forest_admin_datasource_intercom 1.49.0

data/lib/forest_admin_datasource_intercom/collections/ticket.rb

@@ -0,0 +1,143 @@
+module ForestAdminDatasourceIntercom
+  module Collections
+    # Read through POST /tickets/search: Intercom has no GET /tickets, and records come under `tickets`.
+    # Every response carries each ticket's whole timeline with no field selection (measured: 155 parts on one
+    # ticket), hence the small page size and the free part-derived columns.
+    class Ticket < CursorCollection
+      include ContactIdentity
+      include Ticket::Serializer
+      include Ticket::DerivedColumns
+      include CustomAttributes
+      # The same thread a conversation publishes, and free here: the parts are
+      # in the response whether or not anything asks for them.
+      include Timeline
+
+      # Intercom accepts 150. This is not that: it is what keeps one page of
+      # tickets, timelines included, a response an agent can hold and an operator
+      # can wait for. Provisional until measured against real response sizes on
+      # the customer's workspace.
+      MAX_TICKETS_PER_PAGE = 25
+
+      # `/tickets/search` demands a query, so a list view sends the least noisy
+      # predicate that matches everything. Every ticket has a creation date, and
+      # a bound at the epoch keeps whatever the day-granular truncation does to
+      # it harmless.
+      MATCH_EVERY_TICKET = { 'field' => 'created_at', 'operator' => '>', 'value' => '0' }.freeze
+
+      def initialize(datasource, attributes: [])
+        @attributes = attributes
+        super(datasource, 'IntercomTicket')
+        # Declared so the search reaches `refuse_search!` instead of being
+        # emulated by the customizer as an equality on every String column,
+        # which `/tickets/search` answers with an empty page.
+        enable_search
+      end
+
+      protected
+
+      def record_endpoint = 'tickets'
+      def list_key = 'tickets'
+      def searchable = 'tickets'
+      def max_page_size = MAX_TICKETS_PER_PAGE
+
+      # The part bodies are HTML written by end customers, and rendering
+      # third-party HTML inside Forest is neither safe nor useful (R10). Sent on
+      # the search, where Intercom does not document it: a parameter it ignores
+      # costs a query string, while the one it honours saves every row of the
+      # thread from coming back as markup.
+      def read_params = { 'display_as' => 'plaintext' }
+
+      # Intercom exposes no `GET /tickets`, so a list view searches too: with the
+      # filter it was given, or with the predicate that matches everything when
+      # it was given none.
+      def searchable_only? = true
+      def match_all_query = MATCH_EVERY_TICKET
+
+      def enrich(records, rows, projection)
+        embed_contact_identity(records, rows, projection)
+        embed_derived_columns(records, rows, projection)
+        embed_timeline(records, rows, projection)
+      end
+
+      private
+
+      def define_schema
+        add_column('id', 'String', is_primary_key: true)
+        # The number the support team says out loud, next to the id the API
+        # answers by.
+        add_column('ticket_id', 'String')
+        # Read as the label (`Customer` / `Back-office` / `Tracker`); a filter sends
+        # the word `/tickets/search` takes for it (`request` / `task` / `tracker`).
+        add_column('category', 'String')
+        add_column('open', 'Boolean')
+        add_column('is_shared', 'Boolean')
+        add_column('created_at', 'Date')
+        add_column('updated_at', 'Date')
+        add_column('admin_assignee_id', 'String')
+        add_column('team_assignee_id', 'String')
+        # The ticket carries its company as an id alone, unlike a conversation
+        # which carries the whole object: the account name would cost a request
+        # per row, so it is not offered here. Measured: the id is Intercom's own,
+        # not the customer's external one, which is what a relation will have to
+        # target in lot 4.
+        add_column('company_id', 'String')
+        define_state_columns
+        define_type_columns
+        define_contact_columns
+        define_derived_columns
+        add_column('part_count', 'Number')
+        add_column('timeline', 'Json')
+        # Before the attribute columns rather than after: a workspace attribute
+        # whose name lands on a relation is then skipped with a warning, the way
+        # one landing on a column already is. Declared after, it would collide
+        # and take the boot with it.
+        define_relations
+        register_attribute_columns
+      end
+
+      # The state arrives embedded as a whole object, so its label costs nothing:
+      # a queue reads without a join. One label and not three -- the category and
+      # the customer-facing label are read through the `state` relation, which is
+      # where every field of a state lives. Neither of the two was ever
+      # filterable, so nothing that could be saved in a segment or a scope
+      # depended on them.
+      def define_state_columns
+        add_column('state_id', 'String')
+        add_column('state_label', 'String')
+        add_column('previous_state_id', 'String')
+      end
+
+      def define_type_columns
+        add_column('ticket_type_id', 'String')
+        add_column('ticket_type_name', 'String')
+      end
+
+      # /tickets/search filters on admin_assignee_id, team_assignee_id and ticket_type_id, on no state id, and
+      # `contact_ids` is unconfirmed; a traversal the endpoint cannot filter is refused by name, not dropped.
+      def define_relations
+        add_many_to_one('admin_assignee', foreign_collection: 'IntercomAdmin', foreign_key: 'admin_assignee_id')
+        add_many_to_one('team_assignee', foreign_collection: 'IntercomTeam', foreign_key: 'team_assignee_id')
+        add_many_to_one('state', foreign_collection: 'IntercomTicketState', foreign_key: 'state_id')
+        add_many_to_one('previous_state', foreign_collection: 'IntercomTicketState',
+                                          foreign_key: 'previous_state_id')
+        add_many_to_one('ticket_type', foreign_collection: 'IntercomTicketType', foreign_key: 'ticket_type_id')
+        add_many_to_one('contact', foreign_collection: 'IntercomContact', foreign_key: 'contact_id')
+      end
+
+      # Free: the parts come with the search response regardless. An empty list is an empty thread; a payload
+      # with no parts leaves it nil (unknown), as a listed conversation does.
+      def embed_timeline(records, rows, projection)
+        return unless column_asked?(projection, 'timeline')
+
+        records.each_with_index { |record, index| rows[index]['timeline'] = parts_of(record) && build_timeline(record) }
+        truncated = records.count { |record| truncated?(record) }
+        warn_truncated_timelines(truncated) if truncated.positive?
+      end
+
+      # The attribute columns of every ticket type, in union. Read at boot by
+      # `TicketAttributesIntrospector`, which is also where a workspace's own
+      # name is turned into one a Forest query string can carry.
+      def attribute_kind = 'ticket'
+    end
+  end
+end

data/lib/forest_admin_datasource_intercom/collections/ticket_state.rb

@@ -0,0 +1,40 @@
+module ForestAdminDatasourceIntercom
+  module Collections
+    # The ticket states of the workspace. A ticket carries its state as an id, so
+    # without this collection a support queue reads as a column of numbers.
+    class TicketState < FetchAllCollection
+      def initialize(datasource)
+        super(datasource, 'IntercomTicketState')
+      end
+
+      protected
+
+      def fetch_all
+        client.fetch_all('ticket_states')
+      end
+
+      # Two labels rather than one: `internal_label` is what the support team
+      # sees, `external_label` what the customer is shown. An operator reading a
+      # queue needs the first, and needs to know what the second says.
+      def serialize(ticket_state)
+        attrs = ticket_state.is_a?(Hash) ? ticket_state : {}
+
+        { 'id' => stringify_id(attrs['id']),
+          'category' => attrs['category'],
+          'internal_label' => attrs['internal_label'],
+          'external_label' => attrs['external_label'],
+          'archived' => attrs['archived'] }
+      end
+
+      private
+
+      def define_schema
+        add_column('id', 'String', is_primary_key: true)
+        add_column('category', 'String')
+        add_column('internal_label', 'String')
+        add_column('external_label', 'String')
+        add_column('archived', 'Boolean')
+      end
+    end
+  end
+end

data/lib/forest_admin_datasource_intercom/collections/ticket_type.rb

@@ -0,0 +1,46 @@
+module ForestAdminDatasourceIntercom
+  module Collections
+    # The ticket types the workspace defines. They are what makes a ticket's type
+    # readable, and they are also where the ticket attributes are declared --
+    # which is what the ticket collection reads them for.
+    class TicketType < FetchAllCollection
+      def initialize(datasource)
+        super(datasource, 'IntercomTicketType')
+      end
+
+      protected
+
+      def fetch_all
+        client.fetch_all('ticket_types')
+      end
+
+      # `ticket_type_attributes` is deliberately left out: it is a nested list of
+      # attribute definitions, useful to the ticket collection and meaningless as
+      # a column. An attribute of the same name carries a different id from one
+      # type to the next (measured), which is exactly why the ticket collection
+      # has to read the definitions rather than assume them.
+      def serialize(ticket_type)
+        attrs = ticket_type.is_a?(Hash) ? ticket_type : {}
+
+        { 'id' => stringify_id(attrs['id']),
+          'name' => attrs['name'],
+          'description' => attrs['description'],
+          'category' => attrs['category'],
+          'icon' => attrs['icon'],
+          'archived' => attrs['archived'] }
+      end
+
+      private
+
+      def define_schema
+        add_column('id', 'String', is_primary_key: true)
+        add_column('name', 'String')
+        add_column('description', 'String')
+        # The label (`Customer` / `Back-office` / `Tracker`), as on a ticket.
+        add_column('category', 'String')
+        add_column('icon', 'String')
+        add_column('archived', 'Boolean')
+      end
+    end
+  end
+end

data/lib/forest_admin_datasource_intercom/collections/timeline.rb

@@ -0,0 +1,40 @@
+module ForestAdminDatasourceIntercom
+  module Collections
+    # The thread of a conversation or ticket. `part_type` is kept, and internal notes are included next to
+    # customer replies -- that is what a thread is on Intercom. Intercom keeps only the 500 most recent parts.
+    module Timeline
+      private
+
+      def build_timeline(entity)
+        attrs = entity.is_a?(Hash) ? entity : {}
+
+        [opening_entry(attrs)].compact + (parts_of(attrs) || []).map { |part| part_entry(part) }
+      end
+
+      # What comes before the parts. A conversation opens on its `source`, which
+      # is not a part at all; a ticket opens on its first part like any other
+      # event, so there is nothing to prepend.
+      def opening_entry(_attrs) = nil
+
+      def part_entry(part)
+        attrs = part.is_a?(Hash) ? part : {}
+
+        entry(part_type: attrs['part_type'], created_at: attrs['created_at'], author: attrs['author'],
+              body: attrs['body'], attachments: attrs['attachments'])
+          .merge('id' => stringify_id(attrs['id']), 'redacted' => attrs['redacted'])
+      end
+
+      def entry(part_type:, created_at:, author:, body:, attachments:)
+        writer = author.is_a?(Hash) ? author : {}
+
+        { 'part_type' => part_type,
+          'created_at' => stamp(created_at),
+          'author_type' => writer['type'],
+          'author_name' => writer['name'],
+          'author_email' => writer['email'],
+          'body' => body,
+          'attachment_count' => Array(attachments).size }
+      end
+    end
+  end
+end

