basecamp-sdk 0.7.3 → 0.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d07bf1af7eccbc28f132ef388bf5beb2c2571662e0cfc60b030705c1b8184b15
-  data.tar.gz: ab40ddc799b5aea73915f596ba38ba556e0c69b67795809d63927aec9c88ce77
+  metadata.gz: 50a6f193dfed4631d675333812b23a9d586b5f78d2a060bbd15222855c93f62c
+  data.tar.gz: 2a9ce91aff3ae13f3262701feaa2d7706f100c1d217714896bfad94006563daf
 SHA512:
-  metadata.gz: 7ab64d75d93daba3f7d514531a08b688f8442f444a2baa1f265a59d9968f90c4b0d2dc956f0b7a5adf3e1d4c25c0b3d8678664648617b0605164c22919d935db
-  data.tar.gz: feb7f7b9df02aa100f0a63e3b302d045a38c62577b0a121ce28e0db4f0ea7e9e21a11ab89e5cb3a9e10d0f0ac6c05f3cbd8aba5192c9b3990aa621563c1e3ee5
+  metadata.gz: a594aada84cb34e591e3ec6747095d799626fb37763531c14c3d7a0fdc05360e61572e6e3e9748c405c73e4c603ca30c503b22b73c24273cfc13de84891a8f9b
+  data.tar.gz: 60a1d05afbe172cd92b4ee5c75871e57df33cb52f3f664e4c0dfa2823259f7ef5593cb32e022e41cc73ee30b255b214c16c4e2d1901ceef3f48eed6e11075f3b

data/README.md

@@ -133,6 +133,50 @@ if token.expired?
 end
 ```
 
+### Resource-First Discovery (RFC 9728 + RFC 8414)
+
+BC5's Authorization Server (AS) metadata lives only at the canonical issuer (the
+web host), so discovery starts from the **resource** (the API host) rather than
+probing the API host for AS metadata. Three composable operations are provided:
+
+```ruby
+# RFC 8414 — AS metadata for a known issuer, bound to the requested issuer by
+# code-point. token_endpoint is required; authorization_endpoint is OPTIONAL
+# (device-only servers omit it) — authorization-code consumers must assert it.
+config = Basecamp::Oauth.discover("https://launchpad.37signals.com")
+
+# RFC 9728 — protected-resource metadata for a resource origin. resource is
+# bound by code-point; authorization_servers preserves absent (nil) vs [].
+resource = Basecamp::Oauth.discover_protected_resource("https://3.basecampapi.com")
+
+# Orchestrator — resource-first selection + stage-sensitive fallback.
+result = Basecamp::Oauth.discover_from_resource(
+  "https://3.basecampapi.com",
+  expected_issuer: nil # optional: authoritative issuer selection
+)
+
+if result.selected?
+  config = result.config # bound AS config for the selected issuer
+else
+  # Only two SOFT reasons ever yield a fallback (→ Launchpad):
+  #   "resource_discovery_failed" | "no_as_advertised"
+  result.reason
+end
+```
+
+`discover_from_resource` returns a `DiscoveryResult` that is either **selected**
+or a **soft fallback**. Every *hard* failure — an ambiguous advertised set, an
+unavailable `expected_issuer`, an invalid advertised issuer origin, an AS-metadata
+fetch failure, or an issuer-binding mismatch after a BC5 issuer was selected —
+raises `Basecamp::Oauth::DiscoverySelectionError` (carrying a `reason`). A hard
+failure is **never** silently converted into a Launchpad request.
+
+All discovery fetches are SSRF-hardened: origins are validated against the
+origin-root profile (HTTPS-only, localhost exempt) with Ruby's `URI` parser before
+any socket opens, redirects are not followed, timeouts are bounded, non-2xx maps
+to `api_error`, and the response body is read under a genuine streaming cap that
+aborts before an oversized body is buffered.
+
 ## Services
 
 The SDK provides 37 services covering the complete Basecamp API:
@@ -194,6 +238,25 @@ first_10 = account.todos.list(todolist_id: 456).take(10)
 all_projects = account.projects.list.to_a
 ```
 
