DEVICE_REQUEST_TIMEOUT
+    )
+      DeviceFlow.perform_device_login(
+        config: config, client_id: client_id, display: display, scope: scope,
+        clock: clock, sleeper: sleeper, cancelled: cancelled, timeout: timeout
+      )
+    end
+
     # Selects an issuer from the advertised set and — once a BC5 issuer is
     # committed — binds its AS metadata. From this point on, every failure is
     # fatal: no Launchpad request may be issued.

data/lib/basecamp/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Basecamp
-  VERSION = "0.10.0"
-  API_VERSION = "2026-07-28"
+  VERSION = "0.12.0"
+  API_VERSION = "2026-07-31"
 end

data/scripts/generate-services.rb

@@ -116,7 +116,7 @@ class ServiceGenerator
       'ClientVisibility' => %w[SetClientVisibility]
     },
     'Todos' => {
-      'Todos' => %w[ListTodos CreateTodo GetTodo ReplaceTodo CompleteTodo UncompleteTodo TrashTodo],
+      'Todos' => %w[ListTodos CreateTodo CreateTodosetTodo GetTodo ReplaceTodo CompleteTodo UncompleteTodo TrashTodo],
       'Todolists' => %w[GetTodolistOrGroup UpdateTodolistOrGroup ListTodolists CreateTodolist RepositionTodolist],
       'Todosets' => %w[GetTodoset],
       'HillCharts' => %w[GetHillChart UpdateHillChartSettings],
@@ -818,9 +818,9 @@ class ServiceGenerator
     if op[:query_params].any?
       param_names = op[:query_params].map { |q| "#{to_snake_case(q[:name])}: #{to_snake_case(q[:name])}" }
       lines << "        params = compact_query_params(#{param_names.join(', ')})"
-      lines << "        paginate(#{path_expr}, params: params)"
+      lines << "        paginate(#{path_expr}, params: params, operation: \"#{op[:operation_id]}\")"
     else
-      lines << "        paginate(#{path_expr})"
+      lines << "        paginate(#{path_expr}, operation: \"#{op[:operation_id]}\")"
     end
 
     lines
@@ -832,9 +832,9 @@ class ServiceGenerator
     if op[:query_params].any?
       param_names = op[:query_params].map { |q| "#{to_snake_case(q[:name])}: #{to_snake_case(q[:name])}" }
       lines << "        params = compact_query_params(#{param_names.join(', ')})"
-      lines << "        paginate_wrapped(#{path_expr}, key: \"#{pagination_key}\", params: params)"
+      lines << "        paginate_wrapped(#{path_expr}, key: \"#{pagination_key}\", params: params, operation: \"#{op[:operation_id]}\")"
     else
-      lines << "        paginate_wrapped(#{path_expr}, key: \"#{pagination_key}\")"
+      lines << "        paginate_wrapped(#{path_expr}, key: \"#{pagination_key}\", operation: \"#{op[:operation_id]}\")"
     end
 
     lines
@@ -843,6 +843,9 @@ class ServiceGenerator
   def generate_get_method_body(op, path_expr)
     lines = []
     http_method = op[:http_method].downcase
+    # Only GETs are retry-governed in Ruby, and only Http#get accepts the
+    # operation keyword — mutations go through single_request with no retry.
+    operation_arg = http_method == 'get' ? ", operation: \"#{op[:operation_id]}\"" : ''
 
     if op[:has_binary_body]
       # Binary upload - use raw body and set Content-Type header
@@ -863,9 +866,9 @@ class ServiceGenerator
       lines << "        http_#{http_method}(#{path_expr}, body: #{body_expr}).json"
     elsif op[:query_params].any?
       param_names = op[:query_params].map { |q| "#{to_snake_case(q[:name])}: #{to_snake_case(q[:name])}" }
-      lines << "        http_#{http_method}(#{path_expr}, params: compact_query_params(#{param_names.join(', ')})).json"
+      lines << "        http_#{http_method}(#{path_expr}, params: compact_query_params(#{param_names.join(', ')})#{operation_arg}).json"
     else
-      lines << "        http_#{http_method}(#{path_expr}).json"
+      lines << "        http_#{http_method}(#{path_expr}#{operation_arg}).json"
     end
 
     lines

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: basecamp-sdk
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.12.0
 platform: ruby
 authors:
 - Basecamp
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-29 00:00:00.000000000 Z
+date: 2026-08-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -182,7 +182,9 @@ files:
 - lib/basecamp/generated/services/attachments_service.rb
 - lib/basecamp/generated/services/automation_service.rb
 - lib/basecamp/generated/services/base_service.rb
+- lib/basecamp/generated/services/bookmarks_service.rb
 - lib/basecamp/generated/services/boosts_service.rb
+- lib/basecamp/generated/services/calendars_service.rb
 - lib/basecamp/generated/services/campfires_service.rb
 - lib/basecamp/generated/services/card_columns_service.rb
 - lib/basecamp/generated/services/card_steps_service.rb
@@ -195,6 +197,7 @@ files:
 - lib/basecamp/generated/services/client_visibility_service.rb
 - lib/basecamp/generated/services/comments_service.rb
 - lib/basecamp/generated/services/documents_service.rb
+- lib/basecamp/generated/services/drafts_service.rb
 - lib/basecamp/generated/services/events_service.rb
 - lib/basecamp/generated/services/everything_service.rb
 - lib/basecamp/generated/services/forwards_service.rb
@@ -205,6 +208,7 @@ files:
 - lib/basecamp/generated/services/message_types_service.rb
 - lib/basecamp/generated/services/messages_service.rb
 - lib/basecamp/generated/services/my_assignments_service.rb
+- lib/basecamp/generated/services/my_notes_service.rb
 - lib/basecamp/generated/services/my_notifications_service.rb
 - lib/basecamp/generated/services/people_service.rb
 - lib/basecamp/generated/services/projects_service.rb
@@ -234,6 +238,9 @@ files:
 - lib/basecamp/not_found_error.rb
 - lib/basecamp/oauth.rb
 - lib/basecamp/oauth/config.rb
+- lib/basecamp/oauth/device_authorization.rb
+- lib/basecamp/oauth/device_flow.rb
+- lib/basecamp/oauth/device_flow_error.rb
 - lib/basecamp/oauth/discovery.rb
 - lib/basecamp/oauth/discovery_result.rb
 - lib/basecamp/oauth/discovery_selection_error.rb