files.com 1.1.804 → 1.1.805

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: '03977dbe44f5a5b6d323404d96e561cabb387d7149f48407fe25c42a0bde36c6'
-  data.tar.gz: 89bbfc5340eaab7364cbf41d0a9f9f3058e69e40143b24cc7313635424fa7218
+  metadata.gz: ec7bf62c47e0eaca608b506497fd71e4466fcf5759e180b5c3f63b08ad9b4d07
+  data.tar.gz: c0f50f7d3a72d3ae50a57cdccf114da044711f16ab1c2abffe6217516c56030e
 SHA512:
-  metadata.gz: c3db26ca133482457a91c59f867d0a9c47832ce8251d7a8404d330ba6a6f0fb7a3ee2b6b14b59b78f9dcf6b21dcb007bf65ff6b83604bc3756be91b417a05033
-  data.tar.gz: add67cad0aa41b76c4c5c74153b4639c9d51389f2361f9b652d2069d18f038b0e2a2e7e623a179e84f82477c360e69ca1a4fe8833885c5adc3ad003caeb0ba9d
+  metadata.gz: 4ccda75a1ac5b95145654244f5619ab001a187c63a5a07f1ce54a3becb1226b1963499ccf295d7508996fd17cef4d1131cf7acd220f974154957604f4279a3de
+  data.tar.gz: 6d7681f622b12d307abcc66bca066b2038e3f95c93cbe4823af517b9d6f1f908d245d8df1ce4e70101416e9516db27a526864917ab35ad0b1ae8d2ac6ebae943

data/_VERSION

@@ -1 +1 @@
-1.1.804
+1.1.805

data/lib/files.com/api_client.rb

@@ -341,8 +341,8 @@ module Files
     end
 
     # The origin a lockout region mismatch moves this request to, or nil to raise the error as it is. The API answers
-    # with that error, naming the site's own origin in data.host, when the site is pinned to another region or to a
-    # custom domain. Only the configured HTTPS origin, reached over this client's verified connection, may send the
+    # with that error, naming the site's own origin in data.host or X-Files-Host, when the site is pinned to another
+    # region or to a custom domain. Only the configured HTTPS origin, reached over this client's verified connection, may send the
     # credentials elsewhere, apart from an http:// origin to the destination +http_pairs+ pairs it with.
     private def region_continuation_base_url(error_response, base_url, body, http_pairs)
       return if Files.region_policy == :disabled
@@ -351,7 +351,11 @@ module Files
       return unless error_response.http_status == 403 && error_object[:type] == "not-authenticated/lockout-region-mismatch"
       return unless replayable?(body)
 
-      host = error_object[:data].is_a?(Hash) ? error_object[:data][:host] : nil
+      data = error_object[:data]
+      return unless data.nil? || data.is_a?(Hash)
+
+      host = data && data[:host]
+      host = Faraday::Utils::Headers.new(error_response.http_headers || {})["X-Files-Host"] if host.nil? || host == ""
       return http_pair_origin(base_url, host, http_pairs) unless verified_https_connection?(base_url)
 
       configured = Addressable::URI.parse(base_url)
@@ -507,10 +511,11 @@ module Files
 
         case e
         when Faraday::ClientError, Faraday::ServerError
-          error_response = api_error_response(e.response)
-          if relocate && error_response && (regional_base_url = relocate.call(error_response))
+          error_response = api_error_response(e.response, allow_legacy_region_mismatch: !is_transfer)
+          if relocate && num_retries < Files.max_network_retries && error_response && (regional_base_url = relocate.call(error_response))
             relocate = nil
             base_url = regional_base_url
+            num_retries += 1
             retry
           end
 
@@ -547,16 +552,29 @@ module Files
     end
 
     # A failed response carrying a Files.com error object: a JSON object with an
-    # error message or type. Any other body, JSON or not, is not an answer the
-    # SDK can use.
-    private def api_error_response(http_resp)
+    # error message or type, or an ordinary API request's recognized legacy
+    # plain-text region mismatch. Other bodies give the SDK no usable answer.
+    private def api_error_response(http_resp, allow_legacy_region_mismatch: false)
       return unless http_resp
 
       resp = Response.from_faraday_hash(http_resp)
       error_object = resp.data
       resp if error_object.is_a?(Hash) && (error_object[:error] || error_object[:errors] || error_object[:type])
     rescue JSON::ParserError
-      nil
+      return unless allow_legacy_region_mismatch && http_resp[:status] == 403
+
+      body = http_resp[:body]
+      host = Faraday::Utils::Headers.new(http_resp[:headers] || {})["X-Files-Host"]
+      return unless body.is_a?(String) && body.start_with?("You have connected to a URL") && host.is_a?(String) && !host.empty?
+
+      # The legacy API answer predates JSON errors. Give callers the same typed error and routing data while keeping
+      # the original text and headers on the response; a storage response never acquires API routing authority.
+      resp = Response.new
+      resp.http_status = http_resp[:status]
+      resp.http_headers = http_resp[:headers]
+      resp.http_body = body
+      resp.data = { type: "not-authenticated/lockout-region-mismatch", error: body, data: { host: host } }
+      resp
     end
 
