end_point_blank 0.2.2 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 25e18f304c5b420719930533c91b34cc2df76504e5a6d28504491b42c267e2e9
-  data.tar.gz: 99b6acaf7c8dc69e730ebe81a4de17eea39f72ff32e681da08130cdafd2181f2
+  metadata.gz: edb9e7eb50879a3caf5cec7ae59210d29a3096e82d68c997dd4ae545cac00e2d
+  data.tar.gz: 4bd84f05bf328b387fdb6213194c4920c0282cb6eaaee0ad1eb20610785d53bb
 SHA512:
-  metadata.gz: 79f945a9dacd76714a5d2a229931858d0346428b9459a6dfa98b0a5a363a1b043ff12c29643cc3c3f0d1679930d9d7056c29d02813a18863594e796ce667ad7d
-  data.tar.gz: 8b61b6a9f38a5ff2e52d5a37d7979ed18fd0d49f06f8ae3ecf4a07bba8683cc7cefc76b17ec68a3e4a32654644a313e2d6e70c24666de9d1f93654720233ecdd
+  metadata.gz: b958fd1b769033e6fe4420e371b568ec449fb55accac06c7ebb82a2a1ac0b2415770117c4d61b9746af87ef8d27e97c7e0888dbb3bfc55cba605f10c5d57d91d
+  data.tar.gz: 3ef96dd88833a733d9f4dd30592618df157ef6af60483c50aad82e2306c60ffb78348c9a7256a52102d34647b148ab8d58109b25088cf6480cd075b054d46d72

data/CHANGELOG.md

@@ -0,0 +1,36 @@
+# Changelog
+
+## 0.6.0
+
+### Breaking
+
+- **`Authorization.header` and `AccessTokens.token` now take a URL, not a
+  hostname.** Pass the URL you are about to call —
+  `https://api.example.com/orders`, not `api.example.com`. Strip any query
+  string or fragment first; they are rejected. Earlier READMEs showed the
+  hostname form; those examples no longer work.
+- **`AccessTokens#exists?` now requires the same URL argument.** It answers
+  for the entry covering that URL; there is no longer a single process-wide
+  token for it to answer about.
+- **Requires an intake that accepts `base_url`.** An older intake returns
+  `400 {"error":"Missing required parameter: base_url"}`.
+
+### Changed
+
+- `endpoint_authorize` authenticates to intake with Basic instead of minting
+  an access token for itself. The inbound request path no longer touches the
+  token cache at all.
+- A 401 from the authorize endpoint is returned to the caller rather than
+  retried once. With Basic, a 401 means the credential is wrong.
+- Tokens are cached per application environment, keyed on the canonical base
+  URL intake resolves the request to, rather than one per process.
+
+### Security
+
+- The minted bearer token was previously written to the host application's
+  logs at info level: every successful token exchange logged the full intake
+  response body, which contains the live token, whenever your app's Rails
+  logger was set to info or more verbose. This release logs only the
+  response status code. If your logs go back further than this upgrade,
+  treat them as potentially containing live bearer tokens and handle them
+  per your own retention/rotation policy.

data/README.md

@@ -79,6 +79,7 @@ Every setting listed below can be set explicitly in that block, and most also fa
 | `worker_count` | — | `4` | Currently unused by the delayed writer (which always spins up 2 threads); reserved. |
 | `token_ttl` | — | `nil` | Optional TTL (seconds) requested when generating a `Bearer` access token. |
 | `cache_ttl` | — | `300` | TTL (seconds) for the authorization decision cache. |
+| `trust_proxy_headers` | — | `true` | Whether the per-request `scheme`/`host`/`port` report honors `X-Forwarded-Proto`/`-Host`/`-Port`. See [Reported base URL](#reported-base-url). |
 | `masking_rules` | — | `[]` | Ordered list of masking rule hashes — see [Data masking](#data-masking). |
 | `mask_hook` | — | `nil` | Optional `->(payload, record_type_string) { payload }` run after `masking_rules`. |
 | `version_finder` | — | `nil` | Optional `->(request) { "1" }` overriding `EndPointBlank::Commands::VersionFinder`'s default header/param/path detection. |
@@ -88,6 +89,35 @@ Note: there is also a bare `environment` accessor on `Configuration`, but it is
 code path in this gem (the real per-request environment name is `env_name`, described above) — do
 not rely on it.
 
+### Reported base URL
+
+Every request payload carries the base URL the *caller* used, as three separate fields —
+`scheme`, `host` and `port`. A field that cannot be resolved is omitted rather than sent as
+null. EndPointBlank uses these to fill in an application environment's base URL for you,
+instead of asking someone to type it.
+
+By default the gem honors `X-Forwarded-Proto`, `X-Forwarded-Host` and `X-Forwarded-Port`,
+reading the **last** comma-separated hop. It does this on its own, without consulting Rails'
+or Rack's trusted-proxy configuration, so that all five EndPointBlank clients answer
+identically for the same request.
+
+**Turn this off if your application is reachable directly, with no proxy in front of it** —
+or if you would simply rather report nothing than report something a caller could influence:
+
+```ruby
+EndPointBlank.configure { |c| c.trust_proxy_headers = false }
+```
+
+With it off, the `X-Forwarded-*` headers are ignored entirely and `scheme`, `host` and `port`
+come from the connection and the `Host` header only.
+
+It defaults to `true` because the alternative is worse for almost everyone. Most production
+deployments sit behind an ALB, nginx, Caddy or an Ingress, and a client that ignored the
+forwarded headers there would not report *nothing* — it would confidently report an internal
+hostname on an internal port. `host` is caller-controlled either way (it has always come from
+the `Host` header), and none of these three values is ever used as an identity or
+authorization key, so the worst case is a wrong *suggestion* that an admin has to approve.
+
 ### `configure` block example
 
 ```ruby
@@ -120,16 +150,28 @@ export ENDPOINTBLANK_ENV=staging
 
 ### Authorization
 
-`EndPointBlank::Authorization.header(hostname = nil)` builds the outbound `Authorization` header
-used by the gem's own HTTP calls: a cached `Bearer` token for `hostname` when one is available
-(via `EndPointBlank::AccessTokens`), otherwise `Basic` credentials built from `client_id` /
-`client_secret`.
+`EndPointBlank::Authorization.header(base_url = nil)` builds the outbound `Authorization` header
+used by the gem's own HTTP calls: a cached `Bearer` token covering `base_url` when one is
+available (via `EndPointBlank::AccessTokens`), otherwise `Basic` credentials built from
+`client_id` / `client_secret` -- which covers both giving no target and a token that could not
+be obtained.
 
 ```ruby
-EndPointBlank::Authorization.header               # => "Basic ..."
-EndPointBlank::Authorization.header("api.example.com") # => "Bearer ..." if a token is cached
+EndPointBlank::Authorization.header # => "Basic ..."
+
+# Pass the URL you are about to call, NOT a hostname.
+# Strip any query string or fragment first -- intake rejects both.
+EndPointBlank::Authorization.header("https://api.example.com/orders") # => "Bearer ..." if a token is cached
 ```
 
+The argument is the URL you are about to call. intake matches it against registered base URLs by
+longest path prefix, so you need not know how the target registered itself -- `header` for
+`https://api.example.com/orders/42` reuses a token already cached for
+`https://api.example.com/orders`. `EndPointBlank::AccessTokens` caches one token per base URL
+intake resolves to, not one per process, so a service that calls several targets holds a token
+for each. A URL that does not match character-for-character (a different case, a query string,
+an unregistered path) simply misses and mints a new token -- it never guesses.
+
 Under Rails, protect an inbound endpoint by including the `Authorized` concern in a controller —
 it calls `EndPointBlank::Commands::EndpointAuthorize.authorize(request)` before the action, and
 raises `EndPointBlank::UnauthorizedError` (which you can rescue with
@@ -143,8 +185,17 @@ end
 
 `EndPointBlank::Commands::EndpointAuthorize.authorize` sends the request's path, HTTP method,
 inbound `Authorization` header, app name, resolved endpoint version, and remote IP to
-`#{base_url}/api/authorize`, and caches a positive (201) result for `cache_ttl` seconds via
-`EndPointBlank::Commands::AuthenticationCache`.
+`#{base_url}/api/authorize`, authenticating itself to intake with `Basic`, and caches a positive
+(201) result for `cache_ttl` seconds via `EndPointBlank::Commands::AuthenticationCache`. It never
+mints or presents a Bearer token for this call: intake already holds this service's own
+credential, so exchanging one to present it back would buy nothing.
+
+**Behavior change:** `target_hostname` on the authorize call now comes from the `Host` header
+only. It previously came from `request.host`, which reads the last `X-Forwarded-Host` hop. If
+your app sits behind a proxy that **rewrites** `Host` (nginx's default; Caddy and most ALBs
+preserve it) and you registered the external hostname in the portal, either update the
+registered hostname to the internal one the app now reports, or configure the proxy to preserve
+`Host`. Deployments where `Host` and `X-Forwarded-Host` agree are unaffected.
 
 ### Error reporting
 

data/deploy

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+gem build end_point_blank.gemspec
+
+gem push end_point_blank-*.gem

data/end_point_blank.gemspec

@@ -34,8 +34,13 @@ Gem::Specification.new do |spec|
 
   # Uncomment to register a new dependency of your gem
   spec.add_dependency "excon", "~> 1.0"
-  spec.add_dependency "rack"
-  spec.add_dependency "rexml"
+  # rack and rexml carried no floor at all, which let a host application resolve
+  # them to versions with known advisories. These are the lowest releases clear
+  # of every advisory published against each gem, not the newest available — a
+  # library should state the oldest version it will vouch for, not force the
+  # host to the bleeding edge.
+  spec.add_dependency "rack", ">= 3.2.6"
+  spec.add_dependency "rexml", ">= 3.3.9"
   # Base64 was removed from Ruby's default gems as of 3.4; Authorization
   # uses it for the Basic-auth header, so declare it explicitly.
   spec.add_dependency "base64"

data/lib/end_point_blank/access_tokens.rb

@@ -4,69 +4,217 @@ require 'singleton'
 require "time"
 
 module EndPointBlank
-  # Thread-safe singleton cache for storing access tokens per hostname
+  # Thread-safe singleton holding this process's access tokens, one per
+  # application environment.
+  #
+  # A token is cached under the canonical base URL intake resolved the
+  # request to -- not under the URL the caller supplied. A caller asks for the
+  # URL it is about to call; intake answers with the base URL of the
+  # environment that URL belongs to, and subsequent calls anywhere under that
+  # base URL reuse the entry.
+  #
+  # Lookup is a plain exact-or-path-prefix comparison, with the longest match
+  # winning. The SDK deliberately does not normalize: intake owns that rule,
+  # and a miss costs one extra request rather than a wrong answer.
+  #
+  # A lookup has to scan the keys, and the fast path deliberately does not
+  # take the mutex, so every write **replaces** the entries Hash instead of
+  # mutating it. A reader then takes one atomic read of @entries and iterates
+  # something nobody can change underneath it. Mutating in place would risk
+  # "can't add a new key into hash during iteration" as soon as one thread
+  # minted a token for a second target while another was doing a lookup.
   class AccessTokens
     include Singleton
 
-    def initialize()
-      @tokens = {}
-      @mutexes = {}
+    # Replace a token this far ahead of its expiry. An expired token can never
+    # be revived, only replaced, so going early is what keeps an in-flight
+    # request from carrying one that dies before it lands.
+    REFRESH_WINDOW = 120
+
+    # exists? is used to decide whether a caller can proceed without a round
+    # trip, so it answers no while there is barely any life left.
+    PRESENCE_WINDOW = 30
+
+    # How long to hold a token whose expiry the intake sent unreadably.
+    DEFAULT_LIFETIME = 3600
+
+    def initialize
+      @mutex = Mutex.new
+      @entries = {}
     end
 
-    def self.token(arg)
-      instance.token(arg)
+    def self.token(base_url)
+      instance.token(base_url)
     end
 
-    # Retrieve or generate an access token for the given hostname
-    # @param hostname [String] The hostname for which to retrieve the token
-    # @return [String, nil] The access token or nil if generation fails
-    def token(arg)
-      hostname = arg.downcase
-      @mutexes[hostname] ||= Mutex.new
-      @mutexes[hostname].synchronize do
-        # Return cached token if it exists and is not expired
-        return @tokens[hostname][:token] if @tokens.key?(hostname) && @tokens[hostname][:expired_at] > Time.now + 120
-
-        # Fetch new token
-        payload = Commands::GenerateAccessToken.token(hostname)
-
-        if payload && payload[:token]
-          payload[:expired_at] = Time.parse(payload[:expired_at])
-          @tokens[hostname] = payload
+    # Retrieve a token covering base_url, generating one if no usable entry
+    # covers it.
+    # @param base_url [String] the URL you are about to call, with any query
+    #   string and fragment removed. It is sent verbatim; intake normalizes it
+    #   and matches it against registered base URLs by longest path prefix.
+    # @return [String, nil] The access token string, or nil if generation
+    #   failed -- which includes a response that carried a token but no
+    #   base_url.
+    def token(base_url)
+      entry = match(base_url)
+      return entry[:token] if usable?(entry)
+
+      @mutex.synchronize do
+        # Another caller may have filled it while this one waited.
+        entry = match(base_url)
+        return entry[:token] if usable?(entry)
+
+        payload = Commands::GenerateAccessToken.token(base_url)
+
+        # The key is what intake resolved to, and only that. There is no
+        # fallback to the requested URL: that would key on the resource the
+        # caller happened to ask about, so a service walking /orders/1,
+        # /orders/2, /orders/3 would mint and store a token per resource, and
+        # nothing here evicts. Without a base URL the right application
+        # cannot be found, so no token is handed back either.
+        key = payload && payload[:base_url]
+
+        if payload && payload[:token] && key
+          # The match that led here may have resolved under a different key
+          # than the one intake just returned -- an environment's base URL
+          # can change to a shorter path in the portal. Drop that stale key
+          # when it differs from the fresh one, or it goes on shadowing it:
+          # being the longer of the two, it keeps winning "longest match
+          # wins", keeps failing usable?, and keeps forcing a mint on every
+          # call until the process restarts. The failure branch below already
+          # does the equivalent for a match that turned out unusable; this is
+          # the same cleanup for a match that turned out to have moved.
+          stale = match_key(base_url, @entries)
+          new_entries = @entries.merge(
+            key => { token: payload[:token], expired_at: parse_expiry(payload[:expired_at]) }.freeze
+          )
+          new_entries = new_entries.reject { |k, _| k == stale } if stale && stale != key
+          @entries = new_entries.freeze
           payload[:token]
         else
-          EndPointBlank.logger.error "Failed to generate access token for #{hostname}: #{payload&.fetch('error')}"
+          # A failed refresh must not leave an expiring token behind claiming
+          # to be usable -- callers would keep presenting it right up to the
+          # 401. Only the entry that covers this URL goes: the longest match
+          # is the one that was just found unusable, so a shorter, still-good
+          # entry survives.
+          stale = match_key(base_url, @entries)
+          @entries = @entries.reject { |k, _| k == stale }.freeze if stale
+
+          EndPointBlank.logger.error "Failed to generate access token for #{base_url}: #{failure_reason(payload)}"
           nil
         end
       end
     end
 
-    # Clear all tokens from the cache
-    # @return [Hash] Empty hash
-    def clear(arg)
-      @mutexes.keys.each do |hostname|
-        @mutexes[hostname].synchronize do
-          @tokens.delete(hostname)
-        end
+    # Discard every held token
+    # @return [nil]
+    def clear
+      @mutex.synchronize { @entries = {}.freeze }
+    end
+
+    # Discard the held token, but only if it is still the one the caller had
+    #
+    # Every request in flight when a token is rejected reports the same stale
+    # value. Only the first of them should cause an exchange -- the rest are
+    # holding a token that has already been replaced, and clearing on their
+    # behalf would discard a good token and stampede intake.
+    #
+    # The lookup is by token value because a rejected caller has a token, not
+    # a URL.
+    #
+    # @param stale_token [String, nil] the token the caller was rejected for;
+    #   ignored when it is no longer the one held for its base URL.
+    # @return [nil]
+    def invalidate(stale_token)
+      return if stale_token.nil?
+
+      @mutex.synchronize do
+        @entries = @entries.reject { |_, entry| entry[:token] == stale_token }.freeze
+      end
+    end
+
+    # Check whether a token covering base_url is held and is not about to
+    # expire
+    # @param base_url [String] the URL to check coverage for
+    # @return [Boolean]
+    def exists?(base_url)
+      entry = match(base_url)
+      !entry.nil? && entry[:expired_at] > Time.now + PRESENCE_WINDOW
+    end
+
+    private
+
+    # Returns the longest key in entries covering base_url, or nil.
+    #
+    # A nil or empty base_url never matches. An empty cache can't raise on
+    # one -- the loop body never runs -- so a non-empty cache must not either,
+    # or the same call succeeds or raises NoMethodError (nil has no
+    # start_with?) depending on unrelated traffic that happened to warm the
+    # cache first. Checking once, here, keeps every caller consistent for
+    # free: the lookup, the stale-entry cleanup on a failed refresh, and the
+    # stale-entry cleanup on a successful one.
+    #
+    # Deliberately not a port of intake's matcher: no normalization on either
+    # side. A caller that passes a non-canonical URL simply misses and mints
+    # again, which costs one HTTP call and is never a wrong answer.
+    #
+    # Takes entries as an explicit argument, rather than reading @entries
+    # itself, so the snapshot discipline is structural: every caller decides
+    # which snapshot is being scanned instead of this method reaching for
+    # whatever @entries happens to be at the moment it runs.
+    def match_key(base_url, entries)
+      return nil if base_url.nil? || base_url.empty?
+
+      best = nil
+      entries.each_key do |key|
+        next unless base_url == key || base_url.start_with?("#{key}/")
+
+        best = key if best.nil? || key.length > best.length
       end
+      best
     end
 
-    # Remove token for a specific hostname
-    # @param hostname [String] The hostname for which to remove the token
-    # @return [Object, nil] The removed token data or nil if not found
-    def remove(arg)
-      hostname = arg.downcase
-      @mutexes[hostname].synchronize do
-        @tokens.delete(hostname)
+    def match(base_url)
+      entries = @entries # One atomic read; writes replace, never mutate.
+      key = match_key(base_url, entries)
+      key && entries[key]
+    end
+
+    def usable?(entry)
+      !entry.nil? && entry[:expired_at] > Time.now + REFRESH_WINDOW
+    end
+
+    # Why a mint produced no usable token, for the log.
+    def failure_reason(payload)
+      return "no response" unless payload.is_a?(Hash)
+      return payload[:error] if payload[:error]
+
+      if payload[:token]
+        # Distinct from a rejected request: intake's base_url is NOT NULL, and
+        # it answers 422 rather than minting when the caller's URL resolves to
+        # no environment. A token with no base_url is a broken server.
+        return "response carried a token but no base_url"
       end
+
+      "no token in response"
     end
 
-    # Check if a valid token exists for a given hostname
-    # @param hostname [String] The hostname to check
-    # @return [Boolean] True if a valid token exists, false otherwise
-    def exists?(arg)
-      hostname = arg.downcase
-      @tokens.key?(hostname) && @tokens[hostname][:expired_at] > Time.now + 30
+    # Time.parse raises on anything it cannot read — an ArgumentError for a
+    # string it fails to understand, a TypeError for a value that is not a
+    # string at all, including the nil left by a missing key. This runs inside
+    # the mutex on the path a caller's request goes through, so a malformed
+    # timestamp from the intake came out of Authorization.header and into the
+    # host application's request.
+    #
+    # An hour is a guess, but a working one. Treating the token as unusable
+    # instead would mean an exchange on every inbound request for as long as
+    # the far end misbehaves. There is no retry here if the token dies sooner
+    # than the guess -- invalidate has no caller on this path -- so a bad
+    # guess means 401s until the cache's own expiry-based refresh catches up.
+    def parse_expiry(value)
+      Time.parse(value.to_s)
+    rescue ArgumentError, TypeError
+      Time.now + DEFAULT_LIFETIME
     end
   end
 end

data/lib/end_point_blank/authorization.rb

@@ -9,9 +9,17 @@ module EndPointBlank
         EndPointBlank::Configuration.instance
       end
 
-      def header(hostname = nil)
+      # Builds an outbound Authorization header value.
+      # @param base_url [String, nil] the URL you are about to call, with any
+      #   query string and fragment removed. If given, a token covering it is
+      #   used (minting one if necessary) and returned as a Bearer header.
+      #   Called with no argument this is the Basic form -- which is what the
+      #   calls to intake itself use, since intake already holds this
+      #   service's own credential.
+      # @return [String] "Bearer <token>" or "Basic <credentials>"
+      def header(base_url = nil)
         token = nil
-        token = EndPointBlank::AccessTokens.token(hostname) if hostname
+        token = EndPointBlank::AccessTokens.token(base_url) if base_url
 
         if token
           "Bearer " + token

data/lib/end_point_blank/base_url.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+module EndPointBlank
+  # Resolves the base URL the caller used -- scheme, host and port -- from a
+  # Rack env.
+  #
+  # This deliberately does not go through Rack::Request#host / #scheme / #port.
+  # Rack, Express, the servlet spec and Plug each resolve "host" differently
+  # (Rack takes the last X-Forwarded-Host hop, Express the first, WSGI and Plug
+  # neither), which is precisely why the same request produced five different
+  # answers across the five clients. The env is read directly so that this
+  # algorithm is the same one implemented in the JS, Python, Java and Elixir
+  # libraries.
+  #
+  # Forwarded headers are honored when `trust_proxy_headers` is on, which it is
+  # by default: `host` was already caller-controlled in every client (all five
+  # read the Host header), so this opens no new hole for the field that matters
+  # most, and taking the LAST hop means that behind a proxy that appends, the
+  # value is the proxy's own observation rather than anything the caller
+  # planted. A directly-exposed deployment -- where nothing sits in front to
+  # overwrite the headers -- can set the flag to false, and then only the
+  # connection and the Host header are consulted.
+  #
+  # The flag arrives as an argument rather than being read from Configuration
+  # here, so that this module stays framework- and configuration-free and both
+  # states are directly testable.
+  module BaseUrl
+    HOSTNAME = /\A[a-z0-9._-]+\z/
+    IPV6 = /\A\[[0-9a-f:.]+\]\z/
+    SCHEME = /\A[a-z][a-z0-9+.-]{0,31}\z/
+    DEFAULT_PORTS = { "http" => 80, "https" => 443 }.freeze
+
+    module_function
+
+    # Returns a Hash carrying only the fields that resolved to a usable value.
+    # A field that could not be resolved is absent, never nil: the receiver has
+    # to be able to tell "this SDK did not report a port" from "the port is
+    # null".
+    #
+    # With trust_proxy_headers: false the three X-Forwarded-* headers are not
+    # read at all, so the request is never treated as proxied and the
+    # connection's scheme and port stay evidence.
+    def from_rack_env(env, trust_proxy_headers: true)
+      return {} unless env.is_a?(Hash)
+
+      forwarded_scheme = trust_proxy_headers ? clean_scheme(last_hop(env["HTTP_X_FORWARDED_PROTO"])) : nil
+      forwarded_host_part, forwarded_host_authority_port =
+        trust_proxy_headers ? split_authority(last_hop(env["HTTP_X_FORWARDED_HOST"])) : [nil, nil]
+      forwarded_host = clean_host(forwarded_host_part)
+      forwarded_port = trust_proxy_headers ? parse_port(last_hop(env["HTTP_X_FORWARDED_PORT"])) : nil
+
+      # Evidence is judged AFTER validation, not on raw header presence: a
+      # malformed header (e.g. "X-Forwarded-Port: not-a-port") parses to
+      # nothing and so must never count as proxy evidence, or an
+      # unauthenticated caller could blank an otherwise-valid field just by
+      # sending garbage.
+      #
+      # Only a forwarded scheme or port counts as evidence strong enough to
+      # distrust the raw connection. A forwarded Host alone does not: some
+      # proxies rewrite only the Host header and pass scheme/port through
+      # unchanged, so a valid X-Forwarded-Host by itself says nothing about
+      # whether the connection's own scheme/port belong to the proxy or the
+      # caller.
+      proxied = !forwarded_scheme.nil? || !forwarded_port.nil?
+
+      # A malformed X-Forwarded-Host (wrong shape, or too long -- see
+      # clean_host) gets the same treatment as a malformed proto or port: it
+      # is ignored entirely and falls back to the direct Host header, exactly
+      # as if the header were absent, rather than leaving host unresolved.
+      host_part, authority_port =
+        if forwarded_host
+          [forwarded_host_part, forwarded_host_authority_port]
+        else
+          split_authority(host_authority(env))
+        end
+
+      scheme = forwarded_scheme || (proxied ? nil : clean_scheme(env["rack.url_scheme"]))
+      host = forwarded_host || clean_host(host_part)
+      port_candidate = forwarded_port ||
+                       parse_port(authority_port) ||
+                       (proxied ? nil : parse_port(env["SERVER_PORT"]))
+      port = usable_port(port_candidate, scheme)
+
+      resolved = {}
+      resolved[:scheme] = scheme if scheme
+      resolved[:host] = host if host
+      resolved[:port] = port if port
+      resolved
+    end
+
+    # The hostname alone, for the authorize path.
+    #
+    # Deliberately NOT from_rack_env(env)[:host]: reads the Host header only,
+    # never the forwarded chain, however trust_proxy_headers is set. The
+    # value feeds `target_hostname` and the access-token cache key, and the
+    # portal resolves an application environment from it -- a value matching
+    # no registered row is a hard 422 with no fallback, not a cache miss.
+    #
+    # Composed from the same split_authority/clean_host pair from_rack_env
+    # uses, so IPv6 bracketing, lowercasing, and shape and length validation
+    # are identical between the two; only the authority's source differs.
+    def hostname_from_rack_env(env)
+      return nil unless env.is_a?(Hash)
+
+      host_part, _authority_port = split_authority(host_authority(env))
+      clean_host(host_part)
+    end
+
+    # A proxy that appends writes its own observation last. A proxy that
+    # overwrites (nginx, Caddy, ALB) emits one value, where first and last are
+    # the same thing.
+    def last_hop(value)
+      return nil unless value.is_a?(String)
+
+      hops = value.split(",").map(&:strip).reject(&:empty?)
+      hops.last
+    end
+
+    # The authority the caller named, for both resolution paths.
+    #
+    # An empty Host header is treated as ABSENT, not as a present-but-unusable
+    # value. A caller that sends `Host:` with nothing after it has said nothing
+    # about which host it meant, so there is nothing there to prefer over
+    # SERVER_NAME. Falling through concedes no control the caller did not
+    # already have either: SERVER_NAME is a server-side value, not one a
+    # request can steer.
+    #
+    # On the authorize path the alternative is worse than cosmetic. Resolving
+    # the host to nil there drops the request to Basic auth and skips the token
+    # mint entirely, where falling through yields a usable
+    # application-environment lookup key.
+    #
+    # This CHANGES Ruby's behavior: an empty Host header used to resolve the
+    # host to nil. `env["HTTP_HOST"] || env["SERVER_NAME"]` stops at "" because
+    # "" is truthy in Ruby. Python, Java and JS already fell through, because
+    # "" is falsy there; Ruby and Elixir stopped, because "" is truthy in both.
+    # One expression written five times, diverging only on the empty case. It
+    # now lives at one site per SDK, and this comment is why.
+    #
+    # `.to_s.empty?` so a nil Host header takes the same branch as an empty one.
+    def host_authority(env)
+      host = env["HTTP_HOST"]
+      host.to_s.empty? ? env["SERVER_NAME"] : host
+    end
+
+    # "api.example.com:8443" -> ["api.example.com", "8443"]
+    # "[2001:db8::1]:8443"   -> ["[2001:db8::1]", "8443"]
+    def split_authority(value)
+      return [nil, nil] unless value.is_a?(String)
+
+      authority = value.strip
+      if authority.start_with?("[")
+        head, bracket, tail = authority.partition("]")
+        return [nil, nil] if bracket.empty?
+
+        ["#{head}]", tail.start_with?(":") ? tail[1..] : nil]
+      elsif authority.count(":") == 1
+        host, _, port = authority.partition(":")
+        [host, port]
+      else
+        [authority, nil]
+      end
+    end
+
+    # Normalize, then validate. "HTTPS" and "https:" both have to reach intake
+    # as "https": JS's location.protocol and Node's URL#protocol keep the
+    # colon, nothing pins the case, and intake never rewrites a stored row --
+    # two spellings of the same scheme would split the dominant-triple
+    # grouping forever. delete_suffix removes one colon, not all of them, so
+    # "https::" still fails the shape check rather than sneaking through.
+    def clean_scheme(value)
+      return nil unless value.is_a?(String)
+
+      scheme = value.strip.downcase.delete_suffix(":")
+      scheme.match?(SCHEME) ? scheme : nil
+    end
+
+    # DNS caps a hostname at 253 characters, and the receiving column is
+    # varchar(255). No web-server adapter validates the length of
+    # X-Forwarded-Host, so without this a caller could make the SDK report an
+    # arbitrarily long value; dropped, not truncated, because a truncated
+    # hostname is a plausible-looking WRONG one and the portal reads `host`
+    # verbatim to assemble a base URL.
+    def clean_host(value)
+      return nil unless value.is_a?(String)
+
+      host = value.strip.downcase
+      return nil if host.empty? || host.bytesize > 253
+
+      host.match?(HOSTNAME) || host.match?(IPV6) ? host : nil
+    end
+
+    # Numeric validation only -- 1..65535, nothing scheme-aware. Used both to
+    # decide whether a forwarded/authority port counts as a usable value and
+    # as a port candidate; default-port omission happens exactly once, in
+    # usable_port, against the FINAL resolved scheme, so it can never be
+    # skipped just because the scheme happened to resolve from a different
+    # source than the port did.
+    def parse_port(value)
+      port = Integer(value.to_s.strip, 10, exception: false)
+      return nil if port.nil? || port < 1 || port > 65_535
+
+      port
+    end
+
+    # A port is reported only when it can be classified against a resolved
+    # scheme. With no scheme, "default" is meaningless, so an unclassifiable
+    # port is withheld entirely rather than guessed at -- the same origin must
+    # never be reportable two ways depending on which headers happened to
+    # arrive.
+    def usable_port(candidate, scheme)
+      return nil if candidate.nil? || scheme.nil?
+      return nil if DEFAULT_PORTS[scheme] == candidate
+
+      candidate
+    end
+  end
+end

data/lib/end_point_blank/commands/endpoint_authorize.rb

@@ -1,5 +1,6 @@
 #!/bin/ruby
 
+require 'json'
 require_relative 'http'
 require_relative 'authentication_cache'
 
@@ -19,35 +20,56 @@ module EndPointBlank
           method      = request.request_method
           path        = request.route_uri_pattern.to_s.gsub(/\([^)]*\)/, '')
           app_name    = Configuration.instance.app_name
-          cache_key   = "epb_auth:#{client_auth}:#{path}:#{method}:#{app_name}"
+          # The version is part of the key because authorization is decided per
+          # endpoint version, and so is the deprecation carried back with it.
+          # Without it, two callers on different versions of the same route share
+          # one entry: whichever authorizes first decides both, so a client on a
+          # deprecated version can get no warning, or one on a current version
+          # can be told it is retiring.
+          version     = VersionFinder.new.find(request)
+          cache_key   = "epb_auth:#{client_auth}:#{path}:#{method}:#{app_name}:#{version}"
 
           cache = AuthenticationCache.instance
-          return CachedResponse.new(201, '') if cache.exists?(cache_key)
+          # The cached value is the authorize response body, not a truthy
+          # marker.
+          #
+          # It has to be, for two reasons. Callers parse the body — a cache hit
+          # returning '' made JSON.parse raise, so a cached authorization became
+          # a 500 rather than a fast success. And the body is where the
+          # deprecation block lives; without it the Deprecation and Sunset
+          # headers would appear only on cache misses, which reads as a flaky
+          # feature rather than a missing one.
+          if (cached = cache.retrieve(cache_key))
+            return CachedResponse.new(201, cached)
+          end
 
-          hostname = request.host
-          auth = Authorization.header(hostname)
+          # Host header only, never the forwarded chain -- see
+          # BaseUrl.hostname_from_rack_env. request.host would read
+          # X-Forwarded-Host unconditionally.
+          hostname = EndPointBlank::BaseUrl.hostname_from_rack_env(request.env)
           body = {
             path: path,
             http_method: method,
             client_auth: client_auth,
             target_hostname: hostname,
             application: app_name,
-            endpoint_version: VersionFinder.new.find(request),
+            endpoint_version: version,
             source_ip: request.remote_ip,
             uuid: request.uuid
           }
-          response = Http.post(configuration.authorize_url, auth, body)
 
-          if response&.status == 401 && auth.to_s.start_with?("Bearer ")
-            EndPointBlank::AccessTokens.instance.remove(hostname)
-            auth = Authorization.header(hostname)
-            response = Http.post(configuration.authorize_url, auth, body)
-          end
+          # Basic, not Bearer. This call is to intake, which already holds
+          # this service's credential -- minting a token to present it back
+          # was a hop that bought nothing. With no Bearer there is no stale
+          # token, so the 401 retry that used to live here is gone: a 401 now
+          # means the credential is wrong, which is worth surfacing rather
+          # than retrying.
+          response = Http.post(configuration.authorize_url, Authorization.header, body)
 
           return nil if response.nil?
           EndPointBlank.logger.info "Authentication response: #{response.status} - #{response.body}"
           if response.status == 201
-            cache.store(cache_key, true)
+            cache.store(cache_key, response.body)
           elsif response.status > 299
             EndPointBlank.logger.error "Failed to authorize endpoint: #{response.status} - #{response.body}"
           end

data/lib/end_point_blank/commands/endpoint_update.rb

@@ -110,7 +110,7 @@ module EndPointBlank
             nil
           else
             controller_class = "#{route.defaults[:controller].camelize}Controller".constantize
-            versions = controller_class.respond_to?(:versions) ? controller_class.versions(route.defaults[:action].to_sym) : {}
+            versions = controller_class.respond_to?(:versions) ? controller_class.versions(route.defaults[:action].to_sym) : []
             {
               path: route.path.spec.to_s.gsub(/\([^)]*\)/, ''),
               http_method: route.verb,

data/lib/end_point_blank/commands/generate_access_token.rb

@@ -12,8 +12,8 @@ module EndPointBlank
           EndPointBlank::Configuration.instance
         end
 
-        def token(hostname)
-          body = {hostname: hostname}
+        def token(base_url)
+          body = {base_url: base_url}
           if configuration.token_ttl
             body[:token_ttl] = configuration.token_ttl
           end
@@ -23,7 +23,7 @@ module EndPointBlank
             body: body.to_json,
             **EndPointBlank::Commands::Http::TIMEOUT_OPTIONS
           )
-          EndPointBlank.logger.info "Authentication response: #{response.status} - #{response.body}"
+          EndPointBlank.logger.info "Authentication response: #{response.status}"
           parsed_body = response.body.is_a?(String) ? JSON.parse(response.body) : response.body
           parsed_body.transform_keys(&:to_sym)
         rescue => e

data/lib/end_point_blank/configuration.rb

@@ -15,7 +15,7 @@ module EndPointBlank
 
     attr_accessor :worker_count, :log_mode,
                   :version_finder, :application_version, :token_ttl, :cache_ttl,
-                  :masking_rules, :mask_hook, :logger
+                  :masking_rules, :mask_hook, :logger, :trust_proxy_headers
 
     def initialize
       @worker_count = 4
@@ -23,6 +23,7 @@ module EndPointBlank
       @cache_ttl = 300
       @masking_rules = []
       @mask_hook = nil
+      @trust_proxy_headers = true
     end
 
     # Returns the configured client id, falling back to the

data/lib/end_point_blank/deprecation_headers.rb

@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+require "time"
+
+module EndPointBlank
+  # Formats the deprecation facts returned by an authorize call into the
+  # standard response headers.
+  #
+  #   Deprecation  RFC 9745 — an Item Structured Header Date: "@1688169599"
+  #   Sunset       RFC 8594 — an HTTP-date: "Sat, 31 Dec 2018 23:59:59 GMT"
+  #
+  # RFC 9745 permits a past value ("was deprecated at that date"), which is what
+  # EndPointBlank emits: deprecation takes effect when it is declared.
+  #
+  # Pure and stateless on purpose. The SDK does not know what a lifecycle is —
+  # it relays two timestamps the portal already decided about, and this turns
+  # them into two strings. That keeps the vectors in
+  # docs/superpowers/specs/2026-08-01-header-vectors.md assertable without
+  # constructing a request.
+  module DeprecationHeaders
+    DEPRECATION = "Deprecation"
+    SUNSET = "Sunset"
+
+    # Fixed English abbreviations. Ruby's %a/%b are locale-independent, but
+    # spelling them out removes the question entirely — a server running under a
+    # different locale must still emit an HTTP-date.
+    DAYS = %w[Sun Mon Tue Wed Thu Fri Sat].freeze
+    MONTHS = %w[Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec].freeze
+
+    class << self
+      # @param deprecation [Hash, nil] the authorize response's "deprecation"
+      #   block: {"deprecated_at" => iso8601, "sunset_at" => iso8601 | nil}
+      # @return [Hash] header name => value; empty when there is nothing to say
+      def build(deprecation)
+        return {} unless deprecation.is_a?(Hash)
+
+        headers = {}
+
+        if (at = parse(deprecation["deprecated_at"] || deprecation[:deprecated_at]))
+          headers[DEPRECATION] = deprecation_value(at)
+        end
+
+        if (at = parse(deprecation["sunset_at"] || deprecation[:sunset_at]))
+          headers[SUNSET] = sunset_value(at)
+        end
+
+        headers
+      end
+
+      # "@1688169599" — no quotes, no sub-second precision.
+      def deprecation_value(time)
+        "@#{time.to_i}"
+      end
+
+      # "Sat, 31 Dec 2018 23:59:59 GMT" — day-of-month zero padded, always GMT.
+      def sunset_value(time)
+        t = time.utc
+        format(
+          "%s, %02d %s %04d %02d:%02d:%02d GMT",
+          DAYS[t.wday], t.day, MONTHS[t.month - 1], t.year, t.hour, t.min, t.sec
+        )
+      end
+
+      private
+
+      # Never raise into the provider's response path. A malformed timestamp
+      # from the portal is a bug worth no header; it is not worth a 500 on a
+      # request that already succeeded.
+      #
+      # Types are matched rather than coerced. `Time.parse(12345)` does not
+      # raise — it happily returns a date in 2012 — so a `to_s` here would turn
+      # a nonsense value into a plausible-looking header, which is the one
+      # outcome worse than no header at all.
+      def parse(value)
+        case value
+        when Time then value.utc
+        when String then parse_string(value)
+        end
+      end
+
+      def parse_string(value)
+        return nil if value.empty?
+
+        Time.parse(value).utc
+      rescue ArgumentError, TypeError
+        nil
+      end
+    end
+  end
+end

data/lib/end_point_blank/middleware/rack/report_interaction.rb

@@ -19,6 +19,14 @@ module EndPointBlank
 
           status, headers, body = @app.call(env)
 
+          # RFC 9745 / RFC 8594. The provider writes no code for this: the
+          # portal decided the version is deprecated, authorize relayed the
+          # dates, and this attaches them to the response their consumer
+          # already receives.
+          ::EndPointBlank::DeprecationHeaders
+            .build(::EndPointBlank::Rack::EnvStore.deprecation)
+            .each { |name, value| headers[name] = value }
+
           [status, headers, body]
         rescue ::EndPointBlank::UnauthorizedError => e
           # We don't want to log unauthorized errors as they are expected to happen

data/lib/end_point_blank/rack/env_store.rb

@@ -1,8 +1,28 @@
 module EndPointBlank
   module Rack
+    # Per-request state, keyed off the Rack env.
+    #
+    # Only the env itself is held in a thread-local; everything derived from a
+    # request lives *inside* that env. That distinction is the whole point.
+    #
+    # Threads are reused between requests, so a thread-local is correct only for
+    # as long as something reliably clears it — here, the middleware's `ensure`.
+    # Anything that set a value without that middleware in the stack would
+    # strand it on the thread, and the next request served by that thread could
+    # read the previous caller's data: their app-environment id on our audit
+    # row, their sunset date on our response.
+    #
+    # The env is per-request by construction. The server builds a fresh hash per
+    # request and `set/1` replaces it wholesale at the top of the middleware, so
+    # a stranded value is unreachable even if `clear/0` never runs. Correctness
+    # stops depending on cleanup happening.
+    #
+    # Outside a Rack request there is nowhere to put anything and no response to
+    # decorate, so the writers are no-ops and the readers return nil.
     class EnvStore
       KEY = 'end_point_blank.rack_env'.freeze
       SOURCE_ENV_ID_KEY = 'end_point_blank.source_application_environment_id'.freeze
+      DEPRECATION_KEY = 'end_point_blank.deprecation'.freeze
 
       def self.set(env)
         Thread.current[KEY] = env
@@ -17,18 +37,42 @@ module EndPointBlank
         env && ::Rack::Request.new(env)
       end
 
+      # The calling service's application environment, resolved by `authorize!`
+      # and stamped onto every audit row for this request.
       def self.set_source_application_environment_id(id)
-        Thread.current[SOURCE_ENV_ID_KEY] = id
+        put(SOURCE_ENV_ID_KEY, id)
       end
 
       def self.source_application_environment_id
-        Thread.current[SOURCE_ENV_ID_KEY]
+        fetch(SOURCE_ENV_ID_KEY)
+      end
+
+      # The authorize response's deprecation block, stashed on the way in so the
+      # response middleware can turn it into `Deprecation` and `Sunset` headers
+      # on the way out.
+      def self.set_deprecation(deprecation)
+        put(DEPRECATION_KEY, deprecation)
+      end
+
+      def self.deprecation
+        fetch(DEPRECATION_KEY)
       end
 
       def self.clear
         Thread.current[KEY] = nil
-        Thread.current[SOURCE_ENV_ID_KEY] = nil
       end
+
+      def self.put(key, value)
+        env = get
+        env[key] = value if env
+      end
+      private_class_method :put
+
+      def self.fetch(key)
+        env = get
+        env && env[key]
+      end
+      private_class_method :fetch
     end
   end
-end
+end

data/lib/end_point_blank/rack/headers.rb

@@ -3,6 +3,8 @@ module EndPointBlank
     module Headers
       def self.extract
         env = ::EndPointBlank::Rack::EnvStore.get
+        return {} if env.nil?
