noresponse 5.1.1 → 6.0.1

data/lib/no_response/late_results.rb

@@ -6,7 +6,7 @@
 # An assessment can be revised after the account creation was allowed: a slow source
 # settles and the account's decision rises. NoResponse sends the new version as a
 # signed assessment.updated webhook. LateResults.handle verifies that delivery
-# with Webhooks.construct_event, picks an action from your policy, and acts
+# with WebhookVerification.construct_event, picks an action from your policy, and acts
 # through the auth provider's admin API: revoke the user's sessions or ban the
 # user.
 #
@@ -20,7 +20,6 @@ require 'erb'
 require 'json'
 require 'net/http'
 require 'uri'
-require_relative 'webhooks'
 
 module NoResponse
   module LateResults
@@ -53,13 +52,14 @@ module NoResponse
       end
     end
 
-    # event is the verified Webhooks::Event. action is the action that ran:
+    # event is the verified event from WebhookVerification.construct_event,
+    # such as a Models::Shared::AssessmentUpdatedEvent. action is the action that ran:
     # NONE when the policy, the event or the user id called for nothing. It can
     # be stronger than the policy's action when the provider had to fall back:
     # the auth0 provider reports BAN when it blocked the user because the
     # tenant's plan cannot end sessions. user_id is
     # the provider user id acted on, set only when an action was taken. Answer
-    # an endpoint.verification with Webhooks.verification_response(event).
+    # an endpoint.verification with { 'challenge' => event.data.challenge }.
     Result = Struct.new(:event, :action, :user_id, keyword_init: true)
 
     class << self
@@ -70,7 +70,8 @@ module NoResponse
       # strings or symbols) to NONE, REVOKE_SESSIONS or BAN; a decision you
       # leave out does nothing. An unknown action raises ArgumentError.
       def action_for(event, policy = DEFAULT_POLICY)
-        return NONE if event.test? || event.expired?
+        # Only an assessment.updated event can be a test event.
+        return NONE if event.type == 'assessment.updated' && event.test == true
 
         data = event.data
         if event.type == 'account.risk_changed'
@@ -79,6 +80,7 @@ module NoResponse
           decision = data.account.decisions_by_flow.login.to_s
           return NONE if data.previous_decisions_by_flow&.login.to_s == decision
         elsif event.type == 'assessment.updated'
+          return NONE if data.is_a?(Models::Shared::AssessmentExpired)
           return NONE if data.status == Models::Shared::Status::PENDING || data.account.nil?
           decision = data.account.risk.decision.to_s
         else
@@ -101,8 +103,8 @@ module NoResponse
       # Verify a webhook delivery and apply your policy to it.
       #
       # payload, headers and secrets, plus tolerance_seconds and now, are
-      # exactly what Webhooks.construct_event takes; a delivery that fails
-      # verification raises Webhooks::VerificationError before any provider
+      # exactly what WebhookVerification.construct_event takes; a delivery that fails
+      # verification raises WebhookVerification::VerificationError before any provider
       # call. Deduplicate on result.event.id and ignore versions older than one
       # you have acted on.
       #
@@ -111,7 +113,7 @@ module NoResponse
       # account_id; it defaults to the account_id itself, as when you assess
       # with the provider's user id. Return nil or "" to take no action.
       def handle(payload, headers, secrets, provider, policy: DEFAULT_POLICY, user_id: nil, **verify)
-        event = Webhooks.construct_event(payload, headers, secrets, **verify)
+        event = WebhookVerification.construct_event(payload, headers, secrets, **verify)
         action = action_for(event, policy)
         return Result.new(event: event, action: NONE) if action == NONE
 

data/lib/no_response/models/operations/listaccounts_request.rb

@@ -0,0 +1,52 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Operations
+
+      class ListAccountsRequest
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # next_cursor from an earlier page, unchanged. Absent, the list starts from the oldest change.
+        field(
+          :changed_since,
+          Crystalline::Nilable.new(::String),
+          {'query_param': {'field_name': "changed_since", 'style': "form", 'explode': true}}
+        )
+        # Most accounts per page.
+        field(
+          :limit,
+          Crystalline::Nilable.new(::Integer),
+          {'query_param': {'field_name': "limit", 'style': "form", 'explode': true}}
+        )
+        # true lists only accounts with a decision other than allow for some flow and no applied enforcement at their current risk_version.
+        field(
+          :unenforced,
+          Crystalline::Nilable.new(Crystalline::Boolean.new),
+          {'query_param': {'field_name': "unenforced", 'style': "form", 'explode': true}}
+        )
+
+        sig {
+          params(changed_since: T.nilable(::String), limit: T.nilable(::Integer), unenforced: T.nilable(T::Boolean))
+            .void
+        }
+        def initialize(changed_since: nil, limit: 50, unenforced: false)
+          @changed_since = changed_since
+          @limit = limit
+          @unenforced = unenforced
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @changed_since == other.changed_since
+          return false unless @limit == other.limit
+          return false unless @unenforced == other.unenforced
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/operations/listaccounts_request.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Operations::ListAccountsRequest
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Operations::ListAccountsRequest
+  def changed_since
+  end
+
+  def changed_since=(str_)
+  end
+
+  def limit
+  end
+
+  def limit=(str_)
+  end
+
+  def unenforced
+  end
+
+  def unenforced=(str_)
+  end
+end

