bella_baxter 0.1.1.pre.preview.124 → 0.1.1.pre.preview.127

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eec4eefade1bd3de4485c5289c7a84d36de913134d26a4c262b005c94e4e2369
-  data.tar.gz: 7c061b8fd8d7fb28acb173f69bb2c1dd06a41519117e0bb10df49eadc9add810
+  metadata.gz: a932f08dc4dd6970513edd04088130bfaa8fdf778ed4faf1e4439e494dc903a3
+  data.tar.gz: 4565d014ada0d5bbb1d14b036525d82194c7f30278e9eff5863c2a798bbf1f1c
 SHA512:
-  metadata.gz: 2e55049a0f8f4fde2e5d7290de2311bee60d36b43b797d6f515520a2223fc10e90f1241f0e6607ae84eff315933603eb3ec6291e934deaf163d01e0cdfa254b5
-  data.tar.gz: d3859529f4ef7d2dbdaf13a531ec2f57e4f9e3e8bdbdb3bfc5de8aedc1250318b272a340cd26baac5663960f6827348158e8737531ac25ef2ba4ec972cef4d7b
+  metadata.gz: 5b93a3e435d586269555a33d2d45061c3208dca4bdaf8d5c0247557c618bd92e13103715a58d117bdc462b89dd008c553d5638efa411f0e15688eb8f90edb41d
+  data.tar.gz: 97050037d433a16e44ee089ff0ac341d85afbccc97c55f7de741b63df26899a3a7ee2becf6a97c81878387a39e35f032bec10ae48c6818cee8af0df24935e57a

data/README.md

@@ -1,14 +1,14 @@
 # bella_baxter Ruby SDK
 
-Ruby client for [Bella Baxter](https://github.com/cosmic-chimps/bella-baxter) — load secrets into your Ruby or Rails application with zero runtime dependencies.
+Ruby client for [Bella Baxter](https://github.com/cosmic-chimps/bella-baxter) — load secrets into your Ruby or Rails application.
 
 ## Features
 
-- **Zero runtime dependencies** — uses only Ruby's stdlib (`openssl`, `net/http`, `json`)
 - **Rails Railtie** — auto-loads secrets before `database.yml` is evaluated
-- **End-to-end encryption** — optional E2EE using ECDH-P256-HKDF-SHA256-AES256GCM (stdlib OpenSSL)
-- **Thread-safe** — singleton client, mutex-protected HTTP
+- **End-to-end encryption, always on** — ECDH-P256-HKDF-SHA256-AES256GCM (stdlib OpenSSL)
+- **Project and environment from the key** — discovered via `GET /api/v1/keys/me`, nothing to configure
 - **ENV injection** — `load_into_env!` respects existing values (local dev overrides work)
+- **Full API access** — `client.client` is the Kiota-generated navigator for every other endpoint
 
 ## Installation
 
@@ -27,16 +27,22 @@ bundle install
 require "bella_baxter"
 
 client = BellaBaxter::Client.new(
-  baxter_url:  "https://baxter.example.com",
-  api_key:     "bax-...",
-  project:     "my-app",
-  environment: "production"
+  baxter_url: "https://baxter.example.com",
+  api_key:    "bax-..."
 )
 
+# The project and environment are the ones the API key is scoped to.
 secrets = client.all_secrets.secrets
 puts secrets["DATABASE_URL"]
+
+# Or name them explicitly:
+secrets = client.pull_secrets(project: "my-app", environment: "production")
 ```
 
+`Client.new` accepts `baxter_url:`, `api_key:`, `timeout:` (seconds, default 10), `private_key:` (a device
+key PEM; defaults to `BELLA_BAXTER_PRIVATE_KEY`) and `on_wrapped_dek_received:`. The project and environment
+are not constructor options: they come from the key, or are passed to each read.
+
 ## Rails integration
 
 Add the gem to your Gemfile. That's all.
@@ -48,9 +54,8 @@ The gem ships a **Railtie** that injects all secrets into `ENV` during Rails' `b
 ```bash
 BELLA_BAXTER_URL=https://baxter.example.com
 BELLA_API_KEY=bax-...
-BELLA_PROJECT=my-app
-# BELLA_ENV defaults to Rails.env
-# BELLA_E2EE=true  to enable end-to-end encryption
+# The project and environment are the ones the key is scoped to; E2EE is always on.
+# BELLA_BAXTER_PRIVATE_KEY=...  (optional) a registered device key, injected by `bella sdk run`
 ```
 
 **database.yml** — nothing secret lives here:
@@ -87,14 +92,13 @@ BellaBaxter.load_into_env!(overwrite: true)
 
 ## End-to-end encryption
 
+Always on: the client presents a P-256 public key (`X-E2E-Public-Key`) on every read that carries secret
+values — the bulk read, both exports, a provider's list, a single secret, a secret version and the global
+list, including the ones you make through `client.client` — and the server encrypts the response to it. Pass `private_key:` (or set `BELLA_BAXTER_PRIVATE_KEY`) to use a
+registered device key instead of an ephemeral one.
+
 ```ruby
-client = BellaBaxter::Client.new(
-  baxter_url:  "https://baxter.example.com",
-  api_key:     "bax-...",
-  project:     "my-app",
-  environment: "production",
-  enable_e2ee: true   # Client generates P-256 keypair; server encrypts the response
-)
+client = BellaBaxter::Client.new(baxter_url: "https://baxter.example.com", api_key: "bax-...")
 
 # Decryption is transparent — same API
 secrets = client.all_secrets.secrets
@@ -102,26 +106,22 @@ secrets = client.all_secrets.secrets
 
 Algorithm: `ECDH-P256 → HKDF-SHA256 → AES-256-GCM`. All operations use Ruby's built-in `openssl` — no extra gems required.
 
-## Write operations
+**A presented key requires an encrypted answer (#1050).** If a read that presented the key gets back plain
+JSON, an envelope that fails to decrypt (tampered), or one encrypted to a different key, the client raises
+`BellaBaxter::E2EEResponseError` (a `DecryptionError`) instead of returning anything. `error.code` is
+`"e2ee-plaintext-response"` or `"e2ee-decryption-failed"`, the same codes every Bella SDK uses. There is no
+plaintext fallback.
 
-```ruby
-# Create
-client.create_secret(
-  provider:    "my-vault",       # provider slug
-  key:         "DATABASE_URL",
-  value:       "postgres://...",
-  description: "Primary database"
-)
+## Other endpoints (writes, TOTP, providers, …)
 
-# Update
-client.update_secret(
-  provider: "my-vault",
-  key:      "DATABASE_URL",
-  value:    "postgres://new-host/..."
-)
+The client wraps the secret reads above. Every other endpoint — creating or updating secrets, TOTP,
+providers, environments — is on the Kiota-generated navigator, which uses the same signing and E2EE:
 
-# Delete
-client.delete_secret(provider: "my-vault", key: "DATABASE_URL")
+```ruby
+api = client.client.api.v1.projects.by_id("my-app").environments.by_env_slug("production")
+
+totp_keys = api.totp.get.resume
+providers = api.providers.get.resume
 ```
 
 ## Lightweight version check
@@ -138,23 +138,26 @@ puts "Version #{v.version}, last changed #{v.last_modified}"
 ```ruby
 # config/initializers/bella_baxter.rb
 BellaBaxter.configure do |c|
-  c.baxter_url  = ENV["BELLA_BAXTER_URL"]
-  c.api_key     = ENV["BELLA_API_KEY"]
-  c.project     = "my-app"
-  c.environment = Rails.env
-  c.enable_e2ee = Rails.env.production?
+  c.baxter_url = ENV["BELLA_BAXTER_URL"]
+  c.api_key    = ENV["BELLA_API_KEY"]
+  c.timeout    = 5
 end
 
