qopanza 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 9071c080539ac74f1fa070c1e483569f6b513ce5a1a17c5b1380a13aa2e0f169
+  data.tar.gz: c4a7c0d2e86d3d63cb2015a4a4b8231225013d56036d0393872e4eb84c57e909
+SHA512:
+  metadata.gz: b368d3c86f3d45ada955de54da48abd63f54f3d9f3c1a08db1cf92893a9699db2c4c383ca0ec2753448150fa51b17773289028bf5640da35de857b9c561104ce
+  data.tar.gz: 7ef1d0973573fde568c1fe8d774e8f390d17ac6f85fb8e1cbb4210e386d1156bde46928e49c47697bb17db5a637384de7013f450b5249ba4bed1fceaa9752f40

data/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Gsente LLC
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/README.md

@@ -0,0 +1,71 @@
+# qopanza (Ruby)
+
+Ruby client for the Qopanza API.
+
+## Install
+
+```ruby
+gem "qopanza"
+```
+
+Requires Ruby 3.0+. **No runtime dependencies** — `net/http`, `json` and
+`base64` are all standard library. A security gem that drags in a tree of
+transitive dependencies is a harder sell to exactly the teams most likely
+to care about supply chain.
+
+## Usage
+
+Get an API key by signing up first — it is shown exactly once.
+
+```ruby
+require "qopanza"
+
+client = Qopanza::Client.new(base_url: "http://localhost:8000", api_key: api_key)
+
+# One-line encryption: no key management at all.
+sealed = client.encrypt(plaintext: "customer sensitive information")
+client.decrypt(sealed) # => "customer sensitive information"
+
+# Full control.
+key = client.create_key(purpose: "kem", label: "order-service")
+sealed = client.encrypt(key_id: key["id"], plaintext: "hello quantum-safe world")
+
+sig_key = client.create_key(purpose: "signature")
+signed = client.sign(key_id: sig_key["id"], message: "order-42-confirmed")
+client.verify(key_id: sig_key["id"], message: "order-42-confirmed", signature: signed["signature"])
+
+# Discovery.
+run = client.scan_tls(host: "api.example.com")
+posture = client.security_posture
+```
+
+Run the quickstart:
+
+```bash
+QOPANZA_API_KEY=qsk_... QOPANZA_BASE_URL=http://localhost:8000 \
+  ruby examples/quickstart.rb
+```
+
+## Notes
+
+- **Raw strings, not base64.** Base64 is applied internally.
+- **`verify` returns `false` only for a genuinely invalid signature.** A
+  failed call raises `Qopanza::ApiError` instead — treating an
+  unreachable API as "invalid signature" is how a verification step
+  silently becomes a no-op.
+- **A failed scan has a nil `risk_score`**, not zero.
+- `ApiError#status_code` is separate from the message, so a 409 from a
+  revoked key can be handled differently from a 429 rate limit. A status
+  of `0` means the request never reached the API.
+- `decrypt` accepts either string or symbol keys, since Ruby callers
+  reasonably build hashes both ways.
+
+This client holds a secret API key, so it belongs server-side.
+
+## Tests
+
+```bash
+rake test
+# or, without rake:
+ruby -Ilib -Itest test/test_client.rb
+```

data/lib/qopanza.rb

@@ -0,0 +1,233 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "net/http"
+require "uri"
+
+# Ruby client for the Qopanza API.
+#
+# Covers the crypto endpoints (keys, encrypt, decrypt, sign, verify), the
+# AI analysis endpoint, and the scanner/posture endpoints that make the API
+# useful from CI. Account signup, billing and support are dashboard
+# concerns and are not part of this SDK — the same scoping the Python, Go,
+# Rust, PHP, TypeScript and Java SDKs use.
+#
+#   client = Qopanza::Client.new(base_url: "http://localhost:8000", api_key: key)
+#
+#   # One-line encryption: no key management at all.
+#   sealed = client.encrypt(plaintext: "customer sensitive information")
+#   client.decrypt(sealed) # => "customer sensitive information"
+#
+# Byte handling is raw strings at the API boundary with base64 applied
+# internally: base64 is a wire-format detail, and making callers encode it
+# themselves is how a plaintext ends up double-encoded in production.
+#
+# Deliberately stdlib-only (net/http, json, base64). A security library
+# that drags in a tree of transitive gems is a harder sell to exactly the
+# teams most likely to care about supply chain.
+#
+# This client holds a secret API key, so it belongs server-side.
+module Qopanza
+  VERSION = "0.1.0"
+  DEFAULT_BASE_URL = "http://localhost:8000"
+
+  # Raised for any non-2xx response, or a transport failure.
+  #
+  # +status_code+ is kept separate from the message so callers can branch
+  # on it — a 409 from a revoked key needs different handling from a 429
+  # from a rate limit. A status of 0 means the request never reached the
+  # API at all.
+  class ApiError < StandardError
+    attr_reader :status_code, :detail
+
+    def initialize(status_code, detail)
+      @status_code = status_code
+      @detail = detail
+      super("qopanza: [#{status_code}] #{detail}")
+    end
+  end
+
+  class Client
+    # @param transport [#call] optional override with the signature
+    #   call(method, uri, body, headers) -> [status, body]. Exists so the
+    #   test suite can exercise request encoding and response decoding
+    #   without a network, which is where a client library actually breaks.
+    def initialize(base_url: DEFAULT_BASE_URL, api_key: nil, timeout: 15, transport: nil)
+      base_url = DEFAULT_BASE_URL if base_url.nil? || base_url.empty?
+      @base_url = base_url.sub(%r{/+\z}, "")
+      @api_key = api_key
+      @timeout = timeout
+      @transport = transport
+    end
+
+    # ---- Keys ---------------------------------------------------------------
+
+    # Generate a keypair. +purpose+ is "kem", "signature", or "hybrid_kem".
+    def create_key(purpose:, label: nil)
+      body = { purpose: purpose }
+      body[:label] = label if label
+      request(:post, "/keys", body)
+    end
+
+    def get_key(key_id)
+      request(:get, "/keys/#{escape(key_id)}")
+    end
+
+    # ---- Encrypt / decrypt --------------------------------------------------
+
+    # Seal +plaintext+.
+    #
+    # Omit +key_id+ for the one-line path, where the platform provisions
+    # and reuses a managed key for the account and reports which one it
+    # used in "used_managed_key".
+    def encrypt(plaintext:, key_id: nil)
+      body = { plaintext: Base64.strict_encode64(plaintext) }
+      body[:key_id] = key_id if key_id
+      request(:post, "/encrypt", body)
+    end
+
+    # Open what #encrypt sealed. Pass the hash it returned straight back.
+    def decrypt(sealed)
+      result = request(:post, "/decrypt", {
+        key_id: sealed["key_id"] || sealed[:key_id],
+        ciphertext_kem: sealed["ciphertext_kem"] || sealed[:ciphertext_kem],
+        ciphertext_payload: sealed["ciphertext_payload"] || sealed[:ciphertext_payload],
+        nonce: sealed["nonce"] || sealed[:nonce]
+      })
+      Base64.strict_decode64(result["plaintext"])
+    end
+
+    # ---- Sign / verify ------------------------------------------------------
+
+    def sign(key_id:, message:)
+      request(:post, "/sign", { key_id: key_id, message: Base64.strict_encode64(message) })
+    end
+
+    # Check a signature.
+    #
+    # Returns false only when the signature genuinely did not verify. A
+    # failed call raises instead — treating an unreachable API as "invalid
+    # signature" is how a verification step silently becomes a no-op.
+    def verify(key_id:, message:, signature:)
+      result = request(:post, "/verify", {
+        key_id: key_id,
+        message: Base64.strict_encode64(message),
+        signature: signature
+      })
+      result["valid"]
+    end
