envless-sdk 0.0.1

data/lib/envless/sdk/urls.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Envless
+  module Urls
+    SCHEMES = %w[http https].freeze
+    TRAILING_SLASHES = %r{/+\z}
+
+    module_function
+
+    def valid_base_url(value)
+      text = value.is_a?(URI::Generic) ? value.to_s : value
+      raise ArgumentError, "#{value.inspect} #{Messages::BASE_URL_SHAPE}" unless text.is_a?(String)
+
+      trimmed = Text.js_trim(text).sub(TRAILING_SLASHES, "")
+      uri = parse(trimmed)
+      raise ArgumentError, "#{value.inspect} #{Messages::BASE_URL_SHAPE}" unless usable?(uri)
+      raise ArgumentError, Messages::BASE_URL_USERINFO unless uri&.userinfo.nil?
+
+      trimmed
+    end
+
+    def usable?(uri)
+      return false if uri.nil?
+
+      SCHEMES.include?(uri.scheme.to_s.downcase) && !uri.host.to_s.empty? && uri.query.nil? && uri.fragment.nil?
+    end
+
+    def parse(text)
+      URI.parse(text)
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    def api_url(base_url, path)
+      unless path.is_a?(String) && path.start_with?("/") && !path.start_with?("//", "/\\")
+        raise ArgumentError, "#{path.inspect} #{Messages::PATH_SHAPE}"
+      end
+
+      "#{base_url}#{path}"
+    end
+
+    def build_url(base_url, path, query = nil)
+      url = api_url(base_url, path)
+      pairs = (query || {}).filter_map do |key, value|
+        text = value.nil? ? "" : query_value(value)
+        "#{form(key.to_s)}=#{form(text)}" unless text.empty?
+      end
+
+      pairs.empty? ? url : "#{url}?#{pairs.join("&")}"
+    end
+
+    def query_value(value)
+      case value
+      when String, Symbol then value.to_s
+      when true, false, Integer then value.to_s
+      when Float then Numbers.text(value)
+      else raise ArgumentError, format(Messages::QUERY_SHAPE, kind: value.class)
+      end
+    end
+
+    def form(text)
+      URI.encode_www_form_component(Text.utf8(text))
+    end
+
+    def origin(url)
+      uri = URI.parse(url)
+      [uri.scheme.to_s.downcase, uri.host.to_s.downcase, uri.port]
+    end
+  end
+end

data/lib/envless/sdk/variable_names.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Envless
+  module VariableNames
+    LIMITS = Constants::INPUT_LIMITS[:VARIABLE_NAME]
+    ERRORS = Constants::VARIABLE_NAME_ERRORS
+    REFUSAL = Constants::LOCAL_REFUSAL
+
+    module_function
+
+    def validation(name)
+      text = (name.is_a?(String) || name.is_a?(Symbol)) ? Text.utf8(name.to_s) : nil
+      return refused(ERRORS[:REQUIRED]) if text.nil? || Text.utf16_length(text) < LIMITS[:MIN]
+      return refused(ERRORS[:TOO_LONG].sub("{{count}}", LIMITS[:MAX].to_s)) if Text.utf16_length(text) > LIMITS[:MAX]
+      return refused(ERRORS[:SHAPE]) unless Constants::ENV_KEY_PATTERN.match?(text)
+
+      Validation.new(valid: true, error: nil)
+    end
+
+    def refused(error)
+      Validation.new(valid: false, error:)
+    end
+
+    def assert(name)
+      check = validation(name)
+      return if check.valid?
+
+      raise ApiError.new("#{check.error} Received: #{received(name)}", status: REFUSAL[:STATUS],
+        code: Constants::ERROR_CODES[:BODY_INVALID], resource: REFUSAL[:VARIABLE_RESOURCE], field: REFUSAL[:NAME_FIELD])
+    end
+
+    def received(name)
+      return "\"#{name}\"" if name.is_a?(String) || name.is_a?(Symbol)
+
+      name.nil? ? "nil" : name.to_s
+    end
+
+    def assert_input(body)
+      assert(Bodies.field(body, "name"))
+    end
+
+    def assert_patch(patch)
+      assert(Bodies.field(patch, "name")) if Bodies.field?(patch, "name")
+    end
+
+    def assert_inputs(items)
+      items.each { |item| assert_input(item) }
+    end
+
+    def assert_changes(changes)
+      creates = Bodies.field(changes, "creates")
+      assert_inputs(Bodies.list(creates, "creates")) if Wire.truthy?(creates)
+    end
+  end
+end

data/lib/envless/sdk/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Envless
+  VERSION = "0.0.1"
+end

data/lib/envless/sdk/webhooks/headers.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module Envless
+  module Webhooks
+    module Headers
+      SEPARATOR = / /
+
+      module_function
+
+      def read(headers, name)
+        value = (headers.respond_to?(:each_pair) || headers.is_a?(Array)) ? scan(headers, name) : lookup(headers, name)
+        value = value.first if value.is_a?(Array)
+        value.nil? ? "" : Text.utf8(value.to_s)
+      end
+
+      def scan(headers, name)
+        wanted = name.downcase
+        rack = "HTTP_#{name.upcase.tr("-", "_")}"
+        pairs = headers.is_a?(Array) ? headers : headers.each_pair
+
+        pairs.each do |pair|
+          key, value = pair
+          return value if key.to_s.downcase == wanted || key.to_s == rack
+        end
+
+        nil
+      end
+
+      def lookup(headers, name)
+        return nil if headers.nil? || headers.is_a?(Numeric) || headers.is_a?(String) || !headers.respond_to?(:[])
+
+        headers[name]
+      rescue ArgumentError, TypeError, NoMethodError
+        nil
+      end
+
+      def candidates(provided)
+        provided.split(SEPARATOR, -1).filter_map do |part|
+          version, candidate = part.split(Constants::WEBHOOK_SIGNATURE[:SEPARATOR], -1)
+          candidate.to_s if version == Constants::WEBHOOK_SIGNATURE[:VERSION]
+        end
+      end
+
+      def same?(expected, candidate)
+        candidate.bytesize == expected.bytesize && OpenSSL.fixed_length_secure_compare(expected, candidate)
+      end
+    end
+  end
+end

data/lib/envless/sdk/webhooks/verify.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+module Envless
+  module Webhooks
+    module Verify
+      HEADERS = Constants::WEBHOOK_HEADERS
+      MESSAGES = CryptoMessages
+
+      module_function
+
+      def call(payload:, headers:, secret:, tolerance_seconds: nil)
+        raise ArgumentError, MESSAGES::WEBHOOK_PAYLOAD_SHAPE unless payload.is_a?(String)
+
+        tolerance = tolerance_of(tolerance_seconds)
+        id = Headers.read(headers, HEADERS[:ID])
+        timestamp = Headers.read(headers, HEADERS[:TIMESTAMP])
+        provided = Headers.read(headers, HEADERS[:SIGNATURE])
+        raise WebhookVerificationError, MESSAGES::WEBHOOK_MISSING_HEADERS if id.empty? || timestamp.empty? || provided.empty?
+
+        fresh!(timestamp, tolerance)
+        raise WebhookVerificationError, MESSAGES::WEBHOOK_MISSING_SECRET unless secret.is_a?(String) && !secret.empty?
+
+        body = payload.b
+        expected = Crypto::Codec.to_base64(OpenSSL::HMAC.digest("SHA256", Text.utf8(secret), "#{id}.#{timestamp}.".b + body))
+        matched = Headers.candidates(provided).any? { |candidate| Headers.same?(expected, candidate) }
+        raise WebhookVerificationError, MESSAGES::WEBHOOK_MISMATCH unless matched
+
+        parsed(body)
+      end
+
+      def tolerance_of(value)
+        return Constants::WEBHOOK_SIGNATURE[:TOLERANCE_SECONDS] if value.nil?
+
+        number = value.is_a?(Integer) || value.is_a?(Float) || value.is_a?(Rational)
+        return value if number && value.finite? && value >= 0
+
+        raise ArgumentError, MESSAGES::WEBHOOK_TOLERANCE_SHAPE
+      end
+
+      def fresh!(timestamp, tolerance)
+        seconds = Numbers.js_number(timestamp)
+        raise WebhookVerificationError, MESSAGES::WEBHOOK_TIMESTAMP_SHAPE unless seconds.finite?
+
+        drift = (Time.now.to_i - seconds).abs
+        return unless drift > tolerance
+
+        raise WebhookVerificationError, format(MESSAGES::WEBHOOK_OUT_OF_TOLERANCE, drift: Numbers.text(drift),
+          tolerance: Numbers.text(tolerance))
+      end
+
+      def parsed(body)
+        Wire.decode(Text.utf8(body))
+      rescue JSON::ParserError
+        raise WebhookVerificationError, MESSAGES::WEBHOOK_NOT_JSON
+      end
+    end
+  end
+end

