end_point_blank 0.2.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: b2327b3053463662a656ad3f6d03596e7e21c72beae8c30aa18fc445eff230a5
+  data.tar.gz: 4c80916d52eab6b760ec5ebedf1ee70da4132697e49f37305d106aa5637677d5
+SHA512:
+  metadata.gz: 8c13f72a824fa9b0e8d05bbf6a039bae0aec1f9c24fb5226bb23de58cf8f6fe75f99c3089ff95fc7a1989b8dd90bb705d246558fb62f1d8073d10b394ed1b927
+  data.tar.gz: 786fb59740f10dc62c61bdd8ffc014cd72c0fba1c223ff6c9465b840c4c6134720cec8eceb321cd78caee0dd8a4a8ba58f9db0db05ed6cf756eb1fe78239f5ed

data/.rspec

@@ -0,0 +1,3 @@
+--format documentation
+--color
+--require spec_helper

data/.rubocop.yml

@@ -0,0 +1,13 @@
+AllCops:
+  TargetRubyVersion: 2.6
+
+Style/StringLiterals:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Layout/LineLength:
+  Max: 120

data/.ruby-version

@@ -0,0 +1 @@
+3.4.2

data/README.md

@@ -0,0 +1,64 @@
+# EndPointBlankRack
+
+TODO: Delete this and the text below, and describe your gem
+
+Welcome to your new gem! In this directory, you'll find the files you need to be able to package up your Ruby library into a gem. Put your Ruby code in the file `lib/end_point_blank_rack`. To experiment with that code, run `bin/console` for an interactive prompt.
+
+## Installation
+
+TODO: Replace `UPDATE_WITH_YOUR_GEM_NAME_PRIOR_TO_RELEASE_TO_RUBYGEMS_ORG` with your gem name right after releasing it to RubyGems.org. Please do not do it earlier due to security reasons. Alternatively, replace this section with instructions to install your gem from git if you don't plan to release to RubyGems.org.
+
+Install the gem and add to the application's Gemfile by executing:
+
+    $ bundle add UPDATE_WITH_YOUR_GEM_NAME_PRIOR_TO_RELEASE_TO_RUBYGEMS_ORG
+
+If bundler is not being used to manage dependencies, install the gem by executing:
+
+    $ gem install UPDATE_WITH_YOUR_GEM_NAME_PRIOR_TO_RELEASE_TO_RUBYGEMS_ORG
+
+## Usage
+
+### Masking
+
+Mask sensitive data **before it leaves your app**. Configure an ordered list of rules; each rule
+targets one field and masks by a JSONPath, a regex, or both. (Server-side intake also masks
+independently, so this is defense in depth.)
+
+```ruby
+EndPointBlank.configure do |config|
+  config.masking_rules = [
+    # Replace any "ssn" field at any depth in the request body.
+    { target: "request_body", path: "$..ssn", replacement_value: "***" },
+    # Keep first/last 4 of a card number in error messages via backreferences.
+    { target: "error_message", regex: "(\\d{4})-\\d{4}-\\d{4}-(\\d{4})", replacement_value: "$1-****-****-$2" }
+  ]
+  # Optional: runs after the rules; last chance to transform the payload.
+  config.mask_hook = ->(payload, record_type) { payload }
+end
+```
+
+Rules are hashes with symbol keys.
+
+**Rule fields**
+
+- `target` — exactly one of `"request_body"`, `"request_headers"`, `"path"`, `"response_body"`, `"error_message"`.
+- `path` — an optional JSONPath (supported subset: `$`, `.name`, `['name']`, `[n]`, `.*` / `[*]`,
+  and `..name` for recursive descent). Keys are case-sensitive.
+- `regex` — an optional regular expression.
+- `replacement_value` — the replacement string (default `"..."`).
+
+**Semantics — path scopes, regex matches within.** With only a `path`, the selected node is replaced
+entirely. With only a `regex`, every matching string is replaced. With both, the regex is applied
+only within the path-selected node(s). When a `regex` is present, `replacement_value` supports
+backreferences: `$1`, `$2`, … insert capture groups (`$0` the whole match; `$$` for a literal `$`).
+Stacktraces and log messages are never masked.
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/[USERNAME]/end_point_blank_rack.