+## Downloading Files
+
+Fetch an upload's file content in one call. The SDK fetches the upload
+metadata, then follows the authenticated-hop + 302 flow against the
+signed storage URL.
+
+```ruby
+result = account.uploads.download(upload_id: 1069479400)
+File.binwrite("uploaded.bin", result.body)
+# result.content_type, result.content_length, result.filename are also available
+```
+
+For any authenticated download URL (e.g. a `download_url` you already
+have in hand), use `AccountClient#download_url`:
+
+```ruby
+result = account.download_url(url)
+```
+
 ## Retry Behavior
 
 GET requests automatically retry on transient failures with exponential backoff:

data/basecamp-sdk.gemspec

@@ -37,10 +37,9 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'minitest', '~> 6.0'
   spec.add_development_dependency 'rake', '~> 13.0'
   spec.add_development_dependency 'rubocop-37signals'
-  spec.add_development_dependency 'simplecov', '~> 0.22'
+  spec.add_development_dependency 'simplecov', '~> 1.0'
   spec.add_development_dependency 'webmock', '~> 3.24'
   spec.add_development_dependency 'irb', '~> 1.15'
-  spec.add_development_dependency 'rdoc', '~> 7.1'
-  spec.add_development_dependency 'webrick', '~> 1.9'
+  spec.add_development_dependency 'rdoc', '~> 8.0'
   spec.add_development_dependency 'yard', '~> 0.9'
 end

data/lib/basecamp/generated/metadata.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://basecamp.com/schemas/sdk-metadata.json",
   "version": "1.0.0",
-  "generated": "2026-03-26T04:17:28Z",
+  "generated": "2026-07-22T08:33:01Z",
   "operations": {
     "GetAccount": {
       "retry": {
@@ -92,7 +92,7 @@
         "natural": true
       }
     },
-    "ListWebhooks": {
+    "SetCardColumnColor": {
       "retry": {
         "maxAttempts": 3,
         "baseDelayMs": 1000,
@@ -102,13 +102,11 @@
           503
         ]
       },
-      "pagination": {
-        "style": "link",
-        "totalCountHeader": "X-Total-Count",
-        "maxPageSize": 50
+      "idempotent": {
+        "natural": true
       }
     },
-    "CreateWebhook": {
+    "EnableCardColumnOnHold": {
       "retry": {
         "maxAttempts": 2,
         "baseDelayMs": 1000,
@@ -119,7 +117,7 @@
         ]
       }
     },
-    "GetCard": {
+    "DisableCardColumnOnHold": {
       "retry": {
         "maxAttempts": 3,
         "baseDelayMs": 1000,
@@ -128,34 +126,39 @@
           429,
           503
         ]
+      },
+      "idempotent": {
+        "natural": true
       }
     },
-    "UpdateCard": {
+    "CreateTool": {
       "retry": {
-        "maxAttempts": 3,
+        "maxAttempts": 2,
         "baseDelayMs": 1000,
         "backoff": "exponential",
         "retryOn": [
           429,
           503
         ]
-      },
-      "idempotent": {
-        "natural": true
       }
     },
-    "MoveCard": {
+    "ListWebhooks": {
       "retry": {
-        "maxAttempts": 2,
+        "maxAttempts": 3,
         "baseDelayMs": 1000,
         "backoff": "exponential",
         "retryOn": [
           429,
           503
         ]
+      },
+      "pagination": {
+        "style": "link",
+        "totalCountHeader": "X-Total-Count",
+        "maxPageSize": 50
       }
     },
-    "RepositionCardStep": {
+    "CreateWebhook": {
       "retry": {
         "maxAttempts": 2,
         "baseDelayMs": 1000,
@@ -166,9 +169,9 @@
         ]
       }
     },
-    "CreateCardStep": {
+    "GetCard": {
       "retry": {
-        "maxAttempts": 2,
+        "maxAttempts": 3,
         "baseDelayMs": 1000,
         "backoff": "exponential",
         "retryOn": [
@@ -177,7 +180,7 @@
         ]
       }
     },
-    "GetCardColumn": {
+    "UpdateCard": {
       "retry": {
         "maxAttempts": 3,
         "baseDelayMs": 1000,
@@ -186,37 +189,34 @@
           429,
           503
         ]
+      },
+      "idempotent": {
+        "natural": true
       }
     },
-    "UpdateCardColumn": {
+    "MoveCard": {
       "retry": {
-        "maxAttempts": 3,
+        "maxAttempts": 2,
         "baseDelayMs": 1000,
         "backoff": "exponential",
         "retryOn": [
           429,
           503
         ]
-      },
-      "idempotent": {
-        "natural": true
       }
     },
-    "SetCardColumnColor": {
+    "RepositionCardStep": {
       "retry": {
-        "maxAttempts": 3,
+        "maxAttempts": 2,
         "baseDelayMs": 1000,
         "backoff": "exponential",
         "retryOn": [
           429,
           503
         ]
-      },
-      "idempotent": {
-        "natural": true
       }
     },
-    "EnableCardColumnOnHold": {
+    "CreateCardStep": {
       "retry": {
         "maxAttempts": 2,
         "baseDelayMs": 1000,
@@ -227,7 +227,18 @@
         ]
       }
     },
-    "DisableCardColumnOnHold": {
+    "GetCardColumn": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      }
+    },
+    "UpdateCardColumn": {
       "retry": {
         "maxAttempts": 3,
         "baseDelayMs": 1000,
@@ -565,6 +576,20 @@
         ]
       }
     },
+    "UpdateCampfireLine": {
+      "retry": {
+        "maxAttempts": 3,
+        "baseDelayMs": 1000,
+        "backoff": "exponential",
+        "retryOn": [
+          429,
+          503
+        ]
+      },
+      "idempotent": {
+        "natural": true
+      }
+    },
     "DeleteCampfireLine": {
       "retry": {
         "maxAttempts": 3,
@@ -728,17 +753,6 @@
         "natural": true
       }
     },
-    "CloneTool": {
-      "retry": {
-        "maxAttempts": 2,
-        "baseDelayMs": 1000,
-        "backoff": "exponential",
-        "retryOn": [
-          429,
-          503
-        ]
-      }
-    },
     "GetTool": {
       "retry": {
         "maxAttempts": 3,
@@ -2329,7 +2343,7 @@
         ]
       }
     },
-    "UpdateTodo": {
+    "ReplaceTodo": {
       "retry": {
         "maxAttempts": 3,
         "baseDelayMs": 1000,

data/lib/basecamp/generated/services/campfires_service.rb

@@ -112,7 +112,19 @@ module Basecamp
         end
       end
 
-      # Delete a campfire line
+      # Update an existing campfire line; the content is always treated as rich text (HTML).
+      # @param campfire_id [Integer] campfire id ID
+      # @param line_id [Integer] line id ID
+      # @param content [String] The new line content, interpreted as rich text (HTML)
+      # @return [void]
+      def update_line(campfire_id:, line_id:, content:)
+        with_operation(service: "campfires", operation: "update_line", is_mutation: true, resource_id: line_id) do
+          http_put("/chats/#{campfire_id}/lines/#{line_id}", body: compact_params(content: content))
+          nil
+        end
+      end
+
+      # Delete a campfire line; allowed for the line's creator or an admin.
       # @param campfire_id [Integer] campfire id ID
       # @param line_id [Integer] line id ID
       # @return [void]

data/lib/basecamp/generated/services/card_columns_service.rb

@@ -7,51 +7,54 @@ module Basecamp
     # @generated from OpenAPI spec
     class CardColumnsService < BaseService
 
