jbr 3.2.0 → 3.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d1028c7784920b94426d3c9d52a29232cdb4b8426baf5abe11cbcfe64d9f854f
-  data.tar.gz: d27d31e838ea1fd1c2c3035abf3e21635955039febc8a481bb514a8bd8e9fb9d
+  metadata.gz: 074fba6db0300fd967935b1996f1791016e216aa49ef829e771f56340400af1f
+  data.tar.gz: c8433c006174ab91d76db6a331268c325a90ff4f049f179c5adf46acd9716487
 SHA512:
-  metadata.gz: 74d582435245e0aebf5975748e2ba86e5e53f1190a4f4007d1b50e514df47816082f82a8cdf41b8bd9529e63fe25219035005335ed56708b857ba6aabfdbcb4e
-  data.tar.gz: 6977198a4d12a410b0c2b8ef2aa0cda829a43ec5fda670ce7d9dbcd13301ac2ef3da55b605d4a6ab7e3017839a115c9f757a6a4ae6d86522f4fa584151cb4f12
+  metadata.gz: 1d3e116c317b973a9600af44e3fd02466e360321f08b4e1c696c2e214854b91b8318c45a8ffdb7c50f6f880bf07e6388bf060d33f54ad58b60b2ead27aab535d
+  data.tar.gz: 28ee328df69a90a166cfaa4ed6ee0b22fad572c7bca8defb501afba0b3054c652b17741df883f4be32b0bd33ca7253a4a7e5872564b2f636f02d459323a7693c

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [3.3.0] - 2026-08-13
+
+- [Fix] Credentials are given up only when Jobber says the grant itself is no good. Any
+  refusal at all used to set `invalid_at` -- a 500, a rate limit, an unreadable body -- so
+  a moment of trouble at Jobber's end read as a dead token, and an app acting on that could
+  revoke one that still worked. Only an `invalid_grant` Jobber names counts now; everything
+  else raises `Jbr::Error` for the caller to retry, which is what trouble deserves
+- [New] `Jbr::Refused`, a `Jbr::Error` for the grant being no good rather than for the
+  answer failing to arrive. Rescue it to tell the two apart
+- [Change] The token endpoint moved to `Jbr::Token`. `Jbr::OAuth.post` still answers it
+  unchanged, and so do `Jbr::OAuth.client_id` and `Jbr::OAuth.client_secret`
+
 ## [3.2.0] - 2026-08-13
 
 - [New] Wait rather than be refused. Jobber holds an app to two limits at once -- 2,500

data/README.md

@@ -41,6 +41,16 @@ Revoke credentials:
 oauth.delete
 ```
 
+Credentials go bad only when Jobber says so. A refused refresh — the `invalid_grant` Jobber
+names — sets `invalid_at` and answers queries with nothing. Anything else that goes wrong,
+including a 500 or a rate limit, raises `Jbr::Error` instead, because a token that may still
+work is worth more than a tidy failure:
+
+```ruby
+oauth.invalid_at # => 2026-08-13 11:02:41, or nil while the credentials are good
+oauth.query '{ ok }' # => {} once they are refused, raises Jbr::Error where Jobber had trouble
+```
+
 ### Requests
 
 Create a Jobber request, finding or creating a Client with a matching phone number:

data/lib/jbr/oauth.rb

@@ -66,14 +66,7 @@ module Jbr
 
     # Exchange a code or a refresh token for credentials.
     def self.post(params = {})
-      uri = URI 'https://api.getjobber.com/api/oauth/token'
-      response = Net::HTTP.post_form uri,
-        params.merge(client_id: client_id, client_secret: client_secret)
-      raise Error, response.body unless response.is_a? Net::HTTPSuccess
-      output = JSON.parse(response.body)
-      { access_token: output['access_token'], refresh_token: output['refresh_token'],
-        expires_at: (Time.now + output.fetch('expires_in', 3600).to_i),
-      }
+      Token.post params.merge(client_id: client_id, client_secret: client_secret)
     end
 
   private
@@ -85,7 +78,7 @@ module Jbr
       @access_token = output[:access_token]
       @refresh_token = output[:refresh_token]
       @expires_at = output[:expires_at]
-    rescue Error => e
+    rescue Refused
       @invalid_at = Time.now
       false
     end

data/lib/jbr/refused.rb

@@ -0,0 +1,5 @@
+module Jbr
+  # Jobber refusing the grant itself, rather than failing to answer about it. The first is a
+  # token that will never work again; the second may be a moment of trouble at their end.
+  Refused = Class.new Error
+end

data/lib/jbr/token.rb

@@ -0,0 +1,35 @@
+module Jbr
+  # The endpoint that trades an authorization code or a refresh token for credentials.
+  class Token
+    # Where a grant is exchanged.
+    URL = 'https://api.getjobber.com/api/oauth/token'
+
+    # What Jobber calls a grant that is no good, in the OAuth 2 word for it.
+    REFUSAL = 'invalid_grant'
+
+    # Trade a grant for credentials.
+    # @param params [Hash] the grant, and the app making the exchange.
+    # @raise [Refused] where Jobber says the grant itself is no good.
+    # @raise [Error] where Jobber could not answer about it.
+    # @return [Hash] the tokens, and the moment the access one expires.
+    def self.post(params = {})
+      response = Net::HTTP.post_form URI(URL), params
+      raise Refused, response.body if refused? response
+      raise Error, response.body unless response.is_a? Net::HTTPSuccess
+
+      output = JSON.parse response.body
+      { access_token: output['access_token'], refresh_token: output['refresh_token'],
+        expires_at: (Time.now + output.fetch('expires_in', 3600).to_i),
+      }
+    end
+
+    def self.refused?(response)
+      return false if response.is_a? Net::HTTPSuccess
+
+      JSON.parse(response.body)['error'] == REFUSAL
+    rescue JSON::ParserError
+      false
+    end
+    private_class_method :refused?
+  end
+end

data/lib/jbr/version.rb

@@ -1,5 +1,5 @@
 # A Ruby client for the Jobber API.
 module Jbr
   # The version of this gem.
-  VERSION = '3.2.0'
+  VERSION = '3.3.0'
 end

data/lib/jbr.rb

@@ -15,6 +15,8 @@ require 'jbr/mock'
 
 require 'jbr/url'
 require 'jbr/error'
+require 'jbr/refused'
+require 'jbr/token'
 # Phone before Cliental, and Cliental before the records that include it: what each asks
 # Jobber for about a client is built as they load.
 require 'jbr/phone'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jbr
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.3.0
 platform: ruby
 authors:
 - Claudio Baccigalupo
@@ -137,9 +137,11 @@ files:
 - lib/jbr/properted.rb
 - lib/jbr/property.rb
 - lib/jbr/quote.rb
+- lib/jbr/refused.rb
 - lib/jbr/request.rb
 - lib/jbr/resource.rb
 - lib/jbr/throttle.rb
+- lib/jbr/token.rb
 - lib/jbr/url.rb
 - lib/jbr/version.rb
 - lib/jbr/visit.rb