zevauth 0.1.0

data/lib/zevauth/resources.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "erb"
+
+module ZevAuth
+  module Resources
+    # One page of a list, as the API returned it, plus `each` over its items.
+    # Responses keep the API's own field names (`"firstName"`), so what you
+    # read here matches the API reference exactly.
+    class Page
+      include Enumerable
+
+      attr_reader :data, :next_cursor, :total_count, :raw
+
+      def initialize(raw)
+        @raw = raw
+        @data = raw.fetch("data", [])
+        @has_more = raw.fetch("hasMore", false)
+        @next_cursor = raw["next"]
+        @total_count = raw["totalCount"]
+      end
+
+      def has_more?
+        @has_more
+      end
+
+      def each(&)
+        @data.each(&)
+      end
+    end
+
+    class Base
+      def initialize(client)
+        @client = client
+      end
+
+      private
+
+      def path(*segments)
+        "/#{segments.map { |s| ERB::Util.url_encode(s.to_s) }.join('/')}"
+      end
+
+      # Ruby-style keys in, the API's camelCase on the wire: `first_name:`
+      # is sent as `firstName`. Only the top level is converted; metadata
+      # you pass is your data and is sent exactly as given.
+      def wire(params)
+        params.to_h.each_with_object({}) do |(key, value), out|
+          name = key.to_s
+          name = name.gsub(/_([a-z])/) { Regexp.last_match(1).upcase } if name.include?("_")
+          out[name] = value
+        end
+      end
+    end
+
+    class Users < Base
+      # One page. `metadata:` filters on public metadata, ANDed:
+      #   users.list(limit: 50, metadata: { plan: "pro" })
+      def list(limit: nil, after: nil, query: nil, metadata: nil)
+        Page.new(@client.get("/v1/users", { limit: limit, after: after, query: query, metadata: metadata }))
+      end
+
+      # Every user, page after page, as an Enumerator:
+      #   client.users.each(metadata: { plan: "pro" }) { |user| ... }
+      #   client.users.each.lazy.select { ... }.first(10)
+      def each(limit: nil, query: nil, metadata: nil, &block)
+        enumerator = Enumerator.new do |yielder|
+          after = nil
+          loop do
+            page = list(limit: limit, after: after, query: query, metadata: metadata)
+            page.each { |user| yielder << user }
+            break unless page.has_more? && page.next_cursor
+
+            after = page.next_cursor
+          end
+        end
+        block ? enumerator.each(&block) : enumerator
+      end
+
+      def get(user_id) = @client.get(path("v1", "users", user_id))
+      def create(**params) = @client.post("/v1/users", wire(params))
+      def update(user_id, **params) = @client.patch(path("v1", "users", user_id), wire(params))
+      def delete(user_id) = @client.delete(path("v1", "users", user_id))
+
+      # Blocks or unblocks; blocking ends their sessions.
+      # Returns { "user" => …, "sessionsRevoked" => n }.
+      def set_blocked(user_id, blocked)
+        @client.post("#{path('v1', 'users', user_id)}/blocked", { "blocked" => blocked })
+      end
+
+      # Ends every session the user has. Returns { "sessionsRevoked" => n }.
+      def revoke_sessions(user_id)
+        @client.post("#{path('v1', 'users', user_id)}/sessions/revoke")
+      end
+
+      # Removes their two-step verification, for support. Sessions stay
+      # unless `revoke_sessions: true`.
+      def reset_mfa(user_id, revoke_sessions: false)
+        @client.delete("#{path('v1', 'users', user_id)}/mfa", revoke_sessions ? { revokeSessions: "true" } : nil)
+      end
+    end
+
+    class Organizations < Base
+      def list_for_user(user_id) = @client.get("/v1/organizations", { userId: user_id })
+      def get(organization_id) = @client.get(path("v1", "organizations", organization_id))
+
+      # `created_by:` (a user id) is required; they become the owner.
+      def create(**params) = @client.post("/v1/organizations", wire(params))
+
+      # Includes `require_mfa:` to require two-step for every member.
