patchwork-rb 0.1.8 → 0.1.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a83f39124088d921584da26ad346e4d61161b843f0495771ab0342c14cb88879
-  data.tar.gz: 3dde8e91a81d42d90c449d5789720cce885712ce7452dcd025d6e082e3e9d2a4
+  metadata.gz: 2d1aedce8e678200369c6550388c002085afd364d06a2aa98c4f4f1727c728c3
+  data.tar.gz: 01fe72a9e84de16a83a98be88ecd770363ac2520f39857d054fa9fece6c1edea
 SHA512:
-  metadata.gz: e9071f60b2b687cd47ae7526a8ef92b603ccc7df804d1051275efe7a74ea2f2cc4eae601560be959346ef9114977794248b4bba4024a49f52c0e8e8358868e85
-  data.tar.gz: 687340d10a3cd2e15857bdfa8f712e72e9d9d9ce94bf4ff32966121bebca0a441bcb861791846a6f65a38a7ad095f51eb0f010551011f5318f3ad5ca7215e11d
+  metadata.gz: 5f1cf733c653e0186303cdc14f1b80d2f87c8c73cfc13f592c2ade0f197f0120266fb8d102005225b2fb194c6b2738308985a0c0405708b8f29ddbc517924fb5
+  data.tar.gz: d7f9b1a2502da37c696732a96c0b4d2a8094918b5cfeb9fa8ff5c5563bc21a523c7008d961b9d076b005dbed90824d9c6f756cf08cddc65f20a6983957f2a7c1

data/README.md

@@ -235,13 +235,13 @@ Failure behaviour:
 
 ### What the signature does and doesn't cover
 
-A signature carries a label. `v1` covers the method, the path and the raw body. `v2` covers the same with the query string, exactly as sent. The scheme is specified in the [Signing guide](https://docs.usepatchwork.co/guides/signing).
+A signature carries a label. `v2` covers the method, the path **with the query string exactly as sent**, and the raw body. The scheme is specified in the [Signing guide](https://docs.usepatchwork.co/guides/signing).
 
 The gateway and the concern verify either label, and pass the query for you. If you verify with the primitives instead, pass `query:` — the raw query string, `request.query_string` in Rack and Rails. Leave it out and a `v2` value is checked against the bare path, which will not match.
 
-**By default a GET tool's arguments are not protected yet.** Patchwork sends both labels while consumers upgrade, and `v1` does not cover the query, so a header carrying both verifies through `v1` even if the query changed.
+**A GET tool's arguments are covered.** Patchwork signs the query on every signed call — tool calls, a patch dry run, the relay mint, the connection probe and webhook deliveries — so a request whose arguments were changed in flight does not verify. You get this without configuring anything.
 
-Two ways to close that:
+An earlier label, `v1`, covered the path without the query. Patchwork no longer sends it. This gem still accepts one if it arrives, which is harmless because nothing emits one and nobody can produce one without your request secret. To refuse it anyway:
 
 ```ruby
 use Patchwork::Gateway,
@@ -249,10 +249,6 @@ use Patchwork::Gateway,
   labels: [ Patchwork::Signature::V2 ]
 ```
 
-Requiring `v2` refuses any signature that does not cover the query. Patchwork sends `v2` on every signed call — tool calls, a patch dry run, the relay mint, the connection probe and webhook deliveries — so this is safe to turn on today. It will fail against a platform that has not started sending `v2`, which is why it is not the default.
-
-Or give any tool whose arguments matter — ids, amounts, anything that writes — a `POST` binding, where the arguments travel in the signed body.
-
 The signed path is the one your app sees. If a proxy rewrites paths before your app does, mount the gateway where the original path is still intact.
 
 **Method overrides are refused.** A signed request that carries `X-HTTP-Method-Override`, or that `Rack::MethodOverride` has already rewritten, is a 401. Patchwork never sends one, and the header isn't signed.

data/lib/patchwork/version.rb

@@ -1,3 +1,3 @@
 module Patchwork
-  VERSION = "0.1.8".freeze
+  VERSION = "0.1.9".freeze
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: patchwork-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.8
+  version: 0.1.9
 platform: ruby
 authors:
 - Chromablue Labs
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-06 00:00:00.000000000 Z
+date: 2026-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt