noresponse 2.0.17

data/lib/no_response/late_results.rb

@@ -0,0 +1,301 @@
+# typed: true
+# frozen_string_literal: true
+
+# Late-result handlers. Hand-written beside the generated client.
+#
+# An assessment can be revised after the signup was allowed: a slow source
+# settles and the recommendation rises. NoResponse sends the new version as a
+# signed assessment.updated webhook. LateResults.handle verifies that delivery
+# with Webhooks.construct_event, picks an action from your policy, and acts
+# through the auth provider's admin API: revoke the user's sessions or ban the
+# user.
+#
+# The handler verifies the delivery itself, so it never acts on an unverified
+# event. The provider calls are thin: you pass the credentials, and each
+# action is the provider's documented admin endpoint.
+
+require 'erb'
+require 'json'
+require 'net/http'
+require 'uri'
+require_relative 'webhooks'
+
+module NoResponse
+  module LateResults
+    # What to do to the user. BAN also ends every session.
+    NONE = 'none'
+    REVOKE_SESSIONS = 'revoke_sessions'
+    BAN = 'ban'
+    ACTIONS = [NONE, REVOKE_SESSIONS, BAN].freeze
+
+    # Revoke sessions on review; do nothing on allow or step_up. Banning is opt-in.
+    DEFAULT_POLICY = { 'allow' => NONE, 'step_up' => NONE, 'review' => REVOKE_SESSIONS }.freeze
+
+    RECOMMENDATIONS = %w[allow step_up review].freeze
+
+    # Raised when the provider's admin API refuses a call. Answer the webhook
+    # with a 5xx so NoResponse retries it. The message holds no response body
+    # and no credentials.
+    class ProviderActionError < StandardError
+      attr_reader :provider, :status
+
+      def initialize(provider, status, message)
+        super(message)
+        @provider = provider
+        @status = status
+      end
+    end
+
+    # event is the verified Webhooks::Event. action is the action taken: NONE
+    # when the policy, the event or the user id called for nothing. user_id is
+    # the provider user id acted on, set only when an action was taken. Answer
+    # an endpoint.verification with Webhooks.verification_response(event).
+    Result = Struct.new(:event, :action, :user_id, keyword_init: true)
+
+    class << self
+      # The action your policy names for a verified event. Only a served
+      # assessment with a recommendation can act. policy maps allow, step_up
+      # and review (as strings or symbols) to NONE, REVOKE_SESSIONS or BAN; a
+      # recommendation you leave out does nothing. An unknown action raises
+      # ArgumentError.
+      def action_for(event, policy = DEFAULT_POLICY)
+        return NONE if event.type != 'assessment.updated' || event.expired?
+
+        data = event.data
+        recommendation = data.recommendation || data.risk&.recommendation
+        recommendation = recommendation.to_s
+        return NONE unless RECOMMENDATIONS.include?(recommendation)
+
+        table = policy.to_h.transform_keys(&:to_s)
+        return NONE unless table.key?(recommendation)
+
+        action = table[recommendation]
+        return NONE if action.nil?
+
+        action = action.to_s
+        raise ArgumentError, "unknown late result action #{action}" unless ACTIONS.include?(action)
+
+        action
+      end
+
+      # Verify a webhook delivery and apply your policy to it.
+      #
+      # payload, headers and secrets, plus tolerance_seconds and now, are
+      # exactly what Webhooks.construct_event takes; a delivery that fails
+      # verification raises Webhooks::VerificationError before any provider
+      # call. Deduplicate on result.event.id and ignore versions older than one
+      # you have acted on.
+      #
+      # policy defaults to DEFAULT_POLICY. user_id is an optional callable
+      # (account_id, event) returning the provider user id for the assessment's
+      # account_id; it defaults to the account_id itself, as when you assess
+      # with the provider's user id. Return nil or "" to take no action.
+      def handle(payload, headers, secrets, provider, policy: DEFAULT_POLICY, user_id: nil, **verify)
+        event = Webhooks.construct_event(payload, headers, secrets, **verify)
+        action = action_for(event, policy)
+        return Result.new(event: event, action: NONE) if action == NONE || event.type != 'assessment.updated'
+
+        account_id = event.data.account_id
+        resolved = user_id ? user_id.call(account_id, event) : account_id
+        return Result.new(event: event, action: NONE) if resolved.nil? || resolved.to_s.empty?
+
+        resolved = resolved.to_s
+        if action == BAN
+          provider.ban(resolved)
+        else
+          provider.revoke_sessions(resolved)
+        end
+        Result.new(event: event, action: action, user_id: resolved)
+      end
+
+      # Clerk Backend API. revoke_sessions lists the user's active sessions
+      # (GET /sessions?user_id&status=active) and revokes each
+      # (POST /sessions/{id}/revoke). ban is POST /users/{id}/ban, which
+      # revokes every session and blocks sign-in.
+      #
+      # base_url defaults to https://api.clerk.com/v1. http_client is an
+      # optional callable (method, uri, headers, body) returning
+      # [status, body]; the default uses Net::HTTP.
+      def clerk(secret_key:, base_url: 'https://api.clerk.com/v1', http_client: nil)
+        raise ArgumentError, 'clerk needs secret_key' if secret_key.to_s.empty?
+
+        Clerk.new(Caller.new('clerk', base_url, "Bearer #{secret_key}", http_client))
+      end
+
+      # WorkOS User Management. revoke_sessions pages through
+      # GET /user_management/users/{id}/sessions and revokes each active one
+      # with POST /user_management/sessions/revoke. WorkOS has no block or ban,
+      # so ban revokes the sessions and then deletes the user
+      # (DELETE /user_management/users/{id}); deletion is permanent.
+      #
+      # base_url defaults to https://api.workos.com.
+      def workos(api_key:, base_url: 'https://api.workos.com', http_client: nil)
+        raise ArgumentError, 'workos needs api_key' if api_key.to_s.empty?
+
+        WorkOS.new(Caller.new('workos', base_url, "Bearer #{api_key}", http_client))
+      end
+
+      # Auth0 Management API. revoke_sessions deletes every session
+      # (DELETE /users/{id}/sessions) and refresh token
+      # (DELETE /users/{id}/refresh-tokens). ban first sets blocked: true
+      # (PATCH /users/{id}), then does the same. Pass domain (such as
+      # example.eu.auth0.com; the API is https://{domain}/api/v2) or base_url.
+      # token is a Management API access token with update:users,
+      # delete:sessions and delete:refresh_tokens.
+      def auth0(token:, domain: nil, base_url: nil, http_client: nil)
+        raise ArgumentError, 'auth0 needs token' if token.to_s.empty?
+
+        base = base_url || (domain.to_s.empty? ? nil : "https://#{domain}/api/v2")
+        raise ArgumentError, 'auth0 needs domain or base_url' if base.nil?
+
+        Auth0.new(Caller.new('auth0', base, "Bearer #{token}", http_client))
+      end
+    end
+
+    # One provider HTTP client: base URL, Authorization header, error mapping.
+    class Caller
+      def initialize(name, base_url, authorization, http_client)
+        @name = name
+        @base = base_url.to_s.sub(%r{/+\z}, '')
+        @authorization = authorization
+        @http_client = http_client
+      end
+
+      attr_reader :name
+
+      def call(method, path, query: nil, body: nil, allow_404: false)
+        uri = URI.parse(@base + path)
+        uri.query = URI.encode_www_form(query) if query && !query.empty?
+        headers = { 'Authorization' => @authorization, 'Accept' => 'application/json' }
+        payload = nil
+        unless body.nil?
+          headers['Content-Type'] = 'application/json'
+          payload = JSON.generate(body)
+        end
+        status, text = perform(method, uri, headers, payload)
+        return nil if allow_404 && status == 404
+        raise ProviderActionError.new(@name, status, "#{@name} #{method} #{path} answered #{status}") unless status.between?(200, 299)
+        return nil if text.nil? || text.empty?
+
+        begin
+          JSON.parse(text)
+        rescue JSON::ParserError
+          nil
+        end
+      end
+
+      private
+
+      def perform(method, uri, headers, payload)
+        return @http_client.call(method, uri, headers, payload) if @http_client
+
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == 'https'
+        http.open_timeout = 10
+        http.read_timeout = 30
+        request = Net::HTTPGenericRequest.new(method, !payload.nil?, true, uri.request_uri, headers)
+        request.body = payload unless payload.nil?
+        response = http.start { |connection| connection.request(request) }
+        [response.code.to_i, response.body.to_s]
+      end
+    end
+
+    module Segment
+      def self.encode(id)
+        raise ArgumentError, 'user id must be a non-empty string' unless id.is_a?(String) && !id.empty?
+
+        ERB::Util.url_encode(id)
+      end
+
+      def self.sessions(body)
+        list = body.is_a?(Hash) ? body['data'] : body
+        list.is_a?(Array) ? list.grep(Hash) : []
+      end
+
+      def self.active_ids(list)
+        list.select { |s| s['status'] == 'active' && s['id'].is_a?(String) && !s['id'].empty? }.map { |s| s['id'] }
+      end
+    end
+
+    class Clerk
+      PAGE = 100
+
+      def initialize(caller_)
+        @call = caller_
+      end
+
+      def name = 'clerk'
+
+      def revoke_sessions(user_id)
+        Segment.encode(user_id)
+        active = []
+        (0...1000).each do |round|
+          page = Segment.sessions(@call.call('GET', '/sessions', query: [['user_id', user_id], %w[status active],
+                                                                         ['limit', PAGE.to_s],
+                                                                         ['offset', (round * PAGE).to_s]]))
+          active.concat(Segment.active_ids(page))
+          break if page.length < PAGE
+        end
+        active.each { |id| @call.call('POST', "/sessions/#{ERB::Util.url_encode(id)}/revoke") }
+        nil
+      end
+
+      def ban(user_id)
+        @call.call('POST', "/users/#{Segment.encode(user_id)}/ban")
+        nil
+      end
+    end
+
+    class WorkOS
+      def initialize(caller_)
+        @call = caller_
+      end
+
+      def name = 'workos'
+
+      def revoke_sessions(user_id)
+        user = Segment.encode(user_id)
+        active = []
+        after = T.let(nil, T.nilable(String))
+        1000.times do
+          query = T.let([%w[limit 100]], T::Array[T::Array[String]])
+          query << ['after', after] if after
+          body = @call.call('GET', "/user_management/users/#{user}/sessions", query: query)
+          active.concat(Segment.active_ids(Segment.sessions(body)))
+          nxt = body.is_a?(Hash) && body['list_metadata'].is_a?(Hash) ? body['list_metadata']['after'] : nil
+          break unless nxt.is_a?(String) && !nxt.empty?
+
+          after = nxt
+        end
+        active.each { |id| @call.call('POST', '/user_management/sessions/revoke', body: { 'session_id' => id }) }
+        nil
+      end
+
+      def ban(user_id)
+        revoke_sessions(user_id)
+        @call.call('DELETE', "/user_management/users/#{Segment.encode(user_id)}", allow_404: true)
+        nil
+      end
+    end
+
+    class Auth0
+      def initialize(caller_)
+        @call = caller_
+      end
+
+      def name = 'auth0'
+
+      def revoke_sessions(user_id)
+        user = Segment.encode(user_id)
+        @call.call('DELETE', "/users/#{user}/sessions")
+        @call.call('DELETE', "/users/#{user}/refresh-tokens")
+        nil
+      end
+
+      def ban(user_id)
+        @call.call('PATCH', "/users/#{Segment.encode(user_id)}", body: { 'blocked' => true })
+        revoke_sessions(user_id)
+      end
+    end
+  end
+end

data/lib/no_response/models/callbacks.rb

@@ -0,0 +1,10 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Callbacks
+
+    end
+  end
+end

data/lib/no_response/models/errors/apistatuserror.rb

@@ -0,0 +1,41 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Errors
+
+      # Every error the SDK raises for an API response is a NoResponseError.
+      class NoResponseError < StandardError
+      end
+
+      class APIStatusError < NoResponseError
+        include Crystalline::MetadataFields
+        extend T::Sig
+
+        field :body, T.nilable(::String), {'format_json': {'letter_case': ::NoResponse::Utils.field_name("body")}}
+        field :raw_response, T.nilable(Faraday::Response), {}
+        field(
+          :status_code,
+          T.nilable(::Integer),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("status_code")}}
+        )
+
+        sig { params(status_code: ::Integer, body: ::String, raw_response: Faraday::Response).void }
+        def initialize(status_code:, body:, raw_response:)
+          @status_code = status_code
+          @body = body
+          @raw_response = raw_response
+        end
+
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @status_code == other.status_code
+          return false unless @body == other.body
+          return false unless @raw_response == other.raw_response
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/errors/apistatuserror.rbi

@@ -0,0 +1,30 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Errors::NoResponseError < StandardError
+end
+
+class NoResponse::Models::Errors::APIStatusError < NoResponse::Models::Errors::NoResponseError
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Errors::APIStatusError
+
+  def body
+  end
+
+  def body=(body)
+  end
+
+  def raw_response
+  end
+
+  def raw_response=(raw_response)
+  end
+
+  def status_code
+  end
+
+  def status_code=(status_code)
+  end
+end

data/lib/no_response/models/errors/authenticationerror.rb

@@ -0,0 +1,108 @@
+# typed: true
+# frozen_string_literal: true
+
+require_relative "apistatuserror"
+
+module NoResponse
+  module Models
+    module Errors
+      # HTTP 401 problem document.
+      class AuthenticationError < NoResponse::Models::Errors::NoResponseError
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        field :type, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("type"), required: true}}
+
+        field(
+          :title,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("title"), required: true}}
+        )
+
+        field(
+          :detail,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("detail"), required: true}}
+        )
+        # Machine codes an HTTP 401 answer can carry.
+        field(
+          :code,
+          Models::Shared::AuthenticationErrorCode,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("code"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::AuthenticationErrorCode, false)
+            }
+          }
+        )
+
+        field(
+          :request_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("request_id"), required: true}}
+        )
+
+        field(
+          :status,
+          ::Integer,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("status"), required: true}}
+        )
+
+        field(
+          :instance,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("instance")}}
+        )
+
+        field(
+          :invalid_params,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::ProblemInvalidParam)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("invalid_params")}}
+        )
+
+        sig {
+          params(
+            type: ::String,
+            title: ::String,
+            detail: ::String,
+            code: Models::Shared::AuthenticationErrorCode,
+            request_id: ::String,
+            status: ::Integer,
+            instance: T.nilable(::String),
+            invalid_params: T.nilable(T::Array[Models::Shared::ProblemInvalidParam])
+          )
+            .void
+        }
+        def initialize(type:, title:, detail:, code:, request_id:, status: 401, instance: nil, invalid_params: nil)
+          @type = type
+          @title = title
+          @detail = detail
+          @code = code
+          @request_id = request_id
+          unless status == 401
+            raise ArgumentError, "Invalid value for status"
+          end
+
+          @status = 401
+          @instance = instance
+          @invalid_params = invalid_params
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @type == other.type
+          return false unless @title == other.title
+          return false unless @detail == other.detail
+          return false unless @code == other.code
+          return false unless @request_id == other.request_id
+          return false unless @status == other.status
+          return false unless @instance == other.instance
+          return false unless @invalid_params == other.invalid_params
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/errors/authenticationerror.rbi

@@ -0,0 +1,56 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Errors::AuthenticationError
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Errors::AuthenticationError
+  def type
+  end
+
+  def type=(str_)
+  end
+
+  def title
+  end
+
+  def title=(str_)
+  end
+
+  def detail
+  end
+
+  def detail=(str_)
+  end
+
+  def code
+  end
+
+  def code=(str_)
+  end
+
+  def request_id
+  end
+
+  def request_id=(str_)
+  end
+
+  def status
+  end
+
+  def status=(str_)
+  end
+
+  def instance
+  end
+
+  def instance=(str_)
+  end
+
+  def invalid_params
+  end
+
+  def invalid_params=(str_)
+  end
+end

data/lib/no_response/models/errors/badrequesterror.rb

@@ -0,0 +1,108 @@
+# typed: true
+# frozen_string_literal: true
+
+require_relative "apistatuserror"
+
+module NoResponse
+  module Models
+    module Errors
+      # HTTP 400 problem document.
+      class BadRequestError < NoResponse::Models::Errors::NoResponseError
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        field :type, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("type"), required: true}}
+
+        field(
+          :title,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("title"), required: true}}
+        )
+
+        field(
+          :detail,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("detail"), required: true}}
+        )
+        # Machine codes an HTTP 400 answer can carry.
+        field(
+          :code,
+          Models::Shared::BadRequestErrorCode,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("code"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::BadRequestErrorCode, false)
+            }
+          }
+        )
+
+        field(
+          :request_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("request_id"), required: true}}
+        )
+
+        field(
+          :status,
+          ::Integer,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("status"), required: true}}
+        )
+
+        field(
+          :instance,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("instance")}}
+        )
+
+        field(
+          :invalid_params,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::ProblemInvalidParam)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("invalid_params")}}
+        )
+
+        sig {
+          params(
+            type: ::String,
+            title: ::String,
+            detail: ::String,
+            code: Models::Shared::BadRequestErrorCode,
+            request_id: ::String,
+            status: ::Integer,
+            instance: T.nilable(::String),
+            invalid_params: T.nilable(T::Array[Models::Shared::ProblemInvalidParam])
+          )
+            .void
+        }
+        def initialize(type:, title:, detail:, code:, request_id:, status: 400, instance: nil, invalid_params: nil)
+          @type = type
+          @title = title
+          @detail = detail
+          @code = code
+          @request_id = request_id
+          unless status == 400
+            raise ArgumentError, "Invalid value for status"
+          end
+
+          @status = 400
+          @instance = instance
+          @invalid_params = invalid_params
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @type == other.type
+          return false unless @title == other.title
+          return false unless @detail == other.detail
+          return false unless @code == other.code
+          return false unless @request_id == other.request_id
+          return false unless @status == other.status
+          return false unless @instance == other.instance
+          return false unless @invalid_params == other.invalid_params
+          true
+        end
+      end
+    end
+  end
+end