noresponse 2.0.18 → 2.1.0

data/lib/no_response/models/shared/assessmentauthcontext.rb

@@ -0,0 +1,121 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The identity fields of the auth context the assessment was made with, echoed for the tenant's own correlation: the request's auth_context, or the one a hosted provider hook (POST /hooks/{integration_id}) built, with transport provider_hook and its hook_point. Present exactly when the request carried an auth_context, and the same on every revision of the assessment. Values are as the request or the hook sent them; tokens, timestamps, roles and scopes are not echoed, and the echo does not change the score.
+      class AssessmentAuthContext
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The provider slug the context named.
+        field(
+          :provider,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("provider"), required: true}}
+        )
+        # The issuer the context named.
+        field(
+          :issuer,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("issuer"), required: true}}
+        )
+        # The verified flag the context carried. A provider_hook context is always false.
+        field(
+          :verified,
+          Crystalline::Boolean.new,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("verified"), required: true}}
+        )
+        # Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook.
+        field(
+          :transport,
+          Models::Shared::Transport,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("transport"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Transport, false)
+            }
+          }
+        )
+        # The subject the context named; absent when it named none (a pre_registration hook).
+        field(
+          :subject,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("subject")}}
+        )
+        # The session identifier the context named, when it named one.
+        field(
+          :session_id,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("session_id")}}
+        )
+        # The organization identifier the context named, when it named one.
+        field(
+          :organization_id,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("organization_id")}}
+        )
+        # The provider event a provider_hook context was sent for; absent for any other transport.
+        field(
+          :hook_point,
+          Crystalline::Nilable.new(Models::Shared::HookPoint),
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("hook_point"),
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::HookPoint, true)
+            }
+          }
+        )
+
+        sig {
+          params(
+            provider: ::String,
+            issuer: ::String,
+            verified: T::Boolean,
+            transport: Models::Shared::Transport,
+            subject: T.nilable(::String),
+            session_id: T.nilable(::String),
+            organization_id: T.nilable(::String),
+            hook_point: T.nilable(Models::Shared::HookPoint)
+          )
+            .void
+        }
+        def initialize(
+          provider:,
+          issuer:,
+          verified:,
+          transport:,
+          subject: nil,
+          session_id: nil,
+          organization_id: nil,
+          hook_point: nil
+        )
+          @provider = provider
+          @issuer = issuer
+          @verified = verified
+          @transport = transport
+          @subject = subject
+          @session_id = session_id
+          @organization_id = organization_id
+          @hook_point = hook_point
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @provider == other.provider
+          return false unless @issuer == other.issuer
+          return false unless @verified == other.verified
+          return false unless @transport == other.transport
+          return false unless @subject == other.subject
+          return false unless @session_id == other.session_id
+          return false unless @organization_id == other.organization_id
+          return false unless @hook_point == other.hook_point
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentauthcontext.rbi

@@ -0,0 +1,56 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentAuthContext
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentAuthContext
+  def provider
+  end
+
+  def provider=(str_)
+  end
+
+  def issuer
+  end
+
+  def issuer=(str_)
+  end
+
+  def verified
+  end
+
+  def verified=(str_)
+  end
+
+  def transport
+  end
+
+  def transport=(str_)
+  end
+
+  def subject
+  end
+
+  def subject=(str_)
+  end
+
+  def session_id
+  end
+
+  def session_id=(str_)
+  end
+
+  def organization_id
+  end
+
+  def organization_id=(str_)
+  end
+
+  def hook_point
+  end
+
+  def hook_point=(str_)
+  end
+end

data/lib/no_response/models/shared/assessmentquery.rb

@@ -28,7 +28,7 @@ module NoResponse
           {
             'format_json': {
               'letter_case': ::NoResponse::Utils.field_name("response_mode"),
-              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::ResponseMode, true)
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::ResponseMode, true)
             }
           }
         )

data/lib/no_response/models/shared/assessmentrequest.rb

@@ -46,7 +46,7 @@ module NoResponse
           {
             'format_json': {
               'letter_case': ::NoResponse::Utils.field_name("response_mode"),
-              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::ResponseMode, true)
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::ResponseMode, true)
             }
           }
         )

data/lib/no_response/models/shared/authcontext.rb

@@ -128,25 +128,25 @@ module NoResponse
           Crystalline::Nilable.new(Crystalline::Boolean.new),
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("impersonated")}}
         )
-        # Where this context was derived. Backend is the trusted integration path; browser values are treated as weak hints. provider_hook is a hosted provider hook (an Auth0 or WorkOS Action) calling at hook_point; it needs hook_point and verified false, and its authentication facts are not scored.
+        # Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook.
         field(
           :transport,
           Crystalline::Nilable.new(Models::Shared::Transport),
           {
             'format_json': {
               'letter_case': ::NoResponse::Utils.field_name("transport"),
-              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::Transport, true)
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::Transport, true)
             }
           }
         )
-        # The provider event a provider_hook context was sent for. pre_registration runs before the user exists, so subject and the request's account_id may be absent there. Sent only with transport provider_hook.
+        # The provider event a provider_hook context was sent for; absent for any other transport.
         field(
           :hook_point,
           Crystalline::Nilable.new(Models::Shared::HookPoint),
           {
             'format_json': {
               'letter_case': ::NoResponse::Utils.field_name("hook_point"),
-              'decoder': ::NoResponse::Utils.enum_from_string(Models::Shared::HookPoint, true)
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::HookPoint, true)
             }
           }
         )

data/lib/no_response/models/shared/badrequesterrorcode.rb

@@ -11,6 +11,7 @@ module NoResponse
           INVALID_REQUEST = new("invalid_request")
           INVALID_IDEMPOTENCY_KEY = new("invalid_idempotency_key")
           INVALID_CURSOR = new("invalid_cursor")
+          WEBHOOK_URL_REFUSED = new("webhook_url_refused")
         end
 
         open!

data/lib/no_response/models/shared/conflicterrorcode.rb

@@ -10,6 +10,8 @@ module NoResponse
         enums do
           IDEMPOTENCY_KEY_REUSED = new("idempotency_key_reused")
           KEY_ROTATION_IN_PROGRESS = new("key_rotation_in_progress")
+          WEBHOOK_ENDPOINT_LIMIT_REACHED = new("webhook_endpoint_limit_reached")
+          WEBHOOK_ENDPOINT_UNVERIFIED = new("webhook_endpoint_unverified")
           TOO_MANY_INTEGRATIONS = new("too_many_integrations")
         end
 

data/lib/no_response/models/shared/hookpoint.rb

@@ -4,8 +4,9 @@
 module NoResponse
   module Models
     module Shared
-      # HookPoint - The provider event a provider_hook context was sent for. pre_registration runs before the user exists, so subject and the request's account_id may be absent there. Sent only with transport provider_hook.
-      class HookPoint < T::Enum
+      # HookPoint - The provider event a provider_hook context was sent for; absent for any other transport.
+      class HookPoint
+        include ::Crystalline::Enum
         enums do
           PRE_REGISTRATION = new("pre_registration")
           POST_REGISTRATION = new("post_registration")
@@ -13,6 +14,8 @@ module NoResponse
           POST_LOGIN = new("post_login")
           TOKEN_ISSUANCE = new("token_issuance")
         end
+
+        open!
       end
     end
   end

data/lib/no_response/models/shared/responsemode.rb

@@ -5,11 +5,14 @@ module NoResponse
   module Models
     module Shared
       # ResponseMode - standard returns the consolidated risk response; detailed adds merged provider-neutral facts when the key has detailed scope. There is no raw mode.
-      class ResponseMode < T::Enum
+      class ResponseMode
+        include ::Crystalline::Enum
         enums do
           STANDARD = new("standard")
           DETAILED = new("detailed")
         end
+
+        open!
       end
     end
   end

data/lib/no_response/models/shared/security.rb

@@ -11,12 +11,12 @@ module NoResponse
 
         field(
           :api_key,
-          ::String,
+          Crystalline::Nilable.new(::String),
           {'security': {'scheme': true, 'type': "http", 'sub_type': "bearer", 'field_name': "Authorization"}}
         )
 
-        sig { params(api_key: ::String).void }
-        def initialize(api_key:)
+        sig { params(api_key: T.nilable(::String)).void }
+        def initialize(api_key: nil)
           @api_key = api_key
         end
 

data/lib/no_response/models/shared/signingkey.rb

@@ -0,0 +1,49 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # One signing key, by id. The secret is not included.
+      class SigningKey
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The signing key id, sent as NR-Webhook-Key-Id on every delivery it signs.
+        field(
+          :key_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("key_id"), required: true}}
+        )
+
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+        # Present on a key a rotation replaced: it stops verifying at this instant, 7 days after the rotation. Absent on the key that signs.
+        field(
+          :expires_at,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("expires_at")}}
+        )
+
+        sig { params(key_id: ::String, created_at: ::String, expires_at: T.nilable(::String)).void }
+        def initialize(key_id:, created_at:, expires_at: nil)
+          @key_id = key_id
+          @created_at = created_at
+          @expires_at = expires_at
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @key_id == other.key_id
+          return false unless @created_at == other.created_at
+          return false unless @expires_at == other.expires_at
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/signingkey.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::SigningKey
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::SigningKey
+  def key_id
+  end
+
+  def key_id=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def expires_at
+  end
+
+  def expires_at=(str_)
+  end
+end

data/lib/no_response/models/shared/signingsecret.rb

@@ -0,0 +1,49 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # A newly issued signing key with its secret, shown only in this answer. A receiver verifies NR-Webhook-Signature with the secret's UTF-8 bytes as the HMAC-SHA256 key.
+      class SigningSecret
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The signing key id, sent as NR-Webhook-Key-Id on every delivery it signs.
+        field(
+          :key_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("key_id"), required: true}}
+        )
+        # The signing secret: 32 random bytes as 43 characters of unpadded base64url. It is not stored in readable form or returned again.
+        field(
+          :secret,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("secret"), required: true}}
+        )
+
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+
+        sig { params(key_id: ::String, secret: ::String, created_at: ::String).void }
+        def initialize(key_id:, secret:, created_at:)
+          @key_id = key_id
+          @secret = secret
+          @created_at = created_at
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @key_id == other.key_id
+          return false unless @secret == other.secret
+          return false unless @created_at == other.created_at
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/signingsecret.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::SigningSecret
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::SigningSecret
+  def key_id
+  end
+
+  def key_id=(str_)
+  end
+
+  def secret
+  end
+
+  def secret=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+end

data/lib/no_response/models/shared/transport.rb

@@ -4,13 +4,16 @@
 module NoResponse
   module Models
     module Shared
-      # Transport - Where this context was derived. Backend is the trusted integration path; browser values are treated as weak hints. provider_hook is a hosted provider hook (an Auth0 or WorkOS Action) calling at hook_point; it needs hook_point and verified false, and its authentication facts are not scored.
-      class Transport < T::Enum
+      # Transport - Where the context was derived: backend (also when the request named no transport), browser, or provider_hook for a hosted provider hook.
+      class Transport
+        include ::Crystalline::Enum
         enums do
           BACKEND = new("backend")
           BROWSER = new("browser")
           PROVIDER_HOOK = new("provider_hook")
         end
+
+        open!
       end
     end
   end

data/lib/no_response/models/shared/webhookendpoint.rb

@@ -0,0 +1,100 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # One of the tenant's registered webhook endpoints. Signing secrets are not part of it: a secret is shown once, when it is issued (POST /v1/webhooks and POST /v1/webhooks/{endpoint_id}/rotate).
+      class WebhookEndpoint
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Opaque id of the endpoint registration.
+        field(
+          :endpoint_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("endpoint_id"), required: true}}
+        )
+        # The destination URL, as registered.
+        field :url, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("url"), required: true}}
+        # unverified until the endpoint echoes an endpoint.verification challenge (send one with POST /v1/webhooks/{endpoint_id}/test); verified receives assessment.updated events; disabled after 72 hours of continuous delivery failure, and verified again by the same challenge.
+        field(
+          :state,
+          Models::Shared::WebhookEndpointState,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("state"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::WebhookEndpointState, false)
+            }
+          }
+        )
+        # standard returns the consolidated risk response; detailed adds merged provider-neutral facts when the key has detailed scope. There is no raw mode.
+        field(
+          :response_mode,
+          Models::Shared::ResponseMode,
+          {
+            'format_json': {
+              'letter_case': ::NoResponse::Utils.field_name("response_mode"),
+              required: true,
+              'decoder': ::NoResponse::Utils.open_enum_from_string(Models::Shared::ResponseMode, false)
+            }
+          }
+        )
+
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+        # The keys a receiver may see in NR-Webhook-Key-Id, oldest first. The last one signs every new delivery; an older one keeps verifying until its expires_at.
+        field(
+          :signing_keys,
+          Crystalline::Array.new(Models::Shared::SigningKey),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("signing_keys"), required: true}}
+        )
+        # When the endpoint last echoed a challenge. Absent until it first does.
+        field(
+          :verified_at,
+          Crystalline::Nilable.new(::String),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("verified_at")}}
+        )
+
+        sig {
+          params(
+            endpoint_id: ::String,
+            url: ::String,
+            state: Models::Shared::WebhookEndpointState,
+            response_mode: Models::Shared::ResponseMode,
+            created_at: ::String,
+            signing_keys: T::Array[Models::Shared::SigningKey],
+            verified_at: T.nilable(::String)
+          )
+            .void
+        }
+        def initialize(endpoint_id:, url:, state:, response_mode:, created_at:, signing_keys:, verified_at: nil)
+          @endpoint_id = endpoint_id
+          @url = url
+          @state = state
+          @response_mode = response_mode
+          @created_at = created_at
+          @signing_keys = signing_keys
+          @verified_at = verified_at
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @endpoint_id == other.endpoint_id
+          return false unless @url == other.url
+          return false unless @state == other.state
+          return false unless @response_mode == other.response_mode
+          return false unless @created_at == other.created_at
+          return false unless @signing_keys == other.signing_keys
+          return false unless @verified_at == other.verified_at
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/webhookendpoint.rbi

@@ -0,0 +1,50 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::WebhookEndpoint
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::WebhookEndpoint
+  def endpoint_id
+  end
+
+  def endpoint_id=(str_)
+  end
+
+  def url
+  end
+
+  def url=(str_)
+  end
+
+  def state
+  end
+
+  def state=(str_)
+  end
+
+  def response_mode
+  end
+
+  def response_mode=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def signing_keys
+  end
+
+  def signing_keys=(str_)
+  end
+
+  def verified_at
+  end
+
+  def verified_at=(str_)
+  end
+end

data/lib/no_response/models/shared/webhookendpointcreated.rb

@@ -0,0 +1,41 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The 201 answer of POST /v1/webhooks: the new endpoint, unverified, and its first signing secret, shown once. Store the secret where the receiver reads it, then send endpoint.verification with POST /v1/webhooks/{endpoint_id}/test.
+      class WebhookEndpointCreated
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # One of the tenant's registered webhook endpoints. Signing secrets are not part of it: a secret is shown once, when it is issued (POST /v1/webhooks and POST /v1/webhooks/{endpoint_id}/rotate).
+        field(
+          :endpoint,
+          Models::Shared::WebhookEndpoint,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("endpoint"), required: true}}
+        )
+        # A newly issued signing key with its secret, shown only in this answer. A receiver verifies NR-Webhook-Signature with the secret's UTF-8 bytes as the HMAC-SHA256 key.
+        field(
+          :signing_secret,
+          Models::Shared::SigningSecret,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("signing_secret"), required: true}}
+        )
+
+        sig { params(endpoint: Models::Shared::WebhookEndpoint, signing_secret: Models::Shared::SigningSecret).void }
+        def initialize(endpoint:, signing_secret:)
+          @endpoint = endpoint
+          @signing_secret = signing_secret
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @endpoint == other.endpoint
+          return false unless @signing_secret == other.signing_secret
+          true
+        end
+      end
+    end
+  end
+end