data/lib/forest_admin_datasource_intercom/configuration.rb

@@ -0,0 +1,226 @@
+module ForestAdminDatasourceIntercom
+  # Long by line count only: every option of the datasource is declared here
+  # with the reason it has the default it has, and next to the check that
+  # refuses the shapes it cannot mean. Splitting the checks off would put an
+  # option and its meaning in two files.
+  class Configuration # rubocop:disable Metrics/ClassLength
+    # A workspace is hosted in one region and answers in that region only. The
+    # host is therefore a configuration parameter rather than a constant:
+    # `api.intercom.io` does route to the right region, but a customer under
+    # GDPR wants its requests to reach the European host and nothing else.
+    REGION_HOSTS = {
+      us: 'https://api.intercom.io',
+      eu: 'https://api.eu.intercom.io',
+      au: 'https://api.au.intercom.io'
+    }.freeze
+
+    DEFAULT_REGION = :us
+
+    # Where a cleartext base_url reaches nobody else's network, so the bearer
+    # header crossing it in clear is not worth a word.
+    LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1 [::1] 0.0.0.0].freeze
+
+    # Without an explicit version a request follows the workspace's own default,
+    # which an operator can change on Intercom's side -- and the payloads change
+    # shape under us. Pinned to what the spike ran against; 2.14 and 2.16 both
+    # answered, and the response echoes the version back, so `Client#me`
+    # verifies at boot that the pin was honoured.
+    DEFAULT_API_VERSION = '2.16'.freeze
+
+    # Reference lists are re-read on every page otherwise (four sequential round trips per ticket list);
+    # a minute bounds staleness. `0` disables the store. Records are never cached -- see `Cache`.
+    DEFAULT_REFERENCE_CACHE_TTL = 60
+
+    # A ticket list is ~7 requests to one host, so keep-alive saves a TLS handshake each. The pool is sized
+    # against the server's thread count (Puma default 5): a thread waiting >0.5s for a connection gets a
+    # non-retried timeout blamed on Intercom. `adapter: :net_http` opts out; an unloadable adapter is refused.
+    DEFAULT_ADAPTER = [:net_http_persistent, { pool_size: 25 }].freeze
+
+    # How many records a read by id fetches at once -- a related list of
+    # companies, a page of timelines -- Intercom answering those one request
+    # each. One by default: every extra read in flight holds a connection of
+    # the pool above, so widening this is the integrator's call, made against
+    # `pool_size` and the server's thread count together.
+    DEFAULT_CONCURRENT_READS = 1
+
+    attr_reader :access_token, :region, :base_url, :api_version, :open_timeout, :timeout,
+                :retry_policy, :rate_limiter, :boot_open_timeout, :boot_timeout, :boot_retry_policy,
+                :reference_cache_ttl, :adapter, :reference_cache, :concurrent_reads
+
+    # `rate_limiter: nil` leaves the 429 retry as the only rate-limit handling. The `boot_` trio governs
+    # reads made while the datasource is constructed (attribute introspection), during the Rails boot.
+    def initialize(access_token:, region: nil, base_url: nil, api_version: DEFAULT_API_VERSION,
+                   open_timeout: 5, timeout: 30, retry_policy: RetryPolicy.new,
+                   rate_limiter: RateLimiter.new, boot_open_timeout: 3, boot_timeout: 10,
+                   boot_retry_policy: RetryPolicy.boot,
+                   reference_cache_ttl: DEFAULT_REFERENCE_CACHE_TTL, adapter: nil,
+                   concurrent_reads: DEFAULT_CONCURRENT_READS)
+      @access_token = access_token
+      @region       = (region || DEFAULT_REGION).to_s.downcase.to_sym
+      @base_url     = base_url
+      @api_version  = api_version.to_s
+      @open_timeout = open_timeout
+      @timeout      = timeout
+      @retry_policy = retry_policy
+      @rate_limiter = rate_limiter
+      @boot_open_timeout = boot_open_timeout
+      @boot_timeout      = boot_timeout
+      @boot_retry_policy = boot_retry_policy
+      @reference_cache_ttl = reference_cache_ttl
+      @adapter = normalize_adapter(adapter)
+      @concurrent_reads = concurrent_reads
+      validate!
+      # One store per Configuration, hence per token, like the rate limiter:
+      # what it holds is a workspace's own lists, and two workspaces do not
+      # share them. Built here rather than lazily -- a memoized reader would
+      # hand two stores to the two threads that first raced for it, and one of
+      # them would then write into a store nothing else reads.
+      @reference_cache = Cache.new(ttl: @reference_cache_ttl)
+    end
+
+    # An explicit `base_url` wins over the region: it is what points the client
+    # at a mock server or an egress proxy, neither of which is a region.
+    def url
+      @url ||= (@base_url || REGION_HOSTS.fetch(@region)).chomp('/')
+    end
+
+    # The url with any credentials in it masked. `URI` accepts them --
+    # `https://user:pass@proxy/...` -- and the refusal that names such a url
+    # would otherwise print a second secret exactly where this class keeps the
+    # first one from going. A query string is masked whole for the same
+    # reason: it is where a gateway takes its key. Read by `Client#inspect`
+    # too, which prints the same url.
+    def redacted_url
+      @redacted_url ||= url.sub(%r{\A([a-zA-Z][\w+.-]*://)[^/@]*@}, '\1[FILTERED]@')
+                           .sub(/\?.*\z/m, '?[FILTERED]')
+    end
+
+    # `access_token` is a bearer credential, and nothing prints a Configuration
+    # on purpose: what reaches an `inspect` is a Rails error page, or a
