envless-sdk 0.0.1

data/lib/envless/sdk/constants.rb

@@ -0,0 +1,262 @@
+# frozen_string_literal: true
+
+module Envless
+  module Constants
+    CIPHERTEXT_MESSAGES = {UNSUPPORTED: "Unsupported ciphertext format."}
+
+    CIPHERTEXT_PREFIXES = ["v1:", "v2:"]
+
+    COLLECTIONS = {
+      ACCESS: "access",
+      EVENTS: "events",
+      WORKSPACES: "workspaces",
+      PRODUCTS: "products",
+      PROJECTS: "projects",
+      ENVIRONMENTS: "environments",
+      VARIABLES: "variables",
+      HISTORY: "history",
+      VERSIONS: "versions",
+      ENTRIES: "entries",
+      MEMBERS: "members",
+      INVITES: "invites",
+      ROLES: "roles",
+      KEYS: "keys",
+      WEBHOOKS: "webhooks",
+      DELIVERIES: "deliveries"
+    }
+
+    CONTENT_TYPES = {JSON: "application/json"}
+
+    CRYPTO = {
+      PBKDF2_ITERATIONS: 200000,
+      PBKDF2_ITERATIONS_MIN: 100000,
+      PBKDF2_ITERATIONS_MAX: 1000000,
+      HASH: "SHA-256",
+      AES_ALGORITHM: "AES-GCM",
+      KDF_ALGORITHM: "PBKDF2",
+      HMAC_ALGORITHM: "HMAC",
+      AES_LENGTH: 256,
+      IV_LENGTH: 12,
+      SALT_LENGTH: 16,
+      WORKSPACE_SALT_NAMESPACE: "envless:workspace:",
+      CIPHERTEXT_VERSION_PREFIX: "v1:",
+      CIPHERTEXT_VERSION_PREFIX_V2: "v2:"
+    }
+
+    EMPTY_PAGINATION = {limit: 0, offset: 0, totalCount: 0, hasMore: false}
+
+    ENCRYPTION_PARAMETERS = {
+      pbkdf2Iterations: 200000,
+      hash: "SHA-256",
+      aesAlgorithm: "AES-GCM",
+      kdfAlgorithm: "PBKDF2",
+      aesLength: 256,
+      ivLength: 12,
+      saltLength: 16,
+      saltNamespace: "envless:workspace:",
+      ciphertextVersionPrefix: "v1:"
+    }
+
+    ENV_KEY_PATTERN = /\A[A-Za-z_][A-Za-z0-9_]*\z/
+
+    ENV_VARS = {TOKEN: "ENVLESS_TOKEN", BASE_URL: "ENVLESS_API_ENDPOINT", PASSPHRASE: "ENVLESS_PASSPHRASE"}
+
+    ERROR_CODES = {BODY_INVALID: "request.body_invalid", SERVER_ERROR: "server.error"}
+
+    HEADER_KEYS = {
+      AUTHORIZATION: "Authorization",
+      ACCEPT: "Accept",
+      CONTENT_TYPE: "Content-Type",
+      USER_AGENT: "User-Agent",
+      RETRY_AFTER: "retry-after"
+    }
+
+    HTTP_METHODS = {GET: "GET", POST: "POST", PUT: "PUT", PATCH: "PATCH", DELETE: "DELETE"}
+
+    INPUT_LIMITS = {
+      VARIABLE_NAME: {MIN: 1, MAX: 100}
+    }
+
+    KEY_SCOPE_LEVELS = {NONE: "none", READ: "read", WRITE: "write"}
+
+    KEY_SCOPE_RESOURCES = {
+      WORKSPACE: "workspace",
+      PRODUCTS: "products",
+      PRODUCT_ACCESS: "product-access",
+      PROJECTS: "projects",
+      ENVIRONMENTS: "environments",
+      VARIABLES: "variables",
+      VERSIONS: "versions",
+      MEMBERS: "members",
+      ROLES: "roles",
+      KEYS: "keys",
+      WEBHOOKS: "webhooks"
+    }
+
+    LOCAL_REFUSAL = {STATUS: 400, VARIABLE_RESOURCE: "variable", NAME_FIELD: "name"}
+
+    PAGINATION = {MAX_LIMIT: 100, DEFAULT_LIMIT: 25}
+
+    PASSPHRASE_CHARACTER_CLASSES = {
+      LOWERCASE: /[a-z]/,
+      UPPERCASE: /[A-Z]/,
+      DIGIT: /[0-9]/,
+      SYMBOL: /[^a-zA-Z0-9]/
+    }
+
+    PASSPHRASE_STRENGTH = {
+      MIN_LENGTH: 16,
+      MIN_CHARACTER_CLASSES: 3,
+      LONG_LENGTH: 24,
+      LONG_MIN_CHARACTER_CLASSES: 2,
+      MAX_REPEATED_RUN: 3,
+      MAX_SEQUENTIAL_RUN: 3,
+      WEAK_FRAGMENT_COVERAGE: 0.5
+    }
+
+    PASSPHRASE_STRENGTH_ERRORS = {
+      REQUIRED: "Passphrase is required.",
+      TOO_SHORT: "Passphrase must be at least {{count}} characters long.",
+      LOW_VARIETY: "Passphrase must combine at least {{count}} of these: lowercase letters, uppercase letters, numbers, symbols. A longer passphrase needs fewer of them.",
+      REPEATED: "Passphrase must not repeat the same character {{count}} times in a row.",
+      SEQUENCE: "Passphrase must not contain an obvious run like 1234 or abcd.",
+      COMMON: "Passphrase contains a well known weak pattern. Pick something less predictable."
+    }
+
+    PATHS = {
+      ME: "/me",
+      WORKSPACE: "/workspace",
+      WORKSPACES: "/workspaces",
+      WORKSPACE_DOMAIN: "/workspace/domain",
+      WORKSPACE_DOMAIN_VERIFY: "/workspace/domain/verify",
+      PRODUCTS: "/products",
+      PERMISSIONS: "/permissions",
+      ROLES: "/roles",
+      INVITES: "/invites",
+      MEMBERS: "/members",
+      MEMBERS_ME: "/members/me",
+      PROJECTS: "/projects",
+      VARIABLES: "/variables",
+      VERSIONS: "/versions",
+      KEYS: "/keys",
+      WEBHOOKS: "/webhooks",
+      WEBHOOK_EVENT_TYPES: "/webhooks/event-types"
+    }
+
+    QUERY_KEYS = {
+      LIMIT: "limit",
+      OFFSET: "offset",
+      SEARCH: "search",
+      ORDER: "order",
+      PRODUCT: "product",
+      STATUS: "status"
+    }
+
+    REENCRYPT_BATCH_SIZE = 100
+
+    RETRY = {
+      STATUSES: [408, 429, 500, 502, 503, 504],
+      METHODS: ["GET", "HEAD", "PUT", "DELETE"],
+      BASE_BACKOFF_MS: 250,
+      MAX_BACKOFF_MS: 30000
+    }
+
+    ROTATION_FIELDS = {VALUE: "value", DEFAULT_VALUE: "defaultValue"}
+
+    ROTATION_MESSAGES = {
+      NOT_CIPHERTEXT: "The stored value is not ciphertext, so it was left untouched.",
+      DEFAULT_STRANDED: "The entry has no ciphertext value to rewrite it with, so this encrypted default still needs the old passphrase."
