noresponse 5.1.1 → 6.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d918e4d2660417ed78b7a4638b1f641f6f43d2b78307b2e5881774d7bc347421
-  data.tar.gz: 73a9a476b05a676511ec81bf4d7218eec96776283999ecba97791ba8ca7056be
+  metadata.gz: fd8954a2530d7155206de245bf0a37d1634544e60667c805dfc59bc0469a5f9f
+  data.tar.gz: 6abb5ea2ee270b1e6aae69e6c9a388797fdff932cdb83793777d88a2cc98b8d3
 SHA512:
-  metadata.gz: 963720145ad3133a5d2e3c1a31dbbc73e3f9189fe5a8521a61cff2800020d8c273a964f5f32c0c1feb9e3241dfb118ad4d29b46fbf783e6bed96d40730745092
-  data.tar.gz: 46df6c429316e610ed12de84b3e2f51f3355dc929b44ecfc784763c26dafbc32490cc5417d494f66ac58fcbc8fcc1c5536cbe698f3b15478fbd1240679dae94a
+  metadata.gz: 8c1836d4b11868110075208ae16b8a8682db62afdeba32de713400208b5e841a436306944ea9feae1d12df032ddfa0ea8b3d337918a5b1246676bd023bc53c4b
+  data.tar.gz: ef9ade678b73ce8ebcabb013c98ba54a6022dc62dd175ab22224b8fe3c4384383a0e3edd6fda773f70c52a10193ab3601614c5b3d514e713816b487dd71c047d

data/lib/no_response/late_results.rb

@@ -6,7 +6,7 @@
 # An assessment can be revised after the account creation was allowed: a slow source
 # settles and the account's decision rises. NoResponse sends the new version as a
 # signed assessment.updated webhook. LateResults.handle verifies that delivery
-# with Webhooks.construct_event, picks an action from your policy, and acts
+# with WebhookVerification.construct_event, picks an action from your policy, and acts
 # through the auth provider's admin API: revoke the user's sessions or ban the
 # user.
 #
@@ -20,7 +20,6 @@ require 'erb'
 require 'json'
 require 'net/http'
 require 'uri'
-require_relative 'webhooks'
 
 module NoResponse
   module LateResults
@@ -53,13 +52,14 @@ module NoResponse
       end
     end
 
-    # event is the verified Webhooks::Event. action is the action that ran:
+    # event is the verified event from WebhookVerification.construct_event,
+    # such as a Models::Shared::AssessmentUpdatedEvent. action is the action that ran:
     # NONE when the policy, the event or the user id called for nothing. It can
     # be stronger than the policy's action when the provider had to fall back:
     # the auth0 provider reports BAN when it blocked the user because the
     # tenant's plan cannot end sessions. user_id is
     # the provider user id acted on, set only when an action was taken. Answer
-    # an endpoint.verification with Webhooks.verification_response(event).
+    # an endpoint.verification with { 'challenge' => event.data.challenge }.
     Result = Struct.new(:event, :action, :user_id, keyword_init: true)
 
     class << self
@@ -70,7 +70,8 @@ module NoResponse
       # strings or symbols) to NONE, REVOKE_SESSIONS or BAN; a decision you
       # leave out does nothing. An unknown action raises ArgumentError.
       def action_for(event, policy = DEFAULT_POLICY)
-        return NONE if event.test? || event.expired?
+        # Only an assessment.updated event can be a test event.
+        return NONE if event.type == 'assessment.updated' && event.test == true
 
         data = event.data
         if event.type == 'account.risk_changed'
@@ -79,6 +80,7 @@ module NoResponse
           decision = data.account.decisions_by_flow.login.to_s
           return NONE if data.previous_decisions_by_flow&.login.to_s == decision
         elsif event.type == 'assessment.updated'
+          return NONE if data.is_a?(Models::Shared::AssessmentExpired)
           return NONE if data.status == Models::Shared::Status::PENDING || data.account.nil?
           decision = data.account.risk.decision.to_s
         else
@@ -101,8 +103,8 @@ module NoResponse
       # Verify a webhook delivery and apply your policy to it.
       #
       # payload, headers and secrets, plus tolerance_seconds and now, are
-      # exactly what Webhooks.construct_event takes; a delivery that fails
-      # verification raises Webhooks::VerificationError before any provider
+      # exactly what WebhookVerification.construct_event takes; a delivery that fails
+      # verification raises WebhookVerification::VerificationError before any provider
       # call. Deduplicate on result.event.id and ignore versions older than one
       # you have acted on.
       #
@@ -111,7 +113,7 @@ module NoResponse
       # account_id; it defaults to the account_id itself, as when you assess
       # with the provider's user id. Return nil or "" to take no action.
       def handle(payload, headers, secrets, provider, policy: DEFAULT_POLICY, user_id: nil, **verify)
-        event = Webhooks.construct_event(payload, headers, secrets, **verify)
+        event = WebhookVerification.construct_event(payload, headers, secrets, **verify)
         action = action_for(event, policy)
         return Result.new(event: event, action: NONE) if action == NONE
 

data/lib/no_response/models/shared/accountdeleted.rb

@@ -0,0 +1,49 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Terminal for the account's assessments created at or before deleted_at in the receiving endpoint's environment: delete what you hold from them and ignore later-arriving updates of them. deleted_at is no earlier than the creation of any assessment it erased. An assessment created after it belongs to the account assessed again: keep it, even when this event arrives after it.
+      class AccountDeleted
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
+        field(
+          :account_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account_id"), required: true}}
+        )
+        # How many assessments the erasure deleted.
+        field(
+          :assessments_deleted,
+          ::Integer,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessments_deleted"), required: true}}
+        )
+        # When the erasure took effect, equal to deleted_at in the DELETE answer.
+        field(
+          :deleted_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("deleted_at"), required: true}}
+        )
+
+        sig { params(account_id: ::String, assessments_deleted: ::Integer, deleted_at: ::String).void }
+        def initialize(account_id:, assessments_deleted:, deleted_at:)
+          @account_id = account_id
+          @assessments_deleted = assessments_deleted
+          @deleted_at = deleted_at
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @account_id == other.account_id
+          return false unless @assessments_deleted == other.assessments_deleted
+          return false unless @deleted_at == other.deleted_at
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountdeleted.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountDeleted
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountDeleted
+  def account_id
+  end
+
+  def account_id=(str_)
+  end
+
+  def assessments_deleted
+  end
+
+  def assessments_deleted=(str_)
+  end
+
+  def deleted_at
+  end
+
+  def deleted_at=(str_)
+  end
+end

data/lib/no_response/models/shared/accountdeletedevent.rb

@@ -0,0 +1,70 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The account.deleted event.
+      class AccountDeletedEvent
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The event id, equal to the NR-Webhook-Id header and across redeliveries and every endpoint the event fans out to.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+        # When the event was created. Equal across redeliveries; the signing timestamp header is per delivery.
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+        # Terminal for the account's assessments created at or before deleted_at in the receiving endpoint's environment: delete what you hold from them and ignore later-arriving updates of them. deleted_at is no earlier than the creation of any assessment it erased. An assessment created after it belongs to the account assessed again: keep it, even when this event arrives after it.
+        field(
+          :data,
+          Models::Shared::AccountDeleted,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("data"), required: true}}
+        )
+        # Always account.deleted.
+        field :type, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("type"), required: true}}
+        # Present, and true, only on an event sent by POST /v1/webhooks/{endpoint_id}/test: its data is a fixed example assessment, not one of the workspace's, so a receiver acknowledges it and applies nothing. Real events have no test member.
+        field(
+          :test,
+          Crystalline::Nilable.new(Crystalline::Boolean.new),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("test")}}
+        )
+
+        sig {
+          params(
+            id: ::String,
+            created_at: ::String,
+            data: Models::Shared::AccountDeleted,
+            type: ::String,
+            test: T.nilable(T::Boolean)
+          )
+            .void
+        }
+        def initialize(id:, created_at:, data:, type: "account.deleted", test: nil)
+          @id = id
+          @created_at = created_at
+          @data = data
+          unless type == "account.deleted"
+            raise ArgumentError, "Invalid value for type"
+          end
+
+          @type = "account.deleted"
+          @test = test
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @created_at == other.created_at
+          return false unless @data == other.data
+          return false unless @type == other.type
+          return false unless @test == other.test
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountdeletedevent.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountDeletedEvent
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountDeletedEvent
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def data
+  end
+
+  def data=(str_)
+  end
+
+  def type
+  end
+
+  def type=(str_)
+  end
+
+  def test
+  end
+
+  def test=(str_)
+  end
+end

data/lib/no_response/models/shared/accountriskchanged.rb

@@ -0,0 +1,44 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The account's decision for at least one flow changed. account is the account as GET /v1/accounts/{account_id} answers it for the revision that made the change: its new score, decision, reasons and decisions_by_flow, and the assessment the risk comes from. previous_decisions_by_flow are the decisions it replaced, so account.decisions_by_flow differs from them for at least one flow. On the account's first decision, previous_decisions_by_flow is allow for every flow. Events of one account are not ordered: account.risk_version orders them, so keep the account with the highest risk_version and ignore an event whose account is older than the one held.
+      class AccountRiskChanged
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments).
+        field(
+          :account,
+          Models::Shared::Account,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account"), required: true}}
+        )
+        # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them.
+        field(
+          :previous_decisions_by_flow,
+          Models::Shared::AccountDecisionsByFlow,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("previous_decisions_by_flow"), required: true}}
+        )
+
+        sig {
+          params(account: Models::Shared::Account, previous_decisions_by_flow: Models::Shared::AccountDecisionsByFlow)
+            .void
+        }
+        def initialize(account:, previous_decisions_by_flow:)
+          @account = account
+          @previous_decisions_by_flow = previous_decisions_by_flow
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @account == other.account
+          return false unless @previous_decisions_by_flow == other.previous_decisions_by_flow
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountriskchanged.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountRiskChanged
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountRiskChanged
+  def account
+  end
+
+  def account=(str_)
+  end
+
+  def previous_decisions_by_flow
+  end
+
+  def previous_decisions_by_flow=(str_)
+  end
+end

data/lib/no_response/models/shared/accountriskchangedevent.rb

@@ -0,0 +1,70 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The account.risk_changed event.
+      class AccountRiskChangedEvent
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The event id, equal to the NR-Webhook-Id header and across redeliveries and every endpoint the event fans out to.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+        # When the event was created. Equal across redeliveries; the signing timestamp header is per delivery.
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+        # The account's decision for at least one flow changed. account is the account as GET /v1/accounts/{account_id} answers it for the revision that made the change: its new score, decision, reasons and decisions_by_flow, and the assessment the risk comes from. previous_decisions_by_flow are the decisions it replaced, so account.decisions_by_flow differs from them for at least one flow. On the account's first decision, previous_decisions_by_flow is allow for every flow. Events of one account are not ordered: account.risk_version orders them, so keep the account with the highest risk_version and ignore an event whose account is older than the one held.
+        field(
+          :data,
+          Models::Shared::AccountRiskChanged,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("data"), required: true}}
+        )
+        # Always account.risk_changed.
+        field :type, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("type"), required: true}}
+        # Present, and true, only on an event sent by POST /v1/webhooks/{endpoint_id}/test: its data is a fixed example assessment, not one of the workspace's, so a receiver acknowledges it and applies nothing. Real events have no test member.
+        field(
+          :test,
+          Crystalline::Nilable.new(Crystalline::Boolean.new),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("test")}}
+        )
+
+        sig {
+          params(
+            id: ::String,
+            created_at: ::String,
+            data: Models::Shared::AccountRiskChanged,
+            type: ::String,
+            test: T.nilable(T::Boolean)
+          )
+            .void
+        }
+        def initialize(id:, created_at:, data:, type: "account.risk_changed", test: nil)
+          @id = id
+          @created_at = created_at
+          @data = data
+          unless type == "account.risk_changed"
+            raise ArgumentError, "Invalid value for type"
+          end
+
+          @type = "account.risk_changed"
+          @test = test
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @created_at == other.created_at
+          return false unless @data == other.data
+          return false unless @type == other.type
+          return false unless @test == other.test
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountriskchangedevent.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountRiskChangedEvent
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountRiskChangedEvent
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def data
+  end
+
+  def data=(str_)
+  end
+
+  def type
+  end
+
+  def type=(str_)
+  end
+
+  def test
+  end
+
+  def test=(str_)
+  end
+end

data/lib/no_response/models/shared/assessmentexpired.rb

@@ -0,0 +1,82 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Terminal. Nothing to fetch; the consumer deletes its state for assessment_id.
+      class AssessmentExpired
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Opaque, server-assigned assessment id: 'asm_' and a 26-character Crockford base32 ULID. Unique within the workspace; another workspace's assessment id answers 404.
+        field(
+          :assessment_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_id"), required: true}}
+        )
+        # Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
+        field(
+          :account_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account_id"), required: true}}
+        )
+        # The last served version: expiry is not a revision.
+        field(
+          :assessment_version,
+          ::Integer,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessment_version"), required: true}}
+        )
+
+        field(
+          :status,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("status"), required: true}}
+        )
+
+        field(
+          :change_reason,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("change_reason"), required: true}}
+        )
+
+        sig {
+          params(
+            assessment_id: ::String,
+            account_id: ::String,
+            assessment_version: ::Integer,
+            status: ::String,
+            change_reason: ::String
+          )
+            .void
+        }
+        def initialize(assessment_id:, account_id:, assessment_version:, status: "expired", change_reason: "expired")
+          @assessment_id = assessment_id
+          @account_id = account_id
+          @assessment_version = assessment_version
+          unless status == "expired"
+            raise ArgumentError, "Invalid value for status"
+          end
+
+          @status = "expired"
+          unless change_reason == "expired"
+            raise ArgumentError, "Invalid value for change_reason"
+          end
+
+          @change_reason = "expired"
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @assessment_id == other.assessment_id
+          return false unless @account_id == other.account_id
+          return false unless @assessment_version == other.assessment_version
+          return false unless @status == other.status
+          return false unless @change_reason == other.change_reason
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentexpired.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentExpired
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentExpired
+  def assessment_id
+  end
+
+  def assessment_id=(str_)
+  end
+
+  def account_id
+  end
+
+  def account_id=(str_)
+  end
+
+  def assessment_version
+  end
+
+  def assessment_version=(str_)
+  end
+
+  def status
+  end
+
+  def status=(str_)
+  end
+
+  def change_reason
+  end
+
+  def change_reason=(str_)
+  end
+end

data/lib/no_response/models/shared/assessmentupdateddata.rb

@@ -0,0 +1,23 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The assessment, or the minimal notice that it expired.
+      class AssessmentUpdatedData
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        def initialize
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/assessmentupdateddata.rbi

@@ -0,0 +1,9 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AssessmentUpdatedData
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AssessmentUpdatedData
+end