bella_baxter 0.1.1.pre.preview.16

data/lib/bella_baxter/generated/models/webhook_response.rb

@@ -0,0 +1,363 @@
+require 'date'
+require 'microsoft_kiota_abstractions'
+require_relative '../bella_baxter/generated'
+require_relative './models'
+
+module Bella_baxter/generated
+    module Models
+        class WebhookResponse
+            include MicrosoftKiotaAbstractions::AdditionalDataHolder, MicrosoftKiotaAbstractions::Parsable
+            ## 
+            # Stores additional data not described in the OpenAPI description found when deserializing. Can be used for serialization as well.
+            @additional_data
+            ## 
+            # The autoRotateDays property
+            @auto_rotate_days
+            ## 
+            # The createdAt property
+            @created_at
+            ## 
+            # The createdBy property
+            @created_by
+            ## 
+            # The environmentId property
+            @environment_id
+            ## 
+            # The eventTypes property
+            @event_types
+            ## 
+            # The id property
+            @id
+            ## 
+            # The isActive property
+            @is_active
+            ## 
+            # The keyPrefix property
+            @key_prefix
+            ## 
+            # The linkedEnvironmentId property
+            @linked_environment_id
+            ## 
+            # The linkedKeyName property
+            @linked_key_name
+            ## 
+            # The name property
+            @name
+            ## 
+            # The nextRotationAt property
+            @next_rotation_at
+            ## 
+            # The projectId property
+            @project_id
+            ## 
+            # The targetUrl property
+            @target_url
+            ## 
+            # The updatedAt property
+            @updated_at
+            ## 
+            ## Gets the AdditionalData property value. Stores additional data not described in the OpenAPI description found when deserializing. Can be used for serialization as well.
+            ## @return a i_dictionary
+            ## 
+            def additional_data
+                return @additional_data
+            end
+            ## 
+            ## Sets the AdditionalData property value. Stores additional data not described in the OpenAPI description found when deserializing. Can be used for serialization as well.
+            ## @param value Value to set for the AdditionalData property.
+            ## @return a void
+            ## 
+            def additional_data=(value)
+                @additional_data = value
+            end
+            ## 
+            ## Gets the autoRotateDays property value. The autoRotateDays property
+            ## @return a integer
+            ## 
+            def auto_rotate_days
+                return @auto_rotate_days
+            end
+            ## 
+            ## Sets the autoRotateDays property value. The autoRotateDays property
+            ## @param value Value to set for the autoRotateDays property.
+            ## @return a void
+            ## 
+            def auto_rotate_days=(value)
+                @auto_rotate_days = value
+            end
+            ## 
+            ## Instantiates a new WebhookResponse and sets the default values.
+            ## @return a void
+            ## 
+            def initialize()
+                @additional_data = Hash.new
+            end
+            ## 
+            ## Gets the createdAt property value. The createdAt property
+            ## @return a date_time
+            ## 
+            def created_at
+                return @created_at
+            end
+            ## 
+            ## Sets the createdAt property value. The createdAt property
+            ## @param value Value to set for the createdAt property.
+            ## @return a void
+            ## 
+            def created_at=(value)
+                @created_at = value
+            end
+            ## 
+            ## Gets the createdBy property value. The createdBy property
+            ## @return a string
+            ## 
+            def created_by
+                return @created_by
+            end
+            ## 
+            ## Sets the createdBy property value. The createdBy property
+            ## @param value Value to set for the createdBy property.
+            ## @return a void
+            ## 
+            def created_by=(value)
+                @created_by = value
+            end
+            ## 
+            ## Creates a new instance of the appropriate class based on discriminator value
+            ## @param parse_node The parse node to use to read the discriminator value and create the object
+            ## @return a webhook_response
+            ## 
+            def self.create_from_discriminator_value(parse_node)
+                raise StandardError, 'parse_node cannot be null' if parse_node.nil?
+                return WebhookResponse.new
+            end
+            ## 
+            ## Gets the environmentId property value. The environmentId property
+            ## @return a string
+            ## 
+            def environment_id
+                return @environment_id
+            end
+            ## 
+            ## Sets the environmentId property value. The environmentId property
+            ## @param value Value to set for the environmentId property.
+            ## @return a void
+            ## 
+            def environment_id=(value)
+                @environment_id = value
+            end
+            ## 
+            ## Gets the eventTypes property value. The eventTypes property
+            ## @return a string
+            ## 
+            def event_types
+                return @event_types
+            end
+            ## 
+            ## Sets the eventTypes property value. The eventTypes property
+            ## @param value Value to set for the eventTypes property.
+            ## @return a void
+            ## 
+            def event_types=(value)
+                @event_types = value
+            end
+            ## 
+            ## The deserialization information for the current model
+            ## @return a i_dictionary
+            ## 
+            def get_field_deserializers()
+                return {
+                    "autoRotateDays" => lambda {|n| @auto_rotate_days = n.get_number_value() },
+                    "createdAt" => lambda {|n| @created_at = n.get_date_time_value() },
+                    "createdBy" => lambda {|n| @created_by = n.get_string_value() },
+                    "environmentId" => lambda {|n| @environment_id = n.get_string_value() },
+                    "eventTypes" => lambda {|n| @event_types = n.get_collection_of_primitive_values(String) },
+                    "id" => lambda {|n| @id = n.get_string_value() },
+                    "isActive" => lambda {|n| @is_active = n.get_boolean_value() },
+                    "keyPrefix" => lambda {|n| @key_prefix = n.get_string_value() },
+                    "linkedEnvironmentId" => lambda {|n| @linked_environment_id = n.get_guid_value() },
+                    "linkedKeyName" => lambda {|n| @linked_key_name = n.get_string_value() },
+                    "name" => lambda {|n| @name = n.get_string_value() },
+                    "nextRotationAt" => lambda {|n| @next_rotation_at = n.get_date_time_value() },
+                    "projectId" => lambda {|n| @project_id = n.get_string_value() },
+                    "targetUrl" => lambda {|n| @target_url = n.get_string_value() },
+                    "updatedAt" => lambda {|n| @updated_at = n.get_date_time_value() },
+                }
+            end
+            ## 
+            ## Gets the id property value. The id property
+            ## @return a string
+            ## 
+            def id
+                return @id
+            end
+            ## 
+            ## Sets the id property value. The id property
+            ## @param value Value to set for the id property.
+            ## @return a void
+            ## 
+            def id=(value)
+                @id = value
+            end
+            ## 
+            ## Gets the isActive property value. The isActive property
+            ## @return a boolean
+            ## 
+            def is_active
+                return @is_active
+            end
+            ## 
+            ## Sets the isActive property value. The isActive property
+            ## @param value Value to set for the isActive property.
+            ## @return a void
+            ## 
+            def is_active=(value)
+                @is_active = value
+            end
+            ## 
+            ## Gets the keyPrefix property value. The keyPrefix property
+            ## @return a string
+            ## 
+            def key_prefix
+                return @key_prefix
+            end
+            ## 
+            ## Sets the keyPrefix property value. The keyPrefix property
+            ## @param value Value to set for the keyPrefix property.
+            ## @return a void
+            ## 
+            def key_prefix=(value)
+                @key_prefix = value
+            end
+            ## 
+            ## Gets the linkedEnvironmentId property value. The linkedEnvironmentId property
+            ## @return a guid
+            ## 
+            def linked_environment_id
+                return @linked_environment_id
+            end
+            ## 
+            ## Sets the linkedEnvironmentId property value. The linkedEnvironmentId property
+            ## @param value Value to set for the linkedEnvironmentId property.
+            ## @return a void
+            ## 
+            def linked_environment_id=(value)
+                @linked_environment_id = value
+            end
+            ## 
+            ## Gets the linkedKeyName property value. The linkedKeyName property
+            ## @return a string
+            ## 
+            def linked_key_name
+                return @linked_key_name
+            end
+            ## 
+            ## Sets the linkedKeyName property value. The linkedKeyName property
+            ## @param value Value to set for the linkedKeyName property.
+            ## @return a void
+            ## 
+            def linked_key_name=(value)
+                @linked_key_name = value
+            end
+            ## 
+            ## Gets the name property value. The name property
+            ## @return a string
+            ## 
+            def name
+                return @name
+            end
+            ## 
+            ## Sets the name property value. The name property
+            ## @param value Value to set for the name property.
+            ## @return a void
+            ## 
+            def name=(value)
+                @name = value
+            end
+            ## 
+            ## Gets the nextRotationAt property value. The nextRotationAt property
+            ## @return a date_time
+            ## 
+            def next_rotation_at
+                return @next_rotation_at
+            end
+            ## 
+            ## Sets the nextRotationAt property value. The nextRotationAt property
+            ## @param value Value to set for the nextRotationAt property.
+            ## @return a void
+            ## 
+            def next_rotation_at=(value)
+                @next_rotation_at = value
+            end
+            ## 
+            ## Gets the projectId property value. The projectId property
+            ## @return a string
+            ## 
+            def project_id
+                return @project_id
+            end
+            ## 
+            ## Sets the projectId property value. The projectId property
+            ## @param value Value to set for the projectId property.