+      def update(organization_id, **params) = @client.patch(path("v1", "organizations", organization_id), wire(params))
+      def delete(organization_id) = @client.delete(path("v1", "organizations", organization_id))
+
+      def add_member(organization_id, user_id:, role: nil)
+        @client.post("#{path('v1', 'organizations', organization_id)}/members", { "userId" => user_id, "role" => role }.compact)
+      end
+
+      def remove_member(organization_id, user_id)
+        @client.delete(path("v1", "organizations", organization_id, "members", user_id))
+      end
+    end
+  end
+end

data/lib/zevauth/transport.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "net/http"
+require "uri"
+
+module ZevAuth
+  # What every HTTP call in this gem goes through.
+  #
+  # Net::HTTP from the standard library, not Faraday: an auth library sits
+  # in every request path of an app, and each dependency it pulls in is one
+  # more version for the app to reconcile and one more thing to trust. The
+  # calls here are a handful of JSON requests, which Net::HTTP does well.
+  #
+  # Anything responding to `call(method:, url:, headers:, body:, timeout:)`
+  # and returning a Transport::Response can be passed instead, which is how
+  # the tests run without a network and how an app can route through its
+  # own HTTP stack.
+  class Transport
+    Response = Struct.new(:status, :headers, :body, keyword_init: true) do
+      # Header lookup that does not care how the server cased the name.
+      def header(name)
+        wanted = name.downcase
+        headers.each { |key, value| return value if key.to_s.downcase == wanted }
+        nil
+      end
+    end
+
+    # Raised for anything that means "no answer": DNS, refused, timeout.
+    class Failure < StandardError; end
+
+    def call(method:, url:, headers:, body: nil, timeout: 15)
+      uri = URI.parse(url)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = timeout
+      http.read_timeout = timeout
+      http.write_timeout = timeout if http.respond_to?(:write_timeout=)
+
+      request = Net::HTTPGenericRequest.new(
+        method.to_s.upcase, !body.nil?, method.to_s.upcase != "HEAD", uri.request_uri, headers
+      )
+      request.body = body unless body.nil?
+
+      response = http.request(request)
+      Response.new(status: response.code.to_i, headers: response.to_hash.transform_values(&:first), body: response.body)
+    rescue Timeout::Error, SocketError, SystemCallError, IOError, OpenSSL::SSL::SSLError, Net::ProtocolError => e
+      raise Failure, e.message
+    end
+  end
+end

data/lib/zevauth/verifier.rb

@@ -0,0 +1,166 @@
+# frozen_string_literal: true
+
+require "base64"
+require "json"
+require "openssl"
+
+module ZevAuth
+  # Verifies a ZevAuth session token and returns its claims.
+  #
+  # The checks run in the order the server SDK contract fixes, each with
+  # its own code, so a Ruby app and a PHP app refuse the same bad token
+  # with the same reason:
+  #
+  #   1. shape            malformed_token
+  #   2. alg is RS256     unsupported_algorithm   (before any key is touched)
+  #   3. key by kid       unknown_key             (one refetch for rotation)
+  #   4. signature        invalid_signature
+  #   5. iss              invalid_issuer          (read from discovery)
+  #   6. aud              invalid_audience        (the environment id)
+  #   7. exp / nbf        token_expired / token_not_yet_valid (5 s skew)
+  #
+  # The algorithm is never taken from the token. `none` and `HS256` (which
+  # would let the public key be used as an HMAC secret) are refused at
+  # step 2, whatever key they claim.
+  class Verifier
+    ALGORITHM = "RS256"
+    DEFAULT_CLOCK_SKEW = 5
+
+    attr_reader :environment_id
+
+    # environment_id:    required; tokens for any other environment are refused
+    # api_url:           where discovery and keys are fetched from
+    # issuer:            override the discovered issuer (required with jwks:)
+    # jwks:              a local key set (Hash or JSON) instead of fetching
+    # clock_skew_seconds: tolerance on exp/nbf, default 5
+    # clock:             -> Time (or Numeric seconds); injectable for tests
+    # transport:         HTTP for discovery and keys; see Transport
+    # jwks_cooldown_seconds: minimum gap between unknown-kid refetches, default 30
+    def initialize(environment_id:, api_url: ZevAuth::DEFAULT_API_URL, issuer: nil, jwks: nil,
+                   clock_skew_seconds: DEFAULT_CLOCK_SKEW, clock: nil, transport: nil, jwks_cooldown_seconds: 30)
+      if environment_id.nil? || environment_id.to_s.empty?
+        raise ConfigurationError.new(
+          "ZevAuth needs an environment id (env_test_… or env_live_…) to verify tokens.",
+          code: "missing_environment_id"
+        )
+      end
+
+      @environment_id = environment_id
+      @skew = clock_skew_seconds
+      @clock = clock || -> { Time.now }
+      if jwks
+        raise ConfigurationError.new("`issuer` is required when a local `jwks` is given.", code: "missing_issuer") unless issuer
+
+        @keys = KeySet.local(jwks)
+      else
+        @keys = RemoteKeySet.new(
+          api_url: api_url, environment_id: environment_id, transport: transport || Transport.new,
+          clock: @clock, cooldown_seconds: jwks_cooldown_seconds
+        )
+      end
+      @issuer = issuer
+    end
+
+    # Returns the verified claims as a Hash with String keys. Raises
+    # VerifyError with a contract code.
+    def verify(token)
+      header, payload, signing_input, signature = decode(token)
+
+      alg = header["alg"]
+      raise VerifyError.new("Tokens must be signed with RS256, not #{alg.inspect}.", code: "unsupported_algorithm") unless alg == ALGORITHM
+
+      key = @keys.find(header["kid"])
+      raise VerifyError.new("No signing key matches kid #{header['kid'].inspect}.", code: "unknown_key") unless key
+
+      unless key.verify(OpenSSL::Digest.new("SHA256"), signature, signing_input)
+        raise VerifyError.new("The token signature does not verify.", code: "invalid_signature")
+      end
+
+      check_claims(payload)
+      payload
+    rescue OpenSSL::PKey::PKeyError
+      raise VerifyError.new("The token signature does not verify.", code: "invalid_signature")
+    end
+
+    # "Now" in seconds, from the injected clock. The bridge uses it to size
+    # the session cookie to the token's remaining life.
+    def now_seconds
+      now = @clock.call
+      now.respond_to?(:to_f) ? now.to_f : Float(now)
+    end
+
+    private
+
+    def decode(token)
+      parts = token.to_s.split(".", -1)
+      raise malformed("A session token has three dot-separated parts.") unless parts.length == 3 && !parts[0].empty? && !parts[1].empty?
+
+      header = parse_segment(parts[0])
+      payload = parse_segment(parts[1])
+      raise malformed("The token header and payload must be JSON objects.") unless header.is_a?(Hash) && payload.is_a?(Hash)
+
+      # An empty or undecodable signature is decided after the algorithm:
+      # an `alg: none` token carries no signature, and must be refused as
+      # the wrong algorithm, not as a malformed token.
+      signature = parts[2].match?(/\A[A-Za-z0-9_-]+\z/) ? base64url(parts[2]) : ""
+      [header, payload, "#{parts[0]}.#{parts[1]}", signature]
+    end
+
+    def parse_segment(segment)
+      JSON.parse(base64url(segment))
+    rescue JSON::ParserError
+      raise malformed("A token segment is not valid JSON.")
+    end
+
+    def base64url(segment)
+      raise malformed("A token segment is not base64url.") unless segment.match?(/\A[A-Za-z0-9_-]+\z/)
+
+      Base64.urlsafe_decode64(segment + ("=" * ((4 - (segment.length % 4)) % 4)))
+    rescue ArgumentError
+      raise malformed("A token segment is not base64url.")
