wefunder 0.1.0.beta2 → 0.1.0.beta3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 946ede1e59f03277730fa442f9df079e44bac9532db1587306f488d1d8c0a616
-  data.tar.gz: 53ca111474c48a0e954a690caa7001b34cad1c28cd9ba2e275d2489e5f3a235c
+  metadata.gz: a3ac10a62a698ee6cb163f3ec6e100248d461dc6c55bf97caeb1bac349b44af6
+  data.tar.gz: 26d0e08433a88d288942da627f8d509ffa196e6e2ed3cc347bae43beadaf84bf
 SHA512:
-  metadata.gz: 96cafc3351d195aae306c22a512d0ae1ea7613b2a0d7ffdc843cfc2c37614006effae50197c38c175020ecee6145140e2271f5c26355b39a53eac7a2636626c4
-  data.tar.gz: 381a50ca34d2084e923b4336e4d39b7d6403ad6f2c15feb03602493d0ab1ad3ebf88123bf5bf86cb75bab1a718f7709f00e4b7d8d79b1ac34973e7d22fe1ef3e
+  metadata.gz: 4ee97ef8052e3e7a9476a8b0243b52a706bfd2c6a5911e1b9362c07e5d5d6290529615ed6daace3d953769d126a492440692ebef5191cd7846c418a70f6a54b5
+  data.tar.gz: 535800baceafa25b8fcb744d2a1fc16a0596e14d80db5fba6f0c83772ee371c16a361335f82819b5a5e664bf016d17b008d3ff46a3f07f527eab491d8aa36bdd

data/README.md

@@ -84,10 +84,11 @@ class TokenStore
 end
 ```
 
-The rotated set is saved **before** any thread can use it. If `store.save` raises, the SDK still
-switches to the new set in memory (the old refresh token is already dead) and raises
-`Wefunder::TokenPersistenceError`, whose `tokens` is the set that is live but not durable. Alert on it
-and retry the save; do not swallow it, or a restart will not be able to reconnect.
+The rotated set is saved **before** any thread can use it. If `store.save` or `on_token_refresh` raises, the SDK raises
+`Wefunder::TokenPersistenceError` and keeps the rotated set *pending*: no request is made with it, the
+consumed refresh token is never reused, and the next call retries the save (or persist
+`error.tokens` yourself and call `wf.token_manager.mark_persisted!(error.tokens)`; a stale acknowledgment after another rotation is a no-op). Alert on this error; a process
+that keeps failing to save cannot reconnect after a restart.
 
 Concurrent requests that hit a 401 at the same time share one refresh (the client is thread-safe).
 If several application instances can use the same OAuth connection, serialize refreshes for that
@@ -229,10 +230,13 @@ sends a fully-wrapped request and returns the decoded JSON.
 ```bash
 bundle install
 bundle exec rubocop
-bundle exec rspec                 # hermetic; spec/e2e is excluded by rake and CI on PRs
-bundle exec rspec spec/e2e        # live sandbox, with WEFUNDER_CLIENT_ID / WEFUNDER_CLIENT_SECRET
+bundle exec rspec                             # hermetic — live examples are tagged :e2e and filtered out
+WEFUNDER_E2E=1 bundle exec rspec spec/e2e     # live sandbox; also needs WEFUNDER_CLIENT_ID / WEFUNDER_CLIENT_SECRET
 ```
 
+The live group is opt-in by tag, not by path: without `WEFUNDER_E2E=1` it never runs, even when sandbox
+credentials happen to be exported in your shell.
+
 Generated files in `lib/wefunder_generated/` come from `openapi/openapi.yaml` via `script/generate`
 (openapi-generator in Docker; no Java needed) and are never edited by hand.
 

data/lib/wefunder/client.rb

@@ -70,6 +70,9 @@ module Wefunder
     # The current token set (rotated refresh token included).
     def tokens = @token_manager.current
 
+    # The TokenManager (for +mark_persisted!+ after handling a TokenPersistenceError).
+    attr_reader :token_manager
+
     # The generated APIs, one accessor per tag (+wf.raw.syndicate_members.list_syndicate_members(id)+).
     # Wrap calls in +wrap+ to get typed errors.
     attr_reader :raw

data/lib/wefunder/token_manager.rb

@@ -8,8 +8,10 @@ module Wefunder
   # manager already holds a different one, another caller recovered in the meantime and the
   # current set is returned without a round-trip. The rotated set is persisted (store +
   # callback) BEFORE the retried request can use it. Thread-safe (Mutex).
-  # Raised when the token store failed to save a rotated token set. +tokens+ is the set that
-  # is now live in memory but NOT durable; +cause+ is the store's exception.
