files.com 1.1.755 → 1.1.757

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c38e1b80bb3ca6cc68890468ddc3825ea371c9cef66eab7723139cded8a24476
-  data.tar.gz: 9a619e69a0d14981c5aea32983c785fedf71d6e39c94db5ab4e068370a77628d
+  metadata.gz: ebfcb0a65a636d80b045dec828bd4febd6691b14f5b6499b2429093b577ce61a
+  data.tar.gz: 8741f0fe95e2590c5c817dbcd1f4b5f2218608d5caa09e95c61a36b9489ec6c4
 SHA512:
-  metadata.gz: 5cafa2058da9cfaf06f0f060db191533c3052fc1994760f5fc9c6097524144df432374ba6a91c3ed1c85535c5e6d16969ed2e179a9cea7f605d5d65ec0f17b13
-  data.tar.gz: 3c84e0b5b096b36ef608b571d7a764272a5625a1415c825fa21fa3f39db3c60977a2d5657a7d7445a1e285ed57a790d56d0914662e85034521015b0b4da892f0
+  metadata.gz: ee616f53de17251896dd450716b6fbdc000e70cb29e7f66be2b68ea48239cb14f2a81e5e300cba022f632eafe23e99bbec9931fe1b47a8e0dce55da77f9f807e
+  data.tar.gz: 31bb8f5f62b4db746062ab14b9f867d66a2b63ed272f73411c4461669bccca8b26c5f48bb990d047d3cf05c1e6f041f99129f5503bcedc3059094a41785748a2

data/README.md

@@ -561,6 +561,7 @@ Files::FolderAdminPermissionRequiredError -> Files::NotAuthorizedError -> Files:
 |`BillingPermissionRequiredError`|  `NotAuthorizedError` |
 |`BundleMaximumUsesReachedError`|  `NotAuthorizedError` |
 |`BundlePermissionRequiredError`|  `NotAuthorizedError` |
+|`CannotAdministerHigherLevelUserError`|  `NotAuthorizedError` |
 |`CannotLoginWhileUsingKeyError`|  `NotAuthorizedError` |
 |`CantActForOtherUserError`|  `NotAuthorizedError` |
 |`ContactAdminForPasswordChangeHelpError`|  `NotAuthorizedError` |
@@ -662,6 +663,7 @@ Files::FolderAdminPermissionRequiredError -> Files::NotAuthorizedError -> Files:
 |`MultipleProcessingErrorsError`|  `ProcessingFailureError` |
 |`PathTooLongError`|  `ProcessingFailureError` |
 |`RecipientAlreadySharedError`|  `ProcessingFailureError` |
+|`RemoteEntryReadOnlyError`|  `ProcessingFailureError` |
 |`RemoteServerErrorError`|  `ProcessingFailureError` |
 |`ResourceBelongsToParentSiteError`|  `ProcessingFailureError` |
 |`ResourceLockedError`|  `ProcessingFailureError` |

data/_VERSION

@@ -1 +1 @@
-1.1.755
+1.1.757

data/docs/remote_server.md

@@ -111,7 +111,7 @@
 * `s3_assume_role_duration_seconds` (int64): Session duration in seconds for AssumeRole authentication (900-43200).
 * `s3_assume_role_external_id` (string): External ID for AssumeRole authentication.
 * `server_certificate` (string): Remote server certificate
-* `server_host_key` (string): Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+* `server_host_key` (string): Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
 * `server_type` (string): Remote server type.
 * `workspace_id` (int64): Workspace ID (0 for default workspace)
 * `ssl` (string): Should we require SSL?
@@ -401,7 +401,7 @@ Files::RemoteServer.create(
 * `s3_compatible_virtual_hosted_style` (boolean): S3-compatible: If true, use virtual-hosted-style URLs instead of path-style URLs
 * `s3_region` (string): S3 region
 * `server_certificate` (string): Remote server certificate
-* `server_host_key` (string): Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+* `server_host_key` (string): Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
 * `server_type` (string): Remote server type.
 * `sharepoint_client_id` (string): SharePoint: Microsoft Entra application client ID for app-only authentication.
 * `sharepoint_site_url` (string): SharePoint: Site URL to scope app-only authentication to a single site. Leave blank to browse all sites.
@@ -574,7 +574,7 @@ Files::RemoteServer.update(id,
 * `s3_compatible_virtual_hosted_style` (boolean): S3-compatible: If true, use virtual-hosted-style URLs instead of path-style URLs
 * `s3_region` (string): S3 region
 * `server_certificate` (string): Remote server certificate
-* `server_host_key` (string): Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+* `server_host_key` (string): Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
 * `server_type` (string): Remote server type.
 * `sharepoint_client_id` (string): SharePoint: Microsoft Entra application client ID for app-only authentication.
 * `sharepoint_site_url` (string): SharePoint: Site URL to scope app-only authentication to a single site. Leave blank to browse all sites.
@@ -778,7 +778,7 @@ remote_server.update(
 * `s3_compatible_virtual_hosted_style` (boolean): S3-compatible: If true, use virtual-hosted-style URLs instead of path-style URLs
 * `s3_region` (string): S3 region
 * `server_certificate` (string): Remote server certificate
-* `server_host_key` (string): Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+* `server_host_key` (string): Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
 * `server_type` (string): Remote server type.
 * `sharepoint_client_id` (string): SharePoint: Microsoft Entra application client ID for app-only authentication.
 * `sharepoint_site_url` (string): SharePoint: Site URL to scope app-only authentication to a single site. Leave blank to browse all sites.

data/docs/site.md

@@ -14,7 +14,12 @@
       "site_admins": true,
       "workspace_admins": true,
       "folder_admins": true,
-      "all_users": true
+      "all_users": false,
+      "selected_group_members": true,
+      "group_ids": [
+        1,
+        2
+      ]
     }
   },
   "allowed_2fa_method_sms": true,
@@ -224,6 +229,7 @@
     "user_belongs_to_parent_site": false,
     "impersonator_user_id": 1
   },
+  "s3_compatible_endpoint_enabled": true,
   "sftp_enabled": true,
   "sftp_finalize_partial_uploads": true,
   "sftp_host_key_type": "default",
@@ -372,7 +378,7 @@
 * `id` (int64): Site Id
 * `name` (string): Site name
 * `additional_text_file_types` (array(string)): Additional extensions that are considered text files
-* `ai_feature_availability` (object): Availability settings for AI features by user class
+* `ai_feature_availability` (object): Availability settings for AI features. Each feature requires the site_admins, workspace_admins, folder_admins, and all_users keys. Optional selected_group_members defaults to false; when true, members of at least one group in group_ids get access regardless of the other options. All availability options are additive: any enabled option matching the user grants access. Optional group_ids is an array of integer IDs of active groups on this site, from any workspace. Omitted or empty group_ids grants no access through selected_group_members and does not affect other options. Disabling all AI features overrides these settings.
 * `allowed_2fa_method_sms` (boolean): Is SMS two factor authentication allowed?
 * `allowed_2fa_method_totp` (boolean): Is TOTP two factor authentication allowed?
 * `allowed_2fa_method_webauthn` (boolean): Is WebAuthn two factor authentication allowed?
@@ -519,6 +525,7 @@
 * `require_2fa_user_type` (string): What type of user is required to use two-factor authentication (when require_2fa is set to `true` for this site)?
 * `require_logout_from_bundles_and_inboxes` (boolean): If true, we will hide the 'Remember Me' box on Inbox and Bundle registration pages, requiring that the user logout and log back in every time they visit the page.
 * `session` (Session): Current session
+* `s3_compatible_endpoint_enabled` (boolean): Is the S3-compatible endpoint enabled for all users and workspaces on this site? Defaults to true. When false, user and group S3 permissions do not allow access.
 * `sftp_enabled` (boolean): Is SFTP enabled?
 * `sftp_finalize_partial_uploads` (boolean): Finalize partial SFTP uploads from interrupted connections? Default: true.
 * `sftp_host_key_type` (string): Sftp Host Key Type
@@ -625,7 +632,7 @@ Files::Site.update(
   motd_use_for_ftp: false, 
   motd_use_for_sftp: false, 
   disable_all_ai_features: false, 
-  ai_feature_availability: {"in_app_ai_assistant":{"site_admins":true,"workspace_admins":true,"folder_admins":true,"all_users":true}}, 
+  ai_feature_availability: {"in_app_ai_assistant":{"site_admins":true,"workspace_admins":true,"folder_admins":true,"all_users":false,"selected_group_members":true,"group_ids":[1,2]}}, 
   mcp_dcr_enabled: false, 
   additional_text_file_types: ["example"], 
   bundle_require_note: false, 
@@ -694,6 +701,7 @@ Files::Site.update(
   user_requests_notify_admins: false, 
   dav_enabled: false, 
   ftp_enabled: false, 
+  s3_compatible_endpoint_enabled: false, 
   sftp_enabled: false, 
   sftp_finalize_partial_uploads: false, 
   users_can_create_api_keys: false, 
@@ -810,7 +818,7 @@ Files::Site.update(
 * `motd_use_for_sftp` (boolean): Show message to users connecting via SFTP
 * `left_navigation_visibility` (object): Visibility settings for account navigation
 * `disable_all_ai_features` (boolean): If true, all AI features are disabled for this site.
-* `ai_feature_availability` (object): Availability settings for AI features by user class
+* `ai_feature_availability` (object): Availability settings for AI features. Each feature requires the site_admins, workspace_admins, folder_admins, and all_users keys. Optional selected_group_members defaults to false; when true, members of at least one group in group_ids get access regardless of the other options. All availability options are additive: any enabled option matching the user grants access. Optional group_ids is an array of integer IDs of active groups on this site, from any workspace. Omitted or empty group_ids grants no access through selected_group_members and does not affect other options. Disabling all AI features overrides these settings.
 * `mcp_dcr_enabled` (boolean): Is OAuth DCR (dynamic client registration) for MCP enabled?
 * `additional_text_file_types` (array(string)): Additional extensions that are considered text files
 * `bundle_require_note` (boolean): Do Bundles require internal notes?
@@ -879,6 +887,7 @@ Files::Site.update(
 * `user_requests_notify_admins` (boolean): Send email to site admins when a user request is received?
 * `dav_enabled` (boolean): Is WebDAV enabled?
 * `ftp_enabled` (boolean): Is FTP enabled?
+* `s3_compatible_endpoint_enabled` (boolean): Is the S3-compatible endpoint enabled for all users and workspaces on this site? Defaults to true. When false, user and group S3 permissions do not allow access.
 * `sftp_enabled` (boolean): Is SFTP enabled?
 * `sftp_finalize_partial_uploads` (boolean): Finalize partial SFTP uploads from interrupted connections? Default: true.
 * `users_can_create_api_keys` (boolean): Allow users to create their own API keys?

