noresponse 10.0.0 → 10.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2e55989c19fddccb91ddc256165c976402eb3d9a5712b00bbb2b0a0a6f1f4afa
-  data.tar.gz: 71626ebd2ea9eb53dda2073c04042a2c845e27c2b0bde7ace9334f59ff1f872b
+  metadata.gz: 47be67d4a5ea5ad8b80822a30612f68c07105ecf68e7c4d2c9589352612ba67a
+  data.tar.gz: 804eb7cbce3840df38b218c7644868aef1692bb0b4557794f725d45687fe097c
 SHA512:
-  metadata.gz: cc890872c6ce60805f9f331962d4b47d2e81bb36974832b5168ef092b8a6aede034c6a3df16667dacdc66730a15a9d51e1bb9dd88ae27b87fbc0fb025798c6d6
-  data.tar.gz: bc2dab6ef691946033ebca01af8fa3718a270b79ff611aca52fb93f7a23811da5fc742eab40c5d511d86e6b35e51613583094de4160acba2ea833a2c4fdb4582
+  metadata.gz: d6a91801af8bbc5d579de77fd601334c6c3e4ea00fe0c06f0be10080d6ada6ff9b74912351927ce924cb77d805fe515b5a0ac7609eb5a380d208128aa64ccb1a
+  data.tar.gz: 41acbf922cadaab5d58f52a99e5372dedd793f842a6eb56bd07a901074f19b5e8b7a0dbf325bffbcb842c0b463411e004471935883264810078a3b99072c50ae

data/lib/no_response/exports.rb

@@ -50,7 +50,7 @@ module NoResponse
     }
     def create(body:, workspace_id:, idempotency_key: nil, timeout_ms: nil, http_headers: nil)
       # create - Request an asynchronous customer export.
-      # Request an encrypted JSON Lines snapshot of retained account or audit records. Requires exports plus history or audit scope; detailed account data also needs evidence or detailed scope. Criteria are frozen and hashed. Each environment permits four active jobs, 64 MiB per artifact, and 256 KiB per chunk. Artifacts expire after 24 hours. Send an Idempotency-Key to safely repeat a request. Every operation checks current permissions and source retention.
+      # Request an encrypted JSON Lines snapshot of retained account or audit records. Requires exports plus history or audit scope. An account export without legacy history needs investigate with evidence or detailed, because it holds submitted identifiers; detailed account data always needs evidence or detailed. Criteria are frozen and hashed. Each environment permits four active jobs, 64 MiB per artifact, and 256 KiB per chunk. Artifacts expire after 24 hours. Send an Idempotency-Key to safely repeat a request. Every operation checks current permissions and source retention.
       request = Models::Operations::CreateCustomerExportRequest.new(
         workspace_id: workspace_id,
         body: body,

data/lib/no_response/late_results.rb

@@ -73,26 +73,81 @@ module NoResponse
       # current risk. A delivery that fails verification raises
       # WebhookVerification::VerificationError before anything is read; any
       # other event, and a test event, does nothing.
+      #
+      # with_account_lock serializes enforcement of one account across your
+      # workers. It is called with the account id and a callable: hold an
+      # exclusive lock on the account, call the callable, store the result's
+      # risk_version and any state change, then release the lock. An exception
+      # must propagate. Inside the lock the handler reads the account's risk and
+      # your state again, so a stale event or listed account cannot undo a newer
+      # decision. Without it, overlapping calls can act on an old decision after
+      # a newer one.
       def handle_risk_change(client, payload, headers, secrets, provider:, get_account_state:, flows: {},
-                             tolerance_seconds: WebhookVerification::DEFAULT_TOLERANCE_SECONDS, now: nil)
+                             tolerance_seconds: WebhookVerification::DEFAULT_TOLERANCE_SECONDS, now: nil,
+                             with_account_lock: nil)
         event = WebhookVerification.construct_event(payload, headers, secrets, tolerance_seconds: tolerance_seconds, now: now)
         if event.type != 'account.risk_changed' || (event.respond_to?(:test) && event.test == true)
           return EnforcementResult.new(event: event, skipped: 'not_actionable', enforcements: [])
         end
 
-        begin
-          account = client.accounts.get(account_id: event.data.account.id).result
-        rescue Models::Errors::NotFoundError
-          return EnforcementResult.new(event: event, skipped: 'account_gone', enforcements: [])
-        end
-        result = enforce_account(client, account, provider: provider, get_account_state: get_account_state, flows: flows)
+        result = under_account_lock(client, event.data.account.id, provider, get_account_state, flows, with_account_lock)
         result.event = event
         result
       end
 
-      # Enforce one account as read: the account a handler fetched, or one from
-      # accounts.list_changed(unenforced: true) when catching up.
-      def enforce_account(client, account, provider:, get_account_state:, flows: {})
+      # Enforce one account: the account a handler fetched, or one from
+      # accounts.list_changed(unenforced: true) when catching up. With
+      # with_account_lock the account is read again inside the lock; without it
+      # the account is enforced as given.
+      def enforce_account(client, account, provider:, get_account_state:, flows: {}, with_account_lock: nil)
+        return under_account_lock(client, account.id, provider, get_account_state, flows, with_account_lock) if with_account_lock
+
+        enforce_as_read(client, account, provider, get_account_state, flows)
+      end
+
+      # Clerk, WorkOS or Auth0, run from the shared action table. token is the
+      # Clerk secret key, WorkOS API key or Auth0 Management API token; domain
+      # is the Auth0 tenant domain. Pass http (a Faraday connection) for a proxy or for tests.
+      def identity_provider(name, token:, domain: nil, base_url: nil, http: nil)
+        name = name.to_s
+        spec = TABLE.fetch('providers')[name] or raise ArgumentError, "unknown identity provider #{name.inspect}"
+        raise ArgumentError, "#{name} needs token" if token.to_s.empty?
+
+        base = base_url || spec.fetch('base_url')
+        if base.include?('{domain}')
+          raise ArgumentError, "#{name} needs domain or base_url" if domain.to_s.empty?
+
+          base = base.sub('{domain}', domain)
+        end
+        TableProvider.new(name, spec, base.sub(%r{/+\z}, ''), token, http || Faraday.new(request: { timeout: 10 }))
+      end
+
+      # Your own user store: one callable per action you support, keyed by
+      # action. A callable may return other actions it ran. An action without one fails.
+      def custom_provider(handlers)
+        CustomProvider.new(handlers.transform_keys(&:to_s))
+      end
+
+      private
+
+      # Read the account's current risk and enforce it, inside with_account_lock when you gave one.
+      def under_account_lock(client, account_id, provider, get_account_state, flows, with_account_lock)
+        enforce = lambda do
+          begin
+            account = client.accounts.get(account_id: account_id).result
+          rescue Models::Errors::NotFoundError
+            next EnforcementResult.new(skipped: 'account_gone', enforcements: [])
+          end
+          enforce_as_read(client, account, provider, get_account_state, flows)
+        end
+        return enforce.call unless with_account_lock
+
+        result = nil
+        with_account_lock.call(account_id, -> { result = enforce.call })
+        result or raise 'with_account_lock returned without running enforce'
+      end
+
+      def enforce_as_read(client, account, provider, get_account_state, flows)
         answer = get_account_state.call(account)
         return EnforcementResult.new(account: account, skipped: 'unknown_user', enforcements: []) if answer.nil?
 
