patchwork-rb 0.1.5 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 374df53edc622840cc719b9bb341ae9ff6272fbb71cde1f71df2cb3a46819f09
-  data.tar.gz: 5d147937164ef2fdaf16d067f586c9bf83dc13fc8b8eed578bf5ce22a4495864
+  metadata.gz: 564b479edcfcbad47a6b170dc219eecc6a5cd633c066f10a070631dd12583860
+  data.tar.gz: 0f0768a2e84d273f34eaebb0a6bef98f280dc6ff193f8ee72ded3ab6b3b9595a
 SHA512:
-  metadata.gz: dbf196787290106a3380d963f513f40ffba9327ce7c10b33ec307fa7eb4ff1b08182b7850b63b7d05be435fdeb3b427d385f5f2e23c69281350956a29ba40832
-  data.tar.gz: 95ee3747bab93b373d1a39ca115df1eab44a73fef3f0b49e7a2029a1d9df5418f4b7c0a23dc9197481dcf3333c9b928aeb65658639f390d74fd97a2177019521
+  metadata.gz: b4b7217e76620606f0b16b56d1e1828ebc0b36b86f2c99100ae0324adef914d772ca425017dc76a7e1c88f005c46586fd55be8ba5cb1abea895fb0dabf77e9d6
+  data.tar.gz: 71b097330f26014ec0447a8fb90afa21d67400b6314bbb3783b6399a7ce1669d91773ce9054aba74ba76370b95b833e027a73ab5fd1c38f5c1ca31c4e83658d3

data/README.md

@@ -213,6 +213,8 @@ use Patchwork::Gateway, resolve: ->(subject, claims) {
 
 `resolve` can take `(subject)` or `(subject, claims)`. Any object that responds to `call` works.
 
+A verified call answers with `Patchwork-Sdk: patchwork-rb/<version>`, so Patchwork can tell which version you run and retire an old signature label on evidence rather than a guess. A request that falls through to your own auth does not carry it.
+
 After a successful call, the request env carries:
 
 | Key | Value |

data/lib/patchwork/gateway.rb

@@ -63,7 +63,7 @@ module Patchwork
       return relay_mint(request, signature) if @mint_path && at?(request, @mint_path) && request.post?
 
       authenticate!(env, request, signature)
-      @app.call(env)
+      announce(@app.call(env))
     rescue TooLarge
       json(413, { error: "request body too large" })
     rescue InvalidSignature
@@ -177,9 +177,20 @@ module Patchwork
       json(401, { error: message })
     end
 
+    # Only a verified call gets the header. A request that fell through carries
+    # the consumer's own traffic, and Patchwork is not reading it.
+    def announce(response)
+      status, headers, body = response
+      [ status, headers.merge(SDK_HEADER => SDK), body ]
+    end
+
     def json(status, payload)
       body = JSON.generate(payload)
-      [ status, { "content-type" => "application/json", "content-length" => body.bytesize.to_s }, [ body ] ]
+      [ status, {
+        "content-type" => "application/json",
+        "content-length" => body.bytesize.to_s,
+        SDK_HEADER => SDK
+      }, [ body ] ]
     end
   end
 end

data/lib/patchwork/rails.rb

@@ -45,6 +45,7 @@ module Patchwork
         @patchwork_subject = result.subject
         @patchwork_claims = result.claims
         @patchwork_principal = result.principal
+        response.headers[::Patchwork::SDK_HEADER] = ::Patchwork::SDK
       rescue ::Patchwork::StaleSignature
         deny_patchwork_call("stale signature")
       rescue ::Patchwork::InvalidSignature

data/lib/patchwork/version.rb

@@ -1,3 +1,3 @@
 module Patchwork
-  VERSION = "0.1.5".freeze
+  VERSION = "0.1.6".freeze
 end

data/lib/patchwork.rb

@@ -12,6 +12,14 @@ require "patchwork/health_check"
 require "patchwork/mint"
 require "patchwork/bridge_assertion"
 
+module Patchwork
+  # Announced on a response to a verified Patchwork call, so the platform can
+  # tell which version a workspace runs and retire an old signature label on
+  # evidence rather than a guess. Lowercase, as Rack 3 requires.
+  SDK_HEADER = "patchwork-sdk".freeze
+  SDK = "patchwork-rb/#{VERSION}".freeze
+end
+
 module Patchwork
   class << self
     def config

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: patchwork-rb
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.6
 platform: ruby
 authors:
 - Chromablue Labs