data/Rakefile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+require "rubocop/rake_task"
+
+RuboCop::RakeTask.new
+
+task default: %i[spec rubocop]

data/build.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+# Install dependencies so the test suite can run.
+set -euo pipefail
+cd "$(dirname "$0")"
+exec bundle install

data/docs/superpowers/plans/2026-07-08-framework-agnostic-core.md

@@ -0,0 +1,68 @@
+# Framework-agnostic `end_point_blank` (Ruby) — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: superpowers:subagent-driven-development. Steps use `- [ ]` tracking. This is a Ruby gem: RSpec (`bundle exec rspec`) + RuboCop (`bundle exec rubocop`).
+
+**Goal:** Decouple the gem's core from `::Rails` (pluggable logging, env-var config, Rails-only introspection gated) so it runs in plain Ruby / Sinatra, with Rails as an auto-loaded adapter.
+
+**Architecture:** A single logger seam (`EndPointBlank.logger`), `Configuration` reading `ENDPOINTBLANK_*`, and the railtie wiring Rails specifics. Core never calls `::Rails` except through these seams.
+
+## Global Constraints
+- Design source of truth: `docs/superpowers/specs/2026-07-08-framework-agnostic-core-design.md`.
+- Config precedence everywhere: **explicit `configure` value > `ENDPOINTBLANK_*` env > built-in default**.
+- The public API (`EndPointBlank.configure { |c| ... }`, `Configuration.instance`) does not change shape.
+- After each task: `bundle exec rspec` green and `bundle exec rubocop` clean.
+- Do NOT touch `HARDENING_REPORT.md` (pre-existing, untracked, not ours).
+
+---
+
+### Task 1: Pluggable logging seam
+
+**Files:**
+- Modify: `lib/end_point_blank.rb` (logger accessor), `lib/end_point_blank/configuration.rb` (`logger` attr), `lib/end_point_blank/loggers/logger.rb`, `lib/end_point_blank/rails/railtie.rb`
+- Modify (replace `::Rails.logger`): `lib/end_point_blank/access_tokens.rb`, `commands/http.rb`, `commands/basic_authenticate.rb`, `commands/generate_access_token.rb`, `commands/endpoint_authorize.rb`, `commands/endpoint_update.rb`, `writers/delayed_writer.rb`, `middleware/rack/report_interaction.rb`
+- Test: `spec/logger_spec.rb` (new), and adjust any spec that stubs `::Rails.logger`
+
+**Interfaces (Produces):** `EndPointBlank.logger` → a `::Logger`-like object; `EndPointBlank.logger=`; `Configuration#logger` / `#logger=`.
+
+- [ ] **Step 1:** Add to `EndPointBlank` (in `end_point_blank.rb`): `def self.logger; Configuration.instance.logger || (@default_logger ||= ::Logger.new($stdout)); end` and `def self.logger=(l); Configuration.instance.logger = l; end`. `require "logger"` at the top.
+- [ ] **Step 2:** `Configuration` — add `:logger` to `attr_accessor` (default `nil`).
+- [ ] **Step 3 (TDD):** `spec/logger_spec.rb` (fail first):
+  - with `::Rails` not defined, `EndPointBlank.logger` is a `Logger` writing to `$stdout`;
+  - `EndPointBlank.configure { |c| c.logger = my_logger }` → `EndPointBlank.logger == my_logger`;
+  - `EndPointBlank::Loggers::Logger.error("x")` calls `EndPointBlank.logger.error`.
+- [ ] **Step 4:** In `loggers/logger.rb`, change `error/warn/fatal` to `EndPointBlank.logger.error/warn/fatal` (leave `debug`/`info` Writer behavior).
+- [ ] **Step 5:** Replace every remaining `::Rails.logger.X` / `Rails.logger.X` in the 8 core files with `EndPointBlank.logger.X`. (`delayed_writer.rb` already guards — simplify to `EndPointBlank.logger.warn`.)
+- [ ] **Step 6:** In `rails/railtie.rb`, on boot set `EndPointBlank::Configuration.instance.logger ||= ::Rails.logger` (initializer). So Rails apps log via Rails unchanged.
+- [ ] **Step 7:** Update any existing spec stubbing `::Rails.logger` to stub `EndPointBlank.logger`. `bundle exec rspec` green, `rubocop` clean. Commit `feat: pluggable EndPointBlank.logger, decouple core logging from ::Rails`.
+
+### Task 2: Env-var config + Rails-free `app_name`
+
+**Files:**
+- Modify: `lib/end_point_blank/configuration.rb`
+- Test: `spec/configuration_spec.rb` (new or extend)
+
+**Interfaces:** `Configuration#client_id/#client_secret/#base_url/#log_base_url/#app_name` honor `ENDPOINTBLANK_*` fallbacks.
+
+- [ ] **Step 1 (TDD):** `spec/configuration_spec.rb` (fail first), resetting the singleton + `ENV` per example:
+  - unset `client_id` returns `ENV["ENDPOINTBLANK_CLIENT_ID"]`; same for `client_secret`, and `base_url`/`log_base_url`/`app_name`;
+  - explicit `configure` value beats the env var; env var beats the built-in default (`base_url` default stays `https://in.endpointblank.com` when neither set);
+  - `app_name` with `::Rails` undefined + `ENDPOINTBLANK_APP_NAME` set returns that; unset + no Rails → `nil` (no `NameError`).
+- [ ] **Step 2:** Implement env fallbacks. For `client_id`/`client_secret` (no default): `@client_id || ENV["ENDPOINTBLANK_CLIENT_ID"]` via overridden readers. For `base_url`/`log_base_url`: default applied only when both ivar and env are nil. `app_name`: `@app_name || ENV["ENDPOINTBLANK_APP_NAME"] || (::Rails.application.name.underscore if defined?(::Rails))`.
+- [ ] **Step 3:** `bundle exec rspec` green, `rubocop` clean. Commit `feat: ENDPOINTBLANK_* env-var configuration + Rails-free app_name`.
+
+### Task 3: No-Rails packaging + smoke test
+
+**Files:**
+- Modify (only if a load-time/core-path `::Rails` reference is found): the offending file
+- Test: `spec/no_rails_spec.rb` (new)
+
+- [ ] **Step 1:** Grep the core (everything except `lib/end_point_blank/rails/*`, `commands/endpoint_update.rb`, `commands/route_pattern_finder.rb`) for any remaining `::Rails` / `Rails.` reference. Each must be either gone (Task 1) or guarded by `defined?(::Rails)`. Fix any stray one by routing through a seam or guarding.
+- [ ] **Step 2 (TDD):** `spec/no_rails_spec.rb`:
+  - `require "end_point_blank"` succeeds with `::Rails` not defined (it isn't, in specs);
+  - a representative core flow runs without a `NameError: ::Rails` — e.g. build a `Configuration` via `configure`, run a `Middleware::Rack::ReportInteraction` call (or a `Writers` write) with HTTP stubbed, asserting no `::Rails`-related error is raised. (Stub `EndPointBlank::Commands::Http` / excon so nothing leaves the process.)
+- [ ] **Step 3:** Confirm the Rails-only introspection (`endpoint_update`, `route_pattern_finder`) is never reached in this flow. `bundle exec rspec` green, `rubocop` clean. Commit `test: no-Rails smoke coverage for the framework-agnostic core`.
+
+## Notes
+- `Configuration.instance` is a singleton — specs must reset it between examples (a `reset!` helper or `Singleton.__init__`), and save/restore `ENV` keys they touch.
+- Keep changes minimal and mechanical in Task 1 (it's a wide but shallow find-replace); the behavior change is only "logs go through a seam."
+- Do not introduce a `railties` dependency; the railtie is already loaded only under `defined?(::Rails)`.

data/docs/superpowers/specs/2026-07-08-framework-agnostic-core-design.md

@@ -0,0 +1,58 @@
+# Framework-agnostic `end_point_blank` (Ruby) — Design
+
+## Goal
+Make the `end_point_blank` gem run in **plain Ruby / Sinatra**, not just Rails, by decoupling the core from `::Rails`, and add **`ENDPOINTBLANK_*`** environment-variable configuration. Rails stays supported as a thin, auto-loaded adapter. This is the first slice of the client-lib parity work (#1); env-var config for Java/JS/Python/Elixir is a follow-up.
+
+## Context (current state)
+- RSpec suite of 6 specs (`bundle exec rspec`) — the refactor's safety net.
+- The Rails concerns + railtie (`end_point_blank/rails/*`) are **already** gated by `if defined?(::Rails)` in `lib/end_point_blank.rb`. Good — packaging is half-done.
+- Runtime coupling to `::Rails` is three things: **logging** (`::Rails.logger` in ~10 files), **`app_name`** (`::Rails.application.name`), and **route/host/port/env introspection** (`commands/endpoint_update.rb`, `commands/route_pattern_finder.rb`). The introspection is not called from the core request/authorize path — only from Rails-gated code.
+- `Configuration` is a singleton (`Configuration.instance`) with `attr_accessor :client_id, :client_secret, :base_url, :log_base_url, …`, an `app_name` method that falls back to `::Rails.application.name`, and no env-var reading.
+- `EndPointBlank::Loggers::Logger` exists but is inconsistent (`error/warn/fatal` → `::Rails.logger`; `debug`/`info` write via `Writers`; ). It's the seam to build on.
+
+## Design
+
+### 1. Pluggable logging (the pervasive coupling)
+Introduce a single logger seam:
+- `EndPointBlank.logger` — module accessor. Resolution order: `Configuration.instance.logger` (if set) → a memoized default `::Logger.new($stdout)` (level `INFO`). `EndPointBlank.logger=` setter also supported.
+- `Configuration` gains a `logger` accessor (default `nil` → falls through to the stdout default).
+- Replace **every** `::Rails.logger.X` / `Rails.logger.X` call in the core (access_tokens, commands/*, writers/delayed_writer, middleware/rack/report_interaction, loggers/logger) with `EndPointBlank.logger.X`.
+- `Loggers::Logger`'s `error/warn/fatal` route through `EndPointBlank.logger`; its `debug`/`info` Writer behavior is unchanged (that's interaction-emission, a separate concern).
+- The Rails adapter (railtie) sets `Configuration.instance.logger = ::Rails.logger` on boot, so Rails apps log through Rails exactly as today.
+
+### 2. Env-var configuration (`ENDPOINTBLANK_*`)
+`Configuration` reads env vars as fallbacks when a value isn't set in the `configure` block. Precedence: **explicit `configure` value > `ENDPOINTBLANK_*` env var > built-in default**. Mapping:
+
+| setting | env var |
+|---------|---------|
+| `client_id` | `ENDPOINTBLANK_CLIENT_ID` |
+| `client_secret` | `ENDPOINTBLANK_CLIENT_SECRET` |
+| `base_url` | `ENDPOINTBLANK_BASE_URL` |
+| `log_base_url` | `ENDPOINTBLANK_LOG_BASE_URL` |
+| `app_name` | `ENDPOINTBLANK_APP_NAME` |
+
+Implemented so an unset accessor returns the env value if present (e.g. `client_id` returns `@client_id || ENV["ENDPOINTBLANK_CLIENT_ID"]`), keeping the singleton + `configure` API intact.
+
+### 3. `app_name` without Rails
+`Configuration#app_name` resolution: explicit `@app_name` → `ENDPOINTBLANK_APP_NAME` → (only if `defined?(::Rails)`) `::Rails.application.name.underscore` → `nil`/raise-with-clear-message. The Rails adapter may still default it from the Rails app; non-Rails apps set it via `configure` or the env var. Same treatment for the `::Rails.application.class.module_parent_name` fallback in `endpoint_update.rb` (that path is Rails-only anyway).
+
+### 4. Rails-only introspection stays in the adapter
+`commands/endpoint_update.rb` and `commands/route_pattern_finder.rb` (routes, `force_ssl`, host, port, `::Rails.env`, `::Rails.application.routes`) are inherently Rails-specific. They remain, but every `::Rails.*` call in them is reached only under Rails (they're invoked from the railtie / Rails concerns). Requiring the files is fine (load-time touches no `::Rails`); we only guarantee the **core request/authorize + logging path never calls them** without Rails. Non-Rails apps get no automatic endpoint registration — acceptable (the core Rack middleware is enough).
+
+### 5. Packaging
+- `lib/end_point_blank.rb` already loads core files unconditionally and `rails/*` + railtie under `if defined?(::Rails)`. Keep. Verify no core file raises at **load** time when `::Rails` is undefined.
+- The gemspec stays Rails-free (already no railties dependency).
+- The `end_point_blank_sinatra` sample app (requires the gem, no Rails) becomes the real-world validation: it should boot and the middleware should emit interactions without `::Rails`.
+
+### 6. Testing (extend RSpec)
+- **Logger:** with `::Rails` undefined, `EndPointBlank.logger` returns a stdout `Logger`; a configured `config.logger` is honored; `Loggers::Logger.error` routes to it. (Assert via a captured/stubbed logger.)
+- **Env config:** `ENDPOINTBLANK_CLIENT_ID` etc. are read when `configure` doesn't set them; explicit `configure` wins over env; env wins over default.
+- **No-Rails smoke:** in an example where `::Rails` is not defined, `require "end_point_blank"` succeeds and a representative core flow (e.g. a `report_interaction` write, mocked HTTP) runs without raising `NameError: ::Rails`.
+- Adjust existing specs that stub `::Rails.logger` to stub `EndPointBlank.logger` instead.
+- `bundle exec rspec` green; `rubocop` clean (Rakefile runs both).
+
+## Out of scope (follow-ups)
+- Env-var config for the Java / JS / Python / Elixir SDKs (separate slice of #1).
+- A dedicated Sinatra/Rack adapter class (core middleware is enough for now).
+- Non-Rails automatic endpoint/route registration.
+- Renaming the gem or changing the public `configure` API shape.