-      # Get a card column by ID
+      # Set the color of a column
+      # @param bucket_id [Integer] bucket id ID
       # @param column_id [Integer] column id ID
+      # @param color [String] Valid colors: white, red, orange, yellow, green, blue, aqua, purple, gray, pink, brown
       # @return [Hash] response data
-      def get(column_id:)
-        with_operation(service: "cardcolumns", operation: "get", is_mutation: false, resource_id: column_id) do
-          http_get("/card_tables/columns/#{column_id}").json
+      def set_color(bucket_id:, column_id:, color:)
+        with_operation(service: "cardcolumns", operation: "set_color", is_mutation: true, resource_id: column_id) do
+          http_put("/buckets/#{bucket_id}/card_tables/columns/#{column_id}/color.json", body: compact_params(color: color)).json
         end
       end
 
-      # Update an existing column
+      # Enable on-hold section in a column
+      # @param bucket_id [Integer] bucket id ID
       # @param column_id [Integer] column id ID
-      # @param title [String, nil] title
-      # @param description [String, nil] description
       # @return [Hash] response data
-      def update(column_id:, title: nil, description: nil)
-        with_operation(service: "cardcolumns", operation: "update", is_mutation: true, resource_id: column_id) do
-          http_put("/card_tables/columns/#{column_id}", body: compact_params(title: title, description: description)).json
+      def enable_on_hold(bucket_id:, column_id:)
+        with_operation(service: "cardcolumns", operation: "enable_on_hold", is_mutation: true, resource_id: column_id) do
+          http_post("/buckets/#{bucket_id}/card_tables/columns/#{column_id}/on_hold.json").json
         end
       end
 
-      # Set the color of a column
+      # Disable on-hold section in a column
+      # @param bucket_id [Integer] bucket id ID
       # @param column_id [Integer] column id ID
-      # @param color [String] Valid colors: white, red, orange, yellow, green, blue, aqua, purple, gray, pink, brown
       # @return [Hash] response data
-      def set_color(column_id:, color:)
-        with_operation(service: "cardcolumns", operation: "set_color", is_mutation: true, resource_id: column_id) do
-          http_put("/card_tables/columns/#{column_id}/color.json", body: compact_params(color: color)).json
+      def disable_on_hold(bucket_id:, column_id:)
+        with_operation(service: "cardcolumns", operation: "disable_on_hold", is_mutation: true, resource_id: column_id) do
+          http_delete("/buckets/#{bucket_id}/card_tables/columns/#{column_id}/on_hold.json").json
         end
       end
 
-      # Enable on-hold section in a column
+      # Get a card column by ID
       # @param column_id [Integer] column id ID
       # @return [Hash] response data
-      def enable_on_hold(column_id:)
-        with_operation(service: "cardcolumns", operation: "enable_on_hold", is_mutation: true, resource_id: column_id) do
-          http_post("/card_tables/columns/#{column_id}/on_hold.json").json
+      def get(column_id:)
+        with_operation(service: "cardcolumns", operation: "get", is_mutation: false, resource_id: column_id) do
+          http_get("/card_tables/columns/#{column_id}").json
         end
       end
 
-      # Disable on-hold section in a column
+      # Update an existing column
       # @param column_id [Integer] column id ID
+      # @param title [String, nil] title
+      # @param description [String, nil] description
       # @return [Hash] response data
-      def disable_on_hold(column_id:)
-        with_operation(service: "cardcolumns", operation: "disable_on_hold", is_mutation: true, resource_id: column_id) do
-          http_delete("/card_tables/columns/#{column_id}/on_hold.json").json
+      def update(column_id:, title: nil, description: nil)
+        with_operation(service: "cardcolumns", operation: "update", is_mutation: true, resource_id: column_id) do
+          http_put("/card_tables/columns/#{column_id}", body: compact_params(title: title, description: description)).json
         end
       end
 

data/lib/basecamp/generated/services/reports_service.rb

@@ -15,7 +15,7 @@ module Basecamp
         end
       end
 
-      # Get upcoming schedule entries within a date window
+      # Get upcoming schedule entries and assignable items within a date window.
       # @param window_starts_on [String, nil] window starts on
       # @param window_ends_on [String, nil] window ends on
       # @return [Hash] response data

data/lib/basecamp/generated/services/todos_service.rb

@@ -44,9 +44,9 @@ module Basecamp
         end
       end
 
-      # Update an existing todo
+      # Replace a todo with a new complete representation.
       # @param todo_id [Integer] todo id ID
-      # @param content [String, nil] content
+      # @param content [String] content
       # @param description [String, nil] description
       # @param assignee_ids [Array, nil] assignee ids
       # @param completion_subscriber_ids [Array, nil] completion subscriber ids
@@ -54,8 +54,8 @@ module Basecamp
       # @param due_on [String, nil] due on (YYYY-MM-DD)
       # @param starts_on [String, nil] starts on (YYYY-MM-DD)
       # @return [Hash] response data
-      def update(todo_id:, content: nil, description: nil, assignee_ids: nil, completion_subscriber_ids: nil, notify: nil, due_on: nil, starts_on: nil)
-        with_operation(service: "todos", operation: "update", is_mutation: true, resource_id: todo_id) do
+      def replace(todo_id:, content:, description: nil, assignee_ids: nil, completion_subscriber_ids: nil, notify: nil, due_on: nil, starts_on: nil)
+        with_operation(service: "todos", operation: "replace", is_mutation: true, resource_id: todo_id) do
           http_put("/todos/#{todo_id}", body: compact_params(content: content, description: description, assignee_ids: assignee_ids, completion_subscriber_ids: completion_subscriber_ids, notify: notify, due_on: due_on, starts_on: starts_on)).json
         end
       end

data/lib/basecamp/generated/services/tools_service.rb

@@ -7,13 +7,14 @@ module Basecamp
     # @generated from OpenAPI spec
     class ToolsService < BaseService
 
-      # Clone an existing tool to create a new one
-      # @param source_recording_id [Integer] source recording id
-      # @param title [String, nil] title
+      # Create a tool in a project dock
+      # @param bucket_id [Integer] bucket id ID
+      # @param tool_type [String] Tool type to add to the project dock. Values: Chat::Transcript|Inbox|Kanban::Board|Message::Board|Questionnaire|Schedule|Todoset|Vault.
+      # @param title [String, nil] Title for the new tool. When omitted, Basecamp assigns the next available default title for the tool type.
       # @return [Hash] response data
-      def clone(source_recording_id:, title: nil)
-        with_operation(service: "tools", operation: "clone", is_mutation: true) do
-          http_post("/dock/tools.json", body: compact_params(source_recording_id: source_recording_id, title: title)).json
+      def create(bucket_id:, tool_type:, title: nil)
+        with_operation(service: "tools", operation: "create", is_mutation: true, resource_id: bucket_id) do
+          http_post("/buckets/#{bucket_id}/dock/tools.json", body: compact_params(tool_type: tool_type, title: title)).json
         end
       end
 

data/lib/basecamp/generated/services/uploads_service.rb

@@ -57,6 +57,23 @@ module Basecamp
           http_post("/vaults/#{vault_id}/uploads.json", body: compact_params(attachable_sgid: attachable_sgid, description: description, base_name: base_name, subscriptions: subscriptions)).json
         end
       end
+
+      # Download an upload's file content in one call.
+      # Fetches upload metadata, then delegates to the AccountClient download
+      # primitive so the auth'd-hop + 302-follow flow lives in one place.
+      # @param upload_id [Integer] upload id ID
+      # @return [Basecamp::DownloadResult]
+      def download(upload_id:)
+        with_operation(service: "uploads", operation: "download", is_mutation: false, resource_id: upload_id) do
+          upload = get(upload_id: upload_id)
+          url = upload["download_url"]
+          raise UsageError.new("upload #{upload_id} has no download_url") if url.nil? || url.empty?
+
+          result = @client.download_url(url)
+          filename = upload["filename"]
+          filename.to_s.empty? ? result : result.with(filename: filename)
+        end
+      end
     end
   end
 end