data/lib/files.com/errors.rb

@@ -126,6 +126,7 @@ module Files
   class BillingPermissionRequiredError < NotAuthorizedError; end
   class BundleMaximumUsesReachedError < NotAuthorizedError; end
   class BundlePermissionRequiredError < NotAuthorizedError; end
+  class CannotAdministerHigherLevelUserError < NotAuthorizedError; end
   class CannotLoginWhileUsingKeyError < NotAuthorizedError; end
   class CantActForOtherUserError < NotAuthorizedError; end
   class ContactAdminForPasswordChangeHelpError < NotAuthorizedError; end
@@ -231,6 +232,7 @@ module Files
   class MultipleProcessingErrorsError < ProcessingFailureError; end
   class PathTooLongError < ProcessingFailureError; end
   class RecipientAlreadySharedError < ProcessingFailureError; end
+  class RemoteEntryReadOnlyError < ProcessingFailureError; end
   class RemoteServerErrorError < ProcessingFailureError; end
   class ResourceBelongsToParentSiteError < ProcessingFailureError; end
   class ResourceLockedError < ProcessingFailureError; end

data/lib/files.com/models/remote_server.rb

@@ -207,7 +207,7 @@ module Files
       @attributes[:server_certificate] = value
     end
 
-    # string - Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+    # string - Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
     def server_host_key
       @attributes[:server_host_key]
     end
@@ -1023,7 +1023,7 @@ module Files
     #   s3_compatible_virtual_hosted_style - boolean - S3-compatible: If true, use virtual-hosted-style URLs instead of path-style URLs
     #   s3_region - string - S3 region
     #   server_certificate - string - Remote server certificate
-    #   server_host_key - string - Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+    #   server_host_key - string - Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
     #   server_type - string - Remote server type.
     #   sharepoint_client_id - string - SharePoint: Microsoft Entra application client ID for app-only authentication.
     #   sharepoint_site_url - string - SharePoint: Site URL to scope app-only authentication to a single site. Leave blank to browse all sites.
@@ -1283,7 +1283,7 @@ module Files
     #   s3_compatible_virtual_hosted_style - boolean - S3-compatible: If true, use virtual-hosted-style URLs instead of path-style URLs
     #   s3_region - string - S3 region
     #   server_certificate - string - Remote server certificate
-    #   server_host_key - string - Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+    #   server_host_key - string - Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
     #   server_type - string - Remote server type.
     #   sharepoint_client_id - string - SharePoint: Microsoft Entra application client ID for app-only authentication.
     #   sharepoint_site_url - string - SharePoint: Site URL to scope app-only authentication to a single site. Leave blank to browse all sites.
@@ -1463,7 +1463,7 @@ module Files
     #   s3_compatible_virtual_hosted_style - boolean - S3-compatible: If true, use virtual-hosted-style URLs instead of path-style URLs
     #   s3_region - string - S3 region
     #   server_certificate - string - Remote server certificate
-    #   server_host_key - string - Remote server SSH Host Key. If provided, we will require that the server host key matches the provided key. Uses OpenSSH format similar to what would go into ~/.ssh/known_hosts
+    #   server_host_key - string - Pinned plain SSH host key for SFTP, in OpenSSH public key format. If omitted, Files.com detects and stores the server's plain host key, including when the server offers an OpenSSH host certificate. With `server_certificate=require_match` (the default), the server must present the pinned key and prove it holds the matching private key. The pin remains in force until an administrator updates `server_host_key`. Files.com does not authenticate remote hosts through SSH certificates and does not check their CA signatures, principals, or validity periods. Certificate expiration does not end the pin; update `server_host_key` to retire a host key.
     #   server_type - string - Remote server type.
     #   sharepoint_client_id - string - SharePoint: Microsoft Entra application client ID for app-only authentication.
     #   sharepoint_site_url - string - SharePoint: Site URL to scope app-only authentication to a single site. Leave blank to browse all sites.

data/lib/files.com/models/site.rb

@@ -26,7 +26,7 @@ module Files
       @attributes[:additional_text_file_types]
     end
 
-    # object - Availability settings for AI features by user class
+    # object - Availability settings for AI features. Each feature requires the site_admins, workspace_admins, folder_admins, and all_users keys. Optional selected_group_members defaults to false; when true, members of at least one group in group_ids get access regardless of the other options. All availability options are additive: any enabled option matching the user grants access. Optional group_ids is an array of integer IDs of active groups on this site, from any workspace. Omitted or empty group_ids grants no access through selected_group_members and does not affect other options. Disabling all AI features overrides these settings.
     def ai_feature_availability
       @attributes[:ai_feature_availability]
     end
@@ -764,6 +764,11 @@ module Files
       @attributes[:session]
     end
 
+    # boolean - Is the S3-compatible endpoint enabled for all users and workspaces on this site? Defaults to true. When false, user and group S3 permissions do not allow access.
+    def s3_compatible_endpoint_enabled
+      @attributes[:s3_compatible_endpoint_enabled]
+    end
+
     # boolean - Is SFTP enabled?
     def sftp_enabled
       @attributes[:sftp_enabled]
@@ -1040,7 +1045,7 @@ module Files
     #   motd_use_for_sftp - boolean - Show message to users connecting via SFTP
     #   left_navigation_visibility - object - Visibility settings for account navigation
     #   disable_all_ai_features - boolean - If true, all AI features are disabled for this site.
-    #   ai_feature_availability - object - Availability settings for AI features by user class
+    #   ai_feature_availability - object - Availability settings for AI features. Each feature requires the site_admins, workspace_admins, folder_admins, and all_users keys. Optional selected_group_members defaults to false; when true, members of at least one group in group_ids get access regardless of the other options. All availability options are additive: any enabled option matching the user grants access. Optional group_ids is an array of integer IDs of active groups on this site, from any workspace. Omitted or empty group_ids grants no access through selected_group_members and does not affect other options. Disabling all AI features overrides these settings.
     #   mcp_dcr_enabled - boolean - Is OAuth DCR (dynamic client registration) for MCP enabled?
     #   additional_text_file_types - array(string) - Additional extensions that are considered text files
     #   bundle_require_note - boolean - Do Bundles require internal notes?
@@ -1109,6 +1114,7 @@ module Files
     #   user_requests_notify_admins - boolean - Send email to site admins when a user request is received?
     #   dav_enabled - boolean - Is WebDAV enabled?
     #   ftp_enabled - boolean - Is FTP enabled?
+    #   s3_compatible_endpoint_enabled - boolean - Is the S3-compatible endpoint enabled for all users and workspaces on this site? Defaults to true. When false, user and group S3 permissions do not allow access.
     #   sftp_enabled - boolean - Is SFTP enabled?
     #   sftp_finalize_partial_uploads - boolean - Finalize partial SFTP uploads from interrupted connections? Default: true.
     #   users_can_create_api_keys - boolean - Allow users to create their own API keys?

data/lib/files.com/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Files
-  VERSION = "1.1.755"
+  VERSION = "1.1.757"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: files.com
 version: !ruby/object:Gem::Version
-  version: 1.1.755
+  version: 1.1.757
 platform: ruby
 authors:
 - files.com