jbr 3.7.0 → 3.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8a11f9cbda31f995ef0aa78f55db8502f7f5077fa1703db261f9a7705fea971
-  data.tar.gz: 6d178b20c67e47c33e5d4617b0fc1c8cc5637794de9ce3b4a94c0af407b8bab6
+  metadata.gz: 28dde29d20aa9063e6e24e2226d81bf69ec7593ba99efd8a6f335d9fd83c8a10
+  data.tar.gz: 106b0db3001c4aa10c6ef449d4204c6ad2e4574494b6033e7eadf1d13f3ccc59
 SHA512:
-  metadata.gz: c2696a88809c0e13f8da7b7b49a7cedb59bde16d695f233a5719cac00ff83af779a1aeca7ee106d518b0301ef89bb46049ed54fc86a9b4e6a28c216a5e6c57d7
-  data.tar.gz: 2a50c2a089b340ff61d0723a845d12abc653ef7606e80c9963e20ff62c830ec7541039becb9e4999b883dba6e61b5edb323f96435eca25d2ce1ae6f63866719f
+  metadata.gz: 49a59576a7951bc00a29f4ec861576be2e28e448e53c1be2911dd094ebea9a7715a5e98eb34a2d208538ee63a8bd83b402f71b461e390d38aeb7a8885b816bd1
+  data.tar.gz: d20c5ee0c9ddb0927649b884c45f84b7d7e97e315c54a2fd29c779a1b51c3f3691b5417d79e2dc4297d86f4795966703eb3462794ad0f867a0392cc9e9e4411d

data/CHANGELOG.md

@@ -1,3 +1,15 @@
+## [3.7.1] - 2026-08-17
+
+- [Fix] A refresh token Jobber will not take gives the credentials up, as it always should
+  have. Jobber answers that one in prose and with a 401 — `The provided refresh token is not
+  valid.` — where this gem only recognised the OAuth 2 `invalid_grant` in a JSON body, so it
+  read a dead grant as a bad moment: `invalid_at` was never set, the error escaped to the
+  caller, and an app that persists what it is told kept an authentication that could never work
+  again and retried it forever
+- [Change] Read the body rather than the status, deliberately. Jobber answers 401 to an app
+  whose own client id and secret are wrong just as readily, and giving credentials up over that
+  would disconnect every account at once over one misconfigured app
+
 ## [3.7.0] - 2026-08-17
 
 - [New] `store:`, for credentials several processes hold copies of. A queue of workers each

data/README.md

@@ -67,10 +67,11 @@ Revoke credentials:
 oauth.delete
 ```
 
-Credentials go bad only when Jobber says so. A refused refresh — the `invalid_grant` Jobber
-names — sets `invalid_at` and answers queries with nothing. Anything else that goes wrong,
-including a 500 or a rate limit, raises `Jbr::Error` instead, because a token that may still
-work is worth more than a tidy failure:
+Credentials go bad only when Jobber says so of the grant itself: the `invalid_grant` it names,
+or the 401 it answers a refresh token it will not take. Either sets `invalid_at` and answers
+queries with nothing. Anything else that goes wrong raises `Jbr::Error` instead — a 500, a rate
+limit, and the 401 Jobber answers an app whose own client id and secret are wrong, which is
+every account's grant at once rather than this one's:
 
 ```ruby
 oauth.invalid_at # => 2026-08-13 11:02:41, or nil while the credentials are good

data/lib/jbr/token.rb

@@ -7,6 +7,10 @@ module Jbr
     # What Jobber calls a grant that is no good, in the OAuth 2 word for it.
     REFUSAL = 'invalid_grant'
 
+    # And what it calls one in the prose it answers a refresh token with instead. Specific to
+    # the token rather than to the app, which is the whole reason for reading the body.
+    REFUSAL_TEXT = /refresh token is not valid/
+
     # Trade a grant for credentials.
     # @param params [Hash] the grant, and the app making the exchange.
     # @raise [Refused] where Jobber says the grant itself is no good.
@@ -23,13 +27,21 @@ module Jbr
       }
     end
 
+    # Refused where Jobber turns the grant down rather than failing to answer about it: it names
+    # the word, or it names the token. Never the status on its own — Jobber answers 401 to a
+    # refresh token it will not take and 401 to an app whose own credentials are wrong, and
+    # acting on the second as though it were the first would disconnect every account at once.
     def self.refused?(response)
       return false if response.is_a? Net::HTTPSuccess
 
-      JSON.parse(response.body)['error'] == REFUSAL
+      coded_refusal?(response.body) || REFUSAL_TEXT.match?(response.body.to_s)
+    end
+
+    def self.coded_refusal?(body)
+      JSON.parse(body)['error'] == REFUSAL
     rescue JSON::ParserError
       false
     end
-    private_class_method :refused?
+    private_class_method :refused?, :coded_refusal?
   end
 end

data/lib/jbr/version.rb

@@ -1,5 +1,5 @@
 # A Ruby client for the Jobber API.
 module Jbr
   # The version of this gem.
-  VERSION = '3.7.0'
+  VERSION = '3.7.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jbr
 version: !ruby/object:Gem::Version
-  version: 3.7.0
+  version: 3.7.1
 platform: ruby
 authors:
 - Claudio Baccigalupo