invoance 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 465e862ed29dc6dc0d5c4829472f739ddbaaace820845dd7c54bb6d9aabd77dc
-  data.tar.gz: 49e142ab37c383cd94b14aaa6f02a456e7a190bbdd961de45d9f4e215febe56c
+  metadata.gz: 5e2d35b71291d29aa248a149572823d79d968ed379130b206e2e60776fe892b9
+  data.tar.gz: 544522d6d2e329196e3586604cf4ffc86d7bcd8bd8fc183ae7827ce077b2793f
 SHA512:
-  metadata.gz: 6e26cf457a2f054a6d027c30a2fcb3b6335b220431de8d4b67541c6be824287a934ddc5b4509017602fc2949240489c7760fd85b4b024b00bbe609c82e43c078
-  data.tar.gz: ca148fd01bef837bc515093332b3908866a6ce6ebbae7ba02cc97bb84ca33e0869655d128681895d767a2b339ce130d302c55cb21b6c024423aadf64814400a1
+  metadata.gz: f2caf663d660ce5ce79deadff7a86d83e9cc2d3c20fc861c3b558bc8da24fcb776f6968e70e0481a1c9ae6e2e239afe9b8e3b00406ce4c83cdbe341bddce2b76
+  data.tar.gz: 75a63ff16bc063470049c9f24ff8195916cfdaaad90d87d28fda40ebbd96137bfd7ebc170bbf97a9b4284a7923c2a93fea0db67be3c378b5f6e60195181475f3

data/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.0] - 2026-07-14
+
+### Changed
+
+- `Client#validate` now probes the scope-free introspection endpoint
+  `GET /v1/me` instead of `GET /v1/events?limit=1`. Keys restricted to
+  `audit:*` scopes now validate correctly (the old events probe could 403
+  on a missing events scope and report a misleading reason). The return
+  shape (`"valid"` / `"reason"` / `"base_url"`) and the 401 / 403 / 429 /
+  network classifications are unchanged; only the 403 `reason` text changed —
+  it now describes an IP-access-rule block instead of a missing events
+  permission, since `/v1/me` requires no scope.
+
+### Added
+
+- `Client#me` — API-key introspection via `GET /v1/me`. Returns the raw
+  decoded response (organization, tenant, api_key with scopes, limits) as a
+  string-keyed `Hash`; raises like any other resource call.
+- Audit org lifecycle methods on `audit.orgs`:
+  - `update(organization_id, name:)` — rename an org via
+    `PATCH /audit/orgs/:org_id`; pass `name: nil` to clear the name.
+  - `archive(organization_id)` / `unarchive(organization_id)` — idempotent
+    `POST /audit/orgs/:org_id/archive` and `.../unarchive`. Archiving freezes
+    new activity while history stays verifiable.
+  - `delete(organization_id)` — hard delete via `DELETE /audit/orgs/:org_id`;
+    raises `ConflictError` (`org_not_deletable`) when signed history would be
+    destroyed.
+- `audit.orgs.list(include_archived: true)` — include archived orgs in
+  listings (excluded by default). Org responses now carry `archived_at`
+  (RFC 3339 string or `nil`).
+- `PATCH` support in the HTTP transport.
+
 ## [0.1.0] - 2026-07-06
 
 ### Added

data/README.md

@@ -53,6 +53,10 @@ puts event["event_id"]
 # Verify the API key / connectivity (never raises)
 result = client.validate
 raise "bad config: #{result["reason"]}" unless result["valid"]
+
+# Introspect the key — org, tenant, scopes, limits (GET /v1/me; raises on error)
+whoami = client.me
+puts whoami["api_key"]["scopes"]
 ```
 
 Responses are plain Ruby `Hash`es with **string keys** matching the wire JSON

data/lib/invoance/client.rb

@@ -53,14 +53,23 @@ module Invoance
       @config.base_url
     end
 
-    # Probe a cheap authenticated endpoint (GET /v1/events?limit=1) to
-    # confirm the API key works. NEVER raises.
+    # Introspect the API key via GET /v1/me. Requires no scope, so it works
+    # for any valid key. Raises like every other resource call.
+    #
+    # @return [Hash] { "valid" =>, "organization" =>, "tenant" =>,
+    #   "api_key" =>, "limits" => } (string keys, wire JSON as-is)
+    def me
+      @http.get("/me")
+    end
+
+    # Call the scope-free introspection endpoint (GET /v1/me) to confirm
+    # the API key works. NEVER raises.
     #
     # @return [Hash] { "valid" =>, "reason" =>, "base_url" => }
     def validate
       base = @config.base_url
       begin
-        @events.list(limit: 1)
+        me
         { "valid" => true, "reason" => nil, "base_url" => base }
       rescue AuthenticationError
         { "valid" => false,
@@ -68,7 +77,7 @@ module Invoance
           "base_url" => base }
       rescue ForbiddenError
         { "valid" => true,
-          "reason" => "API key authenticated but lacks permission to list events",
+          "reason" => "API key authenticated but the request was blocked (IP access rules)",
           "base_url" => base }
       rescue QuotaExceededError
         { "valid" => true,

data/lib/invoance/http.rb

@@ -59,6 +59,16 @@ module Invoance
       handle(resp, ctx)
     end
 
+    # PATCH returning parsed JSON.
+    def patch(path, body = nil)
+      uri = build_uri(path)
+      ctx = { method: "PATCH", path: path }
+      req = Net::HTTP::Patch.new(uri)
+      req.body = JSON.generate(body) unless body.nil?
+      resp = do_request(req, uri, ctx, headers: @base_headers)
+      handle(resp, ctx)
+    end
+
     # DELETE returning parsed JSON.
     def delete(path)
       uri = build_uri(path)

data/lib/invoance/resources/audit.rb

@@ -107,9 +107,36 @@ module Invoance
           @http.post("/audit/orgs", body)
         end
 
-        # GET /audit/orgs
-        def list
-          @http.get("/audit/orgs")
+        # GET /audit/orgs — archived orgs are excluded unless
+        # include_archived: true is passed.
+        def list(include_archived: nil)
+          @http.get("/audit/orgs", { "include_archived" => include_archived })
+        end
+
+        # PATCH /audit/orgs/:org_id — rename. Pass name: nil to clear the
+        # name (sends JSON null).
+        def update(organization_id, name:)
+          @http.patch("/audit/orgs/#{organization_id}", { "name" => name })
+        end
+
+        # POST /audit/orgs/:org_id/archive — idempotent. Freezes new
+        # activity (ingest/streams/portal/exports return 409 org_archived);
+        # history stays verifiable.
+        def archive(organization_id)
+          @http.post("/audit/orgs/#{organization_id}/archive")
+        end
+
+        # POST /audit/orgs/:org_id/unarchive — idempotent.
+        def unarchive(organization_id)
+          @http.post("/audit/orgs/#{organization_id}/unarchive")
+        end
+
+        # DELETE /audit/orgs/:org_id — hard delete, allowed only when
+        # nothing signed would be destroyed (never-ingested org, or
+        # archived + retention fully purged). Raises ConflictError
+        # (org_not_deletable) otherwise.
+        def delete(organization_id)
+          @http.delete("/audit/orgs/#{organization_id}")
         end
 
         # GET /audit/orgs/:org_id/integrity

data/lib/invoance/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Invoance
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: invoance
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Invoance, Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-06 00:00:00.000000000 Z
+date: 2026-07-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake