vpndetection 5.10.0 → 5.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dedd11823619c5d0503009b84e5b77acf1975d5e1f0a4f3484683543b5b48554
-  data.tar.gz: eab3545e7200ff9939caae8a5e42394d7973c92147b59d7e148a9ad8cbdccf41
+  metadata.gz: 53a47c7a74fc9b0b6d904a2ff64d06fef0e877e93abc4af20b34f543d9c637f1
+  data.tar.gz: 203ddf3621a6e7083fe56998c8a5a1a417b56bf8d21a32ba96f8a2f0a4e52e29
 SHA512:
-  metadata.gz: 880e2eab30ca0651db6ae6954272ace94c3b3e6986824dc28a6498b40dce87a800513c037a1d6904a7040d5920d2ba7b55146e22d21bc7a69de96d4c4d4f6c77
-  data.tar.gz: a832c58a56fb28b0d6637a4b0fb5b64459e2d23d369ccfd31034afb03407edf520a170e4d9cfb021b0bc55dfcb0b352f5045d06cd8ab8d1fc85502d8f39978e9
+  metadata.gz: 83466d57ff0b38c35bcbd8008b17b58675ee08b50e5b85f5183110554316bb3bbf743e16cb2aa6ecc4ff8ff7bc6423366f1d8c7bbf5f4dc54e2d17afbfd0fb28
+  data.tar.gz: 89f88adbe30de7547654930d45cb9884f9ce2d365fbb74baeada08dace99d1576824f3eedfdb2648e68faa1a4e149c8fad5e096357d500dcc1fdd2755cdcfe6a

data/README.md

@@ -221,6 +221,17 @@ token = client.oauth.exchange_authorization_code('your-client-id', code, pkce.ve
 
 Check that `state` came back as you sent it before you exchange `code`, which works once. The client ID can also be the https URL of a client metadata document your app serves, and such an app is never handed a key, so `token.apikey` stays `nil`.
 
+### Register a client
+
+An app with no client ID, and no client metadata document to use as one, registers itself, then signs in with the `client_id` it gets back as the client ID for `authorization_url` and `exchange_authorization_code`:
+
+```ruby
+client = VPNDetection::Client.new
+registration = client.oauth.register(['http://127.0.0.1:8765/callback'], client_name: 'Your App')
+```
+
+Each redirect URI must be https on a public host name, or http on a loopback address, which then matches any port. Nothing is kept until a person approves the client, so an app with no client ID saved can simply register again.
+
 ### Absent is not false
 
 Without a key only `ip` and `is_vpn` come back, and a free key adds Tor, relay, `location` and `asn`. Every other field is present when your plan includes it and `nil` when it does not. `nil` means "not in your plan"; `false` means "we checked, and no".

data/lib/vpndetection/client.rb

@@ -25,7 +25,7 @@ module VPNDetection
 
     # @param api_key [String, nil] omit it entirely to use the free tier, which
     #   answers `ip` and `is_vpn` and allows 1000 requests per day per source
-    #   address.
+    #   address. It is trimmed, and a key of blanks alone is no key.
     # @param cache [Boolean] pass false to disable caching.
     # @param cache_ttl [Numeric] how long an answer stays fresh, in seconds.
     # @param concurrency [Integer] batch requests - chunks of up to 1000 addresses - in flight during a batch.
@@ -37,6 +37,7 @@ module VPNDetection
     #   longer in total, and every call that takes `retries:` also takes
     #   `timeout:` to override it. A dataset transfer bounds only its connect
     #   phase with it.
+    # @raise [ArgumentError] for an `api_key` with a control character in it.
     # @raise [ArgumentError] for a `timeout`, here or on any call, that is
     #   negative, not a finite number, or past 2147483.647 seconds (2**31 - 1 ms),
     #   the longest curl holds.