data/end_point_blank.gemspec

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative "lib/end_point_blank/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "end_point_blank"
+  spec.version = EndPointBlank::VERSION
+  spec.authors = ["Robert A. Lasch"]
+  spec.email = ["rlasch@gmail.com"]
+
+  spec.summary = "Ruby/Rails client for EndPointBlank — endpoint tracking, authorization, and error/request/response/log reporting."
+  spec.description = "EndPointBlank client library for Ruby. A framework-agnostic core runs in plain Ruby / Sinatra, with Rails supported as an auto-loaded adapter. Provides API endpoint tracking, authorization, and error/request/response/log reporting."
+  spec.homepage = "https://github.com/EndPointBlank/end_point_blank_rails"
+  spec.required_ruby_version = ">= 3.4.2"
+
+  spec.metadata["allowed_push_host"] = "https://rubygems.org"
+
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = "https://github.com/EndPointBlank/end_point_blank_rails"
+  spec.metadata["changelog_uri"] = "https://github.com/EndPointBlank/end_point_blank_rails/releases"
+
+  # Specify which files should be added to the gem when it is released.
+  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      (File.expand_path(f) == __FILE__) ||
+        f.start_with?(*%w[bin/ test/ spec/ features/ .git .circleci appveyor Gemfile])
+    end
+  end
+  spec.bindir = "exe"
+  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  # Uncomment to register a new dependency of your gem
+  spec.add_dependency "excon", "~> 1.0"
+  spec.add_dependency "rack"
+  spec.add_dependency "rexml"
+  # Base64 was removed from Ruby's default gems as of 3.4; Authorization
+  # uses it for the Basic-auth header, so declare it explicitly.
+  spec.add_dependency "base64"
+  spec.add_development_dependency "debug", ">= 1.0.0"
+
+  # For more information and examples about making a new gem, check out our
+  # guide at: https://bundler.io/guides/creating_gem.html
+end

data/lib/end_point_blank/access_tokens.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+
+require 'singleton'
+require "time"
+
+module EndPointBlank
+  # Thread-safe singleton cache for storing access tokens per hostname
+  class AccessTokens
+    include Singleton
+
+    def initialize()
+      @tokens = {}
+      @mutexes = {}
+    end
+
+    def self.token(arg)
+      instance.token(arg)
+    end
+
+    # Retrieve or generate an access token for the given hostname
+    # @param hostname [String] The hostname for which to retrieve the token
+    # @return [String, nil] The access token or nil if generation fails
+    def token(arg)
+      hostname = arg.downcase
+      @mutexes[hostname] ||= Mutex.new
+      @mutexes[hostname].synchronize do
+        # Return cached token if it exists and is not expired
+        return @tokens[hostname][:token] if @tokens.key?(hostname) && @tokens[hostname][:expired_at] > Time.now + 120
+
+        # Fetch new token
+        payload = Commands::GenerateAccessToken.token(hostname)
+
+        if payload && payload[:token]
+          payload[:expired_at] = Time.parse(payload[:expired_at])
+          @tokens[hostname] = payload
+          payload[:token]
+        else
+          EndPointBlank.logger.error "Failed to generate access token for #{hostname}: #{payload&.fetch('error')}"
+          nil
+        end
+      end
+    end
+
+    # Clear all tokens from the cache
+    # @return [Hash] Empty hash
+    def clear(arg)
+      @mutexes.keys.each do |hostname|
+        @mutexes[hostname].synchronize do
+          @tokens.delete(hostname)
+        end
+      end
+    end
+
+    # Remove token for a specific hostname
+    # @param hostname [String] The hostname for which to remove the token
+    # @return [Object, nil] The removed token data or nil if not found
+    def remove(arg)
+      hostname = arg.downcase
+      @mutexes[hostname].synchronize do
+        @tokens.delete(hostname)
+      end
+    end
+
+    # Check if a valid token exists for a given hostname
+    # @param hostname [String] The hostname to check
+    # @return [Boolean] True if a valid token exists, false otherwise
+    def exists?(arg)
+      hostname = arg.downcase
+      @tokens.key?(hostname) && @tokens[hostname][:expired_at] > Time.now + 30
+    end
+  end
+end

data/lib/end_point_blank/authorization.rb

@@ -0,0 +1,36 @@
+#!/bin/ruby
+
+require 'base64'
+
+module EndPointBlank
+  module AuthorizationMethods
+    module ClassMethods
+      def configuration
+        EndPointBlank::Configuration.instance
+      end
+
+      def header(hostname = nil)
+        token = nil
+        token = EndPointBlank::AccessTokens.token(hostname) if hostname
+
+        if token
+          "Bearer " + token
+        else
+          "Basic " + Base64.encode64(configuration.client_id + ":" + configuration.client_secret).gsub("\n", "")
+        end
+      end
+    end
+
+    def self.included(base)
+      base.extend(ClassMethods)
+    end
+  end
+
+  # Generates HTTP Basic Authorization headers using client credentials.
+  # Creates a Base64-encoded string from the client_id and client_secret
+  # configured in EndPointBlank::Configuration.
+  # Use header class method to get a properly formatted "Basic {credentials}" header.
+  class Authorization
+    include AuthorizationMethods
+  end
+end