+  # Raised when the token store failed to save a rotated token set. +tokens+ is the rotated
+  # set that is NOT yet durable and NOT yet in use; the manager keeps it pending and retries
+  # the save on the next call (or persist it yourself and call +mark_persisted!(tokens)+). Until it is
+  # saved no request is made with it — the consumed refresh token is never reused either.
   class TokenPersistenceError < StandardError
     attr_reader :tokens
 
@@ -22,7 +24,9 @@ module Wefunder
   class TokenManager
     DEFAULT_EXPIRY_LEEWAY_SECONDS = 30.0
 
-    attr_reader :current
+    # The durable, in-use token set. A rotated set that could not be persisted is held in
+    # +pending_tokens+ instead until a save succeeds.
+    attr_reader :current, :pending_tokens
 
     def initialize(tokens, client_id: nil, client_secret: nil, re_mint: nil, on_token_refresh: nil, store: nil,
                    faraday: nil, now: nil, expiry_leeway_seconds: DEFAULT_EXPIRY_LEEWAY_SECONDS,
@@ -46,16 +50,35 @@ module Wefunder
       can_rotate? || !@re_mint.nil?
     end
 
-    # A valid access token, refreshing proactively if expired / within the leeway.
+    # A valid access token, refreshing proactively if expired / within the leeway. If a rotated
+    # set is pending persistence, the save is retried first — no request uses an undurable token.
     def access_token
+      @lock.synchronize { publish_pending! if @pending_tokens } if @pending_tokens # re-check under the lock
       refresh(stale_token: @current.access_token) if near_expiry? && can_refresh?
       @current.access_token
     end
 
+    # Tell the manager you persisted +tokens+ (the set from a TokenPersistenceError) yourself.
+    # Publishes it only if it is still the pending set; a stale acknowledgment (the manager has
+    # since rotated again) is a no-op and returns false, so an older save can never publish a
+    # newer, unsaved set.
+    def mark_persisted!(tokens)
+      @lock.synchronize do
+        return false unless @pending_tokens && same_token_set?(@pending_tokens, tokens)
+
+        @current = @pending_tokens
+        @pending_tokens = nil
+        true
+      end
+    end
+
     # Recover the token (after a 401 or proactively). If +stale_token+ is no longer the current
     # token, someone else already recovered and the current set is returned.
     def refresh(stale_token: nil)
       @lock.synchronize do
+        # A rotated set awaiting persistence: retry the save rather than rotating again (the
+        # old refresh token was consumed by that rotation).
+        return publish_pending! if @pending_tokens
         return @current if stale_token && @current.access_token != stale_token
 
         previous_refresh = @current.refresh_token
@@ -71,26 +94,35 @@ module Wefunder
           else
             raise AuthError, "Access token expired and no refresh token / re-mint capability is configured."
           end
-        persist(nxt)
-        @current = nxt
-        @on_token_refresh&.call(nxt)
-        nxt
+        @pending_tokens = nxt
+        publish_pending!
       end
     end
 
-    # Persist BEFORE publishing: no other thread may use the rotated token until it is durable,
-    # and a failed save must not leave the process working in memory but unable to reconnect
-    # after a restart. If the store raises we still have the only copy of the rotated refresh
-    # token (the old one is dead), so it is published anyway and the failure is surfaced as
-    # TokenPersistenceError — handle it (alert, retry the save with +error.tokens+), don't swallow it.
-    def persist(tokens)
-      @store&.save(tokens)
-    rescue StandardError => e
+    private
+
+    # Persist BEFORE publishing (caller holds the lock): no thread may use the rotated token
+    # until it is durable, and a failed save must not leave the process working in memory but
+    # unable to reconnect after a restart. On failure the set stays in +pending_tokens+ and
+    # TokenPersistenceError is raised; the next call retries the save.
+    def publish_pending!
+      tokens = @pending_tokens
+      begin
+        @store&.save(tokens)
+        # on_token_refresh is a persistence path too, so it runs BEFORE publication and a failure
+        # keeps the set pending exactly like a store failure.
+        @on_token_refresh&.call(tokens)
+      rescue StandardError => e
+        raise TokenPersistenceError.new(tokens, e)
+      end
+      @pending_tokens = nil
       @current = tokens
-      raise TokenPersistenceError.new(tokens, e)
+      tokens
     end
 
-    private
+    def same_token_set?(a, b)
+      a.access_token == b.access_token && a.refresh_token == b.refresh_token
+    end
 
     def can_rotate?
       !@current.refresh_token.nil? && !@current.refresh_token.empty? && !@client_id.nil?

data/lib/wefunder/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Wefunder
-  VERSION = "0.1.0.beta2"
+  VERSION = "0.1.0.beta3"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wefunder
 version: !ruby/object:Gem::Version
-  version: 0.1.0.beta2
+  version: 0.1.0.beta3
 platform: ruby
 authors:
 - Wefunder