+    end
+
+    def check_claims(payload)
+      issuer = @issuer || @keys.discovered_issuer
+      unless payload["iss"] == issuer
+        raise VerifyError.new("The token was issued by #{payload['iss'].inspect}, not #{issuer}.",
+                              code: "invalid_issuer")
+      end
+
+      unless audience_matches?(payload["aud"])
+        raise VerifyError.new(
+          "The token belongs to another environment (#{payload['aud'].inspect}), not #{@environment_id}.",
+          code: "invalid_audience"
+        )
+      end
+
+      now = now_seconds
+      exp = numeric_claim(payload, "exp", required: true)
+      nbf = numeric_claim(payload, "nbf")
+      raise VerifyError.new("The token expired.", code: "token_expired") if now - @skew >= exp
+      raise VerifyError.new("The token is not valid yet.", code: "token_not_yet_valid") if nbf && now + @skew < nbf
+
+      %w[sub sid].each do |claim|
+        raise malformed("The `#{claim}` claim must be a string.") unless payload[claim].is_a?(String)
+      end
+    end
+
+    # The server sends a string; a list is accepted per RFC 7519 as long as
+    # it contains the environment.
+    def audience_matches?(aud)
+      aud.is_a?(Array) ? aud.include?(@environment_id) : aud == @environment_id
+    end
+
+    def numeric_claim(payload, name, required: false)
+      value = payload[name]
+      return nil if value.nil? && !required
+      raise malformed("The `#{name}` claim must be a number.") unless value.is_a?(Numeric)
+
+      value
+    end
+
+    def malformed(message)
+      VerifyError.new(message, code: "malformed_token")
+    end
+  end
+end

data/lib/zevauth/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module ZevAuth
+  VERSION = "0.1.0"
+end

data/lib/zevauth/webhooks.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "json"
+require "openssl"
+
+module ZevAuth
+  # Checks that a webhook delivery came from ZevAuth.
+  #
+  # Verify the RAW request body, exactly as received. A body parsed and
+  # re-encoded is different bytes, and correctly fails: in Rails that means
+  # `request.raw_post`, in Rack `env["rack.input"].read`, never `params`.
+  module Webhooks
+    SIGNATURE_HEADER = "zevauth-signature"
+    DEFAULT_TOLERANCE = 300
+
+    Event = Struct.new(:id, :type, :created_at, :data, :raw, keyword_init: true)
+
+    module_function
+
+    # Raises WebhookError unless `signature` (the `zevauth-signature`
+    # header) is a valid, current signature of `payload` under `secret`
+    # (your `whsec_…` endpoint secret, prefix included).
+    def verify(payload:, signature:, secret: nil, tolerance_seconds: DEFAULT_TOLERANCE, now: nil)
+      secret ||= ZevAuth.config.webhook_secret
+      raise ConfigurationError.new("A webhook secret (whsec_…) is required.", code: "missing_webhook_secret") if secret.to_s.empty?
+
+      timestamp, given = parse(signature)
+      current = (now || Time.now).to_i
+      if (current - timestamp).abs > tolerance_seconds
+        raise WebhookError.new(
+          "The webhook timestamp is outside the #{tolerance_seconds}s tolerance (a replay, or a clock far off).",
+          code: "webhook_timestamp_out_of_range"
+        )
+      end
+
+      expected = OpenSSL::HMAC.hexdigest("SHA256", secret, "#{timestamp}.#{payload}")
+      return true if secure_compare(expected, given)
+
+      raise WebhookError.new(
+        "The webhook signature does not match. Check the secret, and that you verify the raw body.",
+        code: "webhook_signature_mismatch"
+      )
+    end
+
+    # Verifies, then returns the parsed Event.
+    def construct_event(payload:, signature:, secret: nil, tolerance_seconds: DEFAULT_TOLERANCE, now: nil)
+      verify(payload: payload, signature: signature, secret: secret, tolerance_seconds: tolerance_seconds, now: now)
+      event = JSON.parse(payload)
+      Event.new(id: event["id"], type: event["type"], created_at: event["createdAt"], data: event["data"], raw: event)
+    end
+
+    def parse(header)
+      parts = header.to_s.split(",").each_with_object({}) do |part, out|
+        at = part.index("=")
+        next unless at
+
+        out[part[0...at].strip] = part[(at + 1)..].strip
+      end
+      timestamp = parts["t"]
+      given = parts["v1"]
+      unless timestamp&.match?(/\A\d+\z/) && given && !given.empty?
+        raise WebhookError.new(
+          "The zevauth-signature header is malformed: expected t=<timestamp>,v1=<signature>.",
+          code: "webhook_malformed_signature"
+        )
+      end
+
+      [timestamp.to_i, given]
+    end
+
+    # Constant time, and exact: no case folding, so an uppercase copy of a
+    # valid signature is still refused.
+    def secure_compare(expected, given)
+      return false unless expected.bytesize == given.bytesize
+
+      OpenSSL.fixed_length_secure_compare(expected, given)
+    end
+  end
+end

data/lib/zevauth.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "zevauth/version"
+require_relative "zevauth/errors"
+require_relative "zevauth/transport"
+require_relative "zevauth/key_set"
+require_relative "zevauth/verifier"
+require_relative "zevauth/auth"
+require_relative "zevauth/bridge"
+require_relative "zevauth/authenticator"
+require_relative "zevauth/webhooks"
+require_relative "zevauth/client"
+require_relative "zevauth/resources"
+
+# ZevAuth for Ruby.
+#
+#   ZevAuth.configure do |c|
+#     c.environment_id = ENV.fetch("ZEVAUTH_ENVIRONMENT_ID")
+#     c.secret_key     = ENV.fetch("ZEVAUTH_SECRET_KEY")
+#   end
+#
+#   auth = ZevAuth.get_auth(request)          # never raises
+#   ZevAuth.require_auth(request, require_mfa: true)
+#   ZevAuth.client.users.get(auth.user_id)
+module ZevAuth
+  DEFAULT_API_URL = "https://api.zevauth.net"
+
+  class Configuration
+    # Required to verify sessions: env_test_… or env_live_…
+    attr_accessor :environment_id
+    # For the backend API: sk_test_… or sk_live_…
+    attr_accessor :secret_key
+    # For the handshake page: pk_test_… or pk_live_…
+    attr_accessor :publishable_key
+    # For webhook verification: whsec_…
+    attr_accessor :webhook_secret
+    # Where the API lives. Default https://api.zevauth.net
+    attr_accessor :api_url
+    # What the browser SDK on the handshake page talks to, when it differs
+    # from its own default. Usually leave nil.
+    attr_accessor :frontend_api_url
+    # A local key set and issuer instead of fetching (tests, air-gapped).
+    attr_accessor :jwks, :issuer
+    # Tolerance on exp/nbf in seconds. Default 5.
+    attr_accessor :clock_skew_seconds
+    # -> Time; injectable for tests.
+    attr_accessor :clock
+    # HTTP; see ZevAuth::Transport.
+    attr_accessor :transport
+    # Session bridge (server-rendered apps); see ZevAuth::Bridge::Config.
+    attr_accessor :bridge
+    # Where the bridge endpoint is mounted; the handshake page posts here.
+    attr_accessor :bridge_path
+
+    # Each key falls back to the environment variable of the same name, so
+    # an app that sets them needs no configuration code at all. The names
+    # match every other ZevAuth server SDK.
+    def initialize
+      @environment_id = ENV.fetch("ZEVAUTH_ENVIRONMENT_ID", nil)
+      @secret_key = ENV.fetch("ZEVAUTH_SECRET_KEY", nil)
+      @publishable_key = ENV.fetch("ZEVAUTH_PUBLISHABLE_KEY", nil)
+      @webhook_secret = ENV.fetch("ZEVAUTH_WEBHOOK_SECRET", nil)
+      @api_url = ENV.fetch("ZEVAUTH_API_URL", DEFAULT_API_URL)
+      @clock_skew_seconds = Verifier::DEFAULT_CLOCK_SKEW
+      @bridge = Bridge::Config.new
+      @bridge_path = "/zevauth/session"
+    end
+  end
+
+  class << self
+    def config
+      @config ||= Configuration.new
+    end
+
+    def configure
+      yield config
+      reset!