data/lib/end_point_blank/commands/authentication_cache.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+require 'singleton'
+
+module EndPointBlank
+  module Commands
+    # Thread-safe singleton cache for storing authentication credentials.
+    # Capped at MAX_SIZE entries. When full, expired entries are evicted first;
+    # if still at capacity the entry expiring soonest is removed.
+    class AuthenticationCache
+      include Singleton
+
+      MAX_SIZE = 1000
+
+      def initialize
+        @cache = {}
+        @mutex = Mutex.new
+      end
+
+      # Store credentials in the cache
+      # @param key [String, Symbol] The identifier for the credentials
+      # @param credentials [Object] The credentials to store
+      # @return [Object] The stored credentials
+      def store(key, credentials)
+        return unless credentials
+        @mutex.synchronize do
+          now = Time.now
+          # Evict expired entries first
+          @cache.delete_if { |_, v| v[:expired_at] <= now }
+          # Evict the entry expiring soonest if still at capacity
+          if @cache.size >= MAX_SIZE
+            oldest_key = @cache.min_by { |_, v| v[:expired_at] }.first
+            @cache.delete(oldest_key)
+          end
+          @cache[key] = { expired_at: now + ::EndPointBlank::Configuration.instance.cache_ttl, credentials: credentials }
+        end
+      end
+
+      # Retrieve credentials from the cache
+      # @param key [String, Symbol] The identifier for the credentials
+      # @return [Object, nil] The stored credentials or nil if not found
+      def retrieve(key)
+        @mutex.synchronize do
+          if @cache.key?(key)
+            @cache[key][:credentials] if @cache[key][:expired_at] > Time.now
+          else
+            nil
+          end
+        end
+      end
+
+      # Check if credentials exist for a given key
+      # @param key [String, Symbol] The identifier to check
+      # @return [Boolean] True if credentials exist, false otherwise
+      def exists?(key)
+        @mutex.synchronize do
+          @cache.key?(key) && @cache[key][:expired_at] > Time.now
+        end
+      end
+
+      # Remove credentials from the cache
+      # @param key [String, Symbol] The identifier for the credentials to remove
+      # @return [Object, nil] The removed credentials or nil if not found
+      def remove(key)
+        @mutex.synchronize do
+          @cache.delete(key)
+        end
+      end
+
+      # Clear all credentials from the cache
+      # @return [Hash] Empty hash
+      def clear
+        @mutex.synchronize do
+          @cache.clear
+        end
+      end
+
+      # Get all keys in the cache
+      # @return [Array] Array of all keys
+      def keys
+        @mutex.synchronize do
+          @cache.keys.dup
+        end
+      end
+
+      # Get the number of credentials stored
+      # @return [Integer] The size of the cache
+      def size
+        @mutex.synchronize do
+          @cache.size
+        end
+      end
+    end
+  end
+end

data/lib/end_point_blank/commands/basic_authenticate.rb

@@ -0,0 +1,47 @@
+#!/bin/ruby
+
+require_relative 'http'
+
+module EndPointBlank
+  module Commands
+    module BasicAuthenticateMethods
+      module ClassMethods
+        def configuration
+          EndPointBlank::Configuration.instance
+        end
+
+        def authenticate(request)
+          client_auth = request.headers['Authorization']
+          auth = "Basic #{AuthorizationGenerate.generate}"
+          body = {
+            path: request.route_uri_pattern.to_s.gsub(/\([^)]*\)/, ''),
+            http_method: request.request_method,
+            client_auth: client_auth,
+            application: Configuration.instance.app_name,
+            endpoint_version: VersionFinder.new.find(request),
+            ip_address: request.remote_ip
+          }
+          response = Http.post(configuration.authorize_url, auth, body)
+          return nil if response.nil?
+          EndPointBlank.logger.info "Authentication response: #{response.status} - #{response.body}"
+          if response.status > 299
+            EndPointBlank.logger.error "Failed to authenticate: #{response.status} - #{response.body}"
+          end
+          response
+        end
+      end
+
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+    end
+
+    # Authenticates incoming requests by sending request details to a remote authorization service.
+    # Sends the request path, HTTP method, client authorization header, application name,
+    # API version, and client IP address to the configured authorize_url for validation.
+    # Returns the HTTP response from the authorization service or nil if an error occurs.
+    class BasicAuthenticate
+      include BasicAuthenticateMethods
+    end
+  end
+end

data/lib/end_point_blank/commands/bearer_generate.rb

@@ -0,0 +1,33 @@
+#!/bin/ruby
+
+module EndPointBlank
+  module Commands
+    module BearerGenerateMethods
+      module ClassMethods
+        def configuration
+          EndPointBlank::Configuration.instance
+        end
+
+        def generate()
+          Base64.encode64(configuration.client_id + ":" + configuration.client_secret).gsub("\n", "")
+        end
+
+        def auth_header
+          "Basic " + generate
+        end
+      end
+
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+    end
+
+    # Generates HTTP Basic Authorization headers using client credentials.
+    # Creates a Base64-encoded string from the client_id and client_secret
+    # configured in EndPointBlank::Configuration.
+    # Use auth_header class method to get a properly formatted "Basic {credentials}" header.
+    class BearerGenerate
+      include BearerGenerateMethods
+    end
+  end
+end

data/lib/end_point_blank/commands/endpoint_authorize.rb

@@ -0,0 +1,71 @@
+#!/bin/ruby
+
+require_relative 'http'
+require_relative 'authentication_cache'
+
+module EndPointBlank
+  module Commands
+    # Synthetic response returned on a cache hit to avoid a network call.
+    CachedResponse = Struct.new(:status, :body)
+
+    module EndpointAuthorizeMethods
+      module ClassMethods
+        def configuration
+          EndPointBlank::Configuration.instance
+        end
+
+        def authorize(request)
+          client_auth = request.headers['Authorization'].to_s
+          method      = request.request_method
+          path        = request.route_uri_pattern.to_s.gsub(/\([^)]*\)/, '')
+          app_name    = Configuration.instance.app_name
+          cache_key   = "epb_auth:#{client_auth}:#{path}:#{method}:#{app_name}"
+
+          cache = AuthenticationCache.instance
+          return CachedResponse.new(201, '') if cache.exists?(cache_key)
+
+          hostname = request.host
+          auth = Authorization.header(hostname)
+          body = {
+            path: path,
+            http_method: method,
+            client_auth: client_auth,
+            target_hostname: hostname,
+            application: app_name,
+            endpoint_version: VersionFinder.new.find(request),
+            source_ip: request.remote_ip,
+            uuid: request.uuid
+          }
+          response = Http.post(configuration.authorize_url, auth, body)
+
+          if response&.status == 401 && auth.to_s.start_with?("Bearer ")
+            EndPointBlank::AccessTokens.instance.remove(hostname)
+            auth = Authorization.header(hostname)
+            response = Http.post(configuration.authorize_url, auth, body)
+          end
+
+          return nil if response.nil?
+          EndPointBlank.logger.info "Authentication response: #{response.status} - #{response.body}"
+          if response.status == 201
+            cache.store(cache_key, true)
+          elsif response.status > 299
+            EndPointBlank.logger.error "Failed to authorize endpoint: #{response.status} - #{response.body}"
+          end
+          response
+        end
+      end
+
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+    end
+
+    # Authenticates incoming requests by sending request details to a remote authorization service.
+    # Sends the request path, HTTP method, client authorization header, application name,
+    # API version, and client IP address to the configured authorize_url for validation.
+    # Returns the HTTP response from the authorization service or nil if an error occurs.
+    class EndpointAuthorize
+      include EndpointAuthorizeMethods
+    end
+  end
+end