     private def handle_error_response(resp, context, is_transfer: false)

data/lib/files.com.rb

@@ -285,7 +285,10 @@ module Files
   end
 
   # What a request does when the API answers that the site must be reached through another origin, such as its
-  # region or its custom domain (Files::LockoutRegionMismatchError, with that origin in data[:host]).
+  # region or its custom domain: the typed HTTP 403 Files::LockoutRegionMismatchError, with that origin in data[:host]
+  # or X-Files-Host when the data host is absent or empty, or the legacy plain-text HTTP 403 beginning "You have connected to a URL"
+  # with X-Files-Host. A recognized legacy answer raises the same typed error when the request cannot continue, keeping
+  # its original text and headers in http_body and http_headers. An unrelated 403 never moves the request.
   #
   # :automatic (the default) sends the same request once more to that origin, within the same retry count, and keeps
   # using it for the records and pages the request returns. Other requests still start at Files.base_url. It does so
@@ -305,8 +308,8 @@ module Files
   # Each pair is [source, destination], such as [["http://localhost:3000", "http://site.localhost:3000"]].
   #
   # With region_policy :automatic, a request to the source (Files.base_url, or the request's own base_url) that gets
-  # the error with data[:host] naming the destination, as that full http:// origin or as its bare host (with its port
-  # when it is not 80), is sent once more to the destination, within the same retry count, and the records and pages
+  # the mismatch naming the destination in data[:host] or X-Files-Host, as that full http:// origin or as its bare host
+  # (with its port when it is not 80), is sent once more to the destination, within the same retry count, and the records and pages
   # it returns keep using it. region_handler, when set, is still asked first and can decline. Nothing else continues
   # over plain HTTP, a request to an https:// origin never does, and :disabled still raises the error.
   #

data/spec/lib/region_routing_spec.rb

@@ -0,0 +1,254 @@
+require "spec_helper"
+require_relative "../support/stubbed_api"
+
+RSpec.describe "API region routing" do
+  include StubbedApi
+
+  let(:source) { "http://issuer.example.com" }
+  let(:target) { "http://target.example.com" }
+  let(:path) { "/api/rest/v1/bundles/842" }
+  let(:mismatch_type) { "not-authenticated/lockout-region-mismatch" }
+  let(:legacy_body) { "You have connected to a URL that does not match this site's region." }
+
+  around do |example|
+    original = [ Files.base_url, Files.region_policy, Files.region_handler, Files.region_http_pairs,
+                 Files.max_network_retries, Files.initial_network_retry_delay ]
+    Files.base_url = source
+    Files.region_policy = :automatic
+    Files.region_handler = nil
+    Files.region_http_pairs = [ [ source, target ] ]
+    Files.max_network_retries = 3
+    Files.initial_network_retry_delay = 0
+    example.run
+  ensure
+    Files.base_url, Files.region_policy, Files.region_handler, Files.region_http_pairs,
+      Files.max_network_retries, Files.initial_network_retry_delay = original
+  end
+
+  shared_examples "a header-named mismatch" do
+    it "replays the API request unchanged at the named origin and retains only its operation's routing context" do
+      requests = []
+      client = stubbed_api_client do |stub|
+        [ source, target ].each do |origin|
+          stub.post("#{origin}#{path}") do |env|
+            requests << [ env.url.to_s, env.method, env.body, env.request_headers.to_h ]
+            origin == source ? mismatch : json_response(200, { id: 842, code: "regional" })
+          end
+        end
+      end
+      params = { code: "regional", permissions: "read" }
+      options = { client: client, session_id: "request-session", workspace_id: 0, "X-Request-Context" => "caller" }
+
+      response, returned_options = Files::Api.send_request("/bundles/842", :post, params, options)
+
+      expect(response.data).to include(id: 842, code: "regional")
+      expect(requests.map(&:first)).to eq([ "#{source}#{path}", "#{target}#{path}" ])
+      expect(requests.last.drop(1)).to eq(requests.first.drop(1))
+      expect(requests.last[2]).to eq("code=regional&permissions=read")
+      expect(requests.last[3]).to include("X-FilesAPI-Auth" => "request-session", "X-Files-Workspace-Id" => "0", "X-Request-Context" => "caller")
+      expect(requests.last[3]).not_to have_key("X-FilesAPI-Key")
+      expect(returned_options).to include(base_url: target, session_id: "request-session", workspace_id: 0, region_http_pairs: [ [ source, target ] ])
+      expect(options).not_to have_key(:base_url)
+      expect(params).to eq(code: "regional", permissions: "read")
+      expect(Files.base_url).to eq(source)
+    end
+  end
+
+  context "for a legacy plain-text 403 without Content-Type" do
+    let(:mismatch) { [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ] }
+    include_examples "a header-named mismatch"
+  end
+
+  context "for a legacy plain-text 403 with Content-Type" do
+    let(:mismatch) { [ 403, { "Content-Type" => "text/plain", "x-files-host" => target }, legacy_body ] }
+    include_examples "a header-named mismatch"
+  end
+
+  context "for a typed 403 with no data" do
+    let(:mismatch) { json_response(403, { type: mismatch_type, error: "Region mismatch" }, "X-Files-Host" => "target.example.com") }
+    include_examples "a header-named mismatch"
+  end
+
+  context "for a typed 403 whose data names no host" do
+    let(:mismatch) { json_response(403, { type: mismatch_type, error: "Region mismatch", data: { host: nil } }, "x-files-host" => target) }
+    include_examples "a header-named mismatch"
+  end
+
+  context "for a typed 403 whose data host is empty" do
+    let(:mismatch) { json_response(403, { type: mismatch_type, error: "Region mismatch", data: { host: "" } }, "X-Files-Host" => "target.example.com") }
+    include_examples "a header-named mismatch"
+  end
+
+  it "uses the typed data host before a different host header and keeps the origin on returned models" do
+    requests = []
+    client = stubbed_api_client do |stub|
+      stub.get("#{source}#{path}") do |env|
+        requests << env.url.to_s
+        json_response(403, { type: mismatch_type, data: { host: "target.example.com" } }, "X-Files-Host" => "unapproved.example.com")
+      end
+      stub.get("#{target}#{path}") do |env|
+        requests << env.url.to_s
+        expect(env.request_headers["X-FilesAPI-Key"]).to eq("request-key")
+        json_response(200, { id: 842 })
+      end
+    end
+
+    bundle = Files::Bundle.find(842, {}, api_key: "request-key", client: client)
+
+    expect(bundle.options).to include(base_url: target, api_key: "request-key", client: client)
+    expect(requests).to eq([ "#{source}#{path}?id=842", "#{target}#{path}?id=842" ])
+  end
+
+  {
+    "a path" => "target.example.com/private",
+    "credentials" => "user@target.example.com",
+    "a query" => "target.example.com?token=private",
+    "a fragment" => "target.example.com#private",
+    "whitespace" => " target.example.com",
+    "an unapproved origin" => "unapproved.example.com",
+    "the original origin" => "issuer.example.com"
+  }.each do |description, host|
+    it "refuses a legacy target naming #{description}" do
+      client = stubbed_api_client do |stub|
+        stub.get("#{source}#{path}") { [ 403, { "X-Files-Host" => host }, legacy_body ] }
+      end
+
+      expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::LockoutRegionMismatchError) { |error|
+        expect(error.http_status).to eq(403)
+        expect(error.http_body).to eq(legacy_body)
+        expect(error.http_headers["x-files-host"]).to eq(host)
+        expect(error.data).to eq(host: host)
+      }
+    end
+  end
+
+  [ "target.example.com/private", 42 ].each do |host|
+    it "does not mask an invalid typed data host #{host.inspect} with a valid host header" do
+      client = stubbed_api_client do |stub|
+        stub.get("#{source}#{path}") { json_response(403, { type: mismatch_type, data: { host: host } }, "X-Files-Host" => "target.example.com") }
+      end
+
+      expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::LockoutRegionMismatchError)
+    end
+  end
+
+  it "does not treat non-object typed data as a host-header fallback" do
+    client = stubbed_api_client do |stub|
+      stub.get("#{source}#{path}") { json_response(403, { type: mismatch_type, data: [] }, "X-Files-Host" => "target.example.com") }
+    end
+
+    expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::LockoutRegionMismatchError)
+  end
+
+  it "requires the configured source's authority even when a region handler approves" do
+    Files.region_http_pairs = []
+    Files.region_handler = ->(_event) { raise "an untrusted answer must not ask for approval" }
+    client = stubbed_api_client do |stub|
+      stub.get("#{source}#{path}") { [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ] }
+      stub.get("https://issuer.example.com#{path}") { [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ] }
+    end
+
+    [ source, "https://issuer.example.com" ].each do |origin|
+      expect { Files::Bundle.find(842, {}, api_key: "key", base_url: origin, client: client) }.to raise_error(Files::LockoutRegionMismatchError)
+    end
+  end
+
+  [ :disabled, :declined ].each do |policy|
+    it "keeps a legacy mismatch available to callers when routing is #{policy}" do
+      Files.region_policy = :disabled if policy == :disabled
+      Files.region_handler = ->(_event) { false } if policy == :declined
+      client = stubbed_api_client do |stub|
+        stub.get("#{source}#{path}") { [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ] }
+      end
+
+      expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::LockoutRegionMismatchError) { |error|
+        expect(error.http_body).to eq(legacy_body)
+        expect(error.response.http_body).to eq(legacy_body)
+      }
+    end
+  end
+
+  it "does not route unrelated 403 errors or a legacy-looking answer with another status or no host" do
+    answers = [
+      json_response(403, { type: "not-authenticated", error: "Forbidden" }, "X-Files-Host" => "target.example.com"),
+      [ 403, { "X-Files-Host" => "target.example.com" }, "Forbidden" ],
+      [ 403, {}, legacy_body ],
+      [ 400, { "X-Files-Host" => "target.example.com" }, legacy_body ]
+    ]
+    answers.each do |answer|
+      client = stubbed_api_client do |stub|
+        stub.get("#{source}#{path}") { answer }
+      end
+
+      expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::Error) { |error|
+        expect(error).not_to be_a(Files::LockoutRegionMismatchError)
+      }
+    end
+  end
+
+  it "shares the retry budget with ordinary failures before and after a region continuation" do
+    [ 0, 1, 2 ].each do |retries|
+      Files.max_network_retries = retries
+      requests = []
+      client = stubbed_api_client do |stub|
+        stub.get("#{source}#{path}") do |env|
+          requests << env.url.host
+          requests.size == 1 ? json_response(429, { error: "Busy" }) : [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ]
+        end
+        stub.get("#{target}#{path}") do |env|
+          requests << env.url.host
+          json_response(429, { error: "Busy" })
+        end
+      end
+
+      expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::APIError)
+      expect(requests).to eq([ "issuer.example.com", "issuer.example.com", "target.example.com" ].first(retries + 1))
+    end
+  end
+
+  it "does not continue a mismatch when retries are disabled" do
+    Files.max_network_retries = 0
+    client = stubbed_api_client do |stub|
+      stub.get("#{source}#{path}") { [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ] }
+    end
+
+    expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::LockoutRegionMismatchError)
+  end
+
+  it "does not continue a second mismatch even when ordinary retries remain" do
+    requests = []
+    Files.region_http_pairs = [ [ source, target ], [ target, source ] ]
+    client = stubbed_api_client do |stub|
+      [ source, target ].each do |origin|
+        stub.get("#{origin}#{path}") do |env|
+          requests << env.url.host
+          [ 403, { "X-Files-Host" => origin == source ? target : source }, legacy_body ]
+        end
+      end
+    end
+
+    expect { Files::Bundle.find(842, {}, api_key: "key", client: client) }.to raise_error(Files::LockoutRegionMismatchError)
+    expect(requests).to eq([ "issuer.example.com", "target.example.com" ])
+  end
+
+  it "does not replay a stream body or reroute a signed storage URL" do
+    signed_url = "#{source}/part?X-Amz-Signature=unchanged%2Fvalue"
+    requests = []
+    client = stubbed_api_client do |stub|
+      stub.put("#{source}#{path}") do |env|
+        requests << env.url.to_s
+        [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ]
+      end
+      stub.put(signed_url) do |env|
+        requests << env.url.to_s
+        expect(env.request_headers).not_to have_key("X-FilesAPI-Key")
+        expect(env.request_headers).not_to have_key("X-FilesAPI-Auth")
+        [ 403, { "X-Files-Host" => "target.example.com" }, legacy_body ]
+      end
+    end
+
+    expect { client.execute_request(:put, "/bundles/842", api_key: "key", params: { content: StringIO.new("bytes") }) }.to raise_error(Files::LockoutRegionMismatchError)
+    expect { client.remote_request(:put, signed_url, {}, "part") }.to raise_error(Files::APIConnectionError)
+    expect(requests).to eq([ "#{source}#{path}", signed_url ])
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: files.com
 version: !ruby/object:Gem::Version
-  version: 1.1.804
+  version: 1.1.805
 platform: ruby
 authors:
 - files.com
@@ -486,6 +486,7 @@ files:
 - spec/decimal_contract_spec.rb
 - spec/language_spec.rb
 - spec/lib/api_client_spec.rb
+- spec/lib/region_routing_spec.rb
 - spec/list_spec.rb
 - spec/models/file_download_default_path_spec.rb
 - spec/models/file_spec.rb