basecamp-sdk 0.23.0 → 0.24.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 970062728951b90280186908c54935e720d7297edf23230a9f0a7ccc57804376
-  data.tar.gz: d26a1714e8e59778e2563180531d0835f274f53bdab6f2ebf0edba8d79ab353f
+  metadata.gz: f300a3079488142de429c2df9e1abe31178cfa71ce8dbaddbf98d1d6b641c977
+  data.tar.gz: c277cb71684ca7ee5e60c165a79be00bd3ae123401295ae09f2be5dc072875b2
 SHA512:
-  metadata.gz: 8d7e0cda0be190fbc8d4d40cbe27529b45cc2226e462154dfe2509b80acaf2295da8a1593f1832defd0003b7ff59971df9f416c82ab6adf2ef8094cb29a0aa9d
-  data.tar.gz: d7fb5dfdb49af2eef1740528ef96a88801d0c8e66ef0dc025fc8c9e848456b414fa5187ce56bbaff7fdffdc3967cdb1272325e83ff39f287ffb8d7f8c7ec59e7
+  metadata.gz: 5c609aa069c11cc436de1d503cc165fca51bebad3f10024b81dd3a4b9774b96f14e1fe8b9c6bf3171ef6a38dd22584acca22fac2ea028c4eec6361ce4b17fdf9
+  data.tar.gz: 90662d68fa6fe592b284ec2767f21a59bd8d94571958e96cb7df50ce2aeb4e8c80daf26aa7afafd7551e66715e7ba938b8d22b103756aa3931ac74f1fe61d0ec

data/lib/basecamp/oauth/exchange.rb

@@ -288,9 +288,16 @@ module Basecamp
       end
 
       def parse_token_response(status, body)
-        data = JSON.parse(body)
+        # A failed request is classified from its status and OAuth error
+        # object BEFORE the body is parsed as a token: a refusal whose body is
+        # not JSON (a bare 401, an HTML error page) must surface as that
+        # refusal, not as a malformed token response.
+        handle_error_response(status, body) unless (200..299).cover?(status)
 
-        handle_error_response(status, data) unless (200..299).cover?(status)
+        data = JSON.parse(body)
+        unless data.is_a?(Hash)
+          raise OauthError.new("api_error", "Token response is not a JSON object", http_status: status)
+        end
 
         unless data["access_token"].is_a?(String) && !data["access_token"].empty?
           raise OauthError.new(
@@ -344,20 +351,49 @@ module Basecamp
         ), cause: nil
       end
 
-      def handle_error_response(status, data)
-        error_msg = Basecamp::Security.truncate(data["error_description"] || data["error"] || "Token request failed")
-
-        if status == 401 || data["error"] == "invalid_grant"
+      # The OAuth error codes a caller resolves by signing in again: the grant
+      # is invalid, expired or revoked (+invalid_grant+), the client failed to
+      # authenticate (+invalid_client+) or may not use this grant
+      # (+unauthorized_client+), or the resource owner refused
+      # (+access_denied+). Classified by code, not status: RFC 6749 §5.2
+      # answers +invalid_client+ with a 400 unless the client authenticated
+      # through the Authorization header, so a 401 cannot be the only signal.
+      # Matches every other SDK's token endpoint (conformance/oauth-token).
+      AUTH_ERROR_CODES = %w[invalid_grant invalid_client unauthorized_client access_denied].freeze
+
+      # Classifies a non-2xx token endpoint response: "auth" for an error code
+      # in AUTH_ERROR_CODES on any status, or for any 401 whatever its body
+      # (Launchpad and other servers refuse with a bare status); "api_error"
+      # for everything else. The body is read only for the RFC 6749 +error+
+      # and +error_description+ members and is never echoed — a body that is
+      # not an OAuth error object contributes nothing.
+      def handle_error_response(status, body)
+        data = oauth_error_object(body)
+        error_code = data["error"] if data["error"].is_a?(String)
+        description = data["error_description"] if data["error_description"].is_a?(String)
+        error_msg = Basecamp::Security.truncate(description || error_code || "Token request failed")
+
+        if status == 401 || AUTH_ERROR_CODES.include?(error_code)
           raise OauthError.new(
             "auth",
             error_msg,
             http_status: status,
-            hint: "The authorization code or refresh token may be invalid or expired"
+            hint: "The authorization server refused this grant or client: authorize again, or check the client credentials"
           )
         end
 
         raise OauthError.new("api_error", error_msg, http_status: status)
       end
+
+      # The response body as an OAuth error object, or {} when it is not one.
+      # The parser error is discarded, never chained: its message embeds the
+      # offending input.
+      def oauth_error_object(body)
+        parsed = JSON.parse(body)
+        parsed.is_a?(Hash) ? parsed : {}
+      rescue JSON::ParserError
+        {}
+      end
     end
   end
 end

data/lib/basecamp/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Basecamp
-  VERSION = "0.23.0"
+  VERSION = "0.24.0"
   API_VERSION = "2026-09-15"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: basecamp-sdk
 version: !ruby/object:Gem::Version
-  version: 0.23.0
+  version: 0.24.0
 platform: ruby
 authors:
 - Basecamp
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday