noresponse 10.0.0 → 10.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e55989c19fddccb91ddc256165c976402eb3d9a5712b00bbb2b0a0a6f1f4afa
-  data.tar.gz: 71626ebd2ea9eb53dda2073c04042a2c845e27c2b0bde7ace9334f59ff1f872b
+  metadata.gz: d4580d3276d8e1a6e9b3d9456c55be2baf736602067bf61df070a896ee39903b
+  data.tar.gz: 768921ebf728b70d51b2241e9ec839917f4791d22e0d0b665537b40d9b8a8aea
 SHA512:
-  metadata.gz: cc890872c6ce60805f9f331962d4b47d2e81bb36974832b5168ef092b8a6aede034c6a3df16667dacdc66730a15a9d51e1bb9dd88ae27b87fbc0fb025798c6d6
-  data.tar.gz: bc2dab6ef691946033ebca01af8fa3718a270b79ff611aca52fb93f7a23811da5fc742eab40c5d511d86e6b35e51613583094de4160acba2ea833a2c4fdb4582
+  metadata.gz: 88f56f17d0374b4df2a7886ee75ee575198c6cae98cf25042f2d4f72708b4311c301d2e6d1dc0a99c8dbe4cb6652c0f48d6c8f2852f0abe8df7a6c8f319feef9
+  data.tar.gz: 2c988fcfe40dc2d6731842e349a229e32b3bf43489adcf4ccaf0af840256208f804c143622412892f899a0b4fdc4de0a6d28e01d80f0b7af971878419da52eeb

data/lib/no_response/exports.rb

@@ -50,7 +50,7 @@ module NoResponse
     }
     def create(body:, workspace_id:, idempotency_key: nil, timeout_ms: nil, http_headers: nil)
       # create - Request an asynchronous customer export.
-      # Request an encrypted JSON Lines snapshot of retained account or audit records. Requires exports plus history or audit scope; detailed account data also needs evidence or detailed scope. Criteria are frozen and hashed. Each environment permits four active jobs, 64 MiB per artifact, and 256 KiB per chunk. Artifacts expire after 24 hours. Send an Idempotency-Key to safely repeat a request. Every operation checks current permissions and source retention.
+      # Request an encrypted JSON Lines snapshot of retained account or audit records. Requires exports plus history or audit scope. An account export without legacy history needs investigate with evidence or detailed, because it holds submitted identifiers; detailed account data always needs evidence or detailed. Criteria are frozen and hashed. Each environment permits four active jobs, 64 MiB per artifact, and 256 KiB per chunk. Artifacts expire after 24 hours. Send an Idempotency-Key to safely repeat a request. Every operation checks current permissions and source retention.
       request = Models::Operations::CreateCustomerExportRequest.new(
         workspace_id: workspace_id,
         body: body,

data/lib/no_response/late_results.rb

@@ -73,26 +73,81 @@ module NoResponse
       # current risk. A delivery that fails verification raises
       # WebhookVerification::VerificationError before anything is read; any
       # other event, and a test event, does nothing.
+      #
+      # with_account_lock serializes enforcement of one account across your
+      # workers. It is called with the account id and a callable: hold an
+      # exclusive lock on the account, call the callable, store the result's
+      # risk_version and any state change, then release the lock. An exception
+      # must propagate. Inside the lock the handler reads the account's risk and
+      # your state again, so a stale event or listed account cannot undo a newer
+      # decision. Without it, overlapping calls can act on an old decision after
+      # a newer one.
       def handle_risk_change(client, payload, headers, secrets, provider:, get_account_state:, flows: {},
-                             tolerance_seconds: WebhookVerification::DEFAULT_TOLERANCE_SECONDS, now: nil)
+                             tolerance_seconds: WebhookVerification::DEFAULT_TOLERANCE_SECONDS, now: nil,
+                             with_account_lock: nil)
         event = WebhookVerification.construct_event(payload, headers, secrets, tolerance_seconds: tolerance_seconds, now: now)
         if event.type != 'account.risk_changed' || (event.respond_to?(:test) && event.test == true)
           return EnforcementResult.new(event: event, skipped: 'not_actionable', enforcements: [])
         end
 
-        begin
-          account = client.accounts.get(account_id: event.data.account.id).result
-        rescue Models::Errors::NotFoundError
-          return EnforcementResult.new(event: event, skipped: 'account_gone', enforcements: [])
-        end
-        result = enforce_account(client, account, provider: provider, get_account_state: get_account_state, flows: flows)
+        result = under_account_lock(client, event.data.account.id, provider, get_account_state, flows, with_account_lock)
         result.event = event
         result
       end
 
-      # Enforce one account as read: the account a handler fetched, or one from
-      # accounts.list_changed(unenforced: true) when catching up.
-      def enforce_account(client, account, provider:, get_account_state:, flows: {})
+      # Enforce one account: the account a handler fetched, or one from
+      # accounts.list_changed(unenforced: true) when catching up. With
+      # with_account_lock the account is read again inside the lock; without it
+      # the account is enforced as given.
+      def enforce_account(client, account, provider:, get_account_state:, flows: {}, with_account_lock: nil)
+        return under_account_lock(client, account.id, provider, get_account_state, flows, with_account_lock) if with_account_lock
+
+        enforce_as_read(client, account, provider, get_account_state, flows)
+      end
+
+      # Clerk, WorkOS or Auth0, run from the shared action table. token is the
+      # Clerk secret key, WorkOS API key or Auth0 Management API token; domain
+      # is the Auth0 tenant domain. Pass http (a Faraday connection) for a proxy or for tests.
+      def identity_provider(name, token:, domain: nil, base_url: nil, http: nil)
+        name = name.to_s
+        spec = TABLE.fetch('providers')[name] or raise ArgumentError, "unknown identity provider #{name.inspect}"
+        raise ArgumentError, "#{name} needs token" if token.to_s.empty?
+
+        base = base_url || spec.fetch('base_url')
+        if base.include?('{domain}')
+          raise ArgumentError, "#{name} needs domain or base_url" if domain.to_s.empty?
+
+          base = base.sub('{domain}', domain)
+        end
+        TableProvider.new(name, spec, base.sub(%r{/+\z}, ''), token, http || Faraday.new(request: { timeout: 10 }))
+      end
+
+      # Your own user store: one callable per action you support, keyed by
+      # action. A callable may return other actions it ran. An action without one fails.
+      def custom_provider(handlers)
+        CustomProvider.new(handlers.transform_keys(&:to_s))
+      end
+
+      private
+
+      # Read the account's current risk and enforce it, inside with_account_lock when you gave one.
+      def under_account_lock(client, account_id, provider, get_account_state, flows, with_account_lock)
+        enforce = lambda do
+          begin
+            account = client.accounts.get(account_id: account_id).result
+          rescue Models::Errors::NotFoundError
+            next EnforcementResult.new(skipped: 'account_gone', enforcements: [])
+          end
+          enforce_as_read(client, account, provider, get_account_state, flows)
+        end
+        return enforce.call unless with_account_lock
+
+        result = nil
+        with_account_lock.call(account_id, -> { result = enforce.call })
+        result or raise 'with_account_lock returned without running enforce'
+      end
+
+      def enforce_as_read(client, account, provider, get_account_state, flows)
         answer = get_account_state.call(account)
         return EnforcementResult.new(account: account, skipped: 'unknown_user', enforcements: []) if answer.nil?
 
@@ -149,31 +204,6 @@ module NoResponse
         EnforcementResult.new(account: account, state: state, risk_version: risk_version, enforcements: enforcements)
       end
 
-      # Clerk, WorkOS or Auth0, run from the shared action table. token is the
-      # Clerk secret key, WorkOS API key or Auth0 Management API token; domain
-      # is the Auth0 tenant domain. Pass http (a Faraday connection) for a proxy or for tests.
-      def identity_provider(name, token:, domain: nil, base_url: nil, http: nil)
-        name = name.to_s
-        spec = TABLE.fetch('providers')[name] or raise ArgumentError, "unknown identity provider #{name.inspect}"
-        raise ArgumentError, "#{name} needs token" if token.to_s.empty?
-
-        base = base_url || spec.fetch('base_url')
-        if base.include?('{domain}')
-          raise ArgumentError, "#{name} needs domain or base_url" if domain.to_s.empty?
-
-          base = base.sub('{domain}', domain)
-        end
-        TableProvider.new(name, spec, base.sub(%r{/+\z}, ''), token, http || Faraday.new(request: { timeout: 10 }))
-      end
-
-      # Your own user store: one callable per action you support, keyed by
-      # action. A callable may return other actions it ran. An action without one fails.
-      def custom_provider(handlers)
-        CustomProvider.new(handlers.transform_keys(&:to_s))
-      end
-
-      private
-
       # The error_code of a failed action: the provider's code, else its HTTP status, as <provider>.<code>.
       def failure_code(provider, error)
         code = error.respond_to?(:code) ? error.code : nil

data/lib/no_response/lists.rb

@@ -948,7 +948,7 @@ module NoResponse
     }
     def preview(body:, workspace_id:, environment:, retries: nil, timeout_ms: nil, http_headers: nil)
       # preview - Preview a list override change without side effects.
-      # Preview canonical list matches and current override effects with settings or management. The result states its bounded coverage and changes no list entries.
+      # Preview canonical list matches and current override effects with settings or management, plus legacy history, or investigate with evidence or detailed. The result states its bounded coverage and changes no list entries.
       request = Models::Operations::PreviewListRequest.new(
         workspace_id: workspace_id,
         environment: environment,

data/lib/no_response/sdkconfiguration.rb

@@ -95,9 +95,9 @@ module NoResponse
 
       @language = "ruby"
       @openapi_doc_version = "1"
-      @sdk_version = "10.0.0"
+      @sdk_version = "10.0.1"
       @gen_version = "internal"
-      @user_agent = "noresponse-sdk/ruby 10.0.0 internal 1 noresponse"
+      @user_agent = "noresponse-sdk/ruby 10.0.1 internal 1 noresponse"
     end
 
     sig { returns([String, T::Hash[Symbol, String]]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: noresponse
 version: !ruby/object:Gem::Version
-  version: 10.0.0
+  version: 10.0.1
 platform: ruby
 authors:
 - NoResponse