noresponse 6.0.1 → 7.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7330b6a0690fe0bbf5b80f1a2332e313bcc60f92aa2a3ac05c74db48eabcd4e2
-  data.tar.gz: 39aa2d9d9ce07baf3356c2838834d804b1b830c9842dca5397488445c74681fa
+  metadata.gz: 1b0beeaac217b57c273b36d932b3c3f99afd182c6d0d44df0cc6ca6b4555c58c
+  data.tar.gz: 6764d92c3245796bd28d1d4d36a098200fb08dbf2890108ac42e3d1e4471dfcf
 SHA512:
-  metadata.gz: f78c249866e436cbb122f9c0a6498f3faef3f2f5eae4fbb58c90ea745b75ff00055f95feed2a15602614e3aecabf05ccc152037e5d8751d672230616f480e66a
-  data.tar.gz: e1ac053441377752e13a5519f75bdac2c7f14871e8dc20fa55ec4eb5f953c1663e54f0b7d99e0aba00a30f04abad545c33ee595d985d813e81dc8ae3189099a8
+  metadata.gz: 84f2027ab4697d18e946d606dab0d7e2618dbe3e1ff6e455fdd1ab3cc9cb0f2ca6de8bea2db9f74c09f5e43182ed43ea29ba241bc4f6d14f60303b63bcc619e3
+  data.tar.gz: 655e2452327045a689c270f119b2366a62e58b1d7ca1c1a5dcdd1e602f751fd8ce8eae83fb6d3bf046ca1dd35f90510781330eb3b1ba95bbce381bcf8fa10482

data/lib/no_response/auth.rb

@@ -1,7 +1,7 @@
 # typed: false
 # frozen_string_literal: true
 
-# Auth context adapters. Generated by tools/generate_auth_adapters.py; do not edit.
+# Auth context adapters. Generated by tools/generate_overlays.py; do not edit.
 #
 # Each adapter maps claims your backend has already verified into the
 # auth_context of an assessment request. Pass verified claims, not a raw token.

data/lib/no_response/late_results.rb

@@ -1,47 +1,59 @@
-# typed: true
+# typed: false
 # frozen_string_literal: true
 
-# Late-result handlers. Hand-written beside the generated client.
+# Late enforcement. Generated by tools/generate_overlays.py from
+# tools/late_results/actions.json; do not edit.
 #
-# An assessment can be revised after the account creation was allowed: a slow source
-# settles and the account's decision rises. NoResponse sends the new version as a
-# signed assessment.updated webhook. LateResults.handle verifies that delivery
-# with WebhookVerification.construct_event, picks an action from your policy, and acts
-# through the auth provider's admin API: revoke the user's sessions or ban the
-# user.
+# account.risk_changed only wakes the handler. LateResults.handle_risk_change
+# verifies the delivery, reads the account's current risk
+# (GET /v1/accounts/{account_id}), asks your get_account_state where the
+# account is in your own flow, and takes the actions the table names for that
+# state and the decision of its flow:
 #
-# The handler verifies the delivery itself, so it never acts on an unverified
-# event, and it never acts on a test event from the send-test-event call. Every
-# provider call treats a 404 (user or session already gone) as done, so a
-# repeated delivery is safe. The provider calls are thin: you pass the credentials, and each
-# action is the provider's documented admin endpoint.
+#   onboarding   account_creation review/block  fail_onboarding, revoke_sessions
+#   provisional  account_creation review/block  reject_activation, revoke_sessions
+#   active       login review                   revoke_sessions
+#   active       login block                    restrict, revoke_sessions
+#   restricted   login allow                    unrestrict, when flows['login'].reinstate
+#
+# Every action, or none, is recorded with accounts.record_enforcement at the
+# risk_version read, and a refused action is recorded as failed and raised. No
+# action deletes a user. The same table and vectors
+# (tests/fixtures/late-results-vectors.json) run in every SDK.
 
 require 'erb'
+require 'faraday'
 require 'json'
-require 'net/http'
-require 'uri'
 
 module NoResponse
   module LateResults
-    # What to do to the user. BAN also ends every session.
-    NONE = 'none'
-    REVOKE_SESSIONS = 'revoke_sessions'
-    BAN = 'ban'
-    ACTIONS = [NONE, REVOKE_SESSIONS, BAN].freeze
-
-    # Revoke sessions on review and block; do nothing on allow or step_up.
-    # Banning is opt-in.
-    DEFAULT_POLICY = { 'allow' => NONE, 'step_up' => NONE, 'review' => REVOKE_SESSIONS,
-                       'block' => REVOKE_SESSIONS }.freeze
-
-    DECISIONS = %w[allow step_up review block].freeze
-
-    # Raised when the provider's admin API refuses a call. Answer the webhook
-    # with a 5xx so NoResponse retries it. The message holds no response body
-    # and no credentials.
+    TABLE = JSON.parse('{"lifecycle":{"onboarding":{"flow":"account_creation","on":{"review":["fail_onboarding","revoke_sessions"],"block":["fail_onboarding","revoke_sessions"]}},"provisional":{"flow":"account_creation","on":{"review":["reject_activation","revoke_sessions"],"block":["reject_activation","revoke_sessions"]}},"active":{"flow":"login","on":{"review":["revoke_sessions"],"block":["restrict","revoke_sessions"]}},"restricted":{"flow":"login","on":{},"reinstate":{"allow":["unrestrict"]}},"rejected":{"flow":"account_creation","on":{}}},"providers":{"clerk":{"base_url":"https://api.clerk.com/v1","actions":{"fail_onboarding":[{"call":{"method":"POST","path":"/users/{user}/ban"}}],"reject_activation":[{"call":{"method":"POST","path":"/users/{user}/ban"}}],"restrict":[{"call":{"method":"POST","path":"/users/{user}/ban"}}],"unrestrict":[{"call":{"method":"POST","path":"/users/{user}/unban"}}],"revoke_sessions":[{"each":{"list":{"method":"GET","path":"/sessions","query":{"user_id":"{user}","status":"active","limit":"100"}},"page":{"kind":"offset","param":"offset","size":100},"where":{"status":"active"}},"call":{"method":"POST","path":"/sessions/{item}/revoke"}}]}},"workos":{"base_url":"https://api.workos.com","actions":{"fail_onboarding":[{"call":{"method":"PUT","path":"/user_management/users/{user}","body":{"metadata":{"noresponse_state":"onboarding_failed"}}}}],"reject_activation":[{"call":{"method":"PUT","path":"/user_management/users/{user}","body":{"metadata":{"noresponse_state":"activation_rejected"}}}}],"restrict":[{"call":{"method":"PUT","path":"/user_management/users/{user}","body":{"metadata":{"noresponse_state":"restricted"}}}}],"unrestrict":[{"call":{"method":"PUT","path":"/user_management/users/{user}","body":{"metadata":{"noresponse_state":null}}}}],"revoke_sessions":[{"each":{"list":{"method":"GET","path":"/user_management/users/{user}/sessions","query":{"limit":"100"}},"page":{"kind":"cursor","param":"after","next":["list_metadata","after"]},"where":{"status":"active"}},"call":{"method":"POST","path":"/user_management/sessions/revoke","body":{"session_id":"{item}"}}}]}},"auth0":{"base_url":"https://{domain}/api/v2","actions":{"fail_onboarding":[{"call":{"method":"PATCH","path":"/users/{user}","body":{"blocked":true}}}],"reject_activation":[{"call":{"method":"PATCH","path":"/users/{user}","body":{"blocked":true}}}],"restrict":[{"call":{"method":"PATCH","path":"/users/{user}","body":{"blocked":true}}}],"unrestrict":[{"call":{"method":"PATCH","path":"/users/{user}","body":{"blocked":false}}}],"revoke_sessions":[{"call":{"method":"DELETE","path":"/users/{user}/sessions"},"fallback":{"status":403,"code":"feature_not_enabled","reports":"restrict","steps":[{"call":{"method":"PATCH","path":"/users/{user}","body":{"blocked":true}}}]}},{"call":{"method":"DELETE","path":"/users/{user}/refresh-tokens"},"fallback":{"status":403,"code":"feature_not_enabled","steps":[{"each":{"list":{"method":"GET","path":"/device-credentials","query":{"user_id":"{user}","type":"refresh_token","per_page":"100"}},"page":{"kind":"index","param":"page","size":100}},"call":{"method":"DELETE","path":"/device-credentials/{item}"}},{"each":{"list":{"method":"GET","path":"/device-credentials","query":{"user_id":"{user}","type":"rotating_refresh_token","per_page":"100"}},"page":{"kind":"index","param":"page","size":100}},"call":{"method":"DELETE","path":"/device-credentials/{item}"}}]}}]}}},"limits":{"retries":4,"budget_ms":3000,"backoff_ms":250,"max_pages":100}}').freeze
+    LIMITS = TABLE.fetch('limits')
+    # Every action a provider runs, as the table names them.
+    ACTIONS = TABLE.fetch('providers').values.first.fetch('actions').keys.freeze
+
+    # Where the account is in your flow, from get_account_state. user_id is the
+    # provider's user id (default: the account id). enforced_risk_version is
+    # the risk_version you last enforced (a result's risk_version that you
+    # stored); an account at or below it is skipped.
+    AccountStateAnswer = Struct.new(:state, :user_id, :enforced_risk_version, keyword_init: true)
+
+    # reinstate lifts a restriction once the flow's decision is allow again. Off by default.
+    FlowPolicy = Struct.new(:reinstate, keyword_init: true)
+
+    Enforced = Struct.new(:flow, :action, :status, :error_code, keyword_init: true)
+
+    # event is the verified event (from handle_risk_change). risk_version is the
+    # version acted on: store it and return it as enforced_risk_version. skipped
+    # says why nothing was done: not_actionable (not account.risk_changed, or a
+    # test event), account_gone (erased), unknown_user (get_account_state
+    # returned nil) or already_enforced. enforcements is what was recorded, in order.
+    EnforcementResult = Struct.new(:event, :account, :state, :risk_version, :skipped, :enforcements, keyword_init: true)
+
+    # The provider refused an action or could not be reached (status 0). Answer
+    # the webhook with a 5xx so it is delivered again. code is the provider's
+    # error code, such as Auth0's errorCode "insufficient_scope", when it sent one.
     class ProviderActionError < StandardError
-      # code is the provider's error code from the response body, such as
-      # Auth0's errorCode "insufficient_scope", when it sent one.
       attr_reader :provider, :status, :code
 
       def initialize(provider, status, message, code = nil)
@@ -52,469 +64,310 @@ module NoResponse
       end
     end
 
-    # event is the verified event from WebhookVerification.construct_event,
-    # such as a Models::Shared::AssessmentUpdatedEvent. action is the action that ran:
-    # NONE when the policy, the event or the user id called for nothing. It can
-    # be stronger than the policy's action when the provider had to fall back:
-    # the auth0 provider reports BAN when it blocked the user because the
-    # tenant's plan cannot end sessions. user_id is
-    # the provider user id acted on, set only when an action was taken. Answer
-    # an endpoint.verification with { 'challenge' => event.data.challenge }.
-    Result = Struct.new(:event, :action, :user_id, keyword_init: true)
+    SLUG = /\A[a-z0-9_.-]+\z/
 
     class << self
-      # The action your policy names for a verified event, from the account's
-      # decision (data.account.risk.decision). Only a served assessment whose
-      # account has a decision can act; a pending assessment, an expiry and a
-      # test event never do. policy maps allow, step_up, review and block (as
-      # strings or symbols) to NONE, REVOKE_SESSIONS or BAN; a decision you
-      # leave out does nothing. An unknown action raises ArgumentError.
-      def action_for(event, policy = DEFAULT_POLICY)
-        # Only an assessment.updated event can be a test event.
-        return NONE if event.type == 'assessment.updated' && event.test == true
-
-        data = event.data
-        if event.type == 'account.risk_changed'
-          # The event is sent when any flow's decision changes; sessions are about the
-          # login decision, so an unchanged login decision acts on nothing.
-          decision = data.account.decisions_by_flow.login.to_s
-          return NONE if data.previous_decisions_by_flow&.login.to_s == decision
-        elsif event.type == 'assessment.updated'
-          return NONE if data.is_a?(Models::Shared::AssessmentExpired)
-          return NONE if data.status == Models::Shared::Status::PENDING || data.account.nil?
-          decision = data.account.risk.decision.to_s
-        else
-          return NONE
+      # Verify an account.risk_changed delivery and enforce the account's
+      # current risk. A delivery that fails verification raises
+      # WebhookVerification::VerificationError before anything is read; any
+      # other event, and a test event, does nothing.
+      def handle_risk_change(client, payload, headers, secrets, provider:, get_account_state:, flows: {},
+                             tolerance_seconds: WebhookVerification::DEFAULT_TOLERANCE_SECONDS, now: nil)
+        event = WebhookVerification.construct_event(payload, headers, secrets, tolerance_seconds: tolerance_seconds, now: now)
+        if event.type != 'account.risk_changed' || (event.respond_to?(:test) && event.test == true)
+          return EnforcementResult.new(event: event, skipped: 'not_actionable', enforcements: [])
         end
-        return NONE unless DECISIONS.include?(decision)
 
-        table = policy.to_h.transform_keys(&:to_s)
-        return NONE unless table.key?(decision)
+        begin
+          account = client.accounts.get(account_id: event.data.account.id).result
+        rescue Models::Errors::NotFoundError
+          return EnforcementResult.new(event: event, skipped: 'account_gone', enforcements: [])
+        end
+        result = enforce_account(client, account, provider: provider, get_account_state: get_account_state, flows: flows)
+        result.event = event
+        result
+      end
+
+      # Enforce one account as read: the account a handler fetched, or one from
+      # accounts.list_changed(unenforced: true) when catching up.
+      def enforce_account(client, account, provider:, get_account_state:, flows: {})
+        answer = get_account_state.call(account)
+        return EnforcementResult.new(account: account, skipped: 'unknown_user', enforcements: []) if answer.nil?
+
+        state = answer.state.to_s
+        rule = TABLE.fetch('lifecycle')[state] or raise ArgumentError, "unknown account state #{state.inspect}"
+        risk_version = account.risk_version
+        if !answer.enforced_risk_version.nil? && risk_version <= answer.enforced_risk_version
+          return EnforcementResult.new(account: account, state: state, risk_version: risk_version,
+                                       skipped: 'already_enforced', enforcements: [])
+        end
 
-        action = table[decision]
-        return NONE if action.nil?
+        flow = rule.fetch('flow')
+        decision = account.decisions_by_flow.public_send(flow).to_s
+        policy = (flows || {})[flow] || (flows || {})[flow.to_sym]
+        actions = rule.fetch('on')[decision]
+        actions = (rule['reinstate'] || {})[decision] if actions.nil? && policy&.reinstate
+        enforcements = []
+        record = lambda do |action, status, error_code = nil|
+          body = Models::Shared::EnforcementRequest.new(
+            risk_version: risk_version,
+            flow: Models::Shared::Flow.deserialize(flow),
+            action: Models::Shared::EnforcementAction.deserialize(action),
+            state_before: Models::Shared::EnforcementState.deserialize(state),
+            status: Models::Shared::EnforcementStatus.deserialize(status),
+            provider: Models::Shared::EnforcementProvider.deserialize(provider.name),
+            error_code: error_code
+          )
+          client.accounts.record_enforcement(account_id: account.id, body: body)
+          enforcements << Enforced.new(flow: flow, action: action, status: status, error_code: error_code)
+        end
 
-        action = action.to_s
-        raise ArgumentError, "unknown late result action #{action}" unless ACTIONS.include?(action)
+        if actions.nil? || actions.empty?
+          # An adverse or step_up decision that needs nothing still counts as handled.
+          record.call('none', 'applied') unless decision == 'allow'
+          return EnforcementResult.new(account: account, state: state, risk_version: risk_version, enforcements: enforcements)
+        end
 
-        action
-      end
+        recorded = {}
+        user_id = answer.user_id.to_s.empty? ? account.id : answer.user_id
+        actions.each do |action|
+          begin
+            also_ran = provider.run(action, user_id)
+          rescue StandardError => e
+            record.call(action, 'failed', failure_code(provider.name, e))
+            raise
+          end
+          [*also_ran, action].each do |ran|
+            next if recorded[ran]
 
-      # Verify a webhook delivery and apply your policy to it.
-      #
-      # payload, headers and secrets, plus tolerance_seconds and now, are
-      # exactly what WebhookVerification.construct_event takes; a delivery that fails
-      # verification raises WebhookVerification::VerificationError before any provider
-      # call. Deduplicate on result.event.id and ignore versions older than one
-      # you have acted on.
-      #
-      # policy defaults to DEFAULT_POLICY. user_id is an optional callable
-      # (account_id, event) returning the provider user id for the assessment's
-      # account_id; it defaults to the account_id itself, as when you assess
-      # with the provider's user id. Return nil or "" to take no action.
-      def handle(payload, headers, secrets, provider, policy: DEFAULT_POLICY, user_id: nil, **verify)
-        event = WebhookVerification.construct_event(payload, headers, secrets, **verify)
-        action = action_for(event, policy)
-        return Result.new(event: event, action: NONE) if action == NONE
-
-        account_id = event.type == 'account.risk_changed' ? event.data.account.id : event.data.detail.account_id
-        resolved = user_id ? user_id.call(account_id, event) : account_id
-        return Result.new(event: event, action: NONE) if resolved.nil? || resolved.to_s.empty?
-
-        resolved = resolved.to_s
-        # A provider may define act(action, user_id), returning the action that
-        # ran; the auth0 provider does, to report a block it had to fall back to.
-        ran = action
-        if provider.respond_to?(:act)
-          ran = provider.act(action, resolved)
-        elsif action == BAN
-          provider.ban(resolved)
-        else
-          provider.revoke_sessions(resolved)
+            recorded[ran] = true
+            record.call(ran, 'applied')
+          end
         end
-        Result.new(event: event, action: ACTIONS.include?(ran) ? ran : action, user_id: resolved)
+        EnforcementResult.new(account: account, state: state, risk_version: risk_version, enforcements: enforcements)
       end
 
-      # Clerk Backend API. revoke_sessions lists the user's active sessions
-      # (GET /sessions?user_id&status=active) and revokes each
-      # (POST /sessions/{id}/revoke). ban is POST /users/{id}/ban, which
-      # revokes every session and blocks sign-in. A 404 on any call (user or
-      # session already gone) counts as done, so a repeated delivery is safe.
-      #
-      # base_url defaults to https://api.clerk.com/v1. http_client is an
-      # optional callable (method, uri, headers, body) returning
-      # [status, body]; the default uses Net::HTTP.
-      def clerk(secret_key:, base_url: 'https://api.clerk.com/v1', http_client: nil)
-        raise ArgumentError, 'clerk needs secret_key' if secret_key.to_s.empty?
-
-        Clerk.new(Caller.new('clerk', base_url, "Bearer #{secret_key}", http_client))
-      end
+      # Clerk, WorkOS or Auth0, run from the shared action table. token is the
+      # Clerk secret key, WorkOS API key or Auth0 Management API token; domain
+      # is the Auth0 tenant domain. Pass http (a Faraday connection) for a proxy or for tests.
+      def identity_provider(name, token:, domain: nil, base_url: nil, http: nil)
+        name = name.to_s
+        spec = TABLE.fetch('providers')[name] or raise ArgumentError, "unknown identity provider #{name.inspect}"
+        raise ArgumentError, "#{name} needs token" if token.to_s.empty?
 
-      # WorkOS User Management. revoke_sessions pages through
-      # GET /user_management/users/{id}/sessions and revokes each active one
-      # with POST /user_management/sessions/revoke. WorkOS has no block or ban,
-      # so ban revokes the sessions and then deletes the user
-      # (DELETE /user_management/users/{id}); deletion is permanent. A 404 on
-      # any call (user or session already gone) counts as done, so a repeated
-      # delivery is safe.
-      #
-      # base_url defaults to https://api.workos.com.
-      def workos(api_key:, base_url: 'https://api.workos.com', http_client: nil)
-        raise ArgumentError, 'workos needs api_key' if api_key.to_s.empty?
-
-        WorkOS.new(Caller.new('workos', base_url, "Bearer #{api_key}", http_client))
-      end
+        base = base_url || spec.fetch('base_url')
+        if base.include?('{domain}')
+          raise ArgumentError, "#{name} needs domain or base_url" if domain.to_s.empty?
 
-      # Auth0 Management API. revoke_sessions deletes every session
-      # (DELETE /users/{id}/sessions) and refresh token
-      # (DELETE /users/{id}/refresh-tokens). ban first sets blocked: true
-      # (PATCH /users/{id}), then does the same. Pass domain (such as
-      # example.eu.auth0.com; the API is https://{domain}/api/v2) or base_url.
-      # token is a Management API access token with update:users,
-      # delete:sessions, delete:refresh_tokens, read:device_credentials and
-      # delete:device_credentials. A 404 on any call (user already gone)
-      # counts as done, so a repeated delivery is safe.
-      #
-      # Auth0 offers the sessions and refresh-token endpoints on Enterprise
-      # plans only; on other plans they answer 403 feature_not_enabled. Then
-      # refresh tokens are deleted one by one through /device-credentials
-      # (types refresh_token and rotating_refresh_token), which every plan
-      # has. A login session cannot be ended, so revoke_sessions blocks the
-      # user before deleting the refresh tokens, and act reports BAN. Unblock
-      # the user in the dashboard to undo it. Any other refusal, such as 403
-      # insufficient_scope, raises.
-      #
-      # A 429 from the Management API is waited out and retried: Retry-After,
-      # else X-RateLimit-Reset, else 0.25 s doubling, at most 4 retries a call
-      # and 3 s of waiting a revoke or ban. Past that the 429 raises as
-      # ProviderActionError. An http_client may return [status, body, headers]
-      # so the headers are honoured; without them the backoff applies.
-      def auth0(token:, domain: nil, base_url: nil, http_client: nil)
-        raise ArgumentError, 'auth0 needs token' if token.to_s.empty?
-
-        base = base_url || (domain.to_s.empty? ? nil : "https://#{domain}/api/v2")
-        raise ArgumentError, 'auth0 needs domain or base_url' if base.nil?
-
-        Auth0.new(Caller.new('auth0', base, "Bearer #{token}", http_client, retry_rate_limits: true))
+          base = base.sub('{domain}', domain)
+        end
+        TableProvider.new(name, spec, base.sub(%r{/+\z}, ''), token, http || Faraday.new(request: { timeout: 10 }))
       end
 
-      # A provider for an app with its own login, or for trying the handler
-      # before you wire up a real one. revoke_sessions and ban each log one
-      # line saying what they would do and call nothing: no request leaves
-      # your process. log is any callable that takes the line; the default
-      # writes it to standard error with Kernel#warn. Replace it with your own
-      # provider (name, revoke_sessions and ban) once you know what revoking
-      # and banning mean in your app.
-      def log_only(log: nil)
-        LogOnly.new(log || ->(line) { Kernel.warn(line) })
+      # Your own user store: one callable per action you support, keyed by
+      # action. A callable may return other actions it ran. An action without one fails.
+      def custom_provider(handlers)
+        CustomProvider.new(handlers.transform_keys(&:to_s))
       end
-    end
 
-    # One provider HTTP client: base URL, Authorization header, error mapping.
-    #
-    # Rate limits. Auth0 answers 429 when the Management API rate limit is
-    # hit, and a 429 means it did not act, so the call is safe to send again,
-    # a DELETE included. One revoke or ban waits at most RATE_LIMIT_BUDGET
-    # seconds in all, and each call retries at most RATE_LIMIT_RETRIES times:
-    # it waits Retry-After seconds, else until X-RateLimit-Reset (Unix
-    # seconds), else 0.25, 0.5, 1 and 2 s. A wait that would pass the budget is
-    # not started: the 429 raises at once as ProviderActionError, the webhook
-    # answers 5xx and NoResponse delivers it again later. The budget keeps the
-    # handler inside the 5 s a delivery has to be answered.
-    class Caller
-      RATE_LIMIT_RETRIES = 4
-      RATE_LIMIT_BUDGET = 3.0
-      RATE_LIMIT_BACKOFF = 0.25
-
-      def initialize(name, base_url, authorization, http_client, retry_rate_limits: false)
-        @name = name
-        @base = base_url.to_s.sub(%r{/+\z}, '')
-        @authorization = authorization
-        @http_client = http_client
-        @retry_rate_limits = retry_rate_limits
-        @waited = 0.0
+      private
+
+      # The error_code of a failed action: the provider's code, else its HTTP status, as <provider>.<code>.
+      def failure_code(provider, error)
+        code = error.respond_to?(:code) ? error.code : nil
+        status = error.is_a?(ProviderActionError) ? error.status : nil
+        suffix =
+          if code.is_a?(String) && code.downcase.match?(SLUG) then code.downcase
+          elsif status&.zero? then 'unreachable'
+          elsif status then "http_#{status}"
+          else
+            'error'
+          end
+        "#{provider}.#{suffix}"[0, 128]
       end
+    end
 
+    # Runs one action of the shared table against a provider's admin API.
+    class TableProvider
       attr_reader :name
 
-      # A caller with the same settings and its own rate-limit budget, for one action.
-      def fresh
-        Caller.new(@name, @base, @authorization, @http_client, retry_rate_limits: @retry_rate_limits)
+      def initialize(name, spec, base, token, http)
+        @name = name
+        @spec = spec
+        @base = base
+        @authorization = "Bearer #{token}"
+        @http = http
       end
 
-      # How long a 429 asks to wait, in seconds.
-      def self.rate_limit_wait(headers, retry_index)
-        after = number(header(headers, 'retry-after'))
-        return after if after && after >= 0
-
-        reset = number(header(headers, 'x-ratelimit-reset'))
-        return [0.0, reset - Time.now.to_f].max if reset
+      # Take the action and return any other action that had to run with it (Auth0 restricts to end a session).
+      def run(action, user_id)
+        raise ArgumentError, 'user id must be a non-empty string' unless user_id.is_a?(String) && !user_id.empty?
 
-        RATE_LIMIT_BACKOFF * (2**retry_index)
+        steps = @spec.fetch('actions')[action.to_s] or raise ArgumentError, "unknown action #{action.inspect}"
+        # Per call, so one provider can serve concurrent deliveries.
+        run_steps(steps, Call.new(user_id, 0.0))
       end
 
-      def self.header(headers, name)
-        (headers || {}).each { |key, value| return Array(value).first.to_s.strip if key.to_s.downcase == name }
-        nil
-      end
+      private
 
-      def self.number(text)
-        return nil if text.nil? || text.empty?
+      # The user acted on and the time spent waiting out 429s in this action.
+      Call = Struct.new(:user, :waited_ms)
 
-        value = Float(text)
-        value.finite? ? value : nil
-      rescue ArgumentError
-        nil
+      def run_steps(steps, call)
+        also_ran = []
+        steps.each do |step|
+          if step['each']
+            collect(step['each'], call).each { |item| send_call(step['call'], call, item) }
+            next
+          end
+          begin
+            send_call(step['call'], call)
+          rescue ProviderActionError => e
+            fallback = step['fallback']
+            raise unless fallback && e.status == fallback['status'] && e.code == fallback['code']
+
+            also_ran.concat(run_steps(fallback['steps'], call))
+            also_ran << fallback['reports'] if fallback['reports']
+          end
+        end
+        also_ran
       end
 
-      def call(method, path, query: nil, body: nil, allow_404: false)
-        uri = URI.parse(@base + path)
-        uri.query = URI.encode_www_form(query) if query && !query.empty?
-        headers = { 'Authorization' => @authorization, 'Accept' => 'application/json' }
-        payload = nil
-        unless body.nil?
-          headers['Content-Type'] = 'application/json'
-          payload = JSON.generate(body)
-        end
-        status, text = send_waiting_out_rate_limits(method, uri, headers, payload)
-        return nil if allow_404 && status == 404
-        unless status.between?(200, 299)
-          raise ProviderActionError.new(@name, status, "#{@name} #{method} #{path} answered #{status}", error_code(text))
+      # Every matching item id across the list's pages, collected before any is acted on.
+      def collect(each, call)
+        listing = each['list']
+        page = each['page']
+        where = each['where'] || {}
+        ids = []
+        cursor = nil
+        LIMITS['max_pages'].times do |index|
+          query = (listing['query'] || {}).dup
+          case page['kind']
+          when 'offset' then query[page['param']] = (index * page['size']).to_s
+          when 'index' then query[page['param']] = index.to_s
+          else query[page['param']] = cursor unless cursor.nil?
+          end
+          body = send_call(listing.merge('query' => query), call)
+          items =
+            if body.is_a?(Array) then body
+            elsif body.is_a?(Hash) && body['data'].is_a?(Array) then body['data']
+            else
+              []
+            end
+          items.each do |item|
+            next unless item.is_a?(Hash) && item['id'].is_a?(String) && !item['id'].empty?
+
+            ids << item['id'] if where.all? { |key, value| item[key] == value }
+          end
+          if page['kind'] == 'cursor'
+            following = page['next'].reduce(body) { |node, key| node.is_a?(Hash) ? node[key] : nil }
+            break unless following.is_a?(String) && !following.empty?
+
+            cursor = following
+          elsif items.length < page['size']
+            break
+          end
         end
-        return nil if text.nil? || text.empty?
+        ids
+      end
 
-        begin
-          JSON.parse(text)
-        rescue JSON::ParserError
-          nil
+      def fill(value, user, item)
+        case value
+        when String then value.gsub('{user}', user).gsub('{item}', item.to_s)
+        when Array then value.map { |entry| fill(entry, user, item) }
+        when Hash then value.transform_values { |entry| fill(entry, user, item) }
+        else value
         end
       end
 
-      private
+      def number(text)
+        value = Float(text.to_s.strip, exception: false)
+        value&.finite? ? value : nil
+      end
 
-      def send_waiting_out_rate_limits(method, uri, headers, payload)
-        retry_index = 0
-        loop do
-          status, text, response_headers = perform(method, uri, headers, payload)
-          return [status, text] unless status == 429 && @retry_rate_limits && retry_index < RATE_LIMIT_RETRIES
+      # How long a 429 asks to wait, in milliseconds.
+      def rate_limit_wait_ms(headers, retry_count)
+        after = number(headers['retry-after'])
+        return after * 1000 if after && after >= 0
 
-          wait = Caller.rate_limit_wait(response_headers, retry_index)
-          return [status, text] if @waited + wait > RATE_LIMIT_BUDGET
+        reset = number(headers['x-ratelimit-reset'])
+        return [0.0, (reset * 1000) - (Time.now.to_f * 1000)].max if reset
 
-          @waited += wait
-          sleep(wait)
-          retry_index += 1
-        end
+        (LIMITS['backoff_ms'] * (2**retry_count)).to_f
       end
 
-      # The error code in a provider's error body: Auth0's errorCode, or a top-level code.
+      # The provider's error code: Auth0's errorCode, WorkOS's code or Clerk's errors[0].code.
       def error_code(text)
         body = JSON.parse(text.to_s)
         return nil unless body.is_a?(Hash)
 
         code = body['errorCode'] || body['code']
+        errors = body['errors']
+        code = errors.first['code'] if code.nil? && errors.is_a?(Array) && errors.first.is_a?(Hash)
         code.is_a?(String) && !code.empty? ? code : nil
       rescue JSON::ParserError
         nil
       end
 
-      def perform(method, uri, headers, payload)
-        return @http_client.call(method, uri, headers, payload) if @http_client
-
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == 'https'
-        http.open_timeout = 10
-        http.read_timeout = 30
-        request = Net::HTTPGenericRequest.new(method, !payload.nil?, true, uri.request_uri, headers)
-        request.body = payload unless payload.nil?
-        response = http.start { |connection| connection.request(request) }
-        [response.code.to_i, response.body.to_s, response.to_hash]
-      end
-    end
-
-    module Segment
-      def self.encode(id)
-        raise ArgumentError, 'user id must be a non-empty string' unless id.is_a?(String) && !id.empty?
-
-        ERB::Util.url_encode(id)
-      end
-
-      def self.sessions(body)
-        list = body.is_a?(Hash) ? body['data'] : body
-        list.is_a?(Array) ? list.grep(Hash) : []
-      end
-
-      def self.active_ids(list)
-        list.select { |s| s['status'] == 'active' && s['id'].is_a?(String) && !s['id'].empty? }.map { |s| s['id'] }
-      end
-    end
-
-    class Clerk
-      PAGE = 100
-
-      def initialize(caller_)
-        @call = caller_
-      end
-
-      def name = 'clerk'
-
-      def revoke_sessions(user_id)
-        Segment.encode(user_id)
-        active = []
-        (0...1000).each do |round|
-          page = Segment.sessions(@call.call('GET', '/sessions', query: [['user_id', user_id], %w[status active],
-                                                                         ['limit', PAGE.to_s],
-                                                                         ['offset', (round * PAGE).to_s]], allow_404: true))
-          active.concat(Segment.active_ids(page))
-          break if page.length < PAGE
-        end
-        active.each { |id| @call.call('POST', "/sessions/#{ERB::Util.url_encode(id)}/revoke", allow_404: true) }
-        nil
-      end
-
-      def ban(user_id)
-        @call.call('POST', "/users/#{Segment.encode(user_id)}/ban", allow_404: true)
-        nil
-      end
-    end
-
-    class WorkOS
-      def initialize(caller_)
-        @call = caller_
-      end
-
-      def name = 'workos'
-
-      def revoke_sessions(user_id)
-        user = Segment.encode(user_id)
-        active = []
-        after = T.let(nil, T.nilable(String))
-        1000.times do
-          query = T.let([%w[limit 100]], T::Array[T::Array[String]])
-          query << ['after', after] if after
-          body = @call.call('GET', "/user_management/users/#{user}/sessions", query: query, allow_404: true)
-          active.concat(Segment.active_ids(Segment.sessions(body)))
-          nxt = body.is_a?(Hash) && body['list_metadata'].is_a?(Hash) ? body['list_metadata']['after'] : nil
-          break unless nxt.is_a?(String) && !nxt.empty?
-
-          after = nxt
-        end
-        active.each { |id| @call.call('POST', '/user_management/sessions/revoke', body: { 'session_id' => id }, allow_404: true) }
-        nil
-      end
-
-      def ban(user_id)
-        revoke_sessions(user_id)
-        @call.call('DELETE', "/user_management/users/#{Segment.encode(user_id)}", allow_404: true)
-        nil
-      end
-    end
-
-    class Auth0
-      PAGE = 100
-
-      def initialize(caller_)
-        @call = caller_
-      end
-
-      def name = 'auth0'
-
-      def revoke_sessions(user_id)
-        revoke(user_id)
-        nil
-      end
-
-      def ban(user_id)
-        user = Segment.encode(user_id)
-        call = @call.fresh
-        block(call, user)
-        # The block already ends a session the plan cannot delete.
-        delete_sessions(call, user)
-        delete_refresh_tokens(call, user_id, user)
-        nil
-      end
-
-      # Bans or revokes and returns the action that ran: BAN when revoking had
-      # to block the user.
-      def act(action, user_id)
-        if action == BAN
-          ban(user_id)
-          return BAN
+      # One admin API call. A 404 is done (nil); a 429 is waited out inside the action's budget; any other failure raises.
+      def send_call(request, call, item = nil)
+        path = request['path'].gsub('{user}', ERB::Util.url_encode(call.user)).gsub('{item}', ERB::Util.url_encode(item.to_s))
+        query = (request['query'] || {}).transform_values { |value| fill(value, call.user, item) }
+        url = @base + path
+        url += "?#{URI.encode_www_form(query)}" unless query.empty?
+        headers = { 'Authorization' => @authorization, 'Accept' => 'application/json' }
+        body = nil
+        if request.key?('body')
+          body = JSON.generate(fill(request['body'], call.user, item))
+          headers['Content-Type'] = 'application/json'
         end
-        revoke(user_id)
-      end
-
-      private
-
-      def revoke(user_id)
-        user = Segment.encode(user_id)
-        call = @call.fresh
-        ended = delete_sessions(call, user)
-        # Without the sessions API a login session survives; blocking is the only way to end it.
-        block(call, user) unless ended
-        delete_refresh_tokens(call, user_id, user)
-        ended ? REVOKE_SESSIONS : BAN
-      end
-
-      # Auth0 answers 403 feature_not_enabled when the tenant's plan does not include an endpoint.
-      def not_on_plan?(error)
-        error.status == 403 && error.code == 'feature_not_enabled'
-      end
-
-      def block(call, user)
-        call.call('PATCH', "/users/#{user}", body: { 'blocked' => true }, allow_404: true)
-      end
-
-      # Ends every session; false when the plan has no sessions API.
-      def delete_sessions(call, user)
-        call.call('DELETE', "/users/#{user}/sessions", allow_404: true)
-        true
-      rescue ProviderActionError => e
-        raise unless not_on_plan?(e)
-
-        false
-      end
+        label = "#{@name} #{request['method']} #{request['path']}"
+        retry_count = 0
+        loop do
+          begin
+            response = @http.run_request(request['method'].downcase.to_sym, url, body, headers)
+          rescue Faraday::Error => e
+            raise ProviderActionError.new(@name, 0, "#{label} failed: #{e.message}")
+          end
+          if response.status == 429 && retry_count < LIMITS['retries']
+            wait = rate_limit_wait_ms(response.headers, retry_count)
+            if call.waited_ms + wait <= LIMITS['budget_ms']
+              call.waited_ms += wait
+              sleep(wait / 1000.0)
+              retry_count += 1
+              next
+            end
+          end
+          return nil if response.status == 404
+          unless (200..299).cover?(response.status)
+            raise ProviderActionError.new(@name, response.status, "#{label} answered #{response.status}", error_code(response.body))
+          end
+          return nil if response.body.to_s.empty?
 
-      def delete_refresh_tokens(call, user_id, user)
-        begin
-          call.call('DELETE', "/users/#{user}/refresh-tokens", allow_404: true)
-          return
-        rescue ProviderActionError => e
-          raise unless not_on_plan?(e)
-        end
-        # Collect every id before deleting any, so the pages do not shift underneath.
-        ids = []
-        %w[refresh_token rotating_refresh_token].each do |type|
-          10.times do |page|
-            body = call.call('GET', '/device-credentials',
-                             query: [['user_id', user_id], ['type', type], ['page', page.to_s], ['per_page', PAGE.to_s]],
-                             allow_404: true)
-            listed = body.is_a?(Array) ? body.grep(Hash) : []
-            ids.concat(listed.map { |c| c['id'] }.select { |id| id.is_a?(String) && !id.empty? })
-            break if listed.length < PAGE
+          begin
+            return JSON.parse(response.body)
+          rescue JSON::ParserError
+            return nil
           end
         end
-        ids.each { |id| call.call('DELETE', "/device-credentials/#{ERB::Util.url_encode(id)}", allow_404: true) }
       end
     end
 
-    class LogOnly
-      def initialize(log)
-        @log = log
+    # Your own user store, from custom_provider.
+    class CustomProvider
+      def initialize(handlers)
+        @handlers = handlers
       end
 
-      def name = 'log_only'
+      def name = 'custom'
 
-      def revoke_sessions(user_id)
-        Segment.encode(user_id)
-        @log.call("NoResponse late result (log only): would revoke every session of user #{user_id}")
-        nil
-      end
+      def run(action, user_id)
+        handler = @handlers[action.to_s] or raise ArgumentError, "custom_provider has no #{action} handler"
+        also_ran = handler.call(user_id)
+        # Only an array of action names counts; any other return value (nil, true, a model) is no extra action.
+        return [] unless also_ran.is_a?(Array)
 
-      def ban(user_id)
-        Segment.encode(user_id)
-        @log.call("NoResponse late result (log only): would ban user #{user_id} and end their sessions")
-        nil
+        also_ran.map(&:to_s).select { |name| ACTIONS.include?(name) }
       end
     end
   end

data/lib/no_response/models/shared/account.rb

@@ -17,7 +17,7 @@ module NoResponse
           Models::Shared::AccountRisk,
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("risk"), required: true}}
         )
-        # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them.
+        # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed.
         field(
           :decisions_by_flow,
           Models::Shared::AccountDecisionsByFlow,

data/lib/no_response/models/shared/accountdecision.rb

@@ -4,7 +4,7 @@
 module NoResponse
   module Models
     module Shared
-      # AccountDecision - block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. Your application applies it.
+      # AccountDecision - block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows.<flow>.admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Your application applies it.
       class AccountDecision
         include ::Crystalline::Enum
         enums do
@@ -12,6 +12,7 @@ module NoResponse
           STEP_UP = new("step_up")
           REVIEW = new("review")
           BLOCK = new("block")
+          HELD = new("held")
         end
 
         open!

data/lib/no_response/models/shared/accountdecisionsbyflow.rb

@@ -4,12 +4,12 @@
 module NoResponse
   module Models
     module Shared
-      # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them.
+      # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed.
       class AccountDecisionsByFlow
         extend T::Sig
         include Crystalline::MetadataFields
 
-        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. Your application applies it.
+        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows.<flow>.admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Your application applies it.
         field(
           :account_creation,
           Models::Shared::AccountDecision,
@@ -21,7 +21,7 @@ module NoResponse
             }
           }
         )
-        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. Your application applies it.
+        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows.<flow>.admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Your application applies it.
         field(
           :login,
           Models::Shared::AccountDecision,
@@ -33,7 +33,7 @@ module NoResponse
             }
           }
         )
-        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. Your application applies it.
+        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows.<flow>.admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Your application applies it.
         field(
           :purchase,
           Models::Shared::AccountDecision,

data/lib/no_response/models/shared/accountrisk.rb

@@ -15,7 +15,7 @@ module NoResponse
           ::Integer,
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("score"), required: true}}
         )
-        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. Your application applies it.
+        # block when the score reached your block threshold (risk.block of the assessment), otherwise the assessment's recommendation. held only for a flow whose admission is held (settings flows.<flow>.admission), when the account's current assessment was made for that flow and its investigation has not completed (status partial): the final decision arrives as account.risk_changed when the investigation completes, decided by its score, or when the hold's deadline (hold_seconds after the assessment was created) passes first, as the flow's on_expiry action or the decision the evidence so far gives, whichever is stricter. Your application applies it.
         field(
           :decision,
           Models::Shared::AccountDecision,

data/lib/no_response/models/shared/accountriskchanged.rb

@@ -15,7 +15,7 @@ module NoResponse
           Models::Shared::Account,
           {'format_json': {'letter_case': ::NoResponse::Utils.field_name("account"), required: true}}
         )
-        # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them.
+        # The decision for each flow: the account's score under that flow's thresholds. A flow the workspace has not set uses its account_creation thresholds, so the flows differ only where it set them. The flow of the current assessment is held while that flow's admission is held and the assessment's investigation has not completed.
         field(
           :previous_decisions_by_flow,
           Models::Shared::AccountDecisionsByFlow,

data/lib/no_response/sdkconfiguration.rb

@@ -95,9 +95,9 @@ module NoResponse
 
       @language = "ruby"
       @openapi_doc_version = "1"
-      @sdk_version = "6.0.1"
+      @sdk_version = "7.0.1"
       @gen_version = "internal"
-      @user_agent = "noresponse-sdk/ruby 6.0.1 internal 1 noresponse"
+      @user_agent = "noresponse-sdk/ruby 7.0.1 internal 1 noresponse"
     end
 
     sig { returns([String, T::Hash[Symbol, String]]) }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: noresponse
 version: !ruby/object:Gem::Version
-  version: 6.0.1
+  version: 7.0.1
 platform: ruby
 authors:
 - NoResponse