+      config
+    end
+
+    # Rebuilds the cached verifier and client from the current config.
+    def reset!
+      @authenticator = nil
+      @client = nil
+    end
+
+    def authenticator
+      @authenticator ||= Authenticator.new(
+        Verifier.new(
+          environment_id: config.environment_id,
+          api_url: config.api_url,
+          issuer: config.issuer,
+          jwks: config.jwks,
+          clock_skew_seconds: config.clock_skew_seconds,
+          clock: config.clock,
+          transport: config.transport
+        ),
+        bridge: config.bridge
+      )
+    end
+
+    def client
+      @client ||= Client.new(
+        secret_key: config.secret_key,
+        api_url: config.api_url,
+        transport: config.transport
+      )
+    end
+
+    # Verifies a token and returns its claims; raises VerifyError.
+    def verify_token(token)
+      authenticator.verifier.verify(token)
+    end
+
+    # Who is signed in on this request (Rack env or request object).
+    # Never raises for a missing or bad token.
+    def get_auth(request)
+      authenticator.get_auth(request)
+    end
+
+    # The same, but raises AuthRefused (401/403) unless the request passes.
+    def require_auth(request, allow_pending_tasks: false, require_mfa: false)
+      authenticator.require_auth(request, allow_pending_tasks: allow_pending_tasks, require_mfa: require_mfa)
+    end
+
+    # [auth, handshake_rack_response_or_nil]; see Authenticator.
+    def authenticate_request(request)
+      authenticator.authenticate_request(request)
+    end
+  end
+end
+
+require_relative "zevauth/rack/middleware"
+require_relative "zevauth/rails/railtie" if defined?(Rails::Railtie)

metadata

@@ -0,0 +1,92 @@
+--- !ruby/object:Gem::Specification
+name: zevauth
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- ZevOp Inc.
+autorequire:
+bindir: bin
+cert_chain: []
+date: 2026-11-01 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+description: |
+  Verifies ZevAuth session tokens (RS256, keys fetched and rotated for you),
+  reads who is signed in from a bearer token or the session-bridge cookie,
+  calls the ZevAuth backend API with your secret key, and checks webhook
+  signatures. Includes Rack middleware and an optional Rails engine.
+email:
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE
+- README.md
+- lib/zevauth.rb
+- lib/zevauth/auth.rb
+- lib/zevauth/authenticator.rb
+- lib/zevauth/bridge.rb
+- lib/zevauth/client.rb
+- lib/zevauth/errors.rb
+- lib/zevauth/key_set.rb
+- lib/zevauth/rack/middleware.rb
+- lib/zevauth/rails.rb
+- lib/zevauth/rails/config/routes.rb
+- lib/zevauth/rails/controller.rb
+- lib/zevauth/rails/railtie.rb
+- lib/zevauth/resources.rb
+- lib/zevauth/transport.rb
+- lib/zevauth/verifier.rb
+- lib/zevauth/version.rb
+- lib/zevauth/webhooks.rb
+homepage: https://docs.zevauth.com
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://docs.zevauth.com
+  documentation_uri: https://docs.zevauth.com/sdk/ruby
+  source_code_uri: https://github.com/zevop/zevauth-ruby
+  bug_tracker_uri: https://github.com/zevop/zevauth-ruby/issues
+  changelog_uri: https://github.com/zevop/zevauth-ruby/blob/main/CHANGELOG.md
+  rubygems_mfa_required: 'true'
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.5.3
+signing_key:
+specification_version: 4
+summary: 'ZevAuth for Ruby: verify sessions, call the backend API, check webhooks.'
+test_files: []