sqrl-client 0.1.0 → 0.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0fcfd84f13a0b97bdd7742c8ff8d7cc918cada5c3ce355f51233c77e69463aa6
-  data.tar.gz: 0eef85f22ed8e989649837454f1ceb28994dfd3d3f71ac10b54dac0631ddbd93
+  metadata.gz: 8a9db39e917407e067ccc959b250dd36ee6d027177f8e733dd5938729c7be7bd
+  data.tar.gz: 5e0949bc3ea41694426a66690c6f76429c92f38e8125c08f14d99d7a0a36fcbf
 SHA512:
-  metadata.gz: 896a8745c0a4fdcb39babdb3ad61776b377eac8d60a45a50eb5edbababc62e3e8139f83667edb7ab9cdcd67903c1fa26427dc24f0424b5bd9f2c1ddc05a06442
-  data.tar.gz: 6651d2647ce80e827fe772770e69eae96bf46c1a7e9e4d1088e7c113759db729e9cafc0de2d7eac1c335a4c6cedf1843bc16fe9f4afc634f8605fa5e38e0ce29
+  metadata.gz: 9e712f1fbdca9d1db2ee81bb3a1fd2b0bb2a8594b01140b4ed0f752046db2f7beb08aa75fa15099b3c80b185c90b9b13354b9cc1db20c7c38bc171a7562dc3a6
+  data.tar.gz: e2bbb78aa9529c7e35b9dc2085499f98e413651599efc4010b80a33b5a5b4c4f42d0eef565141674099c6a6139f565015dc093247935c88cc4eb0f128e750897

data/CHANGELOG.md

@@ -1,9 +1,38 @@
 # Changelog
 
-## 0.1.0 — 2026-10-20
+All notable changes to `sqrl-client` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Every gem in
+the family shares one version number and is released in lockstep.
+
+## [Unreleased]
+
+## [0.1.2] - 2026-10-21
+
+### Changed
+
+- After a transient error the agent retries with the fresh nut and stops as soon as two
+  successive replies carry the identical TIF, raising `LoginFailed` (reason `:transient`)
+  with GRC's "The SQRL login page has expired" message, as Gibson specified
+  (grc.sqrl:23543). `max_transient_retries` remains as an upper bound.
+- The conformance runner's `transient_recovery` case accepts both conforming server
+  behaviours: recovery on retry, or the identical repeated transient error.
+- Requires sqrl-core 0.1.2.
+
+## [0.1.1] - 2026-10-20
+
+### Changed
+
+- Requires sqrl-core 0.1.1, which fixes the `NoMethodError` on Ruby 3.1 and 3.2. No other
+  changes.
+
+## [0.1.0] - 2026-10-20
 
 First release.
 
+### Added
+
 - `SQRL::Client::Agent`: login, query, disable, enable, remove against any SQRL site, with
   login-page discovery, previous-identity handling, `ask` and `sin` answering, transient
   retry and CPS handoff on the same cookie jar.
@@ -15,3 +44,8 @@ First release.
 - A 23-case server conformance suite usable from Ruby, RSpec (`it_behaves_like "a SQRL
   server"`) and the command line, with JUnit output.
 - Requires Ruby 3.1+ and `http-cookie`.
+
+[Unreleased]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.2...HEAD
+[0.1.2]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/danielpclark/sqrl-ruby/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/danielpclark/sqrl-ruby/releases/tag/v0.1.0

data/lib/sqrl/client/agent.rb

@@ -88,6 +88,9 @@ module SQRL
     class Agent
       # Seconds between status polls for non-CPS logins.
       DEFAULT_POLL_INTERVAL = 0.5
+      # The message GRC's reference client shows when a login page has gone stale
+      # (Gibson, grc.sqrl:21887, 7 Feb 2019).
+      TRANSIENT_MESSAGE = "The SQRL login page has expired. Please refresh the page, then log in with SQRL."
 
       attr_reader :identity, :transport, :options, :alt_id, :logger
       attr_accessor :cps, :follow_cps, :unknown_site, :ask_handler, :max_transient_retries, :poll, :poll_interval,
@@ -209,11 +212,10 @@ module SQRL
           break unless session.state.transient?
 
           transient += 1
-          next unless transient > @max_transient_retries
+          next unless transient > @max_transient_retries || repeated_error?(ctx)
 
-          raise LoginFailed.new("the server kept answering with a transient error", reason: :transient,
-                                                                                    tif: session.last_response.tif,
-                                                                                    state: session.state)
+          raise LoginFailed.new(TRANSIENT_MESSAGE, reason: :transient, tif: session.last_response.tif,
+                                                   state: session.state)
         end
 
         finish(ctx, command)
@@ -237,10 +239,10 @@ module SQRL
           case state.kind
           when :transient
             transient += 1
-            next if transient <= @max_transient_retries
+            next if transient <= @max_transient_retries && !repeated_error?(ctx)
 
-            raise LoginFailed.new("the server kept answering with a transient error", reason: :transient,
-                                                                                      tif: session.last_response.tif, state: state)
+            raise LoginFailed.new(TRANSIENT_MESSAGE, reason: :transient, tif: session.last_response.tif,
+                                                     state: state)
           when :unknown
             next if session.has_previous? && session.try_next_previous
 
@@ -258,6 +260,13 @@ module SQRL
         end
       end
 
+      # "In the case that two successive TIF errors exactly match, the SQRL client MUST abort the
+      # transaction and ask the user to please refresh their login page" (Gibson, grc.sqrl:23543,
+      # 23 Nov 2019; On The Wire v1.07, "Transient Error Details").
+      def repeated_error?(ctx)
+        ctx.tifs.length >= 2 && ctx.tifs[-1] == ctx.tifs[-2]
+      end
+
       def answer_ask(ctx)
         ask = ctx.session.pending_ask
         return unless ask

data/lib/sqrl/client/conformance/runner.rb

@@ -451,15 +451,26 @@ module SQRL
 
         # ---- robustness --------------------------------------------------------------------
 
+        # A stale nut must draw a transient error (0x20) with a fresh nut. What happens on the
+        # retry depends on the server (On The Wire v1.07, "Transient Error Details"): a server
+        # that can tie the stale nut back to its browser session lets the retry succeed; a
+        # server that keeps its state by reference answers with exactly the same error, which
+        # tells the client to have the user refresh the page. Both are conforming; anything else
+        # (a different error, or a "success" nobody's browser can complete) is not.
         def case_transient_recovery(ctx)
           id = identity
           browser = transport
           page = @site.login_page(browser)
           bogus = page.sqrl_url.sub(/nut=[^&]+/, "nut=conformance-stale")
-          result = agent(id, transport: browser, cps: false, poll: false).login(bogus)
-          ctx.transcript.concat(result.transcript)
-          check(result.tif_history.first.transient_error?, "the stale nut did not produce a transient error")
-          check(result.authenticated?, "login did not recover from the transient error")
+          begin
+            result = agent(id, transport: browser, cps: false, poll: false).login(bogus)
+            ctx.transcript.concat(result.transcript)
+            check(result.tif_history.first.transient_error?, "the stale nut did not produce a transient error")
+            check(result.authenticated?, "login did not recover from the transient error")
+          rescue LoginFailed => e
+            check(e.reason == :transient && e.tif&.transient_error?,
+                  "the stale nut did not produce a transient error (#{e.message})")
+          end
         end
 
         def case_concurrent_logins(ctx)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sqrl-client
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.2
 platform: ruby
 authors:
 - Daniel P. Clark
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.1.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.1.0
+        version: 0.1.2
 description: Identity management, the full SQRL command set, CPS handoff, login-page
   discovery, a Capybara helper, a CLI and a server conformance suite.
 email: