noresponse 2.0.17

data/lib/no_response/models/shared/assessment.rb

@@ -0,0 +1,235 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # One assessment of one account, as POST /v1/assessments, GET /v1/assessments/{assessment_id} and the assessment.updated webhook return it. status says whether it is final (complete), usable with a source still running (partial) or not yet usable (pending). risk and recommendation are present for complete and partial; assessment_url is present for pending. Keep the highest assessment_version.
+      class Assessment
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the tenant; another tenant's assessment id answers 404.
+        field(
+          :assessment_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_id"), required: true}}
+        )
+        # Your own opaque identifier for the account being checked, scoped to your tenant. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused, as is a JWT; a hex digest such as a SHA-256 is allowed. It travels only in request bodies. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
+        field(
+          :account_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account_id"), required: true}}
+        )
+        # complete: final; nothing is still running. A lane that failed or missed its 10 s deadline stays listed in incomplete_sources, and confidence is lower. partial: a recommendation exists and at least one lane is still running or did not settle (see incomplete_sources). pending: nothing usable before the deadline; no recommendation yet, poll or wait for the webhook.
+        field(
+          :status,
+          Models::Shared::Status,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("status"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Status, false)
+            }
+          }
+        )
+        # Ordinal confidence in the recommendation under the current policy: low, medium, high or unavailable.
+        field(
+          :confidence,
+          Models::Shared::Confidence,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("confidence"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Confidence, false)
+            }
+          }
+        )
+        # The lanes that did not settle, each listed once with a reason; lanes, not sources. In a detailed view a lane is listed exactly when one of its signals did not settle; a standard view carries no signals to match.
+        field(
+          :incomplete_sources,
+          Crystalline::Array.new(Models::Shared::IncompleteSource),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("incomplete_sources"), required: true}}
+        )
+        # Version of the hand-authored heuristic weights that produced the recommendation, for example 'risk-2026-10.7'. A tenant threshold override adds a +t<N> suffix, e.g. 'risk-2026-10.7+t3'.
+        field(
+          :policy_version,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("policy_version"), required: true}}
+        )
+        # Monotonic revision of this assessment. 1 on the synchronous answer; each material change while the assessment is served (an async continuation settling a source, a change of recommendation, confidence or status) increments it. Expiry does not increment it: an expired assessment is gone, not revised, and the expiry webhook carries the last served version.
+        field(
+          :assessment_version,
+          ::Integer,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_version"), required: true}}
+        )
+        # When the assessment was created. Fixed for the life of the assessment: every revision carries the same created_at.
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+
+        field(
+          :updated_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("updated_at"), required: true}}
+        )
+        # After this instant the assessment is no longer served: GET /v1/assessments/{assessment_id} answers 404 and it leaves the account history. It is created_at plus your retention period at creation (default and maximum 365 days) and is fixed per record: a later revision keeps it, and a new assessment for the same account starts its own clock. If you later shorten retention, the effective expiry becomes created_at plus the shorter of the two periods.
+        field(
+          :expires_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("expires_at"), required: true}}
+        )
+
+        field(
+          :timing,
+          Models::Shared::AssessmentTiming,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("timing"), required: true}}
+        )
+        # Version of the body shape.
+        field(
+          :schema_version,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("schema_version"), required: true}}
+        )
+        # An optional provider correlation id, echoed back. It is not an idempotency key. Refuses an exact-shape JWT or a bare 40, 64 or 128 character hex digest; a UUID is accepted.
+        field(
+          :request_id,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("request_id")}}
+        )
+        # The recommended action: allow, step_up or review. Your application applies it.
+        field(
+          :recommendation,
+          Crystalline::Nilable.new(Models::Shared::Recommendation),
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("recommendation"),
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Recommendation, true)
+            }
+          }
+        )
+        # The one risk decision for this event. score is 0 (safe) to 100 (risky): the sum of the weights of the reasons that fired, clamped to 0 to 100, from hand-set versioned weights. Every answer with a recommendation carries it, and the top-level recommendation equals risk.recommendation. It names no source or provider.
+        field(
+          :risk,
+          Crystalline::Nilable.new(Models::Shared::Risk),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("risk")}}
+        )
+        # Detailed view only (response_mode=detailed, which needs the detailed scope): a standard answer omits signals[], and a detailed one always carries it, possibly empty. The body does not name its mode, so that rule is the serving gate's; the schema states the half it can: an answer with risk.details is a detailed view and carries signals[]. At most one signal per (type, source_id, identifier).
+        field(
+          :signals,
+          Crystalline::Nilable.new(Crystalline::Array.new(Models::Shared::Signal)),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("signals")}}
+        )
+        # Labels the v0 policy as hand-authored and not statistically validated.
+        field(
+          :policy_basis,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("policy_basis"), required: true}}
+        )
+        # Server-relative path of the authoritative assessment, GET /v1/assessments/{assessment_id}.
+        field(
+          :assessment_url,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_url")}}
+        )
+
+        sig {
+          params(
+            assessment_id: ::String,
+            account_id: ::String,
+            status: Models::Shared::Status,
+            confidence: Models::Shared::Confidence,
+            incomplete_sources: T::Array[Models::Shared::IncompleteSource],
+            policy_version: ::String,
+            assessment_version: ::Integer,
+            created_at: ::String,
+            updated_at: ::String,
+            expires_at: ::String,
+            timing: Models::Shared::AssessmentTiming,
+            schema_version: ::String,
+            request_id: T.nilable(::String),
+            recommendation: T.nilable(Models::Shared::Recommendation),
+            risk: T.nilable(Models::Shared::Risk),
+            signals: T.nilable(T::Array[Models::Shared::Signal]),
+            policy_basis: ::String,
+            assessment_url: T.nilable(::String)
+          )
+            .void
+        }
+        def initialize(
+          assessment_id:,
+          account_id:,
+          status:,
+          confidence:,
+          incomplete_sources:,
+          policy_version:,
+          assessment_version:,
+          created_at:,
+          updated_at:,
+          expires_at:,
+          timing:,
+          schema_version: "1",
+          request_id: nil,
+          recommendation: nil,
+          risk: nil,
+          signals: nil,
+          policy_basis: "heuristic_unvalidated",
+          assessment_url: nil
+        )
+          @assessment_id = assessment_id
+          @account_id = account_id
+          @status = status
+          @confidence = confidence
+          @incomplete_sources = incomplete_sources
+          @policy_version = policy_version
+          @assessment_version = assessment_version
+          @created_at = created_at
+          @updated_at = updated_at
+          @expires_at = expires_at
+          @timing = timing
+          unless schema_version == "1"
+            raise ArgumentError, "Invalid value for schema_version"
+          end
+
+          @schema_version = "1"
+          @request_id = request_id
+          @recommendation = recommendation
+          @risk = risk
+          @signals = signals
+          unless policy_basis == "heuristic_unvalidated"
+            raise ArgumentError, "Invalid value for policy_basis"
+          end
+
+          @policy_basis = "heuristic_unvalidated"
+          @assessment_url = assessment_url
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @assessment_id == other.assessment_id
+          return false unless @account_id == other.account_id
+          return false unless @status == other.status
+          return false unless @confidence == other.confidence
+          return false unless @incomplete_sources == other.incomplete_sources
+          return false unless @policy_version == other.policy_version
+          return false unless @assessment_version == other.assessment_version
+          return false unless @created_at == other.created_at
+          return false unless @updated_at == other.updated_at
+          return false unless @expires_at == other.expires_at
+          return false unless @timing == other.timing
+          return false unless @schema_version == other.schema_version
+          return false unless @request_id == other.request_id
+          return false unless @recommendation == other.recommendation
+          return false unless @risk == other.risk
+          return false unless @signals == other.signals
+          return false unless @policy_basis == other.policy_basis
+          return false unless @assessment_url == other.assessment_url
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessment.rbi

@@ -0,0 +1,116 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::Assessment
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::Assessment
+  def assessment_id
+  end
+
+  def assessment_id=(str_)
+  end
+
+  def account_id
+  end
+
+  def account_id=(str_)
+  end
+
+  def status
+  end
+
+  def status=(str_)
+  end
+
+  def confidence
+  end
+
+  def confidence=(str_)
+  end
+
+  def incomplete_sources
+  end
+
+  def incomplete_sources=(str_)
+  end
+
+  def policy_version
+  end
+
+  def policy_version=(str_)
+  end
+
+  def assessment_version
+  end
+
+  def assessment_version=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def updated_at
+  end
+
+  def updated_at=(str_)
+  end
+
+  def expires_at
+  end
+
+  def expires_at=(str_)
+  end
+
+  def timing
+  end
+
+  def timing=(str_)
+  end
+
+  def schema_version
+  end
+
+  def schema_version=(str_)
+  end
+
+  def request_id
+  end
+
+  def request_id=(str_)
+  end
+
+  def recommendation
+  end
+
+  def recommendation=(str_)
+  end
+
+  def risk
+  end
+
+  def risk=(str_)
+  end
+
+  def signals
+  end
+
+  def signals=(str_)
+  end
+
+  def policy_basis
+  end
+
+  def policy_basis=(str_)
+  end
+
+  def assessment_url
+  end
+
+  def assessment_url=(str_)
+  end
+end

data/lib/no_response/models/shared/assessmentlist.rb

@@ -0,0 +1,78 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Body of the 200 answer to POST /v1/assessments/query: one page of the calling tenant's unexpired assessments for one account, newest first, each at its latest assessment_version. Every item's account_id equals the page's. An assessment past its expires_at is not listed. next_cursor is present only when another page exists.
+      class AssessmentList
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Your own opaque identifier for the account being checked, scoped to your tenant. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused, as is a JWT; a hex digest such as a SHA-256 is allowed. It travels only in request bodies. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
+        field(
+          :account_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account_id"), required: true}}
+        )
+
+        field(
+          :items,
+          Crystalline::Array.new(Models::Shared::Assessment),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("items"), required: true}}
+        )
+        # Version of the body shape.
+        field(
+          :schema_version,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("schema_version"), required: true}}
+        )
+        # Opaque cursor for the next page, bound to your tenant and the account_id it was issued for. Pass it back unchanged in the next query; a tampered, foreign or expired cursor answers 400 invalid_cursor.
+        field(
+          :next_cursor,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("next_cursor")}}
+        )
+        # Your current retention period, so a consumer knows how far back history reaches. Every item expires no later than its created_at plus this many days.
+        field(
+          :retention_days,
+          Crystalline::Nilable.new(::Integer),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("retention_days")}}
+        )
+
+        sig {
+          params(
+            account_id: ::String,
+            items: T::Array[Models::Shared::Assessment],
+            schema_version: ::String,
+            next_cursor: T.nilable(::String),
+            retention_days: T.nilable(::Integer)
+          )
+            .void
+        }
+        def initialize(account_id:, items:, schema_version: "1", next_cursor: nil, retention_days: 365)
+          @account_id = account_id
+          @items = items
+          unless schema_version == "1"
+            raise ArgumentError, "Invalid value for schema_version"
+          end
+
+          @schema_version = "1"
+          @next_cursor = next_cursor
+          @retention_days = retention_days
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @account_id == other.account_id
+          return false unless @items == other.items
+          return false unless @schema_version == other.schema_version
+          return false unless @next_cursor == other.next_cursor
+          return false unless @retention_days == other.retention_days
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentlist.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentList
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentList
+  def account_id
+  end
+
+  def account_id=(str_)
+  end
+
+  def items
+  end
+
+  def items=(str_)
+  end
+
+  def schema_version
+  end
+
+  def schema_version=(str_)
+  end
+
+  def next_cursor
+  end
+
+  def next_cursor=(str_)
+  end
+
+  def retention_days
+  end
+
+  def retention_days=(str_)
+  end
+end

data/lib/no_response/models/shared/assessmentoutcome.rb

@@ -0,0 +1,61 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The 202 answer of POST /v1/assessments/{assessment_id}/outcomes. A replay with the same Idempotency-Key and body answers the same record.
+      class AssessmentOutcome
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Opaque, server-assigned id of one recorded outcome: 'out_' and a 26-character Crockford base32 ULID. Unique within the tenant.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+        # Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the tenant; another tenant's assessment id answers 404.
+        field(
+          :assessment_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_id"), required: true}}
+        )
+        # What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this tenant for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins.
+        field(
+          :outcome,
+          Models::Shared::Outcome,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("outcome"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Outcome, false)
+            }
+          }
+        )
+        # When NoResponse first recorded the outcome.
+        field(
+          :received_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("received_at"), required: true}}
+        )
+
+        sig {
+          params(id: ::String, assessment_id: ::String, outcome: Models::Shared::Outcome, received_at: ::String).void
+        }
+        def initialize(id:, assessment_id:, outcome:, received_at:)
+          @id = id
+          @assessment_id = assessment_id
+          @outcome = outcome
+          @received_at = received_at
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @assessment_id == other.assessment_id
+          return false unless @outcome == other.outcome
+          return false unless @received_at == other.received_at
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentoutcome.rbi

@@ -0,0 +1,32 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentOutcome
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentOutcome
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def assessment_id
+  end
+
+  def assessment_id=(str_)
+  end
+
+  def outcome
+  end
+
+  def outcome=(str_)
+  end
+
+  def received_at
+  end
+
+  def received_at=(str_)
+  end
+end

data/lib/no_response/models/shared/assessmentoutcomerequest.rb

@@ -0,0 +1,71 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # POST /v1/assessments/{assessment_id}/outcomes body: what the provider later learned about the account it assessed. The assessment is named by the path and the tenant by the API key, so neither is a body member. Idempotency-Key is required and binds the body as it does on POST /v1/assessments.
+      class AssessmentOutcomeRequest
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # What the provider later learned about the assessed account. confirmed_abuse, account_takeover and chargeback report abuse; false_positive and legitimate withdraw an earlier abuse report of this tenant for the assessment; unknown is recorded only. Outcomes are append-only and the latest one recorded for an assessment wins.
+        field(
+          :outcome,
+          Models::Shared::Outcome,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("outcome"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Outcome, false)
+            }
+          }
+        )
+        # When the provider observed the outcome. Defaults to when NoResponse received it.
+        field(
+          :observed_at,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("observed_at")}}
+        )
+        # Your own opaque reference for the outcome, such as a case or ticket id. Stored as given and not interpreted; keep direct identifiers out of it.
+        field(
+          :external_ref,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("external_ref")}}
+        )
+        # Free text for your own records, at most 500 characters. Stored only; it is left out of scoring and answers. Keep personal data out of it. Control characters other than tab and line breaks are refused.
+        field(
+          :notes,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("notes")}}
+        )
+
+        sig {
+          params(
+            outcome: Models::Shared::Outcome,
+            observed_at: T.nilable(::String),
+            external_ref: T.nilable(::String),
+            notes: T.nilable(::String)
+          )
+            .void
+        }
+        def initialize(outcome:, observed_at: nil, external_ref: nil, notes: nil)
+          @outcome = outcome
+          @observed_at = observed_at
+          @external_ref = external_ref
+          @notes = notes
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @outcome == other.outcome
+          return false unless @observed_at == other.observed_at
+          return false unless @external_ref == other.external_ref
+          return false unless @notes == other.notes
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentoutcomerequest.rbi

@@ -0,0 +1,32 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentOutcomeRequest
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentOutcomeRequest
+  def outcome
+  end
+
+  def outcome=(str_)
+  end
+
+  def observed_at
+  end
+
+  def observed_at=(str_)
+  end
+
+  def external_ref
+  end
+
+  def external_ref=(str_)
+  end
+
+  def notes
+  end
+
+  def notes=(str_)
+  end
+end