data/lib/vpndetection/oauth_api.rb

@@ -36,6 +36,7 @@ module VPNDetection
     TOKEN_PATH = '/oauth/token'
     REVOKE_PATH = '/oauth/revoke'
     AUTHORIZE_PATH = '/oauth/authorize'
+    REGISTER_PATH = '/oauth/register'
     DEVICE_CODE_GRANT = 'urn:ietf:params:oauth:grant-type:device_code'
     # The longest single `sleep` the poll asks Ruby for, in seconds.
     LONGEST_SLEEP = 2**31 - 1
@@ -45,6 +46,7 @@ module VPNDetection
       OauthMetadata => %i[issuer authorization_endpoint token_endpoint],
       DeviceAuthorization => %i[device_code user_code verification_uri expires_in interval],
       TokenResponse => %i[access_token token_type expires_in],
+      ClientRegistration => %i[client_id client_id_issued_at client_name redirect_uris token_endpoint_auth_method],
     }.freeze
 
     def initialize(transport, retries:)
@@ -151,6 +153,31 @@ module VPNDetection
       [Digest::SHA256.digest(verifier)].pack('m0').tr('+/', '-_').delete('=')
     end
 
+    # Register a client for the authorization code flow, for an app that cannot
+    # serve a Client ID Metadata Document, and get its `client_id` for
+    # {#authorization_url} and {#exchange_authorization_code}.
+    #
+    # Each redirect URI must be https on a public host name, or http on a
+    # loopback address, which then matches on any port; the server refuses any
+    # other with {OauthRequestError} coded `invalid_redirect_uri`. Nothing is kept
+    # until a person approves the client, so registering again costs nothing, and
+    # this is retried like a read. No URI at all, or one that is empty or not
+    # UTF-8, raises ArgumentError before anything is sent.
+    #
+    # @param client_name [String, nil] shown to the person as the client's own
+    #   claim; left out when empty.
+    # @return [ClientRegistration]
+    def register(redirect_uris, client_name: nil, timeout: nil)
+      raise ArgumentError, 'redirect_uris must list at least one URI' unless redirect_uris.is_a?(Array) && !redirect_uris.empty?
+
+      body = { 'redirect_uris' => redirect_uris.each_with_index.map { |uri, i| utf8!("redirect_uris[#{i}]", uri) } }
+      name = client_name.nil? ? '' : utf8!('client_name', client_name, empty: true)
+      body['client_name'] = name unless name.empty?
+      Retries.with_retries(@retries) do
+        decode(ClientRegistration, @transport.oauth_request(:POST, REGISTER_PATH, json: body, timeout: timeout).run)
+      end
+    end
+
     # Revoke an access or refresh token. A refresh token ends the whole grant and
     # every token it issued, which is how a machine signs out.
     #
@@ -226,6 +253,18 @@ module VPNDetection
       raise ArgumentError, "#{name} is not valid UTF-8"
     end
 
+    def utf8!(name, value, empty: false)
+      raise ArgumentError, "#{name} must be a String" unless value.is_a?(String)
+      raise ArgumentError, "#{name} must not be empty" if value.empty? && !empty
+
+      utf8 = value.encode(Encoding::UTF_8)
+      raise ArgumentError, "#{name} is not valid UTF-8" unless utf8.valid_encoding?
+
+      utf8
+    rescue EncodingError
+      raise ArgumentError, "#{name} is not valid UTF-8"
+    end
+
     def exchange(form, timeout)
       decode(TokenResponse, @transport.oauth_request(:POST, TOKEN_PATH, form: form, timeout: timeout).run)
     end

data/lib/vpndetection/transport.rb

@@ -34,6 +34,20 @@ module VPNDetection
             "timeout must be a number of seconds from 0 (no bound) to #{LONGEST_TIMEOUT}, not #{timeout.inspect}"
     end
 
