kinetic_sdk 7.0.0.rc3 → 7.0.0.rc5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7728373bd9c4a15c643c54aed99acd289e5f776ee0819c8b14f7aea9ec54c106
-  data.tar.gz: d22c5e6907360c11cb886dfb2c58f5c80c5434fcd2b8d669f846b074a57d78ae
+  metadata.gz: 3fb9f7ab44be718c7df520bdb50bf97e0b33d184340d610608393ab9847834a0
+  data.tar.gz: d8331e8aeefdf808cc55ff2546df6e8edacde76835300d733b32f1cd72eb528b
 SHA512:
-  metadata.gz: 0eaa0e7c58dead1010dbd1bd7964f42cf762a712ab7bc888037e6a8e6709b2af1b2562df834ed0d759cc1e677473ffacad035582b10542baaaf45d58401c4979
-  data.tar.gz: f882b337544ec35443094eb971e821859d9480994ab7200519f090607672bc4e35ae284a04bb84aa2ffdc7fb15f1e6755c9712905c9188c518bb3751a06fdde3
+  metadata.gz: ef422ca2c44ff3b50d13de5a01aeb2c72bd3f1fd76797979da7e30668183591c8919d7d3d3a958db6dfe77010414bcf182ec72fbc108db9c3e875fde249fae2b
+  data.tar.gz: 93edce1847353966e76ef873ab96969dafcadf47ea923f13a492a8def392c6933700d0a44b22d1e790fa956d36ded1abe77bd3c8e4d9d3aa6e4b64f663f95f13

data/CHANGELOG.md

@@ -1,6 +1,65 @@
 # Change Log
 
 
+## [7.0.0.rc5](https://github.com/kineticdata/kinetic-sdk-rb/tree/7.0.0.rc5) (2026-09-01)
+
+**Fixed bugs:**
+
+- Fixed `401 invalid_client` when retrieving a JWT with a client secret containing `+`, `%`
+  or a space, despite correct credentials. The token request now authenticates with
+  `client_secret_post`, sending `client_id` and `client_secret` as form parameters.
+
+  `client_secret_basic` requires both values to be form-urlencoded before base64 encoding
+  (RFC 6749 section 2.3.1), and Spring Authorization Server's
+  `ClientSecretBasicAuthenticationConverter` correspondingly URL-decodes them. The SDK sent
+  them raw, so a `+` in a secret was decoded to a space and the bcrypt comparison failed.
+  Kinetic Coordinator generates integration user passwords from a character set containing
+  `+`, which is why the failure appeared intermittently across tenants.
+
+  `header_basic_auth` is deliberately unchanged. It is shared by every ordinary HTTP Basic
+  user authentication call site, and Core authenticates those with Spring Security's
+  `BasicAuthenticationConverter`, which does not URL-decode. Adding encoding there would
+  break any user whose password contains `+` or `%`.
+
+- The token request no longer sends an Authorization header, and strips any header inherited
+  from the caller, so it cannot compete with the form credentials. This also keeps the client
+  secret out of the SDK's debug log, which prints request headers.
+
+
+## [7.0.0.rc4](https://github.com/kineticdata/kinetic-sdk-rb/tree/7.0.0.rc4) (2026-09-01)
+
+**Breaking changes:**
+
+- `jwt_token` now uses the OAuth 2.0 `client_credentials` grant, a single POST to
+  `/{space_slug}/app/oauth2/token`. Kinetic Platform 7 runs a standards compliant
+  authorization server in which `/app/oauth2/authorize` is an interactive endpoint
+  requiring a browser session, consent, a registered redirect_uri and PKCE, so the
+  previous authorization-code flow returned `400`. The response shape is unchanged:
+  callers reading `jwt_response.content["access_token"]` are unaffected.
+- `jwt_code` has been removed. It drove the authorization-code flow that no longer
+  applies to machine to machine clients.
+- The OAuth client used by the SDK must be registered in the space as a **confidential**
+  client (or with no `clientType`, which defaults to confidential). Public clients and
+  the built in system client register only the `authorization_code` grant and are
+  rejected by the token endpoint.
+
+**Fixed bugs:**
+
+- The OAuth routes are now space scoped (`/{space_slug}/app/oauth2/...`) when the SDK is
+  built from an `:app_server_url` plus a `:space_slug`. The authorization server resolves
+  the space from the request path and rejects requests made outside a space context.
+- OAuth failures now report the `error` and `error_description` from a JSON error, or the
+  `X-Kinetic-CID` correlation id when Core answers with its generic HTML error page,
+  instead of dumping the inspected response object.
+
+**Implemented enhancements:**
+
+- Added the `:oauth_scope` option, defaulting to `full`. Valid scopes are `full`, `read`,
+  `write`, `admin`, `submissions` and `submissions:read`.
+- Added specs covering the token exchange, scope configuration, and the failure modes for
+  both the Integrator and Discussions SDKs.
+
+
 ## [7.0.0.rc3](https://github.com/kineticdata/kinetic-sdk-rb/tree/7.0.0.rc3) (2026-09-01)
 
 **Fixed bugs:**

data/lib/kinetic_sdk/core/core-sdk.rb

@@ -14,7 +14,8 @@ module KineticSdk
     include KineticSdk::Utils::KineticExportUtils
 
     attr_reader :api_url, :username, :options, :password, :proxy_url,
-                :space_slug, :server, :version, :logger
+                :space_slug, :server, :version, :logger, :oauth_url,
+                :oauth_scope
 
     # Initalize the Core SDK with the web server URL, the space user
     # username and password, along with any custom option values.
@@ -55,6 +56,8 @@ module KineticSdk
     #   * :max_redirects (Fixnum) (_defaults to: 5_) maximum number of redirects to follow
     #   * :ssl_ca_file (String) full path to PEM certificate used to verify the server
     #   * :ssl_verify_mode (String) (_defaults to: none_) - none | peer
+    #   * :oauth_scope (String) (_defaults to: full_) scope requested when retrieving a
+    #     JWT - full | read | write | admin | submissions | submissions:read
     #
     # Example: using a configuration file
     #
@@ -154,12 +157,17 @@ module KineticSdk
         @server = options[:app_server_url].chomp('/')
         @api_url = @server + (@space_slug.nil? ? "/app/api/v1" : "/#{@space_slug}/app/api/v1")
         @proxy_url = @space_slug.nil? ? nil : "#{@server}/#{@space_slug}/app/components"
+        # The authorization server resolves the space from the request path, so the
+        # OAuth routes must be space scoped exactly like the API routes.
+        @oauth_url = @server + (@space_slug.nil? ? "/app/oauth2" : "/#{@space_slug}/app/oauth2")
       else
         raise StandardError.new "The :space_slug option is required when using the :space_server_url option" if @space_slug.nil?
         @server = options[:space_server_url].chomp('/')
         @api_url = "#{@server}/app/api/v1"
         @proxy_url = "#{@server}/app/components"
+        @oauth_url = "#{@server}/app/oauth2"
       end
+      @oauth_scope = @options[:oauth_scope] || @options["oauth_scope"] || "full"
       @version = 1
     end
 

data/lib/kinetic_sdk/core/lib/jwt.rb

@@ -1,55 +1,94 @@
 module KineticSdk
   class Core
 
-    # Gets an authentication token
+    # Gets an authentication token using the OAuth 2.0 client credentials grant.
+    #
+    # Kinetic Platform 7 runs a standards compliant authorization server, in which
+    # `/app/oauth2/authorize` is an interactive endpoint: it expects an authenticated
+    # browser session, a consent round trip, a registered redirect_uri, and PKCE. A
+    # machine to machine client cannot drive it, and should not try - it exchanges its
+    # own credentials for a token directly at the token endpoint instead.
+    #
+    # The OAuth client must be registered in the space as a confidential client (or with
+    # no clientType, which defaults to confidential) so that it carries the
+    # `client_credentials` grant. Public clients and the built in system client support
+    # only `authorization_code`, and will be rejected here.
+    #
+    # The client authenticates with `client_secret_post`, sending its credentials as form
+    # parameters rather than in an Authorization header. `client_secret_basic` requires the
+    # credentials to be form-urlencoded before base64 encoding (RFC 6749 section 2.3.1), which
+    # the shared `header_basic_auth` helper does not do - and must not start doing, because
+    # ordinary HTTP Basic user authentication takes credentials raw. A secret containing "+"
+    # would otherwise reach the server with that "+" decoded to a space.
     #
     # @param client_id [String] the oauth client id
     # @param client_secret [String] the oauth client secret
-    # @param headers [Hash] hash of headers to send, default is basic authentication and accept JSON content type
+    # @param headers [Hash] additional headers to send. The Accept and Content-Type headers
+    #   required by the token endpoint always take precedence, and any Authorization header
+    #   is removed so it cannot compete with the form credentials.
+    # @param scope [String] scope to request, defaults to the +:oauth_scope+ option (+full+)
     # @return [KineticSdk::Utils::KineticHttpResponse] object, with +code+, +message+, +content_string+, and +content+ properties
-    def jwt_token(client_id, client_secret, headers = default_headers)
-      # retrieve the jwt code
-      jwt_code = jwt_code(client_id, headers)
-      # retrieve the jwt token
+    def jwt_token(client_id, client_secret, headers = {}, scope = oauth_scope)
       @logger.info("Retrieving JWT authorization token")
-      url = "#{@server}/app/oauth2/token?grant_type=authorization_code&response_type=token&client_id=#{client_id}&code=#{jwt_code}"
-      token_headers = header_accept_json.merge(header_basic_auth(client_id, client_secret))
-      response = post(url, {}, token_headers, { :max_redirects => 0 })
+      url = "#{@oauth_url}/token"
+
+      # The required headers are merged last so a caller cannot override them. Any inherited
+      # Authorization header (the SDK user's basic auth, for instance) is dropped: the
+      # authorization server would read it as a competing client authentication.
+      token_headers = headers
+        .merge(header_accept_json)
+        .merge({ "Content-Type" => "application/x-www-form-urlencoded" })
+      token_headers.delete_if { |key, _value| key.to_s.casecmp("authorization").zero? }
+
+      # URI.encode_www_form applies the same application/x-www-form-urlencoded rules the
+      # server decodes with, so "+", "%", ":" and spaces in a secret survive the round trip.
+      payload = {
+        "grant_type" => "client_credentials",
+        "client_id" => client_id,
+        "client_secret" => client_secret,
+      }
+      payload["scope"] = scope unless scope.nil? || scope.to_s.empty?
 