data/lib/envless/sdk/wire.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Envless
+  module Wire
+    LONE_SURROGATE = /\\u(d[89ab]\h\h)(\\u(d[c-f]\h\h))?|\\u(d[c-f]\h\h)|\\./i
+    SURROGATE_ESCAPE = /\\u[dD][89a-fA-F]/
+    REPLACEMENT_ESCAPE = "\\ufffd"
+    ISO_INSTANT = "%Y-%m-%dT%H:%M:%S.%LZ"
+    MAX_DEPTH = 100
+
+    module_function
+
+    def encode(value)
+      JSON.generate(ready(value), max_nesting: false)
+    end
+
+    def ready(value, depth = 0)
+      raise ArgumentError, Messages::JSON_DEPTH if depth > MAX_DEPTH
+
+      case value
+      when Hash then value.to_h { |key, item| [key_text(key), ready(item, depth + 1)] }
+      when Array, Set then value.map { |item| ready(item, depth + 1) }
+      when String, Symbol then Text.utf8(value.to_s)
+      when Integer, true, false, nil then value
+      when Float then finite(value)
+      else instant(value) || ready(structure(value), depth + 1)
+      end
+    end
+
+    def key_text(key)
+      return Text.utf8(key.to_s) if key.is_a?(String) || key.is_a?(Symbol) || key.is_a?(Integer)
+
+      raise ArgumentError, format(Messages::JSON_KEY_SHAPE, kind: key.class)
+    end
+
+    def finite(value)
+      return value if value.finite?
+
+      raise ArgumentError, format(Messages::NOT_FINITE, value:)
+    end
+
+    def instant(value)
+      return value.getutc.strftime(ISO_INSTANT) if value.is_a?(Time)
+      return value.new_offset("+00:00").strftime(ISO_INSTANT) if value.is_a?(DateTime)
+
+      value.iso8601 if value.is_a?(Date)
+    end
+
+    def structure(value)
+      return value.to_hash if value.respond_to?(:to_hash)
+      return value.to_h if value.is_a?(Struct) || value.is_a?(Data)
+
+      raise ArgumentError, format(Messages::JSON_SHAPE, kind: value.class)
+    end
+
+    def decode(text)
+      JSON.parse(SURROGATE_ESCAPE.match?(text) ? without_lone_surrogates(text) : text, symbolize_names: true)
+    end
+
+    def without_lone_surrogates(text)
+      text.gsub(LONE_SURROGATE) do |escape|
+        high, pair, _low, lone_low = Regexp.last_match&.captures
+        next escape if high.nil? && lone_low.nil?
+        next escape if high && pair
+
+        REPLACEMENT_ESCAPE
+      end
+    end
+
+    def truthy?(value)
+      return false if value.nil? || value == false || value == ""
+      return !value.zero? && !(value.is_a?(Float) && value.nan?) if value.is_a?(Numeric)
+
+      true
+    end
+  end
+end