 # Access the singleton client anywhere
 BellaBaxter.client.all_secrets
 ```
 
+`BellaBaxter::Configuration` has exactly `baxter_url`, `api_key` and `timeout`.
+
 ## Samples
 
 | Sample | Description |
 |--------|-------------|
-| [`samples/01-standalone/`](samples/01-standalone/) | Pure Ruby script — all usage patterns |
-| [`samples/02-rails/`](samples/02-rails/) | Rails integration with `database.yml` example |
+| [`samples/01-dotenv-file/`](samples/01-dotenv-file/) | Read the `.env` file `bella` writes |
+| [`samples/02-process-inject/`](samples/02-process-inject/) | Read the secrets `bella run` injects into `ENV` |
+| [`samples/03-standalone/`](samples/03-standalone/) | Pure Ruby script using the SDK |
+| [`samples/04-rails/`](samples/04-rails/) | Rails integration with `database.yml` example |
+| [`samples/05-typed-secrets/`](samples/05-typed-secrets/) | Typed secrets generated by `bella secrets generate ruby` |
 
 ---
 

data/lib/bella_baxter/e2ee.rb

@@ -116,6 +116,18 @@ module BellaBaxter
       def decrypt_raw(payload)
         return payload unless payload["encrypted"] == true
 
+        JSON.parse(decrypt_plaintext(payload))
+      rescue JSON::ParserError => e
+        raise BellaBaxter::DecryptionError, "Decrypted payload is not valid JSON: #{e.message}"
+      end
+
+      # Decrypt an envelope and return its plaintext exactly as the server serialized it (a String).
+      # #1162: the middleware hands this on unchanged, whatever the read's shape.
+      #
+      # @param payload [Hash] Parsed JSON encrypted payload ("encrypted" => true).
+      # @return [String] The decrypted UTF-8 JSON text.
+      # @raise [BellaBaxter::DecryptionError] when the GCM tag does not verify.
+      def decrypt_plaintext(payload)
         server_key_der = Base64.strict_decode64(payload["serverPublicKey"])
         nonce          = Base64.strict_decode64(payload["nonce"])
         tag            = Base64.strict_decode64(payload["tag"])
@@ -132,12 +144,9 @@ module BellaBaxter
         cipher.auth_tag  = tag
         cipher.auth_data = ""
 
-        plaintext = cipher.update(ciphertext) + cipher.final
-        JSON.parse(plaintext)
+        (cipher.update(ciphertext) + cipher.final).force_encoding(Encoding::UTF_8)
       rescue OpenSSL::Cipher::CipherError => e
         raise BellaBaxter::DecryptionError, "AES-GCM decryption failed: #{e.message}"
-      rescue JSON::ParserError => e
-        raise BellaBaxter::DecryptionError, "Decrypted payload is not valid JSON: #{e.message}"
       end
 
       private

data/lib/bella_baxter/e2ee_faraday_middleware.rb

@@ -2,12 +2,15 @@
 
 require "faraday"
 require "json"
+require_relative "errors"
+require_relative "e2ee"
 
 module BellaBaxter
-  # Faraday middleware that transparently adds E2EE to GET /secrets requests.
+  # Faraday middleware that transparently adds E2EE to the envelope-required secret reads.
   #
-  # On outbound: adds X-E2E-Public-Key header so the server encrypts the response.
-  # On inbound:  decrypts the encrypted payload and reconstructs a normal secrets response.
+  # On outbound: adds X-E2E-Public-Key on every envelope-required read (#1162, +requires_envelope?+) so
+  #              the server encrypts the response.
+  # On inbound:  decrypts the envelope and hands the server's plaintext JSON on unchanged.
   class E2EEFaradayMiddleware < Faraday::Middleware
     def initialize(app, key_pair: nil, on_wrapped_dek_received: nil)
       super(app)
@@ -15,33 +18,55 @@ module BellaBaxter
       @on_wrapped_dek_received = on_wrapped_dek_received
     end
 
-    def call(env)
-      is_secrets_get = env.method == :get && env.url.path.end_with?("/secrets")
+    # #1050 — the GETs whose 2xx body the server encrypts to a presented key: every read that carries
+    # secret VALUES (apps/sdk/SDK_CONTRACT.md, "Which Endpoints Support E2EE"). Everything else under
+    # /secrets (…/version, …/manifest, …/hash, …/{key}/metadata, writes) is plain JSON by design and must
+    # never be refused. One place, so the rule and the table cannot drift apart inside this SDK.
+    def self.requires_envelope?(method, path)
+      return false unless method.to_s.downcase == "get"
+
+      marker = "/api/v1/projects/"
+      i = path.to_s.index(marker) or return false
+      _project, *rest = path[(i + marker.length)..].split("/", -1)
+
+      return true if rest == ["secrets"]
+      return false unless rest.length >= 3 && rest[0] == "environments"
 
-      if is_secrets_get
-        env.request_headers["X-E2E-Public-Key"] = @e2ee.public_key_b64
+      tail = rest[2..]
+      return true if tail == ["secrets"] || tail == ["secrets", "export"]
+      return false unless tail.length >= 3 && tail[0] == "providers" && tail[2] == "secrets"
+
+      provider_tail = tail[3..]
+      case provider_tail.length
+      when 0 then true
+      when 1 then provider_tail[0] != "hash" && !provider_tail[0].empty?
+      when 3 then provider_tail[1] == "versions" && provider_tail[2].match?(/\A\d+\z/)
+      else false
       end
+    end
+
+    def call(env)
+      # #1162 — the key is presented on EVERY envelope-required read (SDK_CONTRACT.md, "Rule: the key is
