basecradle 0.10.1 → 0.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a805499915d7672ddf23664f7a5147b41915446a488a122c018cb46ac65f076
-  data.tar.gz: 5739cfa3f912b9d9d29d03a9a083c58371175b0bd7dd75dbad1ee6209d426288
+  metadata.gz: 4e662740bb7ecbde3769c3430a269cbe32a0c507a4244626688af1ca13ce3ce4
+  data.tar.gz: 64820f7409159b2cfd1b063a53c96858302bfc939e4ff2df17b6ffcaf3b494e5
 SHA512:
-  metadata.gz: 3836f2b3204ca798e3d2c4bd17dcc43f59faf0dc86c7097504f05e01519e5d91cc8c10f0889852899c64a816ef7c33da009cd3a2948f0f9cd8019ee279246870
-  data.tar.gz: 44894880f4119664ffdceff8d9550b8d69e715073a55ad31287bfbd507ba8a7758bc92003de5fb0f1e8b17919ddf3f0968ff4c6344c988c53f91360aca5c685d
+  metadata.gz: 6c7a007a0c7eef4fe1bb8d4d19fc108c361fc5e5d4a618d5d61600a0cdd55fbb6b97ecc5ea5c07ed8ac6488840b7cc33133c59a6160feab2a04222da73683eeb
+  data.tar.gz: 7059369ae648787b45a97afe3b12ba721474629078031ac036461732cc7dfc9d13e764b916f48a7e72fa96b248bac4c53c1ee3ed686f2abc98d13ed1c54a6c28

data/CHANGELOG.md

@@ -9,6 +9,40 @@ section**. The newest heading is always the version `lib/basecradle/version.rb`
 a release writes its entry and its version in the same PR — and `test/changelog_test.rb`
 fails CI if the two ever disagree.
 
+## [0.10.2] - 2026-09-30
+
+### Security
+
+- **`WebhookEventHeaders` no longer prints header values when inspected**
+  ([#206](https://github.com/basecradle/basecradle-ruby/issues/206)). An inbound
+  delivery's headers are the *sender's*, stored verbatim by the platform, so one of them
+  may be the sender's own credential — a POST authenticated to an ingest URL carries its
+  `Authorization` or `X-Api-Key` right there. `WebhookEventHeaders` is a `Hash`
+  descendant and inherited `Hash`'s render, which prints every pair, so
+  `logger.debug(event.content.headers)` wrote **another party's secret** into your logs.
+  `inspect`, `to_s` and `pp` now render the header names alone, sorted, matching the rule
+  every other object in this SDK already followed (`ApiObject#inspect` prints field
+  names, never values):
+
+  ```
+  #<BaseCradle::WebhookEventHeaders Authorization, Content-Type, X-Api-Key>
+  ```
+
+  **Only the human-facing render changed.** Every read is untouched and still wire-exact:
+  the case-folded lookup, `fetch`, `each`, `keys`, `to_h`, `to_json`, `==`. If you were
+  relying on `inspect` to see values, use `to_h` — which is what it was always for. No
+  credential of yours was exposed; the exposure was of whoever sent you the webhook, so
+  if you have logged inbound deliveries at debug level, treat those senders' headers as
+  disclosed.
+- **Two ways a header value still reaches a log, both by design.** `to_json`/`as_json`
+  emit the delivery verbatim — that is what a webhook record *is* — so
+  `render json: event` and `logger.info(event.to_json)` still write the sender's headers
+  in full. And converting away from the type gives up the redaction exactly as it gives up
+  the case-folding: `slice`, `except`, `select`, `transform_values` and `to_h` each hand
+  back a plain `Hash`, whose `inspect` prints pairs. Only `merge` and `dup` keep the type,
+  and so the redaction. Changing what a webhook record *serializes* as is a separate
+  decision and is not made here.
+
 ## [0.10.1] - 2026-09-30
 
 ### Security
@@ -450,6 +484,7 @@ the Python SDK's behavior in idiomatic Ruby. Zero runtime dependencies.
 - **Quality bars** — a README-as-tested-doc harness (every example runs against a mocked
   API) and a spec drift-guard (CI fails if the live API grows beyond the SDK).
 
+[0.10.2]: https://github.com/basecradle/basecradle-ruby/releases/tag/v0.10.2
 [0.10.1]: https://github.com/basecradle/basecradle-ruby/releases/tag/v0.10.1
 [0.10.0]: https://github.com/basecradle/basecradle-ruby/releases/tag/v0.10.0
 [0.9.0]: https://github.com/basecradle/basecradle-ruby/releases/tag/v0.9.0

data/README.md

@@ -220,6 +220,19 @@ fallback-less `fetch` raise `KeyError` naming the headers that did arrive, while
 and the methods that reshape it (`slice`, `except`, `select`) work on those stored names,
 case-sensitively.
 