+    # `logger.debug` of something holding one. The default would put the token
+    # in clear there. `Client` and `Datasource` mask their own for the same
+    # reason -- together they cut every path from an object this package hands
+    # out to the credential.
+    def inspect
+      "#<#{self.class.name} url=#{redacted_url.inspect} api_version=#{@api_version.inspect} " \
+        'access_token=[FILTERED]>'
+    end
+
+    private
+
+    def validate!
+      raise ConfigurationError, 'ForestAdminDatasourceIntercom missing required config: access_token' if
+        blank?(@access_token)
+
+      validate_region!
+      validate_base_url!
+      raise ConfigurationError, 'ForestAdminDatasourceIntercom api_version cannot be empty' if blank?(@api_version)
+
+      validate_reference_cache_ttl!
+      validate_concurrent_reads!
+    end
+
+    def validate_concurrent_reads!
+      return if @concurrent_reads.is_a?(Integer) && @concurrent_reads.positive?
+
+      raise ConfigurationError,
+            'ForestAdminDatasourceIntercom concurrent_reads must be a whole number of reads, one or more, got ' \
+            "#{@concurrent_reads.inspect}"
+    end
+
+    # Refuses nil, non-numeric strings and Infinity rather than coercing them into a silent 0 (cache off)
+    # or a never-expiring cache.
+    def validate_reference_cache_ttl!
+      return if @reference_cache_ttl.is_a?(Numeric) && @reference_cache_ttl.finite? &&
+                !@reference_cache_ttl.negative?
+
+      raise ConfigurationError,
+            'ForestAdminDatasourceIntercom reference_cache_ttl must be a finite number of seconds, zero or ' \
+            "more, got #{@reference_cache_ttl.inspect}"
+    end
+
+    # Faraday's adapter registry is keyed by symbol: a string name (as YAML hands over) silently lost
+    # keep-alive. Whether the name resolves is left to the client, which refuses one this process cannot load.
+    def normalize_adapter(adapter)
+      return nil if adapter.nil?
+
+      name, options = adapter.is_a?(Array) ? adapter : [adapter, nil]
+      refuse_adapter!(adapter) unless name.respond_to?(:to_sym)
+      refuse_adapter!(adapter) unless options.nil? || namable_hash?(options)
+
+      options.nil? ? name.to_sym : [name.to_sym, options.to_h { |key, value| [key.to_sym, value] }]
+    end
+
+    def namable_hash?(options)
+      options.is_a?(Hash) && options.keys.all? { |key| key.respond_to?(:to_sym) }
+    end
+
+    def refuse_adapter!(adapter)
+      raise ConfigurationError,
+            'ForestAdminDatasourceIntercom adapter must be an adapter name or a [name, options] pair, got ' \
+            "#{adapter.inspect}"
+    end
+
+    def validate_region!
+      return if @base_url || REGION_HOSTS.key?(@region)
+
+      raise ConfigurationError,
+            "ForestAdminDatasourceIntercom unknown region #{@region.inspect}: " \
+            "expected one of #{REGION_HOSTS.keys.map(&:inspect).join(", ")}, or an explicit base_url."
+    end
+
+    # A base url that is not absolute makes Faraday resolve every path against
+    # the process's working directory instead of Intercom, which surfaces much
+    # later as a connection failure naming nothing.
+    def validate_base_url!
+      return if @base_url.nil?
+
+      uri = URI.parse(@base_url)
+      refuse_credentials! if uri.userinfo
+      return warn_cleartext!(uri) if uri.is_a?(URI::HTTP) && !blank?(uri.host)
+
+      raise ConfigurationError,
+            "ForestAdminDatasourceIntercom base_url must be an absolute http(s) url, got #{redacted_url.inspect}"
+    rescue URI::InvalidURIError
+      # Without the parser's error, whose message quotes the url unredacted.
+      raise ConfigurationError,
+            "ForestAdminDatasourceIntercom base_url is not a valid url: #{redacted_url.inspect}", cause: nil
+    end
+
+    # Faraday turns credentials in the url into a Basic `Authorization`
+    # header, which the Intercom bearer token then replaces: they would be
+    # dropped on every request without a word. An egress proxy takes its
+    # credentials from `HTTPS_PROXY`, which Faraday sends as
+    # `Proxy-Authorization` instead.
+    def refuse_credentials!
+      raise ConfigurationError,
+            "ForestAdminDatasourceIntercom base_url #{redacted_url.inspect} carries credentials, which cannot " \
+            'travel: the Authorization header carries the Intercom access token. For a credentialed egress ' \
+            'proxy, set HTTPS_PROXY=https://user:password@proxy:port instead.'
+    end
+
+    # `URI::HTTPS` is a `URI::HTTP`, so plain http passes above -- and it is
+    # worth passing: a mock server in a test suite is one, and that is half of
+    # what `base_url` is for. What it costs is `Authorization: Bearer <token>`
+    # travelling in clear to whatever sits at the other end, and that token
+    # reads the whole workspace. Named rather than allowed in silence; a
+    # loopback host is nobody else's network, so it says nothing there.
+    def warn_cleartext!(uri)
+      return if uri.scheme == 'https' || loopback?(uri.host)
+
+      ForestAdminDatasourceIntercom.logger.warn(
+        "[forest_admin_datasource_intercom] base_url #{redacted_url.inspect} is not https, and every request " \
+        'carries the Intercom access token as a bearer header. Anything on the path can read it and use it ' \
+        'against the workspace. Use https, or terminate TLS before the network this crosses.'
+      )
+    end
+
+    def loopback?(host)
+      LOOPBACK_HOSTS.include?(host.to_s.downcase) || host.to_s.downcase.end_with?('.localhost')
+    end
+
+    def blank?(value)
+      value.nil? || value.to_s.strip.empty?
+    end
+  end
+end

data/lib/forest_admin_datasource_intercom/datasource.rb

@@ -0,0 +1,78 @@
+module ForestAdminDatasourceIntercom
+  class Datasource < ForestAdminDatasourceToolkit::Datasource
+    attr_reader :client, :configuration
+
+    def initialize(access_token:, **options)
+      super()
+      @configuration = Configuration.new(access_token: access_token, **options)
+      @client = Client.new(@configuration)
+
+      verify_api_version
+      register_collections
+    end
+
+    # The datasource is what a Rails error page or a `logger.debug` is likeliest
+    # to print, and it holds the client whose connections carry the access token.
+    # Every collection will reach that token the same way, through the
+    # `@datasource` the toolkit's Collection keeps, so cutting the chain here
+    # covers them too -- and spares the recursive dump the default `inspect`
+    # walks into, a datasource and its collections pointing at each other.
+    def inspect
+      "#<#{self.class.name} collections=#{collections.keys.inspect}>"
+    end
+
+    private
+
+    # The reference collections first: they are what turns an assignee id into a
+    # teammate and a state id into a label. No request is made here -- each
+    # collection reads its endpoint when it is listed, so a datasource boots
+    # whatever Intercom is doing, and a workspace the token cannot read costs
+    # rows rather than the agent.
+    def register_collections
+      add_collection(Collections::Admin.new(self))
+      add_collection(Collections::Team.new(self))
+      # The join Intercom does not expose: without it the membership of a team is
+      # an array of ids on either side, since a many-to-many needs a collection
+      # to travel through.
+      add_collection(Collections::TeamMembership.new(self))
+      add_collection(Collections::TicketType.new(self))
+      add_collection(Collections::TicketState.new(self))
+      # Contacts and Companies before the collections that point at them, so a
+      # relation is declared next to a target the datasource already holds.
+      # Each carries the custom attributes its workspace defines, read at boot:
+      # they cannot be discovered from a payload, a contact carrying the values
+      # of the attributes it happens to have been given.
+      add_collection(Collections::Contact.new(self, attributes: model_attributes('contact')))
+      add_collection(Collections::Company.new(self, attributes: model_attributes('company')))
+      add_collection(Collections::Conversation.new(self))
+      # The attributes a workspace defines on its ticket types, which are
+      # columns of the Tickets collection and cannot be discovered from a ticket
+      # payload either -- a ticket carries the values of its own type only.
+      add_collection(Collections::Ticket.new(self, attributes: ticket_attributes))
+    end
+
+    # Intercom silently serves the workspace's default API version when the pin is not honoured;
+    # `Client#me` checks the echoed version. A token that cannot reach `/me` costs the check, not the boot.
+    def verify_api_version
+      @client.me(boot: true)
+    rescue APIError => e
+      ForestAdminDatasourceIntercom.logger.warn(
+        "[forest_admin_datasource_intercom] could not read /me at boot (HTTP #{e.status || "-"}); the API " \
+        'version Intercom serves was not checked against the pinned one, and a workspace serving another one ' \
+        'answers payloads of another shape.'
+      )
+    end
+
+    # The three attribute reads of the boot, alongside the version check above.
+    # Each degrades to no attribute column rather than to a failed boot: a
+    # token missing a permission costs the columns it could not read, never
+    # the agent.
+    def ticket_attributes
+      Schema::TicketAttributesIntrospector.new(@client).attributes
+    end
+
+    def model_attributes(model)
+      Schema::DataAttributesIntrospector.new(@client, model: model).attributes
+    end
+  end
+end