+      # presented on every envelope-required read"), decided here by the one matcher, never per method.
+      # From then on a 2xx that is not a decryptable envelope is an error (#1050), never a value.
+      presented = self.class.requires_envelope?(env.method, env.url.path)
+
+      env.request_headers["X-E2E-Public-Key"] = @e2ee.public_key_b64 if presented
 
       @app.call(env).on_complete do |resp_env|
-        next unless is_secrets_get && resp_env.status == 200
-
-        data = JSON.parse(resp_env.body)
-        next unless data["encrypted"]
-
-        decrypted = @e2ee.decrypt_raw(data)
-        if decrypted.is_a?(Hash) && decrypted.key?("secrets") && decrypted["secrets"].is_a?(Hash)
-          resp_env[:body] = JSON.generate(decrypted)
-        else
-          secrets = @e2ee.decrypt(data)
-          resp_env[:body] = JSON.generate(
-            "secrets"         => secrets,
-            "version"         => 0,
-            "environmentSlug" => "",
-            "environmentName" => "",
-            "lastModified"    => ""
-          )
+        next unless presented && resp_env.status.between?(200, 299)
+
+        path = env.url.path
+        data = begin
+          JSON.parse(resp_env.body.to_s)
+        rescue JSON::ParserError
+          raise E2EEResponseError.plaintext(path)
         end
 
+        raise E2EEResponseError.plaintext(path) unless data.is_a?(Hash) && data["encrypted"] == true
+
+        resp_env[:body] = decrypted_body(data, path)
+
         if @on_wrapped_dek_received
           wrapped_dek = resp_env.response_headers["X-Bella-Wrapped-Dek"] ||
                         resp_env.response_headers["x-bella-wrapped-dek"]
@@ -56,5 +81,41 @@ module BellaBaxter
         end
       end
     end
+
+    private
+
+    # The body handed on after decryption. The plaintext of every envelope-required read is the JSON the
+    # server would have sent without a key (a secret item, an array of them, a {key: value} export,
+    # ListGlobalSecretsResponse), so it is passed on byte for byte (#1162). Only getAllEnvironmentSecrets
+    # keeps its legacy rescue: a server that encrypted just the flat {key: value} dict is re-wrapped as an
+    # AllEnvironmentSecretsResponse. Any failure — a missing or undecodable field, a GCM tag that does not
+    # verify (tampered), a key it was not encrypted to — is the one refusal, with the original as +cause+.
+    def decrypted_body(data, path)
+      plaintext = @e2ee.decrypt_plaintext(data)
+      decrypted = JSON.parse(plaintext)
+      return plaintext unless all_environment_secrets?(path)
+      return plaintext if decrypted.is_a?(Hash) && decrypted["secrets"].is_a?(Hash)
+      raise E2EEResponseError.decryption_failed(path) unless decrypted.is_a?(Hash)
+
+      JSON.generate(
+        "secrets"         => decrypted.transform_values(&:to_s),
+        "version"         => 0,
+        "environmentSlug" => "",
+        "environmentName" => "",
+        "lastModified"    => ""
+      )
+    rescue E2EEResponseError
+      raise
+    rescue StandardError
+      raise E2EEResponseError.decryption_failed(path)
+    end
+
+    # .../api/v1/projects/{p}/environments/{e}/secrets — getAllEnvironmentSecrets.
+    def all_environment_secrets?(path)
+      marker = "/api/v1/projects/"
+      i = path.to_s.index(marker) or return false
+      segs = path[(i + marker.length)..].split("/", -1)
+      segs.length == 4 && segs[1] == "environments" && segs[3] == "secrets"
+    end
   end
 end

data/lib/bella_baxter/errors.rb

@@ -20,6 +20,32 @@ module BellaBaxter
   # Raised when E2EE decryption fails.
   class DecryptionError < Error; end
 
+  # #1050 — a secrets read that presented X-E2E-Public-Key got back something other than an envelope
+  # that decrypts with this client's key. Refused, never returned: there is no plaintext fallback.
+  #
+  # +code+ is the stable, cross-SDK contract (apps/sdk/SDK_CONTRACT.md, "a presented key requires an
+  # envelope"); the message names the request path and the code, never the body, ciphertext or a key.
+  # A DecryptionError subclass so code that already rescues DecryptionError keeps catching it.
+  class E2EEResponseError < DecryptionError
+    # The 2xx answer was not an `"encrypted": true` envelope (plain secrets, or not JSON at all).
+    PLAINTEXT_RESPONSE = "e2ee-plaintext-response"
+    # The envelope was malformed, tampered with (GCM tag), or encrypted to a different key.
+    DECRYPTION_FAILED  = "e2ee-decryption-failed"
+
+    attr_reader :code, :path
+
+    def initialize(code, path)
+      @code = code
+      @path = path
+      what = code == PLAINTEXT_RESPONSE ? "expected but plaintext received" : "could not be decrypted"
+      super("E2EE response #{what} for #{path}; refusing it (#{code})")
+    end
+
+    def self.plaintext(path) = new(PLAINTEXT_RESPONSE, path)
+
+    def self.decryption_failed(path) = new(DECRYPTION_FAILED, path)
+  end
+
   # Raised when required configuration is missing.
   class ConfigurationError < Error; end
 

data/lib/bella_baxter/generated/api/tenants/invites/item/accept/accept_request_builder.rb

@@ -38,6 +38,8 @@ module BellaBaxterGenerated
                                 )
                                 error_mapping = Hash.new
                                 error_mapping["403"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                                error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                                error_mapping["409"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
                                 error_mapping["503"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
                                 return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::AcceptInviteResponse.create_from_discriminator_value(pn) }, error_mapping)
                             end

data/lib/bella_baxter/generated/api/tenants/invites/item/address_verification/address_verification_request_builder.rb

@@ -38,6 +38,7 @@ module BellaBaxterGenerated
                                 )
                                 error_mapping = Hash.new
                                 error_mapping["403"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                                error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
                                 error_mapping["409"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
                                 error_mapping["503"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
                                 return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::InviteAddressVerificationResponse.create_from_discriminator_value(pn) }, error_mapping)

data/lib/bella_baxter/generated/api/tenants/invites/item/preview/preview_request_builder.rb

@@ -1,6 +1,7 @@
 require 'microsoft_kiota_abstractions'
 require_relative '../../../../../bella_baxter_generated'
 require_relative '../../../../../models/invite_preview_response'
+require_relative '../../../../../models/problem_details'
 require_relative '../../../../api'
 require_relative '../../../tenants'
 require_relative '../../invites'
@@ -35,7 +36,9 @@ module BellaBaxterGenerated
                                 request_info = self.to_get_request_information(
                                     request_configuration
                                 )
-                                return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::InvitePreviewResponse.create_from_discriminator_value(pn) }, nil)
+                                error_mapping = Hash.new
+                                error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                                return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::InvitePreviewResponse.create_from_discriminator_value(pn) }, error_mapping)
                             end
                             ## 
                             ## GET_api_tenants_invites_token_preview

data/lib/bella_baxter/generated/api/tenants/item/invites/invites_request_builder.rb

@@ -16,7 +16,7 @@ module BellaBaxterGenerated
             module Item
                 module Invites
                     ## 
-                    # Builds and executes requests for operations under \api\tenants\{identifier-id}\invites
+                    # Builds and executes requests for operations under \api\tenants\{-id}\invites
                     class InvitesRequestBuilder < MicrosoftKiotaAbstractions::BaseRequestBuilder
                         
                         ## 
@@ -37,7 +37,7 @@ module BellaBaxterGenerated
                         ## @return a void
                         ## 
                         def initialize(path_parameters, request_adapter)
-                            super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{identifier%2Did}/invites")
+                            super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{%2Did}/invites")
                         end
                         ## 
                         ## GET_api_tenants_id_invites
@@ -48,7 +48,9 @@ module BellaBaxterGenerated
                             request_info = self.to_get_request_information(
                                 request_configuration
                             )
-                            return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::InviteListResponse.create_from_discriminator_value(pn) }, nil)
+                            error_mapping = Hash.new
+                            error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                            return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::InviteListResponse.create_from_discriminator_value(pn) }, error_mapping)
                         end
                         ## 
                         ## POST_api_tenants_id_invites
@@ -63,6 +65,8 @@ module BellaBaxterGenerated
                             )
                             error_mapping = Hash.new
                             error_mapping["400"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                            error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                            error_mapping["409"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
                             return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::InviteResponse.create_from_discriminator_value(pn) }, error_mapping)
                         end
                         ## 

data/lib/bella_baxter/generated/api/tenants/item/invites/item/replacement/replacement_request_builder.rb

@@ -17,7 +17,7 @@ module BellaBaxterGenerated
                     module Item
                         module Replacement
                             ## 
-                            # Builds and executes requests for operations under \api\tenants\{identifier-id}\invites\{token}\replacement
+                            # Builds and executes requests for operations under \api\tenants\{-id}\invites\{token}\replacement
                             class ReplacementRequestBuilder < MicrosoftKiotaAbstractions::BaseRequestBuilder
                                 
                                 ## 
@@ -27,7 +27,7 @@ module BellaBaxterGenerated
                                 ## @return a void
                                 ## 
                                 def initialize(path_parameters, request_adapter)
-                                    super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{identifier%2Did}/invites/{token}/replacement")
+                                    super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{%2Did}/invites/{token}/replacement")
                                 end
                                 ## 
                                 ## POST_api_tenants_id_invites_token_replacement
@@ -40,6 +40,8 @@ module BellaBaxterGenerated
                                     )
                                     error_mapping = Hash.new
                                     error_mapping["400"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                                    error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                                    error_mapping["409"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
                                     return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::InviteResponse.create_from_discriminator_value(pn) }, error_mapping)
                                 end
                                 ## 

data/lib/bella_baxter/generated/api/tenants/item/invites/item/with_token_item_request_builder.rb

@@ -1,5 +1,6 @@
 require 'microsoft_kiota_abstractions'
 require_relative '../../../../../bella_baxter_generated'
+require_relative '../../../../../models/problem_details'
 require_relative '../../../../api'
 require_relative '../../../tenants'
 require_relative '../../item'
@@ -14,7 +15,7 @@ module BellaBaxterGenerated
                 module Invites
                     module Item
                         ## 
-                        # Builds and executes requests for operations under \api\tenants\{identifier-id}\invites\{token}
+                        # Builds and executes requests for operations under \api\tenants\{-id}\invites\{token}
                         class WithTokenItemRequestBuilder < MicrosoftKiotaAbstractions::BaseRequestBuilder
                             
                             ## 
@@ -29,7 +30,7 @@ module BellaBaxterGenerated
                             ## @return a void
                             ## 
                             def initialize(path_parameters, request_adapter)
-                                super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{identifier%2Did}/invites/{token}")
+                                super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{%2Did}/invites/{token}")
                             end
                             ## 
                             ## DELETE_api_tenants_id_invites_token
@@ -40,7 +41,9 @@ module BellaBaxterGenerated
                                 request_info = self.to_delete_request_information(
                                     request_configuration
                                 )
-                                return @request_adapter.send_async(request_info, nil, nil)
+                                error_mapping = Hash.new
+                                error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                                return @request_adapter.send_async(request_info, nil, error_mapping)
                             end
                             ## 
                             ## DELETE_api_tenants_id_invites_token
@@ -56,7 +59,7 @@ module BellaBaxterGenerated
                                 request_info.url_template = @url_template
                                 request_info.path_parameters = @path_parameters
                                 request_info.http_method = :DELETE
-                                request_info.headers.try_add('Accept', 'application/json')
+                                request_info.headers.try_add('Accept', 'application/json, application/problem+json')
                                 return request_info
                             end
                             ## 

data/lib/bella_baxter/generated/api/tenants/item/item_request_builder.rb

@@ -0,0 +1,58 @@
+require 'microsoft_kiota_abstractions'
+require_relative '../../../bella_baxter_generated'
+require_relative '../../api'
+require_relative '../tenants'
+require_relative './invites/invites_request_builder'
+require_relative './item'
+require_relative './settings/settings_request_builder'
+require_relative './switch/switch_request_builder'
+require_relative './users/users_request_builder'
+require_relative './verify_access/verify_access_request_builder'
+
+module BellaBaxterGenerated
+    module Api
+        module Tenants
+            module Item
+                ## 
+                # Builds and executes requests for operations under \api\tenants\{-id}
+                class ItemRequestBuilder < MicrosoftKiotaAbstractions::BaseRequestBuilder
+                    
+                    ## 
+                    # The invites property
+                    def invites()
+                        return BellaBaxterGenerated::Api::Tenants::Item::Invites::InvitesRequestBuilder.new(@path_parameters, @request_adapter)
+                    end
+                    ## 
+                    # The settings property
+                    def settings()
+                        return BellaBaxterGenerated::Api::Tenants::Item::Settings::SettingsRequestBuilder.new(@path_parameters, @request_adapter)
+                    end
+                    ## 
+                    # The switch property
+                    def switch()
+                        return BellaBaxterGenerated::Api::Tenants::Item::Switch::SwitchRequestBuilder.new(@path_parameters, @request_adapter)
+                    end
+                    ## 
+                    # The users property
+                    def users()
+                        return BellaBaxterGenerated::Api::Tenants::Item::Users::UsersRequestBuilder.new(@path_parameters, @request_adapter)
+                    end
+                    ## 
+                    # The verifyAccess property
+                    def verify_access()
+                        return BellaBaxterGenerated::Api::Tenants::Item::VerifyAccess::VerifyAccessRequestBuilder.new(@path_parameters, @request_adapter)
+                    end
+                    ## 
+                    ## Instantiates a new ItemRequestBuilder and sets the default values.
+                    ## @param path_parameters Path parameters for the request
+                    ## @param request_adapter The request adapter to use to execute the requests.
+                    ## @return a void
+                    ## 
+                    def initialize(path_parameters, request_adapter)
+                        super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{%2Did}")
+                    end
+                end
+            end
+        end
+    end
+end

data/lib/bella_baxter/generated/api/tenants/item/settings/settings_request_builder.rb

@@ -1,5 +1,6 @@
 require 'microsoft_kiota_abstractions'
 require_relative '../../../../bella_baxter_generated'
+require_relative '../../../../models/problem_details'
 require_relative '../../../../models/tenant_settings_response'
 require_relative '../../../api'
 require_relative '../../tenants'
@@ -12,7 +13,7 @@ module BellaBaxterGenerated
             module Item
                 module Settings
                     ## 
-                    # Builds and executes requests for operations under \api\tenants\{identifier-id}\settings
+                    # Builds and executes requests for operations under \api\tenants\{-id}\settings
                     class SettingsRequestBuilder < MicrosoftKiotaAbstractions::BaseRequestBuilder
                         
                         ## 
@@ -22,7 +23,7 @@ module BellaBaxterGenerated
                         ## @return a void
                         ## 
                         def initialize(path_parameters, request_adapter)
-                            super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{identifier%2Did}/settings")
+                            super(path_parameters, request_adapter, "{+baseurl}/api/tenants/{%2Did}/settings")
                         end
                         ## 
                         ## GET_api_tenants_tenantId_settings
@@ -33,7 +34,10 @@ module BellaBaxterGenerated
                             request_info = self.to_get_request_information(
                                 request_configuration
                             )
-                            return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::TenantSettingsResponse.create_from_discriminator_value(pn) }, nil)
+                            error_mapping = Hash.new
+                            error_mapping["403"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                            error_mapping["404"] = lambda {|pn| BellaBaxterGenerated::Models::ProblemDetails.create_from_discriminator_value(pn) }
+                            return @request_adapter.send_async(request_info, lambda {|pn| BellaBaxterGenerated::Models::TenantSettingsResponse.create_from_discriminator_value(pn) }, error_mapping)
                         end
                         ## 
                         ## GET_api_tenants_tenantId_settings