+What it does **not** show you is the values. `inspect`, `to_s` and `pp` print the header
+names alone — `#<BaseCradle::WebhookEventHeaders Authorization, Content-Type>` — because
+these headers are the **sender's**, and a sender that authenticates its POST to your
+ingest URL carries its credential in one of them. So `logger.debug(event.content.headers)`
+cannot write another party's secret into your logs. Every read is unaffected; `to_h` is
+how you look at values.
+
+Two things do still show them, deliberately. `to_json` emits the delivery verbatim — that
+is what the record is — so `render json: event` and `logger.info(event.to_json)` write the
+headers in full. And converting away from the type gives up the redaction exactly as it
+gives up the case-folding: `slice`, `except`, `select`, `transform_values` and `to_h` hand
+back a plain `Hash`, which prints pairs. `merge` and `dup` keep the type, and keep both.
+
 This holds however you reach the record. A timeline item's `content` is typed by the
 item's own `type`, so a `webhook_event` row of `timeline.items` is a `WebhookEventContent`
 just like one from `bc.webhook_events` — `item.content.headers["X-GitHub-Delivery"]` folds
@@ -426,6 +439,12 @@ CI additionally lints the workflow files with [actionlint](https://github.com/rh
 both and run `actionlint` from the repo root — CI pins actionlint by version and SHA256 in
 `.github/workflows/ci.yml`; match that version to see what CI sees.
 
+Bare `actionlint` covers slightly more than CI blocks on. It lints everything under
+`.github/workflows`, including `needs-human-alert.yml` and `dependabot-auto-merge.yml`,
+which are shared verbatim from the BaseCradle core repo and are not this repo's to edit;
+CI lints those two advisory-only, so a finding in them is reported upstream rather than
+failing the build. A finding in any other workflow does fail it.
+
 ## Contributing
 
 Human and AI contributors work under identical rules here: branch → PR → green CI → merge. See [`CLAUDE.md`](CLAUDE.md) for the project conventions and the issues for the roadmap.

data/lib/basecradle/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BaseCradle
-  VERSION = "0.10.1"
+  VERSION = "0.10.2"
 end

data/lib/basecradle/webhooks.rb

@@ -99,6 +99,14 @@ module BaseCradle
   # that already happened. Converting away from this type gives up the folding too
   # (+to_h+, <tt>{**headers}</tt>, and anything else that hands back a plain +Hash+);
   # +merge+ and +dup+ keep it.
+  #
+  # What it does *not* print is the values: +inspect+, +to_s+ and +pp+ render the header
+  # names alone, because these are the sender's headers and one of them may be the
+  # sender's credential. Every read is unaffected — and so is +to_json+, which still
+  # emits the delivery verbatim. Converting away from this type gives the redaction up
+  # exactly as it gives up the folding, and for the same reason: +slice+, +except+,
+  # +select+, +transform_values+ and +to_h+ hand back a plain +Hash+, whose +inspect+
+  # prints pairs.
   class WebhookEventHeaders < Hash
     # Hash's own exact-match membership, kept under a private name before the case-folding
     # +key?+ below takes the name: a caller who wrote the wire's own spelling is answered
@@ -167,6 +175,43 @@ module BaseCradle
       ->(name) { dig(name) }
     end
 
+    # The header *names* this delivery carried, and none of their values.
+    #
+    # +Hash+'s own +inspect+ prints every pair, and these headers are the *sender's*,
+    # stored verbatim by the platform: a sender that authenticates its POST to an ingest
+    # URL puts its credential in one of them, so +logger.debug(event.content.headers)+
+    # would write another party's secret into our logs. Every other renderable object in
+    # this SDK is already safe by one rule — +ApiObject#inspect+ prints field names, never
+    # values — and this is the one class that sat outside it, because +Hash+ brought its
+    # own render.
+    #
+    # Only the human-facing render changes. Every *read* is untouched and still
+    # wire-exact: lookups, +fetch+, +each+, +keys+, +to_h+, +to_json+, +==+.
+    #
+    # Names are sorted, as +ApiObject#inspect+ sorts its fields and as the +KeyError+ a
+    # missing header raises already lists the ones that did arrive.
+    def inspect
+      return "#<#{self.class}>" if empty?
+
+      "#<#{self.class} #{keys.sort_by(&:to_s).join(', ')}>"
+    end
+
+    # +Hash+ aliases +to_s+ to its *own* +inspect+ — one shared method entry — so
+    # overriding +inspect+ alone would leave <tt>"#{headers}"</tt> and +puts headers+
+    # printing every value. Late-bound rather than +alias to_s inspect+, so a subclass
+    # that redacts more is not bypassed by interpolation (as +Client#to_s+ is).
+    def to_s
+      inspect
+    end
+
+    # +pp+ reaches for +pretty_print+, and +Hash+ brings one that prints the pairs — the
+    # same leak through the one door +inspect+ does not cover. Delegating puts +pp+ back
+    # on the SDK-wide rule: +pp+ uses an object's own +inspect+ when it defines one, which
+    # is why every +ApiObject+ is already safe here and only a +Hash+ descendant was not.
+    def pretty_print(printer)
+      printer.text(inspect)
+    end
+
     private
 
     # The wire's own spelling of +name+, or nil if no casing of it was delivered. Anything

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: basecradle
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.10.2
 platform: ruby
 authors:
 - Drawk Kwast