-      if response.status == 401
-        raise StandardError.new "#{response.message}, the oauth client id and secret are invalid."
-      elsif response.status == 200
+      # Redirects are not followed: the token endpoint has no reason to redirect, and
+      # following one would forward the client credentials to another host.
+      response = post(url, URI.encode_www_form(payload), token_headers, { :max_redirects => 0 })
+
+      case response.status
+      when 200
         response
+      when 401
+        raise StandardError.new(
+          "Unable to retrieve token: #{oauth_error_message(response)}. The oauth client id " \
+          "and secret are invalid, or no such client is registered in this space."
+        )
       else
-        raise StandardError.new "Unable to retrieve token: #{response}"
+        raise StandardError.new("Unable to retrieve token: #{oauth_error_message(response)}")
       end
     end
 
-    # Gets an authentication code.
+    private
+
+    # Builds an actionable message from an OAuth error response.
     #
-    # This method should really never need to be called externally.
+    # The authorization server answers most failures with a JSON OAuth error, but falls
+    # back to Core's generic HTML error page for others. That page carries no error code,
+    # only a correlation id in the X-Kinetic-CID response header, which is what is needed
+    # to find the matching entry in the server log.
     #
-    # @param client_id [String]
-    # @param headers [Hash] hash of headers to send, default is basic authentication and accept JSON content type
-    # @return [KineticSdk::Utils::KineticHttpResponse] object, with +code+, +message+, +content_string+, and +content+ properties
-    def jwt_code(client_id, headers = default_headers)
-      @logger.info("Retrieving JWT authorization code")
-      url = "#{@server}/app/oauth2/authorize?grant_type=authorization_code&response_type=code&client_id=#{client_id}"
-      response = post(url, {}, headers, { :max_redirects => -1 })
-
-      if response.status == 401
-        raise StandardError.new "#{response.message}: #{response.content["error"]}"
-      elsif response.status == 302 || response.status == 303
-        location = response.headers["location"]
-        if location.nil?
-          raise StandardError.new "Unable to retrieve code: #{response.inspect}"
-        elsif !location.include?("?code=")
-          raise StandardError.new "Unable to retrieve code, the authorize endpoint redirected to #{location} without an authorization code."
-        else
-          location.split("?code=").last.split("#/").first
-        end
+    # @param response [KineticSdk::Utils::KineticHttpResponse] the failed response
+    # @return [String] a single line description of the failure
+    def oauth_error_message(response)
+      content = response.content.is_a?(Hash) ? response.content : {}
+      if content["error"]
+        message = "#{response.status} #{content["error"]}"
+        message += " - #{content["error_description"]}" if content["error_description"]
+        message
       else
-        raise StandardError.new "Unable to retrieve code #{response.inspect}"
+        message = "#{response.status} #{response.message}"
+        headers = response.headers
+        correlation_id = headers.is_a?(Hash) ? headers["x-kinetic-cid"] : nil
+        message += " (correlation id #{correlation_id})" if correlation_id
+        message
       end
     end
   end

data/lib/kinetic_sdk/version.rb

@@ -3,5 +3,5 @@ module KineticSdk
   # Version of Kinetic SDK
   #
   # @return [String] Version of the SDK
-  VERSION = "7.0.0.rc3"
+  VERSION = "7.0.0.rc5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kinetic_sdk
 version: !ruby/object:Gem::Version
-  version: 7.0.0.rc3
+  version: 7.0.0.rc5
 platform: ruby
 authors:
 - Kinetic Data
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-01 00:00:00.000000000 Z
+date: 2026-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: slugify