end_point_blank 0.13.0 → 0.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a18f4976c060497e06a7fd5af0ee63d14cc080f7541b951d474baefe75c605ae
-  data.tar.gz: 9d04564e23b5d62e6a6b848c2c7f6f0e8c4ac08639c41072392dfa95ee4b9664
+  metadata.gz: 14c18a9f81130c9ec607b05a25aa5a4a67d9726c6692eb313a395734ce79bcf3
+  data.tar.gz: 4081ad91a0c10503521993a7d2d7887cd0810faab8b8f22229a57f9ed7685749
 SHA512:
-  metadata.gz: 679591ad5e6f06194f5b93f42e30f0c9455deaeaf6b29293a4429beea5cc3e2444d06c7c28389e3432ff8504fbeaa6496ab5e0a08d08f5420888db6d7e0a709e
-  data.tar.gz: d52d7a2bf74d7cff868e96bc338cdd8c77e0b4608c61cabd6014efdd5cf90c50b5ba765e990bce9cf53bc7089969a2deacb26aae3edbce285d8cfd0dd5aaffcc
+  metadata.gz: 181770dadb24b746868274196d0600ff58d92ad7e430f2165b8ff7f59e376a0790ed027b9a8fb000b607b20698190755f5de5525ca78d540c198addab72c5fdd
+  data.tar.gz: 88593bf5bb77615e05d9277de7a4b167d5885a155cb9b30cfac83dbe0335003e84801abe7b826fe55ab81793b8990e0d39578bb05b2033bef2512a4cc5c11d6f

data/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.13.1
+
+### Security
+
+- **Request and response records no longer carry credentials or cookies
+  (sc-1470).** Both records carried every `HTTP_*` header of the request (the
+  response record sends the request's headers, not the response's), so unless
+  you had written a masking rule for it, a caller's `Authorization` header
+  (Basic `client_id:secret` or a bearer token) landed in your request and
+  response logs in EndPointBlank. `RequestWriter` and `ResponseWriter` now
+  leave out `Authorization`, `Proxy-Authorization`, `Cookie` and `Set-Cookie`,
+  in any letter case, before masking runs, so they are not in the payload the
+  rules and hook receive, and they are not sent at all. The list is
+  `EndPointBlank::Rack::Headers::SENSITIVE_HEADERS`; the SDK's own reads of
+  the request (`Headers.extract`, used to find the endpoint version) are
+  unchanged. A masking rule that targeted one of these headers now has nothing
+  to match and can be removed. Records sent by earlier versions may hold these
+  values; rotate any client secret a caller sent while it was in use.
+
+### Upgrading
+
+- A `mask_hook` that reads `Authorization`, `Proxy-Authorization`, `Cookie` or
+  `Set-Cookie` from `headers` now finds it absent; guard the lookup.
+
+### Added
+
+- **`claim_invite` takes an optional `return_to` (sc-1515).**
+  `clients.claim_invite(client_id, email:, return_to:)` and a managed
+  client's `claim_invite(email:, return_to:)` send `return_to`, where
+  EndPointBlank sends the customer's browser once they have claimed the
+  managed client. It is sent only when given, and must equal, byte for byte,
+  a claim return URL your organization registered in EndPointBlank; anything
+  else is refused with `return_to_not_registered` (422), now in
+  `ErrorCodes` as `RETURN_TO_NOT_REGISTERED`.
+
 ## 0.13.0
 
 ### Added

data/README.md

@@ -485,6 +485,11 @@ regex is applied only within the path-selected node(s). When a `regex` is presen
 match; `$$` for a literal `$`). Stacktraces and log messages/data are never masked (there is no
 `log` entry in the masking field map).
 
+**Credential and cookie headers are never sent.** Before any rule runs, the request and response
+records leave out `Authorization`, `Proxy-Authorization`, `Cookie` and `Set-Cookie`, whatever
+their letter case. They are left out of the record, not masked: they are not in the payload the
+rules and hook receive. The list is `EndPointBlank::Rack::Headers::SENSITIVE_HEADERS`.
+
 ## Framework integration
 
 ### Rails
@@ -670,6 +675,11 @@ mgmt.package_assignments.assign(customer["id"], api_package_id: package["id"], e
 
 # ... and hand it over: the customer gets an email, and claiming rotates every credential you issued.
 initech.claim_invite(email: "it@initech.example")
+
+# Optionally send the customer's browser somewhere once they have claimed it. `return_to` must
+# equal, byte for byte, a claim return URL your organization registered in EndPointBlank;
+# anything else is refused with `return_to_not_registered` (422).
+initech.claim_invite(email: "it@initech.example", return_to: "https://app.example/welcome")
 ```
 
 Once claimed, the managed client's calls answer `not_found`. Remove an unclaimed one with

data/lib/end_point_blank/management/client.rb

@@ -215,9 +215,11 @@ module EndPointBlank
       end
 
       # POST /clients/:client_id/claim_invites: emails your customer an
-      # invite to claim the client. @return [Hash]
-      def claim_invite(email:, idempotency_key: nil)
-        @clients.claim_invite(client_id, email: email, idempotency_key: idempotency_key)
+      # invite to claim the client, and with +return_to+ (a claim return URL
+      # your organization registered) where to send them once claimed; see
+      # {Resources::Clients#claim_invite}. @return [Hash]
+      def claim_invite(email:, return_to: nil, idempotency_key: nil)
+        @clients.claim_invite(client_id, email: email, return_to: return_to, idempotency_key: idempotency_key)
       end
 
       def inspect

data/lib/end_point_blank/management/error_codes.rb

@@ -66,6 +66,9 @@ module EndPointBlank
       ENVIRONMENT_NOT_IN_APPLICATION = "environment_not_in_application"
       ALREADY_GRANTED = "already_granted"
       GRANT_REVOKED_CONCURRENTLY = "grant_revoked_concurrently"
+      # A claim invite's +return_to+ is not one of the claim return URLs your
+      # organization registered.
+      RETURN_TO_NOT_REGISTERED = "return_to_not_registered"
 
       # The warning code API package endpoint writes answer in +warnings+ (not
       # an error): a client assignment of the package now derives no grant.
@@ -97,7 +100,7 @@ module EndPointBlank
         ALREADY_A_MEMBER => 422, MANAGED_CLIENT_HAS_CREDENTIALS => 422, API_PACKAGE_NOT_FOUND => 422,
         ENVIRONMENT_NOT_FOUND => 422, ALREADY_ASSIGNED => 422, NOTHING_PUBLISHED_IN_ENVIRONMENT => 422,
         APPLICATION_NOT_FOUND => 422, ENDPOINT_NOT_FOUND => 422, ENVIRONMENT_NOT_IN_APPLICATION => 422,
-        ALREADY_GRANTED => 422, GRANT_REVOKED_CONCURRENTLY => 409
+        ALREADY_GRANTED => 422, GRANT_REVOKED_CONCURRENTLY => 409, RETURN_TO_NOT_REGISTERED => 422
       }.freeze
 
       # Every code the API can send, as strings.

data/lib/end_point_blank/management/resources/clients.rb

@@ -70,9 +70,17 @@ module EndPointBlank
 
         # POST /clients/:client_id/claim_invites: emails your customer an
         # invite to claim a managed client.
+        #
+        # +return_to+ (optional, sent only when given) is where EndPointBlank
+        # sends the customer's browser once they have claimed it. It must
+        # equal, byte for byte, a claim return URL your organization
+        # registered in EndPointBlank, or the call is refused with
+        # +return_to_not_registered+ (422).
         # @return [Hash] <tt>{"client_id", "email", "sent_at", "expires_at"}</tt>
-        def claim_invite(client_id, email:, idempotency_key: nil)
-          post_data(path("clients", client_id, "claim_invites"), { email: email }, idempotency_key)
+        def claim_invite(client_id, email:, return_to: nil, idempotency_key: nil)
+          body = { email: email }
+          body[:return_to] = return_to unless return_to.nil?
+          post_data(path("clients", client_id, "claim_invites"), body, idempotency_key)
         end
       end
 

data/lib/end_point_blank/rack/headers.rb

@@ -1,6 +1,18 @@
 module EndPointBlank
   module Rack
     module Headers
+      # Headers the SDK never sends to intake, lower-cased and matched in any
+      # letter case (sc-1470).
+      #
+      # A request record used to carry every inbound header, so a caller's
+      # `Authorization: Basic client_id:secret` or bearer token, a proxy
+      # credential and its session cookie landed in the provider's request log
+      # unless the provider had written a masking rule for them. The writers
+      # drop these before masking runs, rather than mask them, so no rule and
+      # no mask_hook can bring them back. `Set-Cookie` never arrives on a
+      # request; it is listed so a response record can never carry it either.
+      SENSITIVE_HEADERS = %w[authorization proxy-authorization cookie set-cookie].freeze
+
       def self.extract
         env = ::EndPointBlank::Rack::EnvStore.get
         return {} if env.nil?
@@ -8,6 +20,20 @@ module EndPointBlank
         env.select { |k,v| k.start_with? 'HTTP_'}.
           transform_keys { |k| k.sub(/^HTTP_/, '').split('_').map(&:capitalize).join('-') }
       end
+
+      # The request's headers as a request or response record may send them:
+      # {extract} without any of {SENSITIVE_HEADERS}.
+      def self.reportable
+        without_sensitive(extract)
+      end
+
+      # A new hash of `headers` without any of {SENSITIVE_HEADERS}, whatever
+      # their letter case. Never changes its argument; nil is {}.
+      def self.without_sensitive(headers)
+        return {} if headers.nil?
+
+        headers.reject { |name, _value| SENSITIVE_HEADERS.include?(name.to_s.downcase) }
+      end
     end
   end
-end
+end

data/lib/end_point_blank/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EndPointBlank
-  VERSION = "0.13.0"
+  VERSION = "0.13.1"
 end

data/lib/end_point_blank/writers/request_writer.rb

@@ -25,7 +25,9 @@ module EndPointBlank
         env = ::EndPointBlank::Rack::EnvStore.get
         request = ::Rack::Request.new(env)
         version = Commands::VersionFinder.new.find(request)
-        headers = ::EndPointBlank::Rack::Headers.extract
+        # Authorization, Proxy-Authorization and Cookie are never sent,
+        # masking rule or not (Headers::SENSITIVE_HEADERS, sc-1470).
+        headers = ::EndPointBlank::Rack::Headers.reportable
 
         {
           app_name: EndPointBlank::Configuration.instance.app_name,

data/lib/end_point_blank/writers/response_writer.rb

@@ -24,7 +24,10 @@ module EndPointBlank
       def payload(status:, headers:, body:, data: {})
         request = ::EndPointBlank::Rack::EnvStore.request
         env = ::EndPointBlank::Rack::EnvStore.get
-        headers = ::EndPointBlank::Rack::Headers.extract
+        # The record carries the request's headers, not the `headers:`
+        # argument, so without the sc-1470 filter a caller's Authorization
+        # and Cookie reached the response record too.
+        headers = ::EndPointBlank::Rack::Headers.reportable
         version = request ? Commands::VersionFinder.new.find(request) : nil
         route = request ? Commands::RoutePatternFinder.find(request) : nil
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: end_point_blank
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.13.1
 platform: ruby
 authors:
 - Robert A. Lasch
 bindir: exe
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: excon