+    }
+
+    ROTATION_SCOPES = {VARIABLE: "variable", VERSION_ENTRY: "versionEntry"}
+
+    SEGMENTS = {
+      ACCESS: "access",
+      APPLY: "apply",
+      BULK: "bulk",
+      DELIVERIES: "deliveries",
+      DUPLICATE: "duplicate",
+      ENTRIES: "entries",
+      ENVIRONMENTS: "environments",
+      EXPOSE: "expose",
+      HISTORY: "history",
+      PROJECTS: "projects",
+      REDELIVER: "redeliver",
+      REENCRYPT: "reencrypt",
+      RESEND: "resend",
+      ROLLBACK: "rollback",
+      ROTATE: "rotate",
+      VARIABLES: "variables",
+      VERSIONS: "versions"
+    }
+
+    VARIABLE_NAME_ERRORS = {
+      REQUIRED: "A variable name is required.",
+      TOO_LONG: "Variable name must be at most {{count}} characters long.",
+      SHAPE: "Variable name can only use letters, numbers and underscores, and cannot start with a number."
+    }
+
+    VARIABLE_TYPES = {STRING: "string", NUMBER: "number", BOOLEAN: "boolean"}
+
+    VARIABLE_VISIBILITY = {SERVER: "server", CLIENT: "client"}
+
+    WEAK_PASSPHRASE_FRAGMENTS = {
+      PASSWORD: "password",
+      PASSPHRASE: "passphrase",
+      QWERTY: "qwerty",
+      ASDFGH: "asdfgh",
+      ZXCVBN: "zxcvbn",
+      LETMEIN: "letmein",
+      CHANGEME: "changeme",
+      ILOVEYOU: "iloveyou",
+      TRUSTNO: "trustno1",
+      ABC123: "abc123",
+      ENVLESS: "envless",
+      SECRET123: "secret123",
+      ADMIN123: "admin123",
+      CORRECTHORSE: "correcthorse"
+    }
+
+    WEBHOOK_HEADERS = {
+      ID: "webhook-id",
+      TIMESTAMP: "webhook-timestamp",
+      SIGNATURE: "webhook-signature",
+      EVENT: "Envless-Event",
+      DELIVERY: "Envless-Delivery"
+    }
+
+    WEBHOOK_SIGNATURE = {VERSION: "v1", SEPARATOR: ",", TOLERANCE_SECONDS: 300}
+
+    PAGE_LIMITS = PAGINATION
+
+    SCOPE_LEVELS = KEY_SCOPE_LEVELS
+
+    SCOPE_RESOURCES = KEY_SCOPE_RESOURCES
+
+    VARIABLE_TYPE = VARIABLE_TYPES
+
+    VARIABLE_VISIBILITY_LEVELS = VARIABLE_VISIBILITY
+
+    WEBHOOK_SIGNATURE_HEADERS = WEBHOOK_HEADERS
+
+    BASE64_NON_ALPHABET_PATTERN = /[^A-Za-z0-9+\/]/
+
+    ENDPOINT_SCHEME_PATTERN = /\A[a-z][a-z0-9+.-]*:\/\//i
+
+    LOCAL_HOSTS = ["localhost", "127.0.0.1", "0.0.0.0", "::1"]
+
+    RETRYABLE_METHODS = Set["GET", "HEAD", "PUT", "DELETE"]
+
+    RETRYABLE_STATUSES = Set[408, 429, 500, 502, 503, 504]
+
+    constants.each { |name| Ractor.make_shareable(const_get(name)) }
+  end
+
+  ENCRYPTION_PARAMETERS = Constants::ENCRYPTION_PARAMETERS
+  PAGE_LIMITS = Constants::PAGE_LIMITS
+  SCOPE_LEVELS = Constants::SCOPE_LEVELS
+  SCOPE_RESOURCES = Constants::SCOPE_RESOURCES
+  VARIABLE_TYPE = Constants::VARIABLE_TYPE
+  VARIABLE_VISIBILITY_LEVELS = Constants::VARIABLE_VISIBILITY_LEVELS
+  WEBHOOK_SIGNATURE_HEADERS = Constants::WEBHOOK_SIGNATURE_HEADERS
+end

data/lib/envless/sdk/crypto/cipher.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Envless
+  module Crypto
+    module Cipher
+      CRYPTO = Constants::CRYPTO
+      ALGORITHM = "aes-256-gcm"
+      TAG_BYTES = 16
+
+      module_function
+
+      def encrypt_with_key(key, plaintext)
+        iv = OpenSSL::Random.random_bytes(CRYPTO[:IV_LENGTH])
+        cipher = OpenSSL::Cipher.new(ALGORITHM).encrypt
+        cipher.key = Keys.key_of(key).to_bytes
+        cipher.iv = iv
+        cipher.auth_data = ""
+        bytes = Keys.text(plaintext, "plaintext")
+        sealed = (bytes.empty? ? "".b : cipher.update(bytes)) + cipher.final
+
+        "#{CRYPTO[:CIPHERTEXT_VERSION_PREFIX]}#{Codec.to_base64(iv + sealed + cipher.auth_tag)}"
+      end
+
+      def decrypt(key, encoded)
+        combined = Codec.from_base64(Envelope.parse(encoded).payload)
+        raise DecryptionError, CryptoMessages::TOO_SHORT if combined.bytesize < CRYPTO[:IV_LENGTH] + 1
+
+        secret = Keys.key_of(key)
+        sealed = combined.byteslice(CRYPTO[:IV_LENGTH]..).to_s
+        raise DecryptionError, CryptoMessages::UNDECRYPTABLE if sealed.bytesize < TAG_BYTES
+
+        Text.decode(unseal(secret, combined.byteslice(0, CRYPTO[:IV_LENGTH]).to_s, sealed))
+      end
+
+      def unseal(key, iv, sealed)
+        cipher = OpenSSL::Cipher.new(ALGORITHM).decrypt
+        cipher.key = key.to_bytes
+        cipher.iv = iv
+        cipher.auth_tag = sealed.byteslice(-TAG_BYTES, TAG_BYTES).to_s
+        cipher.auth_data = ""
+        body = sealed.byteslice(0, sealed.bytesize - TAG_BYTES).to_s
+        (body.empty? ? "".b : cipher.update(body)) + cipher.final
+      rescue OpenSSL::Cipher::CipherError
+        raise DecryptionError, CryptoMessages::UNDECRYPTABLE
+      end
+
+      def decrypt_with_key(key, ciphertext)
+        iterations = Envelope.parse(ciphertext).iterations
+
+        if iterations && iterations != CRYPTO[:PBKDF2_ITERATIONS]
+          raise DecryptionError, format(CryptoMessages::PINNED_COST, count: iterations)
+        end
+
+        decrypt(key, ciphertext)
+      end
+    end
+  end
+end

data/lib/envless/sdk/crypto/codec.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Envless
+  module Crypto
+    module Codec
+      module_function
+
+      def to_base64(bytes)
+        [bytes].pack("m0")
+      end
+
+      def from_base64(value)
+        cleaned = Text.utf8(value).gsub(Constants::BASE64_NON_ALPHABET_PATTERN, "")
+        usable = cleaned[0, cleaned.length - ((cleaned.length % 4 == 1) ? 1 : 0)].to_s
+        "#{usable}#{"=" * (-usable.length % 4)}".unpack1("m").to_s.b
+      end
+
+      def from_base64_url(value)
+        from_base64(Text.utf8(value).tr("-_", "+/"))
+      end
+    end
+  end
+end

data/lib/envless/sdk/crypto/envelope.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Envless
+  module Crypto
+    CiphertextEnvelope = Data.define(:payload, :iterations)
+
+    module Envelope
+      CRYPTO = Constants::CRYPTO
+      V1 = CRYPTO[:CIPHERTEXT_VERSION_PREFIX]
+      V2 = CRYPTO[:CIPHERTEXT_VERSION_PREFIX_V2]
+      UNSUPPORTED = Constants::CIPHERTEXT_MESSAGES[:UNSUPPORTED]
+
+      module_function
+
+      def parse(encoded)
+        raise DecryptionError, UNSUPPORTED unless encoded.is_a?(String)
+
+        text = Text.utf8(encoded)
+        return versioned(text.delete_prefix(V2)) if text.start_with?(V2)
+        return CiphertextEnvelope.new(payload: text.delete_prefix(V1), iterations: nil) if text.start_with?(V1)
+
+        raise DecryptionError, UNSUPPORTED
+      end
+
+      def versioned(rest)
+        separator = rest.index(":")
+        raise DecryptionError, UNSUPPORTED if separator.nil?
+
+        CiphertextEnvelope.new(payload: rest[(separator + 1)..].to_s, iterations: iterations(rest[0, separator].to_s))
+      end
+
+      def iterations(text)
+        value = Numbers.js_number(text)
+        raise DecryptionError, UNSUPPORTED unless value.finite? && value == value.floor
+        raise DecryptionError, UNSUPPORTED unless value.between?(CRYPTO[:PBKDF2_ITERATIONS_MIN], CRYPTO[:PBKDF2_ITERATIONS_MAX])
+
+        value.to_i
+      end
+    end
+  end
+end

data/lib/envless/sdk/crypto/keys.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Envless
+  module Crypto
+    module Keys
+      CRYPTO = Constants::CRYPTO
+      DIGEST = CRYPTO[:HASH].delete("-")
+
+      module_function
+
+      def key_of(key)
+        key.is_a?(WorkspaceKey) ? key : WorkspaceKey.new(key)
+      end
+
+      def workspace_salt(workspace_unique_id)
+        material = "#{CRYPTO[:WORKSPACE_SALT_NAMESPACE]}#{text(workspace_unique_id, "workspace_unique_id")}"
+        OpenSSL::Digest.digest(DIGEST, material).byteslice(0, CRYPTO[:SALT_LENGTH]).to_s
+      end
+
+      def derive_key(passphrase, salt, iterations = CRYPTO[:PBKDF2_ITERATIONS])
+        secret = text(passphrase, "passphrase")
+        raw = OpenSSL::KDF.pbkdf2_hmac(secret, salt:, iterations:, length: WorkspaceKey::BYTES, hash: DIGEST)
+        WorkspaceKey.new(raw)
+      end
+
+      def derive_workspace_key(passphrase, workspace_unique_id)
+        raise ArgumentError, CryptoMessages::PASSPHRASE_REQUIRED if passphrase.nil? || passphrase == ""
+        raise ArgumentError, CryptoMessages::WORKSPACE_REQUIRED if workspace_unique_id.nil? || workspace_unique_id == ""
+
+        derive_key(passphrase, workspace_salt(workspace_unique_id))
+      end
+
+      def import_workspace_key(value)
+        WorkspaceKey.new(Codec.from_base64_url(text(value, "key")))
+      end
+
+      def text(value, name)
+        Text.strict(value, name)
+      end
+    end
+  end
+end

data/lib/envless/sdk/crypto/passphrase.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Envless
+  module Crypto
+    module Passphrase
+      RULES = Constants::PASSPHRASE_STRENGTH
+      ERRORS = Constants::PASSPHRASE_STRENGTH_ERRORS
+
+      module_function
+
+      def strength(passphrase)
+        return refused(ERRORS[:REQUIRED]) unless passphrase.is_a?(String) && !passphrase.empty?
+
+        text = Text.utf8(passphrase)
+        units = Text.utf16_units(text)
+        return refused(with_count(ERRORS[:TOO_SHORT], RULES[:MIN_LENGTH])) if units.size < RULES[:MIN_LENGTH]
+
+        required = (units.size >= RULES[:LONG_LENGTH]) ? RULES[:LONG_MIN_CHARACTER_CLASSES] : RULES[:MIN_CHARACTER_CLASSES]
+        present = Constants::PASSPHRASE_CHARACTER_CLASSES.values.count { |pattern| pattern.match?(text) }
+
+        return refused(with_count(ERRORS[:LOW_VARIETY], required)) if present < required
+        return refused(with_count(ERRORS[:REPEATED], RULES[:MAX_REPEATED_RUN] + 1)) if PassphraseRules.repeated_run?(units)
+        return refused(ERRORS[:SEQUENCE]) if PassphraseRules.sequential_run?(units)
+        return refused(ERRORS[:COMMON]) if PassphraseRules.weak_fragment?(text)
+
+        Validation.new(valid: true, error: nil)
+      end
+
+      def refused(error)
+        Validation.new(valid: false, error:)
+      end
+
+      def with_count(message, count)
+        message.sub("{{count}}", count.to_s)
+      end
+    end
+  end
+end

data/lib/envless/sdk/crypto/passphrase_rules.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Envless
+  module Crypto
+    module PassphraseRules
+      RULES = Constants::PASSPHRASE_STRENGTH
+      NOT_ALPHANUMERIC = /[^a-z0-9]/
+
+      module_function
+
+      def repeated_run?(units)
+        run = 1
+
+        (1...units.size).any? do |index|
+          run = (units.fetch(index) == units.fetch(index - 1)) ? run + 1 : 1
+          run > RULES[:MAX_REPEATED_RUN]
+        end
+      end
+
+      def sequential_run?(units)
+        ascending = 1
+        descending = 1
+
+        (1...units.size).any? do |index|
+          step = units.fetch(index) - units.fetch(index - 1)
+          ascending = (step == 1) ? ascending + 1 : 1
+          descending = (step == -1) ? descending + 1 : 1
+          [ascending, descending].max > RULES[:MAX_SEQUENTIAL_RUN]
+        end
+      end
+
+      def weak_fragment?(text)
+        skeleton = text.downcase.gsub(NOT_ALPHANUMERIC, "")
+        return false if skeleton.empty?
+
+        Constants::WEAK_PASSPHRASE_FRAGMENTS.values.any? do |fragment|
+          skeleton.length - skeleton.gsub(fragment, "").length >= skeleton.length * RULES[:WEAK_FRAGMENT_COVERAGE]
+        end
+      end
+    end
+  end
+end

data/lib/envless/sdk/crypto/values.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Envless
+  module Crypto
+    module Values
+      module_function
+
+      def encrypt_value(plaintext, passphrase, workspace_unique_id)
+        Cipher.encrypt_with_key(Keys.derive_workspace_key(passphrase, workspace_unique_id), plaintext)
+      end
+
+      def decrypt_value(ciphertext, passphrase, workspace_unique_id)
+        iterations = Envelope.parse(ciphertext).iterations
+        key = if iterations.nil?
+          Keys.derive_workspace_key(passphrase, workspace_unique_id)
+        else
+          Keys.derive_key(passphrase, Keys.workspace_salt(workspace_unique_id), iterations)
+        end
+
+        Cipher.decrypt(key, ciphertext)
+      end
+
+      def ciphertext?(value)
+        return false unless value.is_a?(String)
+
+        text = Text.utf8(value)
+        Constants::CIPHERTEXT_PREFIXES.any? { |prefix| text.start_with?(prefix) }
+      end
+    end
+  end
+end

data/lib/envless/sdk/crypto/workspace_key.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Envless
+  class WorkspaceKey
+    BITS = Constants::CRYPTO[:AES_LENGTH]
+    BYTES = BITS / 8
+
+    def initialize(raw)
+      raise ArgumentError, CryptoMessages::KEY_SHAPE unless raw.is_a?(String) && raw.encoding == Encoding::BINARY
+
+      bytes = raw.b
+      raise ArgumentError, format(CryptoMessages::KEY_LENGTH, bits: BITS, count: bytes.bytesize) unless bytes.bytesize == BYTES
+
+      @raw = bytes.freeze
+      freeze
+    end
+
+    def to_bytes
+      @raw.dup
+    end
+
+    def ==(other)
+      other.is_a?(WorkspaceKey) && OpenSSL.fixed_length_secure_compare(@raw, other.to_bytes)
+    end
+
+    alias_method :eql?, :==
+
+    def hash
+      [WorkspaceKey, @raw].hash
+    end
+
+    def inspect
+      "#<#{self.class.name} #{Defaults::REDACTED}>"
+    end
+
+    def to_s
+      inspect
+    end
+  end
+end

data/lib/envless/sdk/crypto_messages.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Envless
+  module CryptoMessages
+    PASSPHRASE_REQUIRED = "A workspace passphrase is required. An empty passphrase would produce ciphertext anyone " \
+      "can decrypt."
+    WORKSPACE_REQUIRED = "A workspace id is required. The encryption salt is derived from it."
+    PINNED_COST = "This value pins %<count>s PBKDF2 iterations, which the supplied key was not derived with. Use " \
+      "decrypt_value with the passphrase instead, so the key is derived at the cost the value was written with."
+    TOO_SHORT = "Ciphertext payload is too short."
+    UNDECRYPTABLE = "The value could not be decrypted: the passphrase or key is not the one it was encrypted with, " \
+      "or the ciphertext was altered."
+    KEY_LENGTH = "Invalid %<bits>s-bit key: got %<count>s bytes."
+    KEY_SHAPE = "A workspace key must be an Envless::WorkspaceKey from derive_workspace_key or import_workspace_key, or " \
+      "its 32 raw bytes as a binary String (String#b). Text is refused, so a passphrase is never taken for key bytes."
+    TEXT_SHAPE = "%<name>s must be a String."
+    UTF8_SHAPE = "%<name>s must be valid UTF-8 text. Binary data does not survive the round trip, so encode it first, " \
+      "for example as base64."
+    WEAK_ROTATION = "Refusing to rotate: the new passphrase is too weak. %<error>s"
+    WEBHOOK_MISSING_HEADERS = "Missing webhook-id, webhook-timestamp or webhook-signature header."
+    WEBHOOK_TIMESTAMP_SHAPE = "webhook-timestamp is not a unix timestamp in seconds."
+    WEBHOOK_OUT_OF_TOLERANCE = "Webhook timestamp is %<drift>ss out of tolerance (%<tolerance>ss)."
+    WEBHOOK_MISSING_SECRET = "A webhook signing secret is required. Pass the secret shown when the webhook was " \
+      "created, as secret:."
+    WEBHOOK_MISMATCH = "Webhook signature does not match the payload."
+    WEBHOOK_NOT_JSON = "The webhook payload is not JSON."
+    WEBHOOK_PAYLOAD_SHAPE = "Pass the raw request body as a String, exactly as it arrived. A parsed or re-encoded " \
+      "body no longer matches its signature."
+    WEBHOOK_TOLERANCE_SHAPE = "tolerance_seconds: must be a finite number of seconds, 0 or more."
+  end
+end

data/lib/envless/sdk/default_client.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Envless
+  @default_client = nil
+  @default_lock = Mutex.new
+
+  class << self
+    def new(...)
+      Client.new(...)
+    end
+
+    def create_client(...)
+      Client.new(...)
+    end
+
+    def init(...)
+      created = Client.new(...)
+      @default_lock.synchronize { @default_client = created }
+    end
+
+    def client
+      @default_lock.synchronize { @default_client ||= Client.new }
+    end
+
+    def reset_client
+      @default_lock.synchronize { @default_client = nil }
+    end
+
+    def me = client.me
+
+    def workspace = client.workspace
+
+    def workspaces = client.workspaces
+
+    def products = client.products
+
+    def projects = client.projects
+
+    def environments = client.environments
+
+    def variables = client.variables
+
+    def versions = client.versions
+
+    def members = client.members
+
+    def invites = client.invites
+
+    def roles = client.roles
+
+    def keys = client.keys
+
+    def webhooks = client.webhooks
+  end
+end