data/lib/envless/sdk.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require "date"
+require "json"
+require "net/http"
+require "openssl"
+require "timeout"
+require "uri"
+require "zlib"
+
+require_relative "sdk/version"
+require_relative "sdk/constants"
+require_relative "sdk/defaults"
+require_relative "sdk/messages"
+require_relative "sdk/crypto_messages"
+require_relative "sdk/errors"
+require_relative "sdk/api_error"
+require_relative "sdk/text"
+require_relative "sdk/numbers"
+require_relative "sdk/wire"
+require_relative "sdk/results"
+require_relative "sdk/http"
+require_relative "sdk/clock"
+require_relative "sdk/options"
+require_relative "sdk/urls"
+require_relative "sdk/paths"
+require_relative "sdk/environment"
+require_relative "sdk/envelope"
+require_relative "sdk/retry_policy"
+require_relative "sdk/redirects"
+require_relative "sdk/exchange"
+require_relative "sdk/connector"
+require_relative "sdk/connection_pool"
+require_relative "sdk/received"
+require_relative "sdk/net_http_adapter"
+require_relative "sdk/update_notice"
+require_relative "sdk/transport"
+require_relative "sdk/listing"
+require_relative "sdk/pagination"
+require_relative "sdk/bodies"
+require_relative "sdk/variable_names"
+require_relative "sdk/resource"
+require_relative "sdk/resources/me"
+require_relative "sdk/resources/workspace_domain"
+require_relative "sdk/resources/workspace"
+require_relative "sdk/resources/workspaces"
+require_relative "sdk/resources/product_access"
+require_relative "sdk/resources/products"
+require_relative "sdk/resources/projects"
+require_relative "sdk/resources/environments"
+require_relative "sdk/resources/variables"
+require_relative "sdk/resources/variable_changes"
+require_relative "sdk/resources/versions"
+require_relative "sdk/resources/members"
+require_relative "sdk/resources/invites"
+require_relative "sdk/resources/roles"
+require_relative "sdk/resources/keys"
+require_relative "sdk/resources/webhooks"
+require_relative "sdk/resources/webhook_deliveries"
+require_relative "sdk/client"
+require_relative "sdk/default_client"
+require_relative "sdk/crypto/codec"
+require_relative "sdk/crypto/envelope"
+require_relative "sdk/crypto/workspace_key"
+require_relative "sdk/crypto/keys"
+require_relative "sdk/crypto/cipher"
+require_relative "sdk/crypto/values"
+require_relative "sdk/crypto/passphrase_rules"
+require_relative "sdk/crypto/passphrase"
+require_relative "sdk/rotation/key_ring"
+require_relative "sdk/rotation/ledger"
+require_relative "sdk/rotation/variable_rotator"
+require_relative "sdk/rotation/entry_rotator"
+require_relative "sdk/rotation/runner"
+require_relative "sdk/webhooks/headers"
+require_relative "sdk/webhooks/verify"
+require_relative "sdk/helpers"

data/sig/envless/sdk/adapter.rbs

@@ -0,0 +1,60 @@
+module Envless
+  module Connector
+    def self?.open: (URI::Generic uri, Float? timeout, Integer | Float keep_alive_timeout) -> Net::HTTP
+    def self?.decoded: (String? text) -> String?
+  end
+
+  class ConnectionPool
+    CLOSE_ERRORS: Array[singleton(Exception)]
+
+    @max_idle: Integer
+    @keep_alive_timeout: Integer | Float
+    @idle: Hash[[String, String, Integer?], Array[Net::HTTP]]
+    @lock: Thread::Mutex
+    @pid: Integer
+
+    def initialize: (max_idle: Integer, keep_alive_timeout: Integer | Float) -> void
+    def checkout: (URI::Generic uri, Float? timeout) -> [Net::HTTP, bool]
+    def checkin: (URI::Generic uri, Net::HTTP connection) -> void
+    def discard: (Net::HTTP connection) -> void
+    def close: () -> nil
+
+    private
+
+    def take: (URI::Generic uri) -> Net::HTTP?
+    def usable?: (Net::HTTP connection) -> bool
+    def forget_inherited: () -> void
+    def key: (URI::Generic uri) -> [String, String, Integer?]
+  end
+
+  class Received
+    @body: String
+
+    attr_accessor head: Net::HTTPResponse?
+
+    def initialize: () -> void
+    def append: (String chunk) -> String
+    def truncate: () -> String
+    def response: () -> HttpResponse
+  end
+
+  class NetHttpAdapter
+    STALE_ERRORS: Array[singleton(Exception)]
+    BODY_ERRORS: Array[singleton(Exception)]
+    EMPTY_WRITES: Array[String]
+
+    @pool: ConnectionPool
+
+    def initialize: (?max_idle: Integer, ?keep_alive_timeout: Integer | Float) -> void
+    def call: (HttpRequest request) -> HttpResponse
+    def close: () -> nil
+    def inspect: () -> String
+
+    private
+
+    def attempt: (URI::HTTP uri, HttpRequest request, Float? deadline, bool retried) -> HttpResponse
+    def transfer: (Net::HTTP connection, Net::HTTPGenericRequest outbound, Received received, Float? deadline) -> bool
+    def outbound: (URI::HTTP uri, HttpRequest request) -> Net::HTTPGenericRequest
+    def limit: (Net::HTTP connection, Float? deadline) -> void
+  end
+end

data/sig/envless/sdk/client.rbs

@@ -0,0 +1,31 @@
+module Envless
+  class Client
+    attr_reader raw: Transport
+
+    def initialize: (?String? token_argument, ?token: String?, ?base_url: (String | URI::Generic)?, ?adapter: _Adapter?, ?max_retries: Integer?, ?timeout: seconds?, ?user_agent: String?, ?disable_update_notice: bool) -> void
+    def close: () -> nil
+    def inspect: () -> String
+  end
+
+  module Resources
+    class Workspace < Resource
+      @domain: WorkspaceDomain
+    end
+
+    class WorkspaceDomain < Resource
+      private
+
+      def domain_of: (untyped data) -> custom_domain_resource?
+    end
+
+    class Products < Resource
+      @access: ProductAccess
+    end
+
+    class Environments < Resource
+      private
+
+      def set_exposed: (String project, String environment, bool exposed, (String | Symbol)? product, seconds? timeout) -> environment_resource
+    end
+  end
+end

data/sig/envless/sdk/crypto.rbs

@@ -0,0 +1,92 @@
+module Envless
+  class WorkspaceKey
+    BITS: Integer
+    BYTES: Integer
+
+    @raw: String
+
+    def initialize: (String raw) -> void
+    def to_bytes: () -> String
+    def ==: (untyped other) -> bool
+    def eql?: (untyped other) -> bool
+    def hash: () -> Integer
+    def inspect: () -> String
+    def to_s: () -> String
+  end
+
+  module Crypto
+    type key = WorkspaceKey | String
+
+    class CiphertextEnvelope < Data
+      attr_reader payload: String
+      attr_reader iterations: Integer?
+
+      def self.new: (String payload, Integer? iterations) -> CiphertextEnvelope
+                  | (payload: String, iterations: Integer?) -> CiphertextEnvelope
+    end
+
+    module Codec
+      def self?.to_base64: (String bytes) -> String
+      def self?.from_base64: (String value) -> String
+      def self?.from_base64_url: (String value) -> String
+    end
+
+    module Envelope
+      CRYPTO: untyped
+      V1: String
+      V2: String
+      UNSUPPORTED: String
+
+      def self?.parse: (untyped encoded) -> CiphertextEnvelope
+      def self?.versioned: (String rest) -> CiphertextEnvelope
+      def self?.iterations: (String text) -> Integer
+    end
+
+    module Keys
+      CRYPTO: untyped
+      DIGEST: String
+
+      def self?.key_of: (untyped key) -> WorkspaceKey
+      def self?.workspace_salt: (String workspace_unique_id) -> String
+      def self?.derive_key: (untyped passphrase, String salt, ?Integer iterations) -> WorkspaceKey
+      def self?.derive_workspace_key: (untyped passphrase, untyped workspace_unique_id) -> WorkspaceKey
+      def self?.import_workspace_key: (untyped value) -> WorkspaceKey
+      def self?.text: (untyped value, String name) -> String
+    end
+
+    module Cipher
+      CRYPTO: untyped
+      ALGORITHM: String
+      TAG_BYTES: Integer
+
+      def self?.encrypt_with_key: (untyped key, untyped plaintext) -> String
+      def self?.decrypt: (untyped key, untyped encoded) -> String
+      def self?.unseal: (WorkspaceKey key, String iv, String sealed) -> String
+      def self?.decrypt_with_key: (untyped key, untyped ciphertext) -> String
+    end
+
+    module Values
+      def self?.encrypt_value: (untyped plaintext, untyped passphrase, untyped workspace_unique_id) -> String
+      def self?.decrypt_value: (untyped ciphertext, untyped passphrase, untyped workspace_unique_id) -> String
+      def self?.ciphertext?: (untyped value) -> bool
+    end
+
+    module Passphrase
+      RULES: untyped
+      ERRORS: untyped
+
+      def self?.strength: (untyped passphrase) -> Validation
+      def self?.refused: (String error) -> Validation
+      def self?.with_count: (String message, Integer count) -> String
+    end
+
+    module PassphraseRules
+      RULES: untyped
+      NOT_ALPHANUMERIC: Regexp
+
+      def self?.repeated_run?: (Array[Integer] units) -> bool
+      def self?.sequential_run?: (Array[Integer] units) -> bool
+      def self?.weak_fragment?: (String text) -> bool
+    end
+  end
+end

data/sig/envless/sdk/errors.rbs

@@ -0,0 +1,37 @@
+module Envless
+  class Error < StandardError
+  end
+
+  class NetworkError < Error
+    @timeout: bool
+
+    def initialize: (?String? message, ?timeout: bool) -> void
+    def timeout?: () -> bool
+  end
+
+  class DecryptionError < Error
+  end
+
+  class WebhookVerificationError < Error
+  end
+
+  class ApiError < Error
+    attr_reader status: Integer?
+    attr_reader code: String
+    attr_reader resource: String?
+    attr_reader field: String?
+    attr_reader request_id: String?
+    attr_reader retry_after_seconds: Numeric?
+
+    def initialize: (?String? message, ?status: Integer?, ?code: String, ?resource: String?, ?field: String?, ?request_id: String?, ?retry_after_seconds: Numeric?) -> void
+    def detailed_message: (?highlight: bool, **untyped options) -> String
+    def inspect: () -> String
+    def auth?: () -> bool
+    def scope_missing?: () -> bool
+    def validation?: () -> bool
+    def not_found?: () -> bool
+    def conflict?: () -> bool
+    def rate_limited?: () -> bool
+    def needs_upgrade?: () -> bool
+  end
+end

data/sig/envless/sdk/http.rbs

@@ -0,0 +1,31 @@
+module Envless
+  class HttpRequest < Data
+    attr_reader method: String
+    attr_reader url: String
+    attr_reader headers: Hash[String, String]
+    attr_reader body: String?
+    attr_reader timeout: seconds?
+
+    def self.new: (String method, String url, Hash[String, String] headers, String? body, seconds? timeout) -> HttpRequest
+                | (method: String, url: String, headers: Hash[String, String], body: String?, timeout: seconds?) -> HttpRequest
+
+    def with: (?method: String, ?url: String, ?headers: Hash[String, String], ?body: String?, ?timeout: seconds?) -> HttpRequest
+    def inspect: () -> String
+    def to_s: () -> String
+    def pretty_print: (untyped printer) -> void
+  end
+
+  class HttpResponse < Data
+    attr_reader status: Integer
+    attr_reader headers: Hash[String, String]
+    attr_reader body: String
+    attr_reader reason: String
+
+    def self.new: (Integer status, Hash[String, String] headers, String body, String reason) -> HttpResponse
+                | (status: Integer, headers: Hash[String, String], body: String, reason: String) -> HttpResponse
+
+    def self.from: (untyped response) -> HttpResponse
+    def self.header_text: (untyped value) -> String
+    def header: (String name) -> String?
+  end
+end