+    # The key as sent: trimmed, and nil when nothing is left. Through 5.10.1 a key
+    # of blanks went out as `Authorization: Bearer` and a padded one padded, and
+    # curl passed a control character on, so a key ending in a CR LF and a line
+    # of its own wrote that line onto the wire as a header. Refused where it is
+    # set, without the key in the message, since the key is a secret.
+    def self.checked_key(api_key)
+      return nil if api_key.nil?
+
+      key = api_key.to_s.strip
+      raise ArgumentError, 'api_key must not contain a control character' if key.match?(/[[:cntrl:]]/)
+
+      key.empty? ? nil : key
+    end
+
     # The generated Configuration applies EVERY security scheme the spec lists,
     # so a keyless client would send `Authorization: Bearer `, an empty
     # `X-Api-Key` and an empty `apikey` query parameter. The API answers 401 to
@@ -45,17 +59,18 @@ module VPNDetection
         self.scheme = uri.scheme
         self.host = uri.port == uri.default_port ? uri.host : "#{uri.host}:#{uri.port}"
         self.base_path = uri.path
-        self.access_token = api_key
+        self.access_token = Transport.checked_key(api_key)
         self.timeout = timeout.nil? ? nil : Transport.checked_timeout(timeout)
       end
 
       def auth_settings
-        return {} if access_token.nil? || access_token.to_s.empty?
+        token = access_token.to_s.strip
+        return {} if token.empty?
 
         {
           'bearerAuth' => {
             type: 'bearer', in: 'header', key: 'Authorization',
-            value: "Bearer #{access_token}"
+            value: "Bearer #{token}"
           }
         }
       end
@@ -164,11 +179,13 @@ module VPNDetection
     #
     # The form is encoded here rather than by curl, so a `+` in a value leaves as
     # `%2B` and never arrives as a space.
-    def oauth_request(http_method, path, form: nil, timeout: nil)
+    def oauth_request(http_method, path, form: nil, json: nil, timeout: nil)
       headers = { 'Accept' => 'application/json' }
       headers['Content-Type'] = 'application/x-www-form-urlencoded' unless form.nil?
+      headers['Content-Type'] = 'application/json' unless json.nil?
       request = build_request(http_method, path, header_params: headers, auth_names: [], timeout: timeout)
       request.options[:body] = URI.encode_www_form(form) unless form.nil?
+      request.options[:body] = JSON.generate(json) unless json.nil?
       request
     end
 
@@ -317,6 +334,23 @@ module VPNDetection
                        created],
     }.freeze
 
+    # RFC 3339's full-date, the spec's `date`, and its date-time, the spec's
+    # `date-time`, in the upper case the API sends. Anything else reached the
+    # generated reader's Date.parse or Time.parse, which read "monday" as this
+    # week's, "10:00" as today in the process's zone and 30 February as 2 March,
+    # or a lookup's detail handed it back as served (5.10.0, measured 2026-10-21).
+    RFC3339_DATE = /\A(\d{4})-(\d{2})-(\d{2})\z/
+    RFC3339_DATE_TIME = /\A(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d+)?(?:Z|[+-](\d{2}):(\d{2}))\z/
+
+    # A date in the form its type names, on a day and at a time that exist: an
+    # hour of 24 rolls over the way a missing day does.
+    def self.date?(value, type)
+      m = (type == 'Date' ? RFC3339_DATE : RFC3339_DATE_TIME).match(value)
+      return false unless m && Date.valid_date?(m[1].to_i, m[2].to_i, m[3].to_i)
+
+      type == 'Date' || (m[4].to_i < 24 && m[5].to_i < 60 && m[6].to_i < 60 && m[7].to_i < 24 && m[8].to_i < 60)
+    end
+
     # True when the parsed `value` has the generated `type`, a model's members
     # recursively; raises TypeError naming where it does not. No list entry or
     # map value the spec describes may be null: through 5.9.0 one came back as
@@ -327,7 +361,8 @@ module VPNDetection
 
       typed =
         case type
-        when 'String', 'Date', 'Time' then value.is_a?(String)
+        when 'String' then value.is_a?(String)
+        when 'Date', 'Time' then value.is_a?(String) && date?(value, type)
         when 'Integer' then value.is_a?(Integer)
         when 'Float' then value.is_a?(Numeric)
         when 'Boolean' then [true, false].include?(value)

data/lib/vpndetection/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module VPNDetection
-  VERSION = '5.10.0'
+  VERSION = '5.11.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vpndetection
 version: !ruby/object:Gem::Version
-  version: 5.10.0
+  version: 5.11.0
 platform: ruby
 authors:
 - Mslm Dev