+
+    # ---- AI analysis --------------------------------------------------------
+
+    def analyze(context)
+      request(:post, "/analyze", { context: context })
+    end
+
+    # ---- Scanner ------------------------------------------------------------
+
+    # Scan submitted source or manifest text. Nothing is fetched — only
+    # what you pass is scanned.
+    #
+    # The returned run has a nil "risk_score" when it failed, rather than
+    # zero: a scan that could not run must never read as a clean result.
+    def scan_code(filename:, content:)
+      request(:post, "/scan/code", { filename: filename, content: content })
+    end
+
+    # Probe a live TLS endpoint and record what it actually negotiates,
+    # including its certificate's key algorithm.
+    def scan_tls(host:, port: 443)
+      request(:post, "/scan/tls", { host: host, port: port.zero? ? 443 : port })
+    end
+
+    def scan_assets(scan_id)
+      request(:get, "/scans/#{escape(scan_id)}/assets")
+    end
+
+    # ---- Posture / inventory ------------------------------------------------
+
+    # The account's quantum risk score and what drives it.
+    #
+    # "score" runs 0-100 where higher is better, so it moves opposite to
+    # "quantum_risk". A score of 100 with a nil "last_scan_at" means "no
+    # vulnerable cryptography found" on an empty inventory — an absence of
+    # evidence, not evidence of safety.
+    def security_posture
+      request(:get, "/security/posture")
+    end
+
+    def crypto_inventory
+      request(:get, "/inventory")
+    end
+
+    private
+
+    def escape(value)
+      URI.encode_www_form_component(value.to_s).gsub("+", "%20")
+    end
+
+    def request(method, path, body = nil)
+      uri = URI.parse("#{@base_url}/v1#{path}")
+      headers = { "Content-Type" => "application/json" }
+      headers["X-API-Key"] = @api_key if @api_key
+
+      encoded = body.nil? ? nil : JSON.generate(body)
+      status, response_body =
+        if @transport
+          @transport.call(method, uri, encoded, headers)
+        else
+          send_request(method, uri, encoded, headers)
+        end
+
+      raise ApiError.new(status, extract_detail(response_body)) if status >= 400
+      return {} if response_body.nil? || response_body.empty?
+
+      JSON.parse(response_body)
+    rescue JSON::ParserError => e
+      raise ApiError.new(status || 0, "Response was not valid JSON: #{e.message}")
+    end
+
+    # The API returns {"detail": "..."} for its own errors. Anything else —
+    # a proxy's HTML error page, say — is surfaced raw rather than
+    # swallowed, because "unknown error" helps nobody debug.
+    def extract_detail(response_body)
+      return "" if response_body.nil?
+
+      parsed = begin
+        JSON.parse(response_body)
+      rescue JSON::ParserError
+        nil
+      end
+
+      if parsed.is_a?(Hash) && parsed.key?("detail")
+        detail = parsed["detail"]
+        return detail.is_a?(String) ? detail : JSON.generate(detail)
+      end
+      response_body.strip
+    end
+
+    def send_request(method, uri, body, headers)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = @timeout
+      http.read_timeout = @timeout
+
+      request_class = {
+        get: Net::HTTP::Get,
+        post: Net::HTTP::Post,
+        put: Net::HTTP::Put,
+        delete: Net::HTTP::Delete
+      }.fetch(method)
+
+      req = request_class.new(uri.request_uri)
+      headers.each { |name, value| req[name] = value }
+      req.body = body if body
+
+      response = http.request(req)
+      [response.code.to_i, response.body]
+    rescue StandardError => e
+      raise ApiError.new(0, "Transport error: #{e.message}")
+    end
+  end
+end

metadata

@@ -0,0 +1,64 @@
+--- !ruby/object:Gem::Specification
+name: qopanza
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Gsente LLC
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-09-10 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: minitest
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+description: Post-quantum cryptography (ML-KEM, ML-DSA) and cryptographic discovery
+  from Ruby.
+email:
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/qopanza.rb
+homepage: https://qopanza.com
+licenses:
+- Apache-2.0
+metadata:
+  homepage_uri: https://qopanza.com
+  source_code_uri: https://github.com/isingomajoel2023/qopanza-sdks
+  bug_tracker_uri: https://github.com/isingomajoel2023/qopanza-sdks/issues
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.22
+signing_key:
+specification_version: 4
+summary: Ruby client for the Qopanza API
+test_files: []