fingerly 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5dbd638d3731d3062c062b00a80a0ef4904b486ecf96c91426b0f0ba9ff613cd
-  data.tar.gz: 1a4759ace195de23f5c08cbadd10a5df576ce0093897f32cfb291fa0441335b0
+  metadata.gz: 2259bc6d79895434264b410f747d6061e08a2593ddcdbe38c87dc7e4ace8f813
+  data.tar.gz: e66d6a3ecf9ef426b41bcdf14caee81d16987531a46f00daae9f4079398ac795
 SHA512:
-  metadata.gz: 0da74c52537b8f8091458938f8057536521b295de0df1b13b9af832f4d8cc138365acd2356f425ff9148f9b3977c54ec8c7d9b49de5f336c991901f22aee13fb
-  data.tar.gz: 310aa51b0aa74788d7a694075e8802182c275663d8b38260cda66faec16b383e165b38da542dc414be5d1fff5f5e692ef7c8bbf6cd178412660d2ea7e65232ee
+  metadata.gz: 693a750304fe02ff1347a1095162cfec457d02f70d80ade14a4e89cfa2d8fc6542e15e9f892b26b8fd9b0c80bbe62e9c07abb7361037e8681ea30289311f43b3
+  data.tar.gz: b87b732144d0e575e9fc77628115159f851cdbb900226514f2654488bb1d761299d62426fecc4142d8230207435a7d386442301d259e53d57b2c3e006eade5d2

data/README.md

@@ -147,6 +147,10 @@ end
 `event.raw` keeps the response body exactly as it arrived, so a field the API
 adds later is reachable without a gem upgrade.
 
+`event.project_id` is the UUID string of the Fingerly project the event
+belongs to, on both `events.get` and `events.list` rows; it is `nil` when an
+older server does not send it.
+
 ## Read an event you just identified
 
 An event is usually readable as soon as identification answers. If it is
@@ -181,7 +185,9 @@ Apply your own policy to the server's verdict. A pending event (`pending?`)
 is not a verdict: retry after `retry_after` seconds or verify asynchronously,
 rather than refusing the action. Do not authorize an action using scores or
 visitor identifiers supplied by the browser. Tags correlate events; they do
-not replace your application's authentication or replay protection.
+not replace your application's authentication or replay protection. A tag must
+never hold a personal identifier, such as a user ID, email, install ID or
+advertising ID, because the server keeps tags in long-lived rollups.
 
 ## Webhooks
 
@@ -221,7 +227,9 @@ Malformed or missing input is a false result, never an exception, and a body
 that is not valid UTF-8 verifies rather than raising on concatenation.
 
 `WebhookEvent#data` stays a plain `Hash`, so a new event type needs no gem
-upgrade.
+upgrade. `identification.completed` and `visitor.suspect` deliveries carry the
+event's project as `data["project_id"]`; `identification.refused` carries it
+only when the refused request named a known key.
 
 ## Same-origin proxy
 
@@ -317,7 +325,7 @@ the server's or the load balancer's own limit as well. Falcon streams the body,
 so there the proxy stops reading at the limit. Only the content type, the
 visitor metadata Fingerly needs, and an `Idempotency-Key` are forwarded;
 customer cookies and authorization headers never are. The proxy reports itself
-upstream as `ruby/0.1.0` in `x-fingerly-proxy-version`, which the dashboard
+upstream as `ruby/0.2.0` in `x-fingerly-proxy-version`, which the dashboard
 shows per proxy.
 
 When Fingerly cannot be reached, the visitor gets a gateway error rather than

data/lib/fingerly/client.rb

@@ -187,7 +187,12 @@ module Fingerly
     #   past retention.
     # @raise [TimeoutError] if the request exceeds the client timeout
     def get(request_id)
-      raise ConfigurationError, "request_id is required" if request_id.to_s.empty?
+      # URL parsers resolve a dot segment even when it is percent-encoded, so
+      # escaping cannot keep these in the path: "." and the empty id would name
+      # the list route, and ".." a route above it, secret key attached.
+      if ["", ".", ".."].include?(request_id.to_s)
+        raise ConfigurationError, "request_id is not a Fingerly request id"
+      end
 
       Event.new(@client.get("/events/#{Events.escape(request_id)}"))
     end

data/lib/fingerly/models.rb

@@ -33,12 +33,14 @@ module Fingerly
   # the distinction at the call site.
   class Event
     # Fields copied straight from the response, in the order the API documents
-    # them. Anything not listed stays reachable through {#raw}.
+    # them. Anything not listed stays reachable through {#raw}. +project_id+
+    # is the UUID string of the Fingerly project the event belongs to, and nil
+    # when an older server does not send it.
     STRING_FIELDS = %w[
-      request_id visitor_id state environment platform sdk_platform sdk_version
-      origin url_host url_path tag ip_address country_code country_name asn
-      asn_name anonymity_network agent agent_version os device_kind visitor_kind
-      suspect_level
+      request_id project_id visitor_id state environment platform sdk_platform
+      sdk_version origin url_host url_path tag ip_network country_code
+      country_name asn asn_name anonymity_network agent agent_version os
+      device_kind visitor_kind suspect_level
     ].freeze
 
     STRING_FIELDS.each { |name| attr_reader name.to_sym }
@@ -50,12 +52,12 @@ module Fingerly
     # @return [Array<EventTrigger>] the signal groups behind the score; never
     #   nil, and empty when nothing fired
     attr_reader :triggers
-    # @return [Hash, nil] the archived submission, when one was kept. Its
-    #   contents are deliberately opaque, not a public contract.
+    # @return [Hash, nil] an allow-listed view of the archived request, when
+    #   one was kept: schema, request id, time, SDK, network, IP
+    #   classification and city-level location, risk, attestation and
+    #   velocity. It holds no raw signals, user agent or address, and its
+    #   contents are not a public contract.
     attr_reader :document
-    # @return [Hash, nil] the deferred report attached to this request, when
-    #   one arrived. Also opaque.
-    attr_reader :deferred_signals
     # @return [Hash] the response body exactly as it arrived, so a field the
     #   API adds after this SDK was released needs no upgrade
     attr_reader :raw
@@ -68,7 +70,6 @@ module Fingerly
       @has_document = payload["has_document"] ? true : false
       @triggers = Array(payload["triggers"]).map { |item| EventTrigger.new(item) }.freeze
       @document = payload["document"]
-      @deferred_signals = payload["deferred_signals"]
       @raw = payload
       freeze
     end

data/lib/fingerly/version.rb

@@ -2,5 +2,5 @@
 
 module Fingerly
   # The SDK version, reported to the API on every request.
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

data/sig/fingerly.rbs

@@ -50,6 +50,7 @@ module Fingerly
     STRING_FIELDS: Array[String]
 
     attr_reader request_id: String?
+    attr_reader project_id: String?
     attr_reader visitor_id: String?
     attr_reader state: String?
     attr_reader environment: String?
@@ -60,7 +61,7 @@ module Fingerly
     attr_reader url_host: String?
     attr_reader url_path: String?
     attr_reader tag: String?
-    attr_reader ip_address: String?
+    attr_reader ip_network: String?
     attr_reader country_code: String?
     attr_reader country_name: String?
     attr_reader asn: String?
@@ -77,7 +78,6 @@ module Fingerly
     attr_reader suspect_score: Integer?
     attr_reader triggers: Array[EventTrigger]
     attr_reader document: Hash[String, untyped]?
-    attr_reader deferred_signals: Hash[String, untyped]?
     attr_reader raw: Hash[String, untyped]
 
     def initialize: (Hash[String, untyped]) -> void

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fingerly
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Fingerly