end_point_blank 0.13.0 → 0.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a18f4976c060497e06a7fd5af0ee63d14cc080f7541b951d474baefe75c605ae
-  data.tar.gz: 9d04564e23b5d62e6a6b848c2c7f6f0e8c4ac08639c41072392dfa95ee4b9664
+  metadata.gz: d3074c1bcab8168bdd552228eceb3f5736cacde44e9b00b84445cdb86021d92b
+  data.tar.gz: e94489b6b2b35aa0677273a2d897a7df0f4981be731c13585833fad8b8f0e591
 SHA512:
-  metadata.gz: 679591ad5e6f06194f5b93f42e30f0c9455deaeaf6b29293a4429beea5cc3e2444d06c7c28389e3432ff8504fbeaa6496ab5e0a08d08f5420888db6d7e0a709e
-  data.tar.gz: d52d7a2bf74d7cff868e96bc338cdd8c77e0b4608c61cabd6014efdd5cf90c50b5ba765e990bce9cf53bc7089969a2deacb26aae3edbce285d8cfd0dd5aaffcc
+  metadata.gz: fe2541cb6c5e8e387daddec748689dd14277e90c71658b92b48c310b71987d4a2e77179dab3966fc0e7c773be3b94d3622cfb7f4d9edd4af1e2e56c507bcc102
+  data.tar.gz: d68a18303b8d04efecfbb4358c8c809a077cbfafc76274e0da4c34782349e822933865fbe9513ee36f2dbc4e39ed237079c0fc433edb5a842c691fce405d4445

data/CHANGELOG.md

@@ -1,5 +1,105 @@
 # Changelog
 
+## 0.14.0
+
+### Added
+
+- **Managed clients carry an `owner_email` (sc-1567).** `clients.create`
+  (with `managed: true`) and `clients.create_managed` take `owner_email:`,
+  the person at your customer who will own the managed client, and the new
+  `clients.update(id, owner_email:)` (`PATCH /api/v1/clients/:id`) changes
+  it. Like every PATCH, the update sends no Idempotency-Key and is never
+  retried after a 5xx or a lost connection.
+- **The calling organization's id is kept from `/authorize` (sc-1571).**
+  `EndPointBlank::Rack::EnvStore.source_organization_id` answers
+  `data[0].source_organization_id`, the caller's EndPointBlank organization
+  id, beside `source_application_environment_id`, on a cache miss and on a
+  cache hit alike (the cache holds intake's whole answer). nil, without a log
+  line, when intake is older than the field or the organization has no id. An
+  answer cached before intake sent the field still authorizes, with no
+  organization, until its entry expires (`cache_ttl`).
+- **`create_portal_session` signs a managed client's owner in to its
+  EndPointBlank portal (sc-1574).** `clients.create_portal_session(client_id,
+  return_url: nil)` and a managed client's `create_portal_session(return_url:
+  nil)` call `POST /api/v1/clients/:client_id/portal_sessions` and answer
+  `{"client_id", "url", "expires_at", "return_url"}`: a single-use link that
+  expires 60 seconds after it is minted, so mint it when the user clicks and
+  redirect their browser to it. `return_url` is sent only when given and must
+  equal one of your organization's claim return URLs. Refused with 404 for a
+  client that is not yours, and 422 (`client_not_managed`,
+  `client_being_removed`, `owner_email_missing`, `return_url_not_registered`)
+  for one that is not an unclaimed managed client open to claims with an
+  owner email. The answer is never replayed: each call sends a new
+  Idempotency-Key, and a reused one answers 409
+  `idempotency_replay_unavailable`, whose message now also says to create a
+  new portal session with a new key.
+- `ErrorCodes` lists the API codes it was missing: `already_invited` (409),
+  `invite_accepted`, `invite_not_open`, `invite_rate_limited` (429),
+  `not_an_email_invite`, `client_being_removed`, `client_not_removable`,
+  `return_url_not_registered` and `owner_email_missing`.
+
+### Fixed
+
+- **The gem loads on Ruby 3.3 (sc-1628).** `LogWriter#payload` defaulted each
+  keyword to itself (`message: message`), which Ruby 3.3 rejects with
+  "circular argument reference" (a SyntaxError), so requiring the gem failed.
+  The keywords are now plain required keywords. `required_ruby_version` is
+  lowered from `>= 3.4.2` to `>= 3.3`, and CI runs the suite on 3.3 and 3.4.2.
+- **The response record carries the response's headers (sc-1627).**
+  `ReportInteraction` sent the request's headers in the response record, so
+  intake's response log showed request headers and any credential header not
+  dropped by sc-1470 reached intake twice. It now sends the app's response
+  headers (none when the app raised), minus the same sensitive headers the
+  request record drops. A header Rack gives as an array is joined with ", ".
+- **API key and token headers are never sent (sc-1626).** Request and
+  response records already left out `Authorization`, `Proxy-Authorization`,
+  `Cookie` and `Set-Cookie` (sc-1470). They now also leave out `X-Api-Key`,
+  `Api-Key`, `X-Auth-Token`, `X-Access-Token`, `X-Refresh-Token`,
+  `X-Amz-Security-Token`, `X-Csrf-Token`, `X-Xsrf-Token`, `X-Goog-Api-Key` and
+  `Ocp-Apim-Subscription-Key`, in any letter case. Every SDK and intake drop
+  the same set.
+- **A failed authorization no longer leaves an earlier caller in the request
+  store.** `EndpointAuthorize.authorize` clears the source environment and
+  organization ids before it asks, so a refused or unanswered authorization on
+  a reused env (a direct caller of the command) cannot name the previous
+  caller. The Rack middleware already starts every request from an empty
+  store, by installing that request's own env.
+
+## 0.13.1
+
+### Security
+
+- **Request and response records no longer carry credentials or cookies
+  (sc-1470).** Both records carried every `HTTP_*` header of the request (the
+  response record sends the request's headers, not the response's), so unless
+  you had written a masking rule for it, a caller's `Authorization` header
+  (Basic `client_id:secret` or a bearer token) landed in your request and
+  response logs in EndPointBlank. `RequestWriter` and `ResponseWriter` now
+  leave out `Authorization`, `Proxy-Authorization`, `Cookie` and `Set-Cookie`,
+  in any letter case, before masking runs, so they are not in the payload the
+  rules and hook receive, and they are not sent at all. The list is
+  `EndPointBlank::Rack::Headers::SENSITIVE_HEADERS`; the SDK's own reads of
+  the request (`Headers.extract`, used to find the endpoint version) are
+  unchanged. A masking rule that targeted one of these headers now has nothing
+  to match and can be removed. Records sent by earlier versions may hold these
+  values; rotate any client secret a caller sent while it was in use.
+
+### Upgrading
+
+- A `mask_hook` that reads `Authorization`, `Proxy-Authorization`, `Cookie` or
+  `Set-Cookie` from `headers` now finds it absent; guard the lookup.
+
+### Added
+
+- **`claim_invite` takes an optional `return_to` (sc-1515).**
+  `clients.claim_invite(client_id, email:, return_to:)` and a managed
+  client's `claim_invite(email:, return_to:)` send `return_to`, where
+  EndPointBlank sends the customer's browser once they have claimed the
+  managed client. It is sent only when given, and must equal, byte for byte,
+  a claim return URL your organization registered in EndPointBlank; anything
+  else is refused with `return_to_not_registered` (422), now in
+  `ErrorCodes` as `RETURN_TO_NOT_REGISTERED`.
+
 ## 0.13.0
 
 ### Added

data/README.md

@@ -485,6 +485,13 @@ regex is applied only within the path-selected node(s). When a `regex` is presen
 match; `$$` for a literal `$`). Stacktraces and log messages/data are never masked (there is no
 `log` entry in the masking field map).
 
+**Credential and cookie headers are never sent.** Before any rule runs, the request and response
+records leave out `Authorization`, `Proxy-Authorization`, `Cookie`, `Set-Cookie`, `X-Api-Key`,
+`Api-Key`, `X-Auth-Token`, `X-Access-Token`, `X-Refresh-Token`, `X-Amz-Security-Token`,
+`X-Csrf-Token`, `X-Xsrf-Token`, `X-Goog-Api-Key` and `Ocp-Apim-Subscription-Key`, whatever
+their letter case. They are left out of the record, not masked: they are not in the payload the
+rules and hook receive. The list is `EndPointBlank::Rack::Headers::SENSITIVE_HEADERS`.
+
 ## Framework integration
 
 ### Rails
@@ -653,7 +660,9 @@ A managed client is an organization you create and run for a customer until they
 under `/api/v1/clients/:client_id/`:
 
 ```ruby
-customer = mgmt.clients.create_managed(name: "Initech")
+# `owner_email` (optional) names the person at your customer who will own it; change it later
+# with `mgmt.clients.update(customer["id"], owner_email: ...)`.
+customer = mgmt.clients.create_managed(name: "Initech", owner_email: "it@initech.example")
 initech  = mgmt.for_managed_client(customer["id"])
 
 # The managed client's organization already has a "production" environment (the name is
@@ -670,6 +679,18 @@ mgmt.package_assignments.assign(customer["id"], api_package_id: package["id"], e
 
 # ... and hand it over: the customer gets an email, and claiming rotates every credential you issued.
 initech.claim_invite(email: "it@initech.example")
+
+# Optionally send the customer's browser somewhere once they have claimed it. `return_to` must
+# equal, byte for byte, a claim return URL your organization registered in EndPointBlank;
+# anything else is refused with `return_to_not_registered` (422).
+initech.claim_invite(email: "it@initech.example", return_to: "https://app.example/welcome")
+
+# Until they claim it, send its owner into its EndPointBlank portal from your app: mint a link
+# when they click and redirect their browser to it. The link works once and expires after 60
+# seconds, so never render it into a page, and mint a new one (with a new Idempotency-Key, the
+# default) on every click. `return_url:` (optional) must be one of your claim return URLs too.
+portal = initech.create_portal_session(return_url: "https://app.example/welcome")
+redirect_to portal["url"], allow_other_host: true
 ```
 
 Once claimed, the managed client's calls answer `not_found`. Remove an unclaimed one with

data/end_point_blank.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
   spec.summary = "Ruby and Rails SDK for EndPointBlank: authorize service-to-service API calls, report endpoint versions, and see which clients still call deprecated API versions."
   spec.description = "Ruby and Rails SDK for EndPointBlank: authorize service-to-service (machine-to-machine) API calls, report endpoint versions, and see which clients still call deprecated API versions before you sunset them. A framework-agnostic core runs in plain Ruby / Sinatra, with Rails supported as an auto-loaded adapter."
   spec.homepage = "https://endpointblank.com"
-  spec.required_ruby_version = ">= 3.4.2"
+  spec.required_ruby_version = ">= 3.3"
   spec.license = "Nonstandard"
 
   spec.metadata["allowed_push_host"] = "https://rubygems.org"

data/lib/end_point_blank/commands/endpoint_authorize.rb

@@ -16,6 +16,12 @@ module EndPointBlank
         end
 
         def authorize(request)
+          # A thread that serves more than one request, or a direct caller
+          # that reuses one env, must not carry the last caller's identity
+          # into this one: a refused or failed authorization leaves both ids
+          # unset rather than naming whoever was authorized before.
+          record_source(nil, nil)
+
           client_auth = request.headers['Authorization'].to_s
           method      = request.request_method
           path        = request.route_uri_pattern.to_s.gsub(/\([^)]*\)/, '')
@@ -33,14 +39,16 @@ module EndPointBlank
           # The cached value is the authorize response body, not a truthy
           # marker.
           #
-          # It has to be, for two reasons. Callers parse the body — a cache hit
+          # It has to be, for three reasons. Callers parse the body — a cache hit
           # returning '' made JSON.parse raise, so a cached authorization became
           # a 500 rather than a fast success. And the body is where the
           # deprecation block lives; without it the Deprecation and Sunset
           # headers would appear only on cache misses, which reads as a flaky
-          # feature rather than a missing one.
+          # feature rather than a missing one. And the calling organization's
+          # id (sc-1571) is in it too, for the same reason. A body cached
+          # before intake sent that id simply has none, and answers nil.
           if (cached = cache.retrieve(cache_key))
-            record_source_application_environment_id(cached)
+            record_source_ids(cached)
             return CachedResponse.new(201, cached)
           end
 
@@ -70,7 +78,7 @@ module EndPointBlank
           return nil if response.nil?
           EndPointBlank.logger.info "Authentication response: #{response.status} - #{response.body}"
           if response.status == 201
-            record_source_application_environment_id(response.body)
+            record_source_ids(response.body)
             cache.store(cache_key, response.body)
           elsif response.status > 299
             EndPointBlank.logger.error "Failed to authorize endpoint: #{response.status} - #{response.body}"
@@ -80,6 +88,33 @@ module EndPointBlank
 
         private
 
+        def record_source(source_env_id, source_organization_id)
+          ::EndPointBlank::Rack::EnvStore.set_source_application_environment_id(source_env_id)
+          ::EndPointBlank::Rack::EnvStore.set_source_organization_id(source_organization_id)
+        end
+
+        def record_source_ids(body)
+          record_source_application_environment_id(body)
+          ::EndPointBlank::Rack::EnvStore.set_source_organization_id(source_organization_id(body))
+        end
+
+        # sc-1571: the calling organization's EndPointBlank id. An intake older
+        # than the field does not send it, and an organization with no id
+        # there gets null; both are nil here, silently, since neither is a
+        # broken contract. A body that is not a JSON object has already been
+        # logged by record_source_application_environment_id.
+        def source_organization_id(body)
+          parsed = JSON.parse(body)
+          return nil unless parsed.is_a?(Hash)
+
+          data = parsed['data']
+          first = data.is_a?(Array) ? data.first : nil
+          id = first.is_a?(Hash) ? first['source_organization_id'] : nil
+          id.is_a?(String) && !id.empty? ? id : nil
+        rescue JSON::ParserError
+          nil
+        end
+
         # Intake renders the grant under data[0]. The Rails controller also
         # records this value, but the command is also used directly (today,
         # by end_point_blank_deploy's conformance driver), so the command must

data/lib/end_point_blank/management/client.rb

@@ -215,9 +215,19 @@ module EndPointBlank
       end
 
       # POST /clients/:client_id/claim_invites: emails your customer an
-      # invite to claim the client. @return [Hash]
-      def claim_invite(email:, idempotency_key: nil)
-        @clients.claim_invite(client_id, email: email, idempotency_key: idempotency_key)
+      # invite to claim the client, and with +return_to+ (a claim return URL
+      # your organization registered) where to send them once claimed; see
+      # {Resources::Clients#claim_invite}. @return [Hash]
+      def claim_invite(email:, return_to: nil, idempotency_key: nil)
+        @clients.claim_invite(client_id, email: email, return_to: return_to, idempotency_key: idempotency_key)
+      end
+
+      # POST /clients/:client_id/portal_sessions: a single-use, 60-second
+      # link that signs the client's owner in to its EndPointBlank portal
+      # until they claim it; see {Resources::Clients#create_portal_session}.
+      # @return [Hash]
+      def create_portal_session(return_url: nil, idempotency_key: nil)
+        @clients.create_portal_session(client_id, return_url: return_url, idempotency_key: idempotency_key)
       end
 
       def inspect

data/lib/end_point_blank/management/error.rb

@@ -125,7 +125,8 @@ module EndPointBlank
                      "that is shown only once, so it can't be replayed and was not retried. Read or list " \
                      "the resource to see its current state"
           message << " (#{location})" if location
-          message << ". If you need a secret you never received, rotate the credential."
+          message << ". If you need a secret you never received, rotate the credential; for a portal " \
+                     "session, create a new one with a new key."
           message
         end
       end

data/lib/end_point_blank/management/error_codes.rb

@@ -56,6 +56,13 @@ module EndPointBlank
       CLIENT_ACCEPTED = "client_accepted"
       CLIENT_NOT_MANAGED = "client_not_managed"
       ALREADY_A_MEMBER = "already_a_member"
+      ALREADY_INVITED = "already_invited"
+      INVITE_ACCEPTED = "invite_accepted"
+      INVITE_NOT_OPEN = "invite_not_open"
+      INVITE_RATE_LIMITED = "invite_rate_limited"
+      NOT_AN_EMAIL_INVITE = "not_an_email_invite"
+      CLIENT_BEING_REMOVED = "client_being_removed"
+      CLIENT_NOT_REMOVABLE = "client_not_removable"
       MANAGED_CLIENT_HAS_CREDENTIALS = "managed_client_has_credentials"
       API_PACKAGE_NOT_FOUND = "api_package_not_found"
       ENVIRONMENT_NOT_FOUND = "environment_not_found"
@@ -66,6 +73,14 @@ module EndPointBlank
       ENVIRONMENT_NOT_IN_APPLICATION = "environment_not_in_application"
       ALREADY_GRANTED = "already_granted"
       GRANT_REVOKED_CONCURRENTLY = "grant_revoked_concurrently"
+      # A claim invite's +return_to+ is not one of the claim return URLs your
+      # organization registered.
+      RETURN_TO_NOT_REGISTERED = "return_to_not_registered"
+      # A portal session's +return_url+ is not one of those claim return URLs.
+      RETURN_URL_NOT_REGISTERED = "return_url_not_registered"
+      # A portal session for a managed client with no owner email; set one
+      # with <tt>clients.update</tt>.
+      OWNER_EMAIL_MISSING = "owner_email_missing"
 
       # The warning code API package endpoint writes answer in +warnings+ (not
       # an error): a client assignment of the package now derives no grant.
@@ -94,10 +109,13 @@ module EndPointBlank
         DELETE_REFUSED => 422, INTAKE_CREDENTIAL => 409, INTAKE_REJECTED => 422, INTAKE_UNAVAILABLE => 503,
         INVALID_CONTACTS => 422, INVALID_PACKAGES => 422, INVALID_GRANTS => 422, INVALID_MANAGED => 422,
         CLIENT_NOT_ACCEPTED => 422, CLIENT_ACCEPTED => 422, CLIENT_NOT_MANAGED => 422,
-        ALREADY_A_MEMBER => 422, MANAGED_CLIENT_HAS_CREDENTIALS => 422, API_PACKAGE_NOT_FOUND => 422,
+        ALREADY_A_MEMBER => 422, ALREADY_INVITED => 409, INVITE_ACCEPTED => 422, INVITE_NOT_OPEN => 422,
+        INVITE_RATE_LIMITED => 429, NOT_AN_EMAIL_INVITE => 422, CLIENT_BEING_REMOVED => 422,
+        CLIENT_NOT_REMOVABLE => 422, MANAGED_CLIENT_HAS_CREDENTIALS => 422, API_PACKAGE_NOT_FOUND => 422,
         ENVIRONMENT_NOT_FOUND => 422, ALREADY_ASSIGNED => 422, NOTHING_PUBLISHED_IN_ENVIRONMENT => 422,
         APPLICATION_NOT_FOUND => 422, ENDPOINT_NOT_FOUND => 422, ENVIRONMENT_NOT_IN_APPLICATION => 422,
-        ALREADY_GRANTED => 422, GRANT_REVOKED_CONCURRENTLY => 409
+        ALREADY_GRANTED => 422, GRANT_REVOKED_CONCURRENTLY => 409, RETURN_TO_NOT_REGISTERED => 422,
+        RETURN_URL_NOT_REGISTERED => 422, OWNER_EMAIL_MISSING => 422
       }.freeze
 
       # Every code the API can send, as strings.

data/lib/end_point_blank/management/resources/clients.rb

@@ -40,11 +40,16 @@ module EndPointBlank
         #   target_endpoint_id: nil}</tt>
         # @param managed [Boolean, nil] true creates a managed client (no
         #   packages or grants with it; assign those afterwards)
+        # @param owner_email [String, nil] with <tt>managed: true</tt>, the
+        #   email address of the person at your customer who will own the
+        #   managed client; change it later with {#update}
         # @return [Hash] the new client; +invite_code+ is what the client
         #   accepts with
         # rubocop:disable Metrics/ParameterLists
-        def create(name:, contacts: nil, packages: nil, grants: nil, managed: nil, idempotency_key: nil)
-          body = compact(name: name, contacts: contacts, packages: packages, grants: grants, managed: managed)
+        def create(name:, contacts: nil, packages: nil, grants: nil, managed: nil, owner_email: nil,
+                   idempotency_key: nil)
+          body = compact(name: name, contacts: contacts, packages: packages, grants: grants, managed: managed,
+                         owner_email: owner_email)
           post_data(path("clients"), body, idempotency_key)
         end
         # rubocop:enable Metrics/ParameterLists
@@ -57,8 +62,15 @@ module EndPointBlank
 
         # Creates a managed client: {#create} with <tt>managed: true</tt>. Set
         # it up with {Client#for_managed_client}.
-        def create_managed(name:, contacts: nil, idempotency_key: nil)
-          create(name: name, contacts: contacts, managed: true, idempotency_key: idempotency_key)
+        def create_managed(name:, contacts: nil, owner_email: nil, idempotency_key: nil)
+          create(name: name, contacts: contacts, managed: true, owner_email: owner_email,
+                 idempotency_key: idempotency_key)
+        end
+
+        # PATCH /clients/:id: +owner_email+ is the email address of the
+        # person at your customer who will own a managed client. @return [Hash]
+        def update(id, owner_email:)
+          patch_data(path("clients", id), { owner_email: owner_email })
         end
 
         # DELETE /clients/:id. Refused with +managed_client_has_credentials+
@@ -70,9 +82,45 @@ module EndPointBlank
 
         # POST /clients/:client_id/claim_invites: emails your customer an
         # invite to claim a managed client.
+        #
+        # +return_to+ (optional, sent only when given) is where EndPointBlank
+        # sends the customer's browser once they have claimed it. It must
+        # equal, byte for byte, a claim return URL your organization
+        # registered in EndPointBlank, or the call is refused with
+        # +return_to_not_registered+ (422).
         # @return [Hash] <tt>{"client_id", "email", "sent_at", "expires_at"}</tt>
-        def claim_invite(client_id, email:, idempotency_key: nil)
-          post_data(path("clients", client_id, "claim_invites"), { email: email }, idempotency_key)
+        def claim_invite(client_id, email:, return_to: nil, idempotency_key: nil)
+          body = { email: email }
+          body[:return_to] = return_to unless return_to.nil?
+          post_data(path("clients", client_id, "claim_invites"), body, idempotency_key)
+        end
+
+        # POST /clients/:client_id/portal_sessions: mints a single-use link
+        # that signs the owner of managed client +client_id+ in to its
+        # EndPointBlank portal.
+        #
+        # The link expires 60 seconds after it is minted and works once, so
+        # mint it when the user clicks and redirect their browser to it; never
+        # render it into a page, log it or send it in an email. +return_url+
+        # (optional, sent only when given) is where the portal links back to,
+        # and must equal, byte for byte, a claim return URL your organization
+        # registered.
+        #
+        # Each call sends a new Idempotency-Key unless you pass one, and that
+        # is what you want: the answer is never replayed, so a key used before
+        # is refused with +idempotency_replay_unavailable+ (409). Never reuse a
+        # key across clicks.
+        #
+        # Refused with +not_found+ (404) for a client that is not yours, and
+        # with +client_not_managed+ (not a managed client, or already
+        # claimed), +client_being_removed+, +owner_email_missing+ (set one with
+        # {#update}) or +return_url_not_registered+ (an empty string included),
+        # all 422.
+        # @return [Hash] <tt>{"client_id", "url", "expires_at", "return_url"}</tt>,
+        #   +return_url+ nil when none was given
+        def create_portal_session(client_id, return_url: nil, idempotency_key: nil)
+          body = return_url.nil? ? nil : { return_url: return_url }
+          post_data(path("clients", client_id, "portal_sessions"), body, idempotency_key)
         end
       end
 

data/lib/end_point_blank/middleware/rack/report_interaction.rb

@@ -14,6 +14,10 @@ module EndPointBlank
         end
 
         def call(env)
+          # Start from nothing: installing this request's own env replaces the
+          # store wholesale, so an earlier request on this thread whose ensure
+          # never ran cannot lend its caller (source environment and
+          # organization ids, deprecation) to this one.
           ::EndPointBlank::Rack::EnvStore.set(env)
           ::EndPointBlank::Writers::RequestWriter.write
 
@@ -44,8 +48,8 @@ module EndPointBlank
 
           raise e
         ensure
-          headers = ::EndPointBlank::Rack::Headers.extract
-          ::EndPointBlank::Writers::ResponseWriter.write(status:, headers:, body:)
+          # The app's response headers; none when the app raised (sc-1627).
+          ::EndPointBlank::Writers::ResponseWriter.write(status:, headers: headers || {}, body:)
           ::EndPointBlank::Rack::EnvStore.clear
         end
 

data/lib/end_point_blank/rack/env_store.rb

@@ -22,6 +22,7 @@ module EndPointBlank
     class EnvStore
       KEY = 'end_point_blank.rack_env'.freeze
       SOURCE_ENV_ID_KEY = 'end_point_blank.source_application_environment_id'.freeze
+      SOURCE_ORGANIZATION_ID_KEY = 'end_point_blank.source_organization_id'.freeze
       DEPRECATION_KEY = 'end_point_blank.deprecation'.freeze
 
       def self.set(env)
@@ -47,6 +48,18 @@ module EndPointBlank
         fetch(SOURCE_ENV_ID_KEY)
       end
 
+      # The calling organization's EndPointBlank id, from intake's authorize
+      # answer (data[0].source_organization_id, sc-1571), resolved beside the
+      # source application environment id. nil when intake is older than that
+      # field or the organization has no id there.
+      def self.set_source_organization_id(id)
+        put(SOURCE_ORGANIZATION_ID_KEY, id)
+      end
+
+      def self.source_organization_id
+        fetch(SOURCE_ORGANIZATION_ID_KEY)
+      end
+
       # The authorize response's deprecation block, stashed on the way in so the
       # response middleware can turn it into `Deprecation` and `Sunset` headers
       # on the way out.

data/lib/end_point_blank/rack/headers.rb

@@ -1,6 +1,37 @@
 module EndPointBlank
   module Rack
     module Headers
+      # Headers the SDK never sends to intake, lower-cased and matched in any
+      # letter case (sc-1470).
+      #
+      # A request record used to carry every inbound header, so a caller's
+      # `Authorization: Basic client_id:secret` or bearer token, a proxy
+      # credential and its session cookie landed in the provider's request log
+      # unless the provider had written a masking rule for them. The writers
+      # drop these before masking runs, rather than mask them, so no rule and
+      # no mask_hook can bring them back. `Set-Cookie` never arrives on a
+      # request; it is listed so a response record can never carry it either.
+      #
+      # sc-1626 added the other headers that commonly carry an API key or
+      # token. Every SDK and intake's ingest backstop drop this same set; keep
+      # them in step.
+      SENSITIVE_HEADERS = %w[
+        authorization
+        proxy-authorization
+        cookie
+        set-cookie
+        x-api-key
+        api-key
+        x-auth-token
+        x-access-token
+        x-refresh-token
+        x-amz-security-token
+        x-csrf-token
+        x-xsrf-token
+        x-goog-api-key
+        ocp-apim-subscription-key
+      ].freeze
+
       def self.extract
         env = ::EndPointBlank::Rack::EnvStore.get
         return {} if env.nil?
@@ -8,6 +39,33 @@ module EndPointBlank
         env.select { |k,v| k.start_with? 'HTTP_'}.
           transform_keys { |k| k.sub(/^HTTP_/, '').split('_').map(&:capitalize).join('-') }
       end
+
+      # The request's headers as a request or response record may send them:
+      # {extract} without any of {SENSITIVE_HEADERS}.
+      def self.reportable
+        without_sensitive(extract)
+      end
+
+      # A response's own headers as a response record may send them
+      # (sc-1627): a plain hash of name to string, without any of
+      # {SENSITIVE_HEADERS}. Accepts a Hash or a Rack::Headers; a header Rack 3
+      # gives as an array of values is joined with ", ". nil is {}.
+      def self.reportable_response(headers)
+        return {} if headers.nil?
+
+        plain = headers.to_h.to_h do |name, value|
+          [name.to_s, value.is_a?(Array) ? value.join(", ") : value.to_s]
+        end
+        without_sensitive(plain)
+      end
+
+      # A new hash of `headers` without any of {SENSITIVE_HEADERS}, whatever
+      # their letter case. Never changes its argument; nil is {}.
+      def self.without_sensitive(headers)
+        return {} if headers.nil?
+
+        headers.reject { |name, _value| SENSITIVE_HEADERS.include?(name.to_s.downcase) }
+      end
     end
   end
-end
+end

data/lib/end_point_blank/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EndPointBlank
-  VERSION = "0.13.0"
+  VERSION = "0.14.0"
 end

data/lib/end_point_blank/writers/log_writer.rb

@@ -37,7 +37,7 @@ module EndPointBlank
         instance.write(message, level, data)
       end
 
-      def payload(message: message, level: level, data: data)
+      def payload(message:, level:, data:)
         env = ::EndPointBlank::Rack::EnvStore.get
         uuid = request_uuid(env)
 

data/lib/end_point_blank/writers/request_writer.rb

@@ -25,7 +25,9 @@ module EndPointBlank
         env = ::EndPointBlank::Rack::EnvStore.get
         request = ::Rack::Request.new(env)
         version = Commands::VersionFinder.new.find(request)
-        headers = ::EndPointBlank::Rack::Headers.extract
+        # Authorization, Proxy-Authorization and Cookie are never sent,
+        # masking rule or not (Headers::SENSITIVE_HEADERS, sc-1470).
+        headers = ::EndPointBlank::Rack::Headers.reportable
 
         {
           app_name: EndPointBlank::Configuration.instance.app_name,

data/lib/end_point_blank/writers/response_writer.rb

@@ -24,7 +24,10 @@ module EndPointBlank
       def payload(status:, headers:, body:, data: {})
         request = ::EndPointBlank::Rack::EnvStore.request
         env = ::EndPointBlank::Rack::EnvStore.get
-        headers = ::EndPointBlank::Rack::Headers.extract
+        # The response's own headers (sc-1627). This used to send the
+        # request's headers instead, so the response log showed the caller's
+        # headers and any credential header reached intake a second time.
+        headers = ::EndPointBlank::Rack::Headers.reportable_response(headers)
         version = request ? Commands::VersionFinder.new.find(request) : nil
         route = request ? Commands::RoutePatternFinder.find(request) : nil
 

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: end_point_blank
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.14.0
 platform: ruby
 authors:
 - Robert A. Lasch
 bindir: exe
 cert_chain: []
-date: 2026-10-02 00:00:00.000000000 Z
+date: 2026-10-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: excon
@@ -175,7 +175,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 3.4.2
+      version: '3.3'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="