+
         env.select { |k,v| k.start_with? 'HTTP_'}.
           transform_keys { |k| k.sub(/^HTTP_/, '').split('_').map(&:capitalize).join('-') }
       end

data/lib/end_point_blank/rails/authorized.rb

@@ -17,6 +17,9 @@ module EndPointBlank
         result_json = JSON.parse(result.body)
         app_env_id = result_json['data'][0]['source_application_environment_id']
         ::EndPointBlank::Rack::EnvStore.set_source_application_environment_id(app_env_id)
+        # Present only when the called version is deprecated; the middleware
+        # turns it into Deprecation / Sunset headers on the way out.
+        ::EndPointBlank::Rack::EnvStore.set_deprecation(result_json['deprecation'])
       end
 
       private

data/lib/end_point_blank/rails/versioned.rb

@@ -4,15 +4,20 @@ module EndPointBlank
       extend ActiveSupport::Concern
 
       class_methods do
-        # Define versioning for specific actions
+        # Record which versions specific actions serve.
+        #
+        # Lifecycle state (Current, Deprecated, ...) is NOT declared here. It is
+        # managed in the EndPointBlank portal, where changing it does not require
+        # shipping code. This reports which versions exist, not what they mean.
+        #
         # @param versions [Array<String>] List of version strings (e.g., ["v1", "v2"])
         # @param options [Hash] Options hash with :only or :except keys
         # @option options [Array<Symbol>] :only Actions to include in versioning
         # @option options [Array<Symbol>] :except Actions to exclude from versioning
         #
         # Example:
-        #   version ["v1", "v2"], only: [:index], state: "Current"
-        #   version ["v3"], except: [:destroy], state: "Deprecated"
+        #   version ["v1", "v2"], only: [:index]
+        #   version ["v3"], except: [:destroy]
         def version(values, options = {})
           versions = Array(values)
           @versioning_config ||= {}
@@ -20,23 +25,16 @@ module EndPointBlank
           actions = determine_actions(options)
 
           actions.each do |action|
-            @versioning_config[action] ||= {}
-            state = options[:state] || "__default__"
-            @versioning_config[action][state] ||= []
-            @versioning_config[action][state] = (@versioning_config[action][state] + versions).uniq
+            # uniq preserves declaration order, so the manifest stays stable
+            # between deploys instead of churning.
+            @versioning_config[action] = ((@versioning_config[action] || []) + versions).uniq
           end
         end
 
-        # Returns the versioning configuration hash
-        # @return [Hash] Hash mapping action names to their version arrays
-        #
-        # Example return value:
-        #   {
-        #     index: ["v1", "v2"],
-        #     show: ["v1"]
-        #   }
+        # Versions the given action serves.
+        # @return [Array<String>] e.g. ["v1", "v2"]; empty when none declared.
         def versions(action)
-          @versioning_config&.fetch(action, {}) || {}
+          @versioning_config&.fetch(action, []) || []
         end
 
         private

data/lib/end_point_blank/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module EndPointBlank
-  VERSION = "0.2.2"
+  VERSION = "0.6.0"
 end

data/lib/end_point_blank/writers/request_writer.rb

@@ -26,11 +26,10 @@ module EndPointBlank
         version = Commands::VersionFinder.new.find(request)
         headers = ::EndPointBlank::Rack::Headers.extract
 
-        payload = {
+        {
           app_name: EndPointBlank::Configuration.instance.app_name,
           env: SessionConfiguration.env_name,
           uuid: request_uuid(env),
-          host: request.host,
           status: request_status(request),
           headers: headers,
           path: request.path,
@@ -38,7 +37,12 @@ module EndPointBlank
           endpoint_version: version,
           request: request_body(request),
           sent_at: Time.now.utc.iso8601(3)
-        }
+        }.merge(
+          ::EndPointBlank::BaseUrl.from_rack_env(
+            env,
+            trust_proxy_headers: EndPointBlank::Configuration.instance.trust_proxy_headers
+          )
+        )
       end
 
       def write()

data/lib/end_point_blank.rb

@@ -7,12 +7,14 @@ require_relative "end_point_blank/access_tokens"
 require_relative "end_point_blank/authorization"
 require_relative "end_point_blank/version"
 require_relative "end_point_blank/configuration"
+require_relative "end_point_blank/base_url"
 require_relative "end_point_blank/session_configuration"
 require_relative "end_point_blank/log_entry"
 require_relative "end_point_blank/string_truncator"
 require_relative "end_point_blank/fast_json_truncator"
 require_relative "end_point_blank/xml_truncator"
 require_relative "end_point_blank/masking"
+require_relative "end_point_blank/deprecation_headers"
 require_relative "end_point_blank/writers/shared"
 require_relative "end_point_blank/writers/delayed_writer"
 require_relative "end_point_blank/writers/direct_writer"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: end_point_blank
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.6.0
 platform: ruby
 authors:
 - Robert A. Lasch
 bindir: exe
 cert_chain: []
-date: 2026-07-10 00:00:00.000000000 Z
+date: 2026-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: excon
@@ -29,28 +29,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.2.6
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.2.6
 - !ruby/object:Gem::Dependency
   name: rexml
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.3.9
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 3.3.9
 - !ruby/object:Gem::Dependency
   name: base64
   requirement: !ruby/object:Gem::Requirement
@@ -91,17 +91,20 @@ files:
 - ".rspec"
 - ".rubocop.yml"
 - ".ruby-version"
+- CHANGELOG.md
 - HARDENING_REPORT.md
 - LICENSE
 - README.md
 - Rakefile
 - build.sh
+- deploy
 - docs/superpowers/plans/2026-07-08-framework-agnostic-core.md
 - docs/superpowers/specs/2026-07-08-framework-agnostic-core-design.md
 - end_point_blank.gemspec
 - lib/end_point_blank.rb
 - lib/end_point_blank/access_tokens.rb
 - lib/end_point_blank/authorization.rb
+- lib/end_point_blank/base_url.rb
 - lib/end_point_blank/commands/authentication_cache.rb
 - lib/end_point_blank/commands/basic_authenticate.rb
 - lib/end_point_blank/commands/bearer_generate.rb
@@ -112,6 +115,7 @@ files:
 - lib/end_point_blank/commands/route_pattern_finder.rb
 - lib/end_point_blank/commands/version_finder.rb
 - lib/end_point_blank/configuration.rb
+- lib/end_point_blank/deprecation_headers.rb
 - lib/end_point_blank/fast_json_truncator.rb
 - lib/end_point_blank/log_entry.rb
 - lib/end_point_blank/loggers/logger.rb