data/lib/no_response/models/operations/listaccounts_response.rb

@@ -0,0 +1,32 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Operations
+
+      class ListAccountsResponse
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        field :headers, Crystalline::Hash.new(Symbol, Crystalline::Array.new(::String))
+
+        field :result, Models::Shared::AccountList, {}
+
+        sig { params(headers: T::Hash[Symbol, T::Array[::String]], result: Models::Shared::AccountList).void }
+        def initialize(headers:, result:)
+          @headers = headers
+          @result = result
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @headers == other.headers
+          return false unless @result == other.result
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/operations/listaccounts_response.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Operations::ListAccountsResponse
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Operations::ListAccountsResponse
+  def headers
+  end
+
+  def headers=(str_)
+  end
+
+  def result
+  end
+
+  def result=(str_)
+  end
+end

data/lib/no_response/models/operations/recordenforcement_request.rb

@@ -0,0 +1,33 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Operations
+
+      class RecordEnforcementRequest
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The account_id the workspace sends with its assessments, as one path segment (percent-encode '|' and ':' if the client requires it). A value that does not match the account_id shape answers 400 invalid_request.
+        field :account_id, ::String, {'path_param': {'field_name': "account_id", 'style': "simple", 'explode': false}}
+
+        field :body, Models::Shared::EnforcementRequest, {'request': {'media_type': "application/json"}}
+
+        sig { params(account_id: ::String, body: Models::Shared::EnforcementRequest).void }
+        def initialize(account_id:, body:)
+          @account_id = account_id
+          @body = body
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @account_id == other.account_id
+          return false unless @body == other.body
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/operations/recordenforcement_request.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Operations::RecordEnforcementRequest
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Operations::RecordEnforcementRequest
+  def account_id
+  end
+
+  def account_id=(str_)
+  end
+
+  def body
+  end
+
+  def body=(str_)
+  end
+end

data/lib/no_response/models/operations/recordenforcement_response.rb

@@ -0,0 +1,32 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Operations
+
+      class RecordEnforcementResponse
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        field :headers, Crystalline::Hash.new(Symbol, Crystalline::Array.new(::String))
+
+        field :result, Models::Shared::Enforcement, {}
+
+        sig { params(headers: T::Hash[Symbol, T::Array[::String]], result: Models::Shared::Enforcement).void }
+        def initialize(headers:, result:)
+          @headers = headers
+          @result = result
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @headers == other.headers
+          return false unless @result == other.result
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/operations/recordenforcement_response.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Operations::RecordEnforcementResponse
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Operations::RecordEnforcementResponse
+  def headers
+  end
+
+  def headers=(str_)
+  end
+
+  def result
+  end
+
+  def result=(str_)
+  end
+end

data/lib/no_response/models/operations.rb

@@ -22,6 +22,8 @@ module NoResponse
       autoload :GetAssessmentResponse, "no_response/models/operations/getassessment_response.rb"
       autoload :ListAccountAssessmentsRequest, "no_response/models/operations/listaccountassessments_request.rb"
       autoload :ListAccountAssessmentsResponse, "no_response/models/operations/listaccountassessments_response.rb"
+      autoload :ListAccountsRequest, "no_response/models/operations/listaccounts_request.rb"
+      autoload :ListAccountsResponse, "no_response/models/operations/listaccounts_response.rb"
       autoload :ListIntegrationsResponse, "no_response/models/operations/listintegrations_response.rb"
       autoload :ListWebhookDeliveriesRequest, "no_response/models/operations/listwebhookdeliveries_request.rb"
       autoload :ListWebhookDeliveriesResponse, "no_response/models/operations/listwebhookdeliveries_response.rb"
@@ -29,6 +31,8 @@ module NoResponse
       autoload :QueryAccountAssessmentsResponse, "no_response/models/operations/queryaccountassessments_response.rb"
       autoload :RecordAssessmentOutcomeRequest, "no_response/models/operations/recordassessmentoutcome_request.rb"
       autoload :RecordAssessmentOutcomeResponse, "no_response/models/operations/recordassessmentoutcome_response.rb"
+      autoload :RecordEnforcementRequest, "no_response/models/operations/recordenforcement_request.rb"
+      autoload :RecordEnforcementResponse, "no_response/models/operations/recordenforcement_response.rb"
       autoload :RecordKeyUsageRequest, "no_response/models/operations/recordkeyusage_request.rb"
       autoload :RecordKeyUsageResponse, "no_response/models/operations/recordkeyusage_response.rb"
       autoload :ReplayWebhookDeliveryRequest, "no_response/models/operations/replaywebhookdelivery_request.rb"

data/lib/no_response/models/shared/accountdeleted.rb

@@ -0,0 +1,49 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Terminal for the account's assessments created at or before deleted_at in the receiving endpoint's environment: delete what you hold from them and ignore later-arriving updates of them. deleted_at is no earlier than the creation of any assessment it erased. An assessment created after it belongs to the account assessed again: keep it, even when this event arrives after it.
+      class AccountDeleted
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Your own opaque identifier for the account being checked, scoped to your workspace. Use an id you mint, with no direct identifier (email, phone, name or national id) in it. '|' is accepted so an Auth0 user id such as 'auth0|64abc' passes unchanged; '@', '+', '$' and whitespace are refused by the pattern, as is an exact-shape JWT; a hex digest such as a SHA-256 is allowed, because hashing an internal id is a common pseudonymous scheme. A value such as '07700900123' or 'jane.doe.gmail.com' cannot be told apart from an opaque id. It travels in bodies, and in a URL only as the path segment of GET /v1/accounts/{account_id} and its /assessments. An assessment requested by a provider hook at pre_registration, which has no account yet, carries the server-issued account_id pre: followed by its assessment_id.
+        field(
+          :account_id,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account_id"), required: true}}
+        )
+        # How many assessments the erasure deleted.
+        field(
+          :assessments_deleted,
+          ::Integer,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("assessments_deleted"), required: true}}
+        )
+        # When the erasure took effect, equal to deleted_at in the DELETE answer.
+        field(
+          :deleted_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("deleted_at"), required: true}}
+        )
+
+        sig { params(account_id: ::String, assessments_deleted: ::Integer, deleted_at: ::String).void }
+        def initialize(account_id:, assessments_deleted:, deleted_at:)
+          @account_id = account_id
+          @assessments_deleted = assessments_deleted
+          @deleted_at = deleted_at
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @account_id == other.account_id
+          return false unless @assessments_deleted == other.assessments_deleted
+          return false unless @deleted_at == other.deleted_at
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountdeleted.rbi

@@ -0,0 +1,26 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountDeleted
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountDeleted
+  def account_id
+  end
+
+  def account_id=(str_)
+  end
+
+  def assessments_deleted
+  end
+
+  def assessments_deleted=(str_)
+  end
+
+  def deleted_at
+  end
+
+  def deleted_at=(str_)
+  end
+end

data/lib/no_response/models/shared/accountdeletedevent.rb

@@ -0,0 +1,70 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The account.deleted event.
+      class AccountDeletedEvent
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # The event id, equal to the NR-Webhook-Id header and across redeliveries and every endpoint the event fans out to.
+        field :id, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("id"), required: true}}
+        # When the event was created. Equal across redeliveries; the signing timestamp header is per delivery.
+        field(
+          :created_at,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("created_at"), required: true}}
+        )
+        # Terminal for the account's assessments created at or before deleted_at in the receiving endpoint's environment: delete what you hold from them and ignore later-arriving updates of them. deleted_at is no earlier than the creation of any assessment it erased. An assessment created after it belongs to the account assessed again: keep it, even when this event arrives after it.
+        field(
+          :data,
+          Models::Shared::AccountDeleted,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("data"), required: true}}
+        )
+        # Always account.deleted.
+        field :type, ::String, {'format_json': {'letter_case': ::NoResponse::Utils.field_name("type"), required: true}}
+        # Present, and true, only on an event sent by POST /v1/webhooks/{endpoint_id}/test: its data is a fixed example assessment, not one of the workspace's, so a receiver acknowledges it and applies nothing. Real events have no test member.
+        field(
+          :test,
+          Crystalline::Nilable.new(Crystalline::Boolean.new),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("test")}}
+        )
+
+        sig {
+          params(
+            id: ::String,
+            created_at: ::String,
+            data: Models::Shared::AccountDeleted,
+            type: ::String,
+            test: T.nilable(T::Boolean)
+          )
+            .void
+        }
+        def initialize(id:, created_at:, data:, type: "account.deleted", test: nil)
+          @id = id
+          @created_at = created_at
+          @data = data
+          unless type == "account.deleted"
+            raise ArgumentError, "Invalid value for type"
+          end
+
+          @type = "account.deleted"
+          @test = test
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @id == other.id
+          return false unless @created_at == other.created_at
+          return false unless @data == other.data
+          return false unless @type == other.type
+          return false unless @test == other.test
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountdeletedevent.rbi

@@ -0,0 +1,38 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountDeletedEvent
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountDeletedEvent
+  def id
+  end
+
+  def id=(str_)
+  end
+
+  def created_at
+  end
+
+  def created_at=(str_)
+  end
+
+  def data
+  end
+
+  def data=(str_)
+  end
+
+  def type
+  end
+
+  def type=(str_)
+  end
+
+  def test
+  end
+
+  def test=(str_)
+  end
+end

data/lib/no_response/models/shared/accountlist.rb

@@ -0,0 +1,40 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # Body of the 200 answer to GET /v1/accounts: the calling workspace's accounts whose risk changed after changed_since, in the environment of the calling key, oldest change first. An account is listed when its risk_version advanced and it has a current risk, and each item is the account exactly as GET /v1/accounts/{account_id} answers it. An account appears once per page, at its latest change; when its risk changes again later, it appears again on a later page with the newer risk_version. next_cursor is always present: pass it back as changed_since to read the changes made after this page.
+      class AccountList
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        field(
+          :items,
+          Crystalline::Array.new(Models::Shared::Account),
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("items"), required: true}}
+        )
+        # Opaque cursor after the last change this page read, bound to the workspace and the environment of the calling key. Pass it back unchanged as changed_since. It is present on every page, the last one included: when nothing changed after changed_since it is the cursor that was sent, so a poller keeps calling with the latest next_cursor. A tampered or foreign cursor answers 400 invalid_cursor. Consumers do not parse it.
+        field(
+          :next_cursor,
+          ::String,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("next_cursor"), required: true}}
+        )
+
+        sig { params(items: T::Array[Models::Shared::Account], next_cursor: ::String).void }
+        def initialize(items:, next_cursor:)
+          @items = items
+          @next_cursor = next_cursor
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @items == other.items
+          return false unless @next_cursor == other.next_cursor
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountlist.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountList
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountList
+  def items
+  end
+
+  def items=(str_)
+  end
+
+  def next_cursor
+  end
+
+  def next_cursor=(str_)
+  end
+end

data/lib/no_response/models/shared/accountriskchanged.rb

@@ -0,0 +1,44 @@
+# typed: true
+# frozen_string_literal: true
+
+module NoResponse
+  module Models
+    module Shared
+      # The account's decision for at least one flow changed. account is the account as GET /v1/accounts/{account_id} answers it for the revision that made the change: its new score, decision, reasons and decisions_by_flow, and the assessment the risk comes from. previous_decisions_by_flow are the decisions it replaced, so account.decisions_by_flow differs from them for at least one flow. On the account's first decision, previous_decisions_by_flow is allow for every flow. Events of one account are not ordered: account.risk_version orders them, so keep the account with the highest risk_version and ignore an event whose account is older than the one held.
+      class AccountRiskChanged
+        extend T::Sig
+        include Crystalline::MetadataFields
+
+        # Body of the 200 answer to GET /v1/accounts/{account_id}: the one current risk of one of the calling workspace's accounts. It is the risk of the account's latest assessment that has a decision (status complete or partial), by created_at and then assessment_id, scored exactly as GET /v1/assessments/{assessment_id} scores that assessment, plus the account's own reason shared_api_key when a key issued to the account was used from many IP addresses or countries (POST /v1/key_usage/batches). Its assessments are the account's history (GET /v1/accounts/{account_id}/assessments).
+        field(
+          :account,
+          Models::Shared::Account,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account"), required: true}}
+        )
+        # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them.
+        field(
+          :previous_decisions_by_flow,
+          Models::Shared::AccountDecisionsByFlow,
+          {'format_json': {'letter_case': ::NoResponse::Utils.field_name("previous_decisions_by_flow"), required: true}}
+        )
+
+        sig {
+          params(account: Models::Shared::Account, previous_decisions_by_flow: Models::Shared::AccountDecisionsByFlow)
+            .void
+        }
+        def initialize(account:, previous_decisions_by_flow:)
+          @account = account
+          @previous_decisions_by_flow = previous_decisions_by_flow
+        end
+
+        sig { params(other: T.untyped).returns(T::Boolean) }
+        def ==(other)
+          return false unless other.is_a?(self.class)
+          return false unless @account == other.account
+          return false unless @previous_decisions_by_flow == other.previous_decisions_by_flow
+          true
+        end
+      end
+    end
+  end
+end

data/lib/no_response/models/shared/accountriskchanged.rbi

@@ -0,0 +1,20 @@
+# typed: true
+# frozen_string_literal: true
+
+class NoResponse::Models::Shared::AccountRiskChanged
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+class NoResponse::Models::Shared::AccountRiskChanged
+  def account
+  end
+
+  def account=(str_)
+  end
+
+  def previous_decisions_by_flow
+  end
+
+  def previous_decisions_by_flow=(str_)
+  end
+end