konfidant 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9defdc63a2d22d69dabe29e0c3639d225348ba9aef1b975a8153e9b7e762179
-  data.tar.gz: 59d2d610234de9ccd59fd02bd3a06f3343375ae6ccc25baab71ad0aab4f98fc9
+  metadata.gz: 2dd0f63c7378b463ca026143137aff868ad08b6e7d8b8a8672120fa283138326
+  data.tar.gz: 9b77783dc745eb9919f0bb864cd506899d2651b957af20da128639329797c5a2
 SHA512:
-  metadata.gz: 81a88c2361ec384f99e7282516a40dd8286fdceed5bce6834a2e219cd4fc5aa8fa5c8cc24b5f70cf794dd25b672a0e35f6fc84e6bdeffcfd59cc20d02cad116a
-  data.tar.gz: 3c4177715e1bcc654e8d90772b4d97abb501449b6f741077c2fc854ef21a927142f1044bbdee8826558f7e61a976a0e9b7c73594f3130b91ecb9fad04615711c
+  metadata.gz: f704dc0b64fdb6820a0a9220f4bbb8abc876d402ee96bffdbac2b4187e53953528ae057661a57da014879ed2dfda51dda32dbc1684a25601b370ec8693d87037
+  data.tar.gz: 5f266d4494ae32900e035b0b75d23150441c9630f006fb6d22263ad7e4edf61736d59e793ea333b82953ffa217b74954dba2dc0ab4545c73aff52be249415571

data/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Konfidant
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -3,8 +3,9 @@
 [![Test](https://github.com/konfidant/sdk-ruby/actions/workflows/test.yml/badge.svg)](https://github.com/konfidant/sdk-ruby/actions/workflows/test.yml)
 [![Codacy Badge](https://app.codacy.com/project/badge/Grade/eb3798f7eb59412abc2bd3ce307760b5)](https://app.codacy.com/gh/konfidant/sdk-ruby/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_grade)
 [![Codacy Badge](https://app.codacy.com/project/badge/Coverage/eb3798f7eb59412abc2bd3ce307760b5)](https://app.codacy.com/gh/konfidant/sdk-ruby/dashboard?utm_source=gh&utm_medium=referral&utm_content=&utm_campaign=Badge_coverage)
+[![Quality gate status](https://sonarcloud.io/api/project_badges/measure?project=konfidant_sdk-ruby&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=konfidant_sdk-ruby)
 
-Official Ruby SDK for the [Konfidant](https://www.konfidant.app) API.
+Official Ruby SDK for the [Konfidant](https://www.konfidant.app?utm_source=github&utm_medium=rubysdk&utm_campaign=github) API.
 
 Konfidant lets you share secrets — text and files — that self-destruct after being read.
 
@@ -150,6 +151,12 @@ Returns `shares` (`Array<Konfidant::Share>` with `type`, `file_size_bytes`, `cre
 `accessed_at`, `created_by`) and `pagination` (`total`, `limit`, `offset`, `has_more`). File names are not
 available: the server never sees them.
 
+### `client.me` → `Konfidant::KeyInfo`
+
+Describes the API key without creating a share: `organization` (`id`, `name`), `api_key` (`name`, `environment`,
+`scopes`, `rate_limit_per_minute`, `expires_at`) and the plan's `limits` (`max_ttl_hours`, `max_file_size_mb`). It
+needs no scope and does not count as an API share. Use it to check a key before storing it.
+
 ### `Konfidant::Knf`
 
 The KNF1 implementation is public for advanced use and interoperability:

data/lib/konfidant/client.rb

@@ -9,6 +9,11 @@ module Konfidant
   # Konfidant API client. All content is encrypted locally (KNF1) before it leaves this process; the key is only
   # ever placed in the returned share link's URL fragment and is never sent to Konfidant.
   class Client
+    CONTENT_TYPE = 'Content-Type'
+    JSON_MIME    = 'application/json'
+    BINARY_MIME  = 'application/octet-stream'
+    private_constant :CONTENT_TYPE, :JSON_MIME, :BINARY_MIME
+
     def initialize(api_key:, base_url: nil, http_timeout: DEFAULT_TIMEOUT)
       raise ArgumentError, 'api_key is required' if api_key.nil? || api_key.empty?
 
@@ -78,7 +83,7 @@ module Konfidant
       req = Net::HTTP::Put.new(uri)
       upload.upload_headers.each { |name, value| req[name] = value.to_s }
       # Only when the server did not specify one: Net::HTTP would otherwise send application/x-www-form-urlencoded.
-      req['Content-Type'] ||= 'application/octet-stream'
+      req[CONTENT_TYPE] ||= BINARY_MIME
       req['Content-Length'] = size.to_s
       if ciphertext.is_a?(String)
         req.body = ciphertext.b
@@ -117,6 +122,27 @@ module Konfidant
       )
     end
 
+    # Describes the API key: its organization, scopes and rate limit, and the plan's share limits. Use it to validate
+    # a key without creating a share. Needs no scope and does not count as an API share.
+    def me
+      body = api_request(:get, '/api/v1/me')
+      key = body['api_key']
+      KeyInfo.new(
+        organization: Organization.new(id: body['organization']['id'], name: body['organization']['name']),
+        api_key:      ApiKeyInfo.new(
+          name:                  key['name'],
+          environment:           key['environment'],
+          scopes:                key['scopes'],
+          rate_limit_per_minute: key['rate_limit_per_minute'],
+          expires_at:            key['expires_at']
+        ),
+        limits:       PlanLimits.new(
+          max_ttl_hours:    body['limits']['max_ttl_hours'],
+          max_file_size_mb: body['limits']['max_file_size_mb']
+        )
+      )
+    end
+
     # Recipient side: fetches the ciphertext behind +share_url+ (consuming its single-use token) and decrypts it
     # locally. Only the token is sent; the key and the API key are not. Raises ApiError (410) if the share was
     # already opened or has expired, KnfError if decryption fails.
@@ -124,8 +150,8 @@ module Konfidant
       origin, token, key = Knf.parse_share_url(share_url)
       uri = URI.parse("#{origin}/api/download")
       req = Net::HTTP::Post.new(uri)
-      req['Content-Type'] = 'application/json'
-      req['Accept']       = 'application/octet-stream'
+      req[CONTENT_TYPE] = JSON_MIME
+      req['Accept']     = BINARY_MIME
       req.body = JSON.generate({ t: token })
 
       ciphertext = handle_response(perform(uri, req))
@@ -177,7 +203,7 @@ module Konfidant
       req = method == :get ? Net::HTTP::Get.new(uri) : Net::HTTP::Post.new(uri)
       req['Authorization'] = "Bearer #{@api_key}"
       if payload
-        req['Content-Type'] = 'application/json'
+        req[CONTENT_TYPE] = JSON_MIME
         req.body = JSON.generate(payload)
       elsif method == :post
         req.body = ''
@@ -188,7 +214,7 @@ module Konfidant
 
     def handle_response(resp)
       content_type = resp['content-type'] || ''
-      body = content_type.include?('application/json') ? parse_json(resp.body) : resp.body
+      body = content_type.include?(JSON_MIME) ? parse_json(resp.body) : resp.body
 
       return body if success?(resp)
 

data/lib/konfidant/knf.rb

@@ -36,6 +36,7 @@ module Konfidant
     META_LENGTH_PREFIX = 4
     CIPHER             = 'aes-256-gcm'.freeze
     KEY_PATTERN        = /\A[A-Za-z0-9_-]{43}\z/
+    METADATA_TRUNCATED = 'Metadata truncated'.freeze
 
     # Result of a successful decryption. +data+ is a binary String; +kind+ is "text" or "file".
     Decrypted = Data.define(:kind, :name, :mime, :data) do
@@ -47,7 +48,7 @@ module Konfidant
       end
     end
 
-    module_function
+    extend self
 
     # 32 random bytes from the OS CSPRNG. Use a fresh key for every share.
     def generate_key
@@ -165,6 +166,8 @@ module Konfidant
       raise ArgumentError, 'Invalid share URL'
     end
 
+    private
+
     # --- internal helpers --------------------------------------------------------------------------------------
 
     def check_key!(key)
@@ -218,10 +221,10 @@ module Konfidant
     end
 
     def decode_stream(stream)
-      raise KnfError, 'Metadata truncated' if stream.bytesize < META_LENGTH_PREFIX
+      raise KnfError, METADATA_TRUNCATED if stream.bytesize < META_LENGTH_PREFIX
 
       meta_length = stream.byteslice(0, META_LENGTH_PREFIX).unpack1('N')
-      raise KnfError, 'Metadata truncated' if META_LENGTH_PREFIX + meta_length > stream.bytesize
+      raise KnfError, METADATA_TRUNCATED if META_LENGTH_PREFIX + meta_length > stream.bytesize
 
       meta = stream.byteslice(META_LENGTH_PREFIX, meta_length)
       kind, name, mime = decode_metadata(meta)
@@ -230,13 +233,13 @@ module Konfidant
     end
 
     def decode_metadata(meta)
-      raise KnfError, 'Metadata truncated' if meta.bytesize < META_FIXED_SIZE
+      raise KnfError, METADATA_TRUNCATED if meta.bytesize < META_FIXED_SIZE
 
       kind = KINDS.key(meta.getbyte(0))
       raise KnfError, 'Unknown content kind' unless kind
 
       name_length = meta.byteslice(1, 2).unpack1('n')
-      raise KnfError, 'Metadata truncated' if 3 + name_length + 2 > meta.bytesize
+      raise KnfError, METADATA_TRUNCATED if 3 + name_length + 2 > meta.bytesize
 
       mime_length = meta.byteslice(3 + name_length, 2).unpack1('n')
       raise KnfError, 'Metadata length mismatch' unless META_FIXED_SIZE + name_length + mime_length == meta.bytesize
@@ -268,9 +271,6 @@ module Konfidant
       value.nil? || value.empty?
     end
 
-    private_class_method :check_key!, :check_chunk_size!, :build_header, :parse_header, :chunk_nonce, :seal,
-                         :open_sealed, :decode_stream, :decode_metadata, :utf8_bytes, :utf8_string, :blank?
-
     # Streaming KNF1 encryptor with an IO-like read interface. #size is the exact ciphertext length, known up front
     # so it can be declared to the server (ciphertext_size) and sent as Content-Length.
     class Encryptor

data/lib/konfidant/types.rb

@@ -24,4 +24,15 @@ module Konfidant
   Pagination = Data.define(:total, :limit, :offset, :has_more)
 
   ListSharesResponse = Data.define(:shares, :pagination)
+
+  # Result of Client#me: the key's organization, the key itself and the plan's share limits.
+  Organization = Data.define(:id, :name)
+
+  # +expires_at+ is nil if the key never expires.
+  ApiKeyInfo = Data.define(:name, :environment, :scopes, :rate_limit_per_minute, :expires_at)
+
+  # +max_file_size_mb+ is the largest file before encryption.
+  PlanLimits = Data.define(:max_ttl_hours, :max_file_size_mb)
+
+  KeyInfo = Data.define(:organization, :api_key, :limits)
 end

data/lib/konfidant/version.rb

@@ -1,3 +1,3 @@
 module Konfidant
-  VERSION = '1.3.0'
+  VERSION = '1.4.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: konfidant
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Konfidant
@@ -85,6 +85,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- LICENSE
 - README.md
 - lib/konfidant.rb
 - lib/konfidant/client.rb