foil-server 0.3.4 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. checksums.yaml +4 -4
  2. data/README.md +24 -29
  3. data/lib/foil/server/client.rb +6 -155
  4. data/lib/foil/server/sealed_token.rb +83 -16
  5. data/lib/foil/server/version.rb +1 -1
  6. data/lib/foil/server/webhooks.rb +71 -0
  7. data/lib/foil/server.rb +8 -6
  8. data/spec/README.md +14 -28
  9. data/spec/fixtures/api/organizations/api-key-create.json +1 -0
  10. data/spec/fixtures/api/organizations/api-key-list.json +1 -0
  11. data/spec/fixtures/api/organizations/api-key-revoke.json +1 -0
  12. data/spec/fixtures/api/organizations/api-key-rotate.json +1 -0
  13. data/spec/fixtures/api/organizations/api-key-update.json +1 -0
  14. data/spec/fixtures/api/sessions/detail.json +8 -1
  15. data/spec/fixtures/manifest.json +0 -85
  16. data/spec/fixtures/sealed-token/vector.v2.json +59 -0
  17. data/spec/fixtures/webhooks/signature.json +9 -0
  18. data/spec/openapi.json +1683 -6333
  19. data/spec/sealed-token.md +47 -18
  20. metadata +5 -22
  21. data/lib/foil/server/gate_delivery.rb +0 -332
  22. data/spec/fixtures/api/gate/agent-token-revoke.json +0 -3
  23. data/spec/fixtures/api/gate/agent-token-verify.json +0 -12
  24. data/spec/fixtures/api/gate/login-session-consume.json +0 -10
  25. data/spec/fixtures/api/gate/login-session-create.json +0 -12
  26. data/spec/fixtures/api/gate/registry-detail.json +0 -45
  27. data/spec/fixtures/api/gate/registry-list.json +0 -47
  28. data/spec/fixtures/api/gate/service-create.json +0 -49
  29. data/spec/fixtures/api/gate/service-detail.json +0 -49
  30. data/spec/fixtures/api/gate/service-disable.json +0 -49
  31. data/spec/fixtures/api/gate/service-update.json +0 -49
  32. data/spec/fixtures/api/gate/services-list.json +0 -51
  33. data/spec/fixtures/api/gate/session-ack.json +0 -10
  34. data/spec/fixtures/api/gate/session-create.json +0 -13
  35. data/spec/fixtures/api/gate/session-poll.json +0 -36
  36. data/spec/fixtures/gate-delivery/approved-webhook-payload.valid.json +0 -19
  37. data/spec/fixtures/gate-delivery/delivery-request.json +0 -9
  38. data/spec/fixtures/gate-delivery/env-policy.json +0 -40
  39. data/spec/fixtures/gate-delivery/vector.v1.json +0 -28
  40. data/spec/fixtures/gate-delivery/webhook-signature.json +0 -9
data/spec/fixtures/api/gate/service-detail.json DELETED
@@ -1,49 +0,0 @@
1
- {
2
- "data": {
3
- "object": "gate_service",
4
- "id": "acme_prod",
5
- "status": "active",
6
- "discoverable": false,
7
- "name": "Acme Production",
8
- "description": "Acme production signup flow",
9
- "website": "https://acme.example.com",
10
- "dashboard_login_url": "https://dashboard.acme.example.com/auth/gate",
11
- "env_vars": [
12
- {
13
- "name": "Publishable key",
14
- "key": "ACME_PUBLISHABLE_KEY",
15
- "secret": false
16
- },
17
- {
18
- "name": "Secret key",
19
- "key": "ACME_SECRET_KEY",
20
- "secret": true
21
- }
22
- ],
23
- "docs_url": "https://docs.acme.example.com/signup",
24
- "sdks": [
25
- {
26
- "label": "Node",
27
- "install": "npm install @acme/sdk",
28
- "url": "https://www.npmjs.com/package/@acme/sdk"
29
- }
30
- ],
31
- "branding": {
32
- "logo_url": "https://acme.example.com/logo.png",
33
- "primary_color": "#117BE7",
34
- "secondary_color": "#0B5CAD",
35
- "ascii_art": "ACME",
36
- "verified": false
37
- },
38
- "consent": {
39
- "terms_url": "https://acme.example.com/terms",
40
- "privacy_url": "https://acme.example.com/privacy"
41
- },
42
- "created_at": "2026-04-03T20:00:00.000Z",
43
- "updated_at": "2026-04-03T20:05:00.000Z",
44
- "webhook_endpoint_id": "we_0123456789abcdef0123456789abcdef"
45
- },
46
- "meta": {
47
- "request_id": "req_0123456789abcdef0123456789abcdef"
48
- }
49
- }
data/spec/fixtures/api/gate/service-disable.json DELETED
@@ -1,49 +0,0 @@
1
- {
2
- "data": {
3
- "object": "gate_service",
4
- "id": "acme_prod",
5
- "status": "disabled",
6
- "discoverable": false,
7
- "name": "Acme Production",
8
- "description": "Acme production signup flow",
9
- "website": "https://acme.example.com",
10
- "dashboard_login_url": "https://dashboard.acme.example.com/auth/gate",
11
- "env_vars": [
12
- {
13
- "name": "Publishable key",
14
- "key": "ACME_PUBLISHABLE_KEY",
15
- "secret": false
16
- },
17
- {
18
- "name": "Secret key",
19
- "key": "ACME_SECRET_KEY",
20
- "secret": true
21
- }
22
- ],
23
- "docs_url": "https://docs.acme.example.com/signup",
24
- "sdks": [
25
- {
26
- "label": "Node",
27
- "install": "npm install @acme/sdk",
28
- "url": "https://www.npmjs.com/package/@acme/sdk"
29
- }
30
- ],
31
- "branding": {
32
- "logo_url": "https://acme.example.com/logo.png",
33
- "primary_color": "#117BE7",
34
- "secondary_color": "#0B5CAD",
35
- "ascii_art": "ACME",
36
- "verified": false
37
- },
38
- "consent": {
39
- "terms_url": "https://acme.example.com/terms",
40
- "privacy_url": "https://acme.example.com/privacy"
41
- },
42
- "created_at": "2026-04-03T20:00:00.000Z",
43
- "updated_at": "2026-04-03T20:15:00.000Z",
44
- "webhook_endpoint_id": "we_0123456789abcdef0123456789abcdef"
45
- },
46
- "meta": {
47
- "request_id": "req_0123456789abcdef0123456789abcdef"
48
- }
49
- }
data/spec/fixtures/api/gate/service-update.json DELETED
@@ -1,49 +0,0 @@
1
- {
2
- "data": {
3
- "object": "gate_service",
4
- "id": "acme_prod",
5
- "status": "active",
6
- "discoverable": true,
7
- "name": "Acme Production",
8
- "description": "Acme production signup flow",
9
- "website": "https://acme.example.com",
10
- "dashboard_login_url": "https://dashboard.acme.example.com/auth/gate",
11
- "env_vars": [
12
- {
13
- "name": "Publishable key",
14
- "key": "ACME_PUBLISHABLE_KEY",
15
- "secret": false
16
- },
17
- {
18
- "name": "Secret key",
19
- "key": "ACME_SECRET_KEY",
20
- "secret": true
21
- }
22
- ],
23
- "docs_url": "https://docs.acme.example.com/signup",
24
- "sdks": [
25
- {
26
- "label": "Node",
27
- "install": "npm install @acme/sdk",
28
- "url": "https://www.npmjs.com/package/@acme/sdk"
29
- }
30
- ],
31
- "branding": {
32
- "logo_url": "https://acme.example.com/logo.png",
33
- "primary_color": "#117BE7",
34
- "secondary_color": "#0B5CAD",
35
- "ascii_art": "ACME",
36
- "verified": false
37
- },
38
- "consent": {
39
- "terms_url": "https://acme.example.com/terms",
40
- "privacy_url": "https://acme.example.com/privacy"
41
- },
42
- "created_at": "2026-04-03T20:00:00.000Z",
43
- "updated_at": "2026-04-03T20:10:00.000Z",
44
- "webhook_endpoint_id": "we_0123456789abcdef0123456789abcdef"
45
- },
46
- "meta": {
47
- "request_id": "req_0123456789abcdef0123456789abcdef"
48
- }
49
- }
data/spec/fixtures/api/gate/services-list.json DELETED
@@ -1,51 +0,0 @@
1
- {
2
- "data": [
3
- {
4
- "object": "gate_service",
5
- "id": "acme_prod",
6
- "status": "active",
7
- "discoverable": false,
8
- "name": "Acme Production",
9
- "description": "Acme production signup flow",
10
- "website": "https://acme.example.com",
11
- "dashboard_login_url": "https://dashboard.acme.example.com/auth/gate",
12
- "env_vars": [
13
- {
14
- "name": "Publishable key",
15
- "key": "ACME_PUBLISHABLE_KEY",
16
- "secret": false
17
- },
18
- {
19
- "name": "Secret key",
20
- "key": "ACME_SECRET_KEY",
21
- "secret": true
22
- }
23
- ],
24
- "docs_url": "https://docs.acme.example.com/signup",
25
- "sdks": [
26
- {
27
- "label": "Node",
28
- "install": "npm install @acme/sdk",
29
- "url": "https://www.npmjs.com/package/@acme/sdk"
30
- }
31
- ],
32
- "branding": {
33
- "logo_url": "https://acme.example.com/logo.png",
34
- "primary_color": "#117BE7",
35
- "secondary_color": "#0B5CAD",
36
- "ascii_art": "ACME",
37
- "verified": false
38
- },
39
- "consent": {
40
- "terms_url": "https://acme.example.com/terms",
41
- "privacy_url": "https://acme.example.com/privacy"
42
- },
43
- "created_at": "2026-04-03T20:00:00.000Z",
44
- "updated_at": "2026-04-03T20:05:00.000Z",
45
- "webhook_endpoint_id": "we_0123456789abcdef0123456789abcdef"
46
- }
47
- ],
48
- "meta": {
49
- "request_id": "req_0123456789abcdef0123456789abcdef"
50
- }
51
- }
data/spec/fixtures/api/gate/session-ack.json DELETED
@@ -1,10 +0,0 @@
1
- {
2
- "data": {
3
- "object": "gate_session_delivery",
4
- "gate_session_id": "gate_0123456789abcdefghjkmnpqrs",
5
- "status": "acknowledged"
6
- },
7
- "meta": {
8
- "request_id": "req_0123456789abcdef0123456789abcdef"
9
- }
10
- }
data/spec/fixtures/api/gate/session-create.json DELETED
@@ -1,13 +0,0 @@
1
- {
2
- "data": {
3
- "object": "gate_session",
4
- "id": "gate_0123456789abcdefghjkmnpqrs",
5
- "status": "pending",
6
- "poll_token": "gtpoll_0123456789abcdefghjkmnpqrs",
7
- "consent_url": "https://usefoil.com/gate?session=gate_0123456789abcdefghjkmnpqrs",
8
- "expires_at": "2026-04-04T20:15:00.000Z"
9
- },
10
- "meta": {
11
- "request_id": "req_0123456789abcdef0123456789abcdef"
12
- }
13
- }
data/spec/fixtures/api/gate/session-poll.json DELETED
@@ -1,36 +0,0 @@
1
- {
2
- "data": {
3
- "object": "gate_session",
4
- "id": "gate_0123456789abcdefghjkmnpqrs",
5
- "status": "approved",
6
- "expires_at": "2026-04-04T20:15:00.000Z",
7
- "gate_account_id": "gacct_0123456789abcdefghjkmnpqrs",
8
- "account_name": "my-project",
9
- "delivery_bundle": {
10
- "integrator": {
11
- "version": 1,
12
- "algorithm": "x25519-hkdf-sha256/aes-256-gcm",
13
- "key_id": "kid_integrator_0123456789abcdefgh",
14
- "ephemeral_public_key": "ephemeral_public_key_integrator",
15
- "salt": "salt_integrator",
16
- "iv": "iv_integrator",
17
- "ciphertext": "ciphertext_integrator",
18
- "tag": "tag_integrator"
19
- },
20
- "gate": {
21
- "version": 1,
22
- "algorithm": "x25519-hkdf-sha256/aes-256-gcm",
23
- "key_id": "kid_gate_0123456789abcdefghjkm",
24
- "ephemeral_public_key": "ephemeral_public_key_gate",
25
- "salt": "salt_gate",
26
- "iv": "iv_gate",
27
- "ciphertext": "ciphertext_gate",
28
- "tag": "tag_gate"
29
- }
30
- },
31
- "docs_url": "https://usefoil.com/docs/gate"
32
- },
33
- "meta": {
34
- "request_id": "req_0123456789abcdef0123456789abcdef"
35
- }
36
- }
data/spec/fixtures/gate-delivery/approved-webhook-payload.valid.json DELETED
@@ -1,19 +0,0 @@
1
- {
2
- "service_id": "foil",
3
- "gate_session_id": "gate_0123456789abcdefghjkmnpqrs",
4
- "gate_account_id": "gacct_0123456789abcdefghjkmnpqrs",
5
- "account_name": "Acme",
6
- "metadata": {
7
- "plan": "pro"
8
- },
9
- "foil": {
10
- "verdict": "human",
11
- "score": 0.12
12
- },
13
- "delivery": {
14
- "version": 1,
15
- "algorithm": "x25519-hkdf-sha256/aes-256-gcm",
16
- "key_id": "LyGqfpvB0SCaX4P0inVpMJTAjCNJVWq_3OE87it2ZYo",
17
- "public_key": "bn6szfMIS-7pLl01PqvssrrGRoW1SVTkUuqeg0hfrW0"
18
- }
19
- }
data/spec/fixtures/gate-delivery/delivery-request.json DELETED
@@ -1,9 +0,0 @@
1
- {
2
- "delivery": {
3
- "version": 1,
4
- "algorithm": "x25519-hkdf-sha256/aes-256-gcm",
5
- "key_id": "LyGqfpvB0SCaX4P0inVpMJTAjCNJVWq_3OE87it2ZYo",
6
- "public_key": "bn6szfMIS-7pLl01PqvssrrGRoW1SVTkUuqeg0hfrW0"
7
- },
8
- "derived_key_id": "LyGqfpvB0SCaX4P0inVpMJTAjCNJVWq_3OE87it2ZYo"
9
- }
data/spec/fixtures/gate-delivery/env-policy.json DELETED
@@ -1,40 +0,0 @@
1
- {
2
- "derive_agent_token_env_key": [
3
- {
4
- "service_id": "foil",
5
- "expected": "FOIL_GATE_AGENT_TOKEN"
6
- },
7
- {
8
- "service_id": "acme-prod",
9
- "expected": "ACME_PROD_GATE_AGENT_TOKEN"
10
- }
11
- ],
12
- "is_gate_managed_env_var_key": [
13
- {
14
- "key": "FOIL_AGENT_TOKEN",
15
- "managed": true
16
- },
17
- {
18
- "key": "ACME_PROD_GATE_AGENT_TOKEN",
19
- "managed": true
20
- },
21
- {
22
- "key": "ACME_API_KEY",
23
- "managed": false
24
- }
25
- ],
26
- "is_blocked_gate_env_var_key": [
27
- {
28
- "key": "PATH",
29
- "blocked": true
30
- },
31
- {
32
- "key": "npm_config_registry",
33
- "blocked": true
34
- },
35
- {
36
- "key": "FOIL_SECRET_KEY",
37
- "blocked": false
38
- }
39
- ]
40
- }
data/spec/fixtures/gate-delivery/vector.v1.json DELETED
@@ -1,28 +0,0 @@
1
- {
2
- "version": 1,
3
- "delivery": {
4
- "version": 1,
5
- "algorithm": "x25519-hkdf-sha256/aes-256-gcm",
6
- "key_id": "LyGqfpvB0SCaX4P0inVpMJTAjCNJVWq_3OE87it2ZYo",
7
- "public_key": "bn6szfMIS-7pLl01PqvssrrGRoW1SVTkUuqeg0hfrW0"
8
- },
9
- "private_key_pkcs8": "MC4CAQAwBQYDK2VuBCIEIL8KtbBiPaNXyTYwgHfrxlH5RQkpHQ41rwkX77or4_eV",
10
- "payload": {
11
- "version": 1,
12
- "outputs": {
13
- "FOIL_PUBLISHABLE_KEY": "pk_test_vector",
14
- "FOIL_SECRET_KEY": "sk_test_vector"
15
- },
16
- "ack_token": "ack_test_vector"
17
- },
18
- "envelope": {
19
- "version": 1,
20
- "algorithm": "x25519-hkdf-sha256/aes-256-gcm",
21
- "key_id": "LyGqfpvB0SCaX4P0inVpMJTAjCNJVWq_3OE87it2ZYo",
22
- "ephemeral_public_key": "5mKwN8SvDqqFUgQAW3EkFugR6W7InfBfU5ykFmPcakw",
23
- "salt": "YTkiBQxfVmcCM-RGK7g-pfUA6YlOgqyvDdk19iXx9OM",
24
- "iv": "yUylHkoF854xQ6Vm",
25
- "ciphertext": "_Qadd9WzJOlwCJYRH0jXt2Po_mxYMJWwCBztRdFmDFGZQaQ1L-VA8uJPzcV4Z4foLSMk3NWuC3Gl1hTcenBQO7NWcmRv0GlKwv9HynOul88Ok3aGwXO7CmWhNA7wvsnc2DMNnTcJn21erJiJOGah-AvBs7JRLIHWXrCK_yEgqO4cIg",
26
- "tag": "ie7SPn1eNOdPJk4dgRYM3A"
27
- }
28
- }
data/spec/fixtures/gate-delivery/webhook-signature.json DELETED
@@ -1,9 +0,0 @@
1
- {
2
- "secret": "whsec_test",
3
- "timestamp": "1735776000",
4
- "expired_timestamp": "1735775400",
5
- "now_seconds": 1735776000,
6
- "raw_body": "{\"id\":\"wevt_0123456789abcdef0123456789abcdef\",\"object\":\"webhook_event\",\"type\":\"gate.session.approved\",\"created\":\"2026-01-02T00:00:00.000Z\",\"data\":{\"service_id\":\"foil\",\"gate_session_id\":\"gate_0123456789abcdefghjkmnpqrs\",\"gate_account_id\":\"gacct_0123456789abcdefghjkmnpqrs\",\"account_name\":\"Acme\",\"metadata\":{\"plan\":\"pro\"},\"foil\":{\"verdict\":\"human\",\"score\":0.12},\"delivery\":{\"version\":1,\"algorithm\":\"x25519-hkdf-sha256/aes-256-gcm\",\"key_id\":\"LyGqfpvB0SCaX4P0inVpMJTAjCNJVWq_3OE87it2ZYo\",\"public_key\":\"bn6szfMIS-7pLl01PqvssrrGRoW1SVTkUuqeg0hfrW0\"}}}",
7
- "signature": "afef24484ba4275cca886460a61d1aa1cc0e5d78057d18013d124b22391b6ceb",
8
- "invalid_signature": "0fef24484ba4275cca886460a61d1aa1cc0e5d78057d18013d124b22391b6ceb"
9
- }