+            ## @return a void
+            ## 
+            def project_id=(value)
+                @project_id = value
+            end
+            ## 
+            ## Serializes information the current object
+            ## @param writer Serialization writer to use to serialize this model
+            ## @return a void
+            ## 
+            def serialize(writer)
+                raise StandardError, 'writer cannot be null' if writer.nil?
+                writer.write_number_value("autoRotateDays", @auto_rotate_days)
+                writer.write_date_time_value("createdAt", @created_at)
+                writer.write_string_value("createdBy", @created_by)
+                writer.write_string_value("environmentId", @environment_id)
+                writer.write_collection_of_primitive_values("eventTypes", @event_types)
+                writer.write_string_value("id", @id)
+                writer.write_boolean_value("isActive", @is_active)
+                writer.write_string_value("keyPrefix", @key_prefix)
+                writer.write_guid_value("linkedEnvironmentId", @linked_environment_id)
+                writer.write_string_value("linkedKeyName", @linked_key_name)
+                writer.write_string_value("name", @name)
+                writer.write_date_time_value("nextRotationAt", @next_rotation_at)
+                writer.write_string_value("projectId", @project_id)
+                writer.write_string_value("targetUrl", @target_url)
+                writer.write_date_time_value("updatedAt", @updated_at)
+                writer.write_additional_data(@additional_data)
+            end
+            ## 
+            ## Gets the targetUrl property value. The targetUrl property
+            ## @return a string
+            ## 
+            def target_url
+                return @target_url
+            end
+            ## 
+            ## Sets the targetUrl property value. The targetUrl property
+            ## @param value Value to set for the targetUrl property.
+            ## @return a void
+            ## 
+            def target_url=(value)
+                @target_url = value
+            end
+            ## 
+            ## Gets the updatedAt property value. The updatedAt property
+            ## @return a date_time
+            ## 
+            def updated_at
+                return @updated_at
+            end
+            ## 
+            ## Sets the updatedAt property value. The updatedAt property
+            ## @param value Value to set for the updatedAt property.
+            ## @return a void
+            ## 
+            def updated_at=(value)
+                @updated_at = value
+            end
+        end
+    end
+end

data/lib/bella_baxter/hmac_auth_provider.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "digest"
+require "time"
+require "uri"
+
+module BellaBaxter
+  # Kiota AuthenticationProvider that signs every request with HMAC-SHA256.
+  #
+  # Reads the bax-{keyId}-{signingSecret} API key and adds:
+  #   X-Bella-Key-Id, X-Bella-Timestamp, X-Bella-Signature
+  class HmacAuthProvider
+    def initialize(api_key, bella_client: 'bella-ruby-sdk', app_client: nil)
+      parts = api_key.split("-", 3)
+      unless parts.length == 3 && parts[0] == "bax"
+        raise InvalidApiKeyError, "api_key must be in format bax-{keyId}-{signingSecret}"
+      end
+
+      @key_id         = parts[1]
+      @signing_secret = [parts[2]].pack("H*")
+      @bella_client   = bella_client
+      @app_client     = app_client || ENV['BELLA_BAXTER_APP_CLIENT']
+    end
+
+    def authenticate_request(request, _additional_context = {})
+      Fiber.new do
+        method    = request.http_method.to_s.upcase
+        uri       = URI.parse(request.uri.to_s)
+        path      = uri.path
+        query     = sorted_query(uri.query)
+        body      = request.content.to_s
+        timestamp = Time.now.utc.strftime("%Y-%m-%dT%H:%M:%SZ")
+        body_hash = Digest::SHA256.hexdigest(body)
+        sts       = "#{method}\n#{path}\n#{query}\n#{timestamp}\n#{body_hash}"
+        signature = OpenSSL::HMAC.hexdigest("SHA256", @signing_secret, sts)
+
+        request.headers.try_add("X-Bella-Key-Id",    @key_id)
+        request.headers.try_add("X-Bella-Timestamp", timestamp)
+        request.headers.try_add("X-Bella-Signature", signature)
+        request.headers.try_add("X-Bella-Client",    @bella_client)
+        request.headers.try_add("X-App-Client",      @app_client) if @app_client
+      end
+    end
+
+    private
+
+    def sorted_query(raw)
+      return "" if raw.nil? || raw.empty?
+
+      URI.decode_www_form(raw).sort_by { |k, _| k }
+        .map { |k, v| "#{URI.encode_www_form_component(k)}=#{URI.encode_www_form_component(v)}" }
+        .join("&")
+    end
+  end
+end

data/lib/bella_baxter/models.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module BellaBaxter
+  # Options for constructing a Client.
+  Configuration = Struct.new(
+    :baxter_url,    # Base URL of the Baxter API (e.g. "https://baxter.example.com")
+    :api_key,       # Bella API key in format bax-{keyId}-{signingSecret}
+    :timeout,       # HTTP timeout in seconds (default: 10)
+    keyword_init: true
+  ) do
+    def initialize(**)
+      super
+      self.timeout ||= 10
+    end
+  end
+
+  # Response from GET /api/v1/projects/:project/environments/:env/secrets
+  AllSecretsResponse = Struct.new(
+    :environment_slug,   # String
+    :environment_name,   # String
+    :secrets,            # Hash<String, String> — all secrets for the environment
+    :version,            # Integer — monotonically increasing (unix timestamp of last mutation)
+    :last_modified,      # String — ISO-8601 timestamp
+    keyword_init: true
+  )
+
+  # Response from GET .../secrets/version (lightweight version check)
+  SecretsVersionResponse = Struct.new(
+    :environment_slug,
+    :version,
+    :last_modified,
+    keyword_init: true
+  )
+
+  # Metadata for a single TOTP key stored in an environment.
+  # Returned by Client#list_totp_keys.
+  TotpKeyInfo = Struct.new(
+    :name,          # String — key name
+    :issuer,        # String | nil — e.g. "GitHub"
+    :account_name,  # String | nil — e.g. "user@example.com"
+    :algorithm,     # String — e.g. "SHA1"
+    :digits,        # Integer — code length (usually 6)
+    :period,        # Integer — rotation period in seconds (usually 30)
+    keyword_init: true
+  )
+end

data/lib/bella_baxter/railtie.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require_relative "client"
+
+module BellaBaxter
+  # Rails Railtie — automatically loads secrets into ENV before Rails
+  # reads database.yml, cache config, and config/initializers/*.
+  #
+  # == How it works
+  #
+  # +config.before_configuration+ is Rails' earliest boot hook. Bella Baxter
+  # calls /api/v1/keys/me to discover which project/environment the API key
+  # belongs to, fetches all secrets, and injects them into ENV — before
+  # database.yml is evaluated.
+  #
+  # == Setup
+  #
+  #   # Gemfile
+  #   gem "bella_baxter"
+  #
+  #   # Start your app
+  #   bella exec -- bundle exec rails server
+  #
+  # That's it. The Railtie auto-registers when the gem is loaded.
+  #
+  # == Required environment variables (set by `bella exec`)
+  #
+  #   BELLA_API_KEY      Your API key (bax-...)
+  #   BELLA_BAXTER_URL   Base URL of your Bella Baxter instance
+  #
+  # Project slug, environment slug, and E2EE are auto-discovered from the
+  # API key — you do not set them manually.
+  #
+  # == config/initializers/bella_baxter.rb
+  #
+  # Secrets are already in ENV by the time initializers run. That file is
+  # for optional patterns only (hot-reload, health checks, etc.).
+  #
+  class Railtie < ::Rails::Railtie
+    config.before_configuration do
+      BellaBaxter.auto_load_from_env!
+    end
+  end
+end

data/lib/bella_baxter/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module BellaBaxter
+  VERSION = "0.1.1-preview.16"
+end

data/lib/bella_baxter/webhook_signature.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module BellaBaxter
+  # Verifies the X-Bella-Signature header on incoming Bella Baxter webhook requests.
+  #
+  # Signature format:  X-Bella-Signature: t={unix_epoch_seconds},v1={hmac_sha256_hex}
+  # Signing input:     "{t}.{rawBodyJson}"  (UTF-8)
+  # HMAC key:          the raw signing secret string (full whsec-xxx value, UTF-8 encoded)
+  module WebhookSignature
+    DEFAULT_TOLERANCE = 300
+
+    # Verifies the X-Bella-Signature header on an incoming webhook.
+    #
+    # @param secret [String] the whsec-xxx signing secret
+    # @param signature_header [String] value of X-Bella-Signature header
+    # @param raw_body [String] raw request body string (UTF-8)
+    # @param tolerance [Integer] max age in seconds (default 300)
+    # @return [Boolean] true if the signature is valid and the timestamp is within tolerance
+    # @raise [WebhookSignatureError] if the header is malformed or the timestamp is out of tolerance
+    def self.verify(secret:, signature_header:, raw_body:, tolerance: DEFAULT_TOLERANCE)
+      parts   = signature_header.to_s.split(",")
+      t_part  = parts.find { |p| p.start_with?("t=") }
+      v1_part = parts.find { |p| p.start_with?("v1=") }
+
+      raise BellaBaxter::WebhookSignatureError, "Malformed X-Bella-Signature header: missing t= or v1=" \
+        if t_part.nil? || v1_part.nil?
+
+      begin
+        timestamp = Integer(t_part[2..], 10)
+      rescue ArgumentError
+        raise BellaBaxter::WebhookSignatureError, "Malformed X-Bella-Signature header: t= is not a valid integer"
+      end
+
+      v1  = v1_part[3..]
+      age = Time.now.utc.to_i - timestamp
+
+      raise BellaBaxter::WebhookSignatureError,
+        "Webhook timestamp is stale or in the future (age=#{age}s, tolerance=#{tolerance}s)" \
+        if age.abs > tolerance
+
+      signing_input = "#{timestamp}.#{raw_body}"
+      expected = OpenSSL::HMAC.hexdigest("SHA256", secret, signing_input)
+
+      secure_compare(expected, v1)
+    end
+    private_class_method def self.secure_compare(a, b)
+      # Constant-time comparison: XOR every byte pair and OR the results.
+      # Returning false on a length mismatch is safe here because `a` is always
+      # the 64-character HMAC-SHA256 hex digest — its length is not secret.
+      return false unless a.bytesize == b.bytesize
+
+      result = 0
+      a.bytes.zip(b.bytes) { |x, y| result |= x ^ y }
+      result.zero?
+    end
+  end
+end

data/lib/bella_baxter.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "logger"
+
+require_relative "bella_baxter/version"
+require_relative "bella_baxter/errors"
+require_relative "bella_baxter/models"
+require_relative "bella_baxter/e2ee"
+require_relative "bella_baxter/client"
+require_relative "bella_baxter/webhook_signature"
+
+module BellaBaxter
+  class << self
+    # Optional global configuration.
+    # When set, BellaBaxter.client uses it instead of ENV vars.
+    attr_accessor :configuration
+
+    def configure
+      self.configuration ||= Configuration.new(
+        baxter_url:   ENV.fetch("BELLA_BAXTER_URL", ""),
+        api_key:      ENV.fetch("BELLA_API_KEY", ""),
+        project:      ENV.fetch("BELLA_PROJECT", ""),
+        environment:  ENV.fetch("BELLA_ENV", "")
+      )
+      yield configuration
+      self
+    end
+
+    # Returns a singleton client built from the global configuration.
+    # @return [BellaBaxter::Client]
+    def client
+      @client ||= Client.new(config: configuration || config_from_env)
+    end
+
+    # Shorthand: fetch all secrets and inject into ENV.
+    # Existing ENV values are NOT overwritten unless overwrite: true.
+    #
+    # @return [Integer] number of secrets injected
+    def load_into_env!(overwrite: false)
+      client.load_into_env!(overwrite: overwrite)
+    end
+
+    # Called automatically by the Rails Railtie before_configuration hook.
+    # Silently skips if BELLA_API_KEY is not set (no-op in dev without Bella).
+    def auto_load_from_env!
+      return unless ENV["BELLA_API_KEY"]
+
+      c = config_from_env
+      if c.baxter_url.empty?
+        logger.warn "[BellaBaxter] BELLA_API_KEY set but BELLA_BAXTER_URL missing — skipping"
+        return
+      end
+
+      begin
+        client = Client.new(config: c)
+        count  = client.load_into_env!
+        ctx    = client.key_context
+        logger.info "[BellaBaxter] Loaded #{count} secret(s) into ENV " \
+                    "(project=#{ctx['projectSlug']} env=#{ctx['environmentSlug']})"
+      rescue BellaBaxter::Error => e
+        logger.warn "[BellaBaxter] Failed to load secrets: #{e.message}"
+      end
+    end
+
+    private
+
+    def config_from_env
+      Configuration.new(
+        baxter_url: ENV.fetch("BELLA_BAXTER_URL", ""),
+        api_key:    ENV.fetch("BELLA_API_KEY", "")
+      )
+    end
+
+    def logger
+      @logger ||= (defined?(Rails) && Rails.logger) || Logger.new($stdout)
+    end
+  end
+end
+
+# Auto-register Railtie when Rails is present.
+require_relative "bella_baxter/railtie" if defined?(Rails::Railtie)