@@ -149,31 +204,6 @@ module NoResponse
         EnforcementResult.new(account: account, state: state, risk_version: risk_version, enforcements: enforcements)
       end
 
-      # Clerk, WorkOS or Auth0, run from the shared action table. token is the
-      # Clerk secret key, WorkOS API key or Auth0 Management API token; domain
-      # is the Auth0 tenant domain. Pass http (a Faraday connection) for a proxy or for tests.
-      def identity_provider(name, token:, domain: nil, base_url: nil, http: nil)
-        name = name.to_s
-        spec = TABLE.fetch('providers')[name] or raise ArgumentError, "unknown identity provider #{name.inspect}"
-        raise ArgumentError, "#{name} needs token" if token.to_s.empty?
-
-        base = base_url || spec.fetch('base_url')
-        if base.include?('{domain}')
-          raise ArgumentError, "#{name} needs domain or base_url" if domain.to_s.empty?
-
-          base = base.sub('{domain}', domain)
-        end
-        TableProvider.new(name, spec, base.sub(%r{/+\z}, ''), token, http || Faraday.new(request: { timeout: 10 }))
-      end
-
-      # Your own user store: one callable per action you support, keyed by
-      # action. A callable may return other actions it ran. An action without one fails.
-      def custom_provider(handlers)
-        CustomProvider.new(handlers.transform_keys(&:to_s))
-      end
-
-      private
-
       # The error_code of a failed action: the provider's code, else its HTTP status, as <provider>.<code>.
       def failure_code(provider, error)
         code = error.respond_to?(:code) ? error.code : nil

data/lib/no_response/lists.rb

@@ -948,7 +948,7 @@ module NoResponse
     }
     def preview(body:, workspace_id:, environment:, retries: nil, timeout_ms: nil, http_headers: nil)
       # preview - Preview a list override change without side effects.
-      # Preview canonical list matches and current override effects with settings or management. The result states its bounded coverage and changes no list entries.
+      # Preview canonical list matches and current override effects with settings or management, plus legacy history, or investigate with evidence or detailed. The result states its bounded coverage and changes no list entries.
       request = Models::Operations::PreviewListRequest.new(
         workspace_id: workspace_id,
         environment: environment,

data/lib/no_response/models/shared/attribute.rb

@@ -0,0 +1,21 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Attribute - name_gender is the records' gender against the submitted first name's usual one.
+      class Attribute
+        include ::Crystalline::Enum
+        enums do
+          BIRTH_DATE = new("birth_date")
+          GENDER = new("gender")
+          NATIONALITY = new("nationality")
+          NAME_GENDER = new("name_gender")
+        end
+
+        open!
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/attribute.rbi

@@ -0,0 +1,9 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::Attribute
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::Attribute
+end

data/lib/no_response/models/shared/risk.rb

@@ -80,6 +80,18 @@ module NoResponse
           Crystalline::Nilable.new(::Integer),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("block_threshold")}}
         )
+        # The score at which this answer's flow starts to recommend step_up. Absent from an answer stored before it was recorded.
+        field(
+          :step_up_threshold,
+          Crystalline::Nilable.new(::Integer),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("step_up_threshold")}}
+        )
+        # The score at which this answer's flow starts to recommend review. An answer nothing answered recommends review below it, with confidence unavailable. Absent from an answer stored before it was recorded.
+        field(
+          :review_threshold,
+          Crystalline::Nilable.new(::Integer),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("review_threshold")}}
+        )
         # Labels the v0 policy as hand-authored and not statistically validated.
         field(
           :policy_basis,
@@ -110,6 +122,8 @@ module NoResponse
             coverage: Models::Shared::RiskCoverage,
             block: T.nilable(T::Boolean),
             block_threshold: T.nilable(::Integer),
+            step_up_threshold: T.nilable(::Integer),
+            review_threshold: T.nilable(::Integer),
             policy_basis: ::String,
             summary: T.nilable(Models::Shared::RiskSummary),
             details: T.nilable(Models::Shared::RiskDetails)
@@ -126,6 +140,8 @@ module NoResponse
           coverage:,
           block: nil,
           block_threshold: nil,
+          step_up_threshold: nil,
+          review_threshold: nil,
           policy_basis: "heuristic_unvalidated",
           summary: nil,
           details: nil
@@ -139,6 +155,8 @@ module NoResponse
           @coverage = coverage
           @block = block
           @block_threshold = block_threshold
+          @step_up_threshold = step_up_threshold
+          @review_threshold = review_threshold
           unless policy_basis == "heuristic_unvalidated"
             raise ArgumentError, "Invalid value for policy_basis"
           end
@@ -160,6 +178,8 @@ module NoResponse
           return false unless @coverage == other.coverage
           return false unless @block == other.block
           return false unless @block_threshold == other.block_threshold
+          return false unless @step_up_threshold == other.step_up_threshold
+          return false unless @review_threshold == other.review_threshold
           return false unless @policy_basis == other.policy_basis
           return false unless @summary == other.summary
           return false unless @details == other.details

data/lib/no_response/models/shared/risk.rbi

@@ -60,6 +60,18 @@ class NoResponse::Models::Shared::Risk
   def block_threshold=(str_)
   end
 
+  def step_up_threshold
+  end
+
+  def step_up_threshold=(str_)
+  end
+
+  def review_threshold
+  end
+
+  def review_threshold=(str_)
+  end
+
   def policy_basis
   end
 

data/lib/no_response/models/shared/riskdetails.rb

@@ -38,6 +38,12 @@ module NoResponse
           Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::OnlineAccount)),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("accounts")}}
         )
+        # What an identity_attribute_conflict reason weighed: each attribute the records disagree on and the sites reporting it. Absent when the reason did not fire, and on an answer stored before conflicts were recorded. No value is served.
+        field(
+          :attribute_conflicts,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::RiskDetailsAttributeConflict)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("attribute_conflicts")}}
+        )
 
         sig {
           params(
@@ -45,16 +51,25 @@ module NoResponse
             breaches: T.nilable(T::Array[Models::Shared::Breach]),
             breach_names: T.nilable(T::Array[Models::Shared::RiskDetailsBreachName]),
             events: T.nilable(T::Array[Models::Shared::RiskDetailsEvent]),
-            accounts: T.nilable(T::Array[Models::Shared::OnlineAccount])
+            accounts: T.nilable(T::Array[Models::Shared::OnlineAccount]),
+            attribute_conflicts: T.nilable(T::Array[Models::Shared::RiskDetailsAttributeConflict])
           )
             .void
         }
-        def initialize(phone_names: nil, breaches: nil, breach_names: nil, events: nil, accounts: nil)
+        def initialize(
+          phone_names: nil,
+          breaches: nil,
+          breach_names: nil,
+          events: nil,
+          accounts: nil,
+          attribute_conflicts: nil
+        )
           @phone_names = phone_names
           @breaches = breaches
           @breach_names = breach_names
           @events = events
           @accounts = accounts
+          @attribute_conflicts = attribute_conflicts
         end
 
         sig { params(other: T.untyped).returns(T::Boolean) }
@@ -65,6 +80,7 @@ module NoResponse
           return false unless @breach_names == other.breach_names
           return false unless @events == other.events
           return false unless @accounts == other.accounts
+          return false unless @attribute_conflicts == other.attribute_conflicts
           true
         end
       end

data/lib/no_response/models/shared/riskdetails.rbi

@@ -35,4 +35,10 @@ class NoResponse::Models::Shared::RiskDetails
 
   def accounts=(str_)
   end
+
+  def attribute_conflicts
+  end
+
+  def attribute_conflicts=(str_)
+  end
 end

data/lib/no_response/models/shared/riskdetailsattributeconflict.rb

@@ -0,0 +1,62 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+
+      class RiskDetailsAttributeConflict
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # name_gender is the records' gender against the submitted first name's usual one.
+        field(
+          :attribute,
+          Models::Shared::Attribute,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("attribute"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Attribute, false)
+            }
+          }
+        )
+        # The domains of the breached sites whose tables report the attribute, newest breach first, at most 32. Absent when none of the tables has a site.
+        field(
+          :sites,
+          Crystalline::Nilable.new(Crystalline::Array.new(::String)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("sites")}}
+        )
+        # How many of the tables reporting the attribute have no site, such as a credential list or a stealer log. Absent when none.
+        field(
+          :unsited,
+          Crystalline::Nilable.new(::Integer),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("unsited")}}
+        )
+
+        sig {
+          params(
+            attribute: Models::Shared::Attribute,
+            sites: T.nilable(T::Array[::String]),
+            unsited: T.nilable(::Integer)
+          )
+            .void
+        }
+        def initialize(attribute:, sites: nil, unsited: nil)
+          @attribute = attribute
+          @sites = sites
+          @unsited = unsited
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @attribute == other.attribute
+          return false unless @sites == other.sites
+          return false unless @unsited == other.unsited
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/riskdetailsattributeconflict.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::RiskDetailsAttributeConflict
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::RiskDetailsAttributeConflict
+  def attribute
+  end
+
+  def attribute=(str_)
+  end
+
+  def sites
+  end
+
+  def sites=(str_)
+  end
+
+  def unsited
+  end
+
+  def unsited=(str_)
+  end
+end

data/lib/no_response/models/shared.rb

@@ -70,6 +70,7 @@ module NoResponse
       autoload :AssessmentUpdatedData, "no_response/models/shared/assessmentupdateddata.rb"
       autoload :AssessmentUpdatedEvent, "no_response/models/shared/assessmentupdatedevent.rb"
       autoload :AssuranceLevel, "no_response/models/shared/assurancelevel.rb"
+      autoload :Attribute, "no_response/models/shared/attribute.rb"
       autoload :AttributeAgreement, "no_response/models/shared/attributeagreement.rb"
       autoload :AuditEvent, "no_response/models/shared/auditevent.rb"
       autoload :AuditEventEvent, "no_response/models/shared/auditeventevent.rb"
@@ -310,6 +311,7 @@ module NoResponse
       autoload :RiskConfidence, "no_response/models/shared/riskconfidence.rb"
       autoload :RiskCoverage, "no_response/models/shared/riskcoverage.rb"
       autoload :RiskDetails, "no_response/models/shared/riskdetails.rb"
+      autoload :RiskDetailsAttributeConflict, "no_response/models/shared/riskdetailsattributeconflict.rb"
       autoload :RiskDetailsBreachName, "no_response/models/shared/riskdetailsbreachname.rb"
       autoload :RiskDetailsEvent, "no_response/models/shared/riskdetailsevent.rb"
       autoload :RiskDetailsEventKind, "no_response/models/shared/riskdetailseventkind.rb"

data/lib/no_response/sdkconfiguration.rb

@@ -95,9 +95,9 @@ module NoResponse
 
       @language = "ruby"
       @openapi_doc_version = "1"
-      @sdk_version = "10.0.0"
+      @sdk_version = "10.0.2"
       @gen_version = "internal"
-      @user_agent = "noresponse-sdk/ruby 10.0.0 internal 1 noresponse"
+      @user_agent = "noresponse-sdk/ruby 10.0.2 internal 1 noresponse"
     end
 
     sig { returns([String, T::Hash[Symbol, String]]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: noresponse
 version: !ruby/object:Gem::Version
-  version: 10.0.0
+  version: 10.0.2
 platform: ruby
 authors:
 - NoResponse
@@ -807,6 +807,8 @@ files:
 - lib/no_response/models/shared/assessmentupdatedevent.rbi
 - lib/no_response/models/shared/assurancelevel.rb
 - lib/no_response/models/shared/assurancelevel.rbi
+- lib/no_response/models/shared/attribute.rb
+- lib/no_response/models/shared/attribute.rbi
 - lib/no_response/models/shared/attributeagreement.rb
 - lib/no_response/models/shared/attributeagreement.rbi
 - lib/no_response/models/shared/auditevent.rb
@@ -1295,6 +1297,8 @@ files:
 - lib/no_response/models/shared/riskcoverage.rbi
 - lib/no_response/models/shared/riskdetails.rb
 - lib/no_response/models/shared/riskdetails.rbi
+- lib/no_response/models/shared/riskdetailsattributeconflict.rb
+- lib/no_response/models/shared/riskdetailsattributeconflict.rbi
 - lib/no_response/models/shared/riskdetailsbreachname.rb
 - lib/no_response/models/shared/riskdetailsbreachname.rbi
 - lib/no_response/models/shared/riskdetailsevent.rb