jbr 3.7.0 → 3.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8a11f9cbda31f995ef0aa78f55db8502f7f5077fa1703db261f9a7705fea971
-  data.tar.gz: 6d178b20c67e47c33e5d4617b0fc1c8cc5637794de9ce3b4a94c0af407b8bab6
+  metadata.gz: e017275cf5a3a41647f3817608327ddf8fa909c2fdf25e1f8c2a43ee1ad3b044
+  data.tar.gz: 1d01c835b75bd16cd21b8d4e658644520cc065c0659b1f394f105e02775b8f69
 SHA512:
-  metadata.gz: c2696a88809c0e13f8da7b7b49a7cedb59bde16d695f233a5719cac00ff83af779a1aeca7ee106d518b0301ef89bb46049ed54fc86a9b4e6a28c216a5e6c57d7
-  data.tar.gz: 2a50c2a089b340ff61d0723a845d12abc653ef7606e80c9963e20ff62c830ec7541039becb9e4999b883dba6e61b5edb323f96435eca25d2ce1ae6f63866719f
+  metadata.gz: 89e55dd309b839918c67d79ee4c761d28cacb3f2c0dba30daa996354b0a22c4436aa52928dbfb7208df62609073157f77e42f7349943f4f58a2910dea1f43f00
+  data.tar.gz: 2cd3bf9d534e4fbb349debe3643aad4a62982e5780e27e558214594ffe9d536413bc5e8d837976d832422011b5da9be146bd9998492f6c33d99011274c213ef5

data/CHANGELOG.md

@@ -1,3 +1,22 @@
+## [3.7.2] - 2026-08-17
+
+- [Change] Jobber's token endpoint answers in prose, so that is all this reads. 3.7.1 kept a
+  branch for the OAuth 2 `invalid_grant` in a JSON body, guarded by a rescue for a body that
+  would not parse — and every failure body Jobber has ever been seen to send is prose, so the
+  rescue was the path and the branch it protected had never once been taken. Both are gone
+
+## [3.7.1] - 2026-08-17
+
+- [Fix] A refresh token Jobber will not take gives the credentials up, as it always should
+  have. Jobber answers that one in prose and with a 401 — `The provided refresh token is not
+  valid.` — where this gem only recognised the OAuth 2 `invalid_grant` in a JSON body, so it
+  read a dead grant as a bad moment: `invalid_at` was never set, the error escaped to the
+  caller, and an app that persists what it is told kept an authentication that could never work
+  again and retried it forever
+- [Change] Read the body rather than the status, deliberately. Jobber answers 401 to an app
+  whose own client id and secret are wrong just as readily, and giving credentials up over that
+  would disconnect every account at once over one misconfigured app
+
 ## [3.7.0] - 2026-08-17
 
 - [New] `store:`, for credentials several processes hold copies of. A queue of workers each

data/README.md

@@ -67,10 +67,11 @@ Revoke credentials:
 oauth.delete
 ```
 
-Credentials go bad only when Jobber says so. A refused refresh — the `invalid_grant` Jobber
-names — sets `invalid_at` and answers queries with nothing. Anything else that goes wrong,
-including a 500 or a rate limit, raises `Jbr::Error` instead, because a token that may still
-work is worth more than a tidy failure:
+Credentials go bad only when Jobber says so of the grant itself — `The provided refresh token
+is not valid.` — which sets `invalid_at` and answers queries with nothing. Anything else that
+goes wrong raises `Jbr::Error` instead: a 500, a rate limit, and the 401 Jobber answers an app
+whose own client id and secret are wrong, which is every account's grant at once rather than
+this one's:
 
 ```ruby
 oauth.invalid_at # => 2026-08-13 11:02:41, or nil while the credentials are good

data/lib/jbr/token.rb

@@ -4,8 +4,10 @@ module Jbr
     # Where a grant is exchanged.
     URL = 'https://api.getjobber.com/api/oauth/token'
 
-    # What Jobber calls a grant that is no good, in the OAuth 2 word for it.
-    REFUSAL = 'invalid_grant'
+    # What Jobber says of a grant it will not take, in the prose it answers with. About the
+    # token rather than about the app, which is what tells it from the 401 a wrong client id and
+    # secret get — and that one is every account at once rather than this one.
+    REFUSAL = /refresh token is not valid/
 
     # Trade a grant for credentials.
     # @param params [Hash] the grant, and the app making the exchange.
@@ -14,7 +16,7 @@ module Jbr
     # @return [Hash] the tokens, and the moment the access one expires.
     def self.post(params = {})
       response = Net::HTTP.post_form URI(URL), params
-      raise Refused, response.body if refused? response
+      raise Refused, response.body if REFUSAL.match? response.body
       raise Error, response.body unless response.is_a? Net::HTTPSuccess
 
       output = JSON.parse response.body
@@ -22,14 +24,5 @@ module Jbr
         expires_at: (Time.now + output.fetch('expires_in', 3600).to_i),
       }
     end
-
-    def self.refused?(response)
-      return false if response.is_a? Net::HTTPSuccess
-
-      JSON.parse(response.body)['error'] == REFUSAL
-    rescue JSON::ParserError
-      false
-    end
-    private_class_method :refused?
   end
 end

data/lib/jbr/version.rb

@@ -1,5 +1,5 @@
 # A Ruby client for the Jobber API.
 module Jbr
   # The version of this gem.
-  VERSION = '3.7.0'
+  VERSION = '3.7.2'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: jbr
 version: !ruby/object:Gem::Version
-  version: 3.7.0
+  version: 3.7.2
 platform: ruby
 authors:
 - Claudio Baccigalupo