zyphr 0.1.52 → 0.1.53

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f75ed6cc534f48323ebfd87603494f864ccaa1a04c92fe195f57259314cb8f37
-  data.tar.gz: 718da4c96ac21ee903d062e2571cf277ba0f79cfc60c6afd73ffe9b92eb57277
+  metadata.gz: c48e48e0a4e1c2a2ea9d58e507adcee64e9cbac7a31c336da15d0ca3b0df3d51
+  data.tar.gz: c8accc89829202be56cdcae385e1ffd1df20da4bd89bbb2c46d70944eebe9ad8
 SHA512:
-  metadata.gz: d502a6ef3e460bbbf38adda6c8c0a9752860e07e1fbf50fdd51191e6964ee494a9ab6fa3142ba4bb6ad5046e2a0436dce6edbde6458c5d843c3eefb09eb5e326
-  data.tar.gz: 92a8acd011029ec21a5b872189a875ae4529a387cf669f560b36a63b20ad89b3dc1eb5bee28a167b0aac65f663e8f0b7146e766264873178e2344fcbf8cc1c34
+  metadata.gz: f3281a542c1412e8722f4a45a9363b956b8aa78133d77d0bd8dc56a9a40e827e88f8f05f8b80d75436786eb50e0772714dcc20c7fa0db00ff61bd86d2162eda3
+  data.tar.gz: bb9cd301b7568d3b9ff54f04555f1f1006c8a29a847c0c2f79986e45ac1368aa4d74daae347df7c3ba73f51fed00ac27e83f6d889faf29c2fbb8fe5125878b0a

data/docs/ApplicationSelf.md

@@ -10,6 +10,7 @@
 | **signing_algorithm** | **String** | JWT signing algorithm for this application's end-user tokens. |  |
 | **test_recipients** | **Array<String>** | The auth-email allowlist. In `allowlist` mode, only these addresses receive auth emails; in `unrestricted` mode it is ignored. Settable via PATCH /auth/application (sc-7600). |  |
 | **auth_email_mode** | **String** | Explicit auth-email gate mode (sc-7673). `unrestricted` sends auth emails to everyone. `allowlist` restricts auth email to `test_recipients` — and an EMPTY allowlist in this mode fails CLOSED (blocks all auth email). This replaces the previous behavior where the gate was inferred from whether `test_recipients` was empty. Defaults to `unrestricted`. |  |
+| **password_disallow_breached** | **Boolean** | When true (sc-7680), passwords found in the HaveIBeenPwned breach corpus are rejected at register/reset (and returned `valid:false` by `/auth/password-strength`). When false (default), breach info is advisory only. Fail-open: a breach-source outage never blocks auth. |  |
 
 ## Example
 
@@ -22,7 +23,8 @@ instance = Zyphr::ApplicationSelf.new(
   environment: null,
   signing_algorithm: null,
   test_recipients: null,
-  auth_email_mode: null
+  auth_email_mode: null,
+  password_disallow_breached: null
 )
 ```
 

data/docs/SetSelfApplicationTestRecipientsRequest.md

@@ -6,6 +6,7 @@
 | ---- | ---- | ----------- | ----- |
 | **test_recipients** | **Array<String>** | Email addresses allowed to receive auth emails when auth_email_mode is 'allowlist'. Ignored in 'unrestricted' mode. Optional — omit to leave the current list unchanged. | [optional] |
 | **auth_email_mode** | **String** | Optional (sc-7673). Explicit auth-email gate mode. 'unrestricted' sends to everyone; 'allowlist' restricts to test_recipients (an EMPTY list in allowlist mode fails closed — blocks all auth email). Omit to leave the current mode unchanged. | [optional] |
+| **password_disallow_breached** | **Boolean** | Optional (sc-7680/sc-7697). When true, reject HIBP-breached passwords at register/reset. Omit to leave unchanged. | [optional] |
 
 ## Example
 
@@ -14,7 +15,8 @@ require 'zyphr'
 
 instance = Zyphr::SetSelfApplicationTestRecipientsRequest.new(
   test_recipients: null,
-  auth_email_mode: null
+  auth_email_mode: null,
+  password_disallow_breached: null
 )
 ```
 

data/lib/zyphr/models/application_self.rb

@@ -34,6 +34,9 @@ module Zyphr
     # Explicit auth-email gate mode (sc-7673). `unrestricted` sends auth emails to everyone. `allowlist` restricts auth email to `test_recipients` — and an EMPTY allowlist in this mode fails CLOSED (blocks all auth email). This replaces the previous behavior where the gate was inferred from whether `test_recipients` was empty. Defaults to `unrestricted`.
     attr_accessor :auth_email_mode
 
+    # When true (sc-7680), passwords found in the HaveIBeenPwned breach corpus are rejected at register/reset (and returned `valid:false` by `/auth/password-strength`). When false (default), breach info is advisory only. Fail-open: a breach-source outage never blocks auth.
+    attr_accessor :password_disallow_breached
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -64,7 +67,8 @@ module Zyphr
         :'environment' => :'environment',
         :'signing_algorithm' => :'signing_algorithm',
         :'test_recipients' => :'test_recipients',
-        :'auth_email_mode' => :'auth_email_mode'
+        :'auth_email_mode' => :'auth_email_mode',
+        :'password_disallow_breached' => :'password_disallow_breached'
       }
     end
 
@@ -86,7 +90,8 @@ module Zyphr
         :'environment' => :'String',
         :'signing_algorithm' => :'String',
         :'test_recipients' => :'Array<String>',
-        :'auth_email_mode' => :'String'
+        :'auth_email_mode' => :'String',
+        :'password_disallow_breached' => :'Boolean'
       }
     end
 
@@ -150,6 +155,12 @@ module Zyphr
       else
         self.auth_email_mode = nil
       end
+
+      if attributes.key?(:'password_disallow_breached')
+        self.password_disallow_breached = attributes[:'password_disallow_breached']
+      else
+        self.password_disallow_breached = nil
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -177,6 +188,10 @@ module Zyphr
         invalid_properties.push('invalid value for "auth_email_mode", auth_email_mode cannot be nil.')
       end
 
+      if @password_disallow_breached.nil?
+        invalid_properties.push('invalid value for "password_disallow_breached", password_disallow_breached cannot be nil.')
+      end
+
       invalid_properties
     end
 
@@ -195,6 +210,7 @@ module Zyphr
       return false if @auth_email_mode.nil?
       auth_email_mode_validator = EnumAttributeValidator.new('String', ["allowlist", "unrestricted"])
       return false unless auth_email_mode_validator.valid?(@auth_email_mode)
+      return false if @password_disallow_breached.nil?
       true
     end
 
@@ -258,6 +274,16 @@ module Zyphr
       @auth_email_mode = auth_email_mode
     end
 
+    # Custom attribute writer method with validation
+    # @param [Object] password_disallow_breached Value to be assigned
+    def password_disallow_breached=(password_disallow_breached)
+      if password_disallow_breached.nil?
+        fail ArgumentError, 'password_disallow_breached cannot be nil'
+      end
+
+      @password_disallow_breached = password_disallow_breached
+    end
+
     # Checks equality by comparing each attribute.
     # @param [Object] Object to be compared
     def ==(o)
@@ -268,7 +294,8 @@ module Zyphr
           environment == o.environment &&
           signing_algorithm == o.signing_algorithm &&
           test_recipients == o.test_recipients &&
-          auth_email_mode == o.auth_email_mode
+          auth_email_mode == o.auth_email_mode &&
+          password_disallow_breached == o.password_disallow_breached
     end
 
     # @see the `==` method
@@ -280,7 +307,7 @@ module Zyphr
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [id, name, environment, signing_algorithm, test_recipients, auth_email_mode].hash
+      [id, name, environment, signing_algorithm, test_recipients, auth_email_mode, password_disallow_breached].hash
     end
 
     # Builds the object from hash

data/lib/zyphr/models/set_self_application_test_recipients_request.rb

@@ -14,7 +14,7 @@ require 'date'
 require 'time'
 
 module Zyphr
-  # Provide test_recipients and/or auth_email_mode. Omitting one leaves that value unchanged; sending neither is a 400.
+  # Provide any of test_recipients, auth_email_mode, or password_disallow_breached. Omitting one leaves that value unchanged; sending none is a 400. Unknown fields are rejected (400).
   class SetSelfApplicationTestRecipientsRequest
     # Email addresses allowed to receive auth emails when auth_email_mode is 'allowlist'. Ignored in 'unrestricted' mode. Optional — omit to leave the current list unchanged.
     attr_accessor :test_recipients
@@ -22,6 +22,9 @@ module Zyphr
     # Optional (sc-7673). Explicit auth-email gate mode. 'unrestricted' sends to everyone; 'allowlist' restricts to test_recipients (an EMPTY list in allowlist mode fails closed — blocks all auth email). Omit to leave the current mode unchanged.
     attr_accessor :auth_email_mode
 
+    # Optional (sc-7680/sc-7697). When true, reject HIBP-breached passwords at register/reset. Omit to leave unchanged.
+    attr_accessor :password_disallow_breached
+
     class EnumAttributeValidator
       attr_reader :datatype
       attr_reader :allowable_values
@@ -48,7 +51,8 @@ module Zyphr
     def self.attribute_map
       {
         :'test_recipients' => :'test_recipients',
-        :'auth_email_mode' => :'auth_email_mode'
+        :'auth_email_mode' => :'auth_email_mode',
+        :'password_disallow_breached' => :'password_disallow_breached'
       }
     end
 
@@ -66,7 +70,8 @@ module Zyphr
     def self.openapi_types
       {
         :'test_recipients' => :'Array<String>',
-        :'auth_email_mode' => :'String'
+        :'auth_email_mode' => :'String',
+        :'password_disallow_breached' => :'Boolean'
       }
     end
 
@@ -101,6 +106,10 @@ module Zyphr
       if attributes.key?(:'auth_email_mode')
         self.auth_email_mode = attributes[:'auth_email_mode']
       end
+
+      if attributes.key?(:'password_disallow_breached')
+        self.password_disallow_breached = attributes[:'password_disallow_breached']
+      end
     end
 
     # Show invalid properties with the reasons. Usually used together with valid?
@@ -136,7 +145,8 @@ module Zyphr
       return true if self.equal?(o)
       self.class == o.class &&
           test_recipients == o.test_recipients &&
-          auth_email_mode == o.auth_email_mode
+          auth_email_mode == o.auth_email_mode &&
+          password_disallow_breached == o.password_disallow_breached
     end
 
     # @see the `==` method
@@ -148,7 +158,7 @@ module Zyphr
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [test_recipients, auth_email_mode].hash
+      [test_recipients, auth_email_mode, password_disallow_breached].hash
     end
 
     # Builds the object from hash

data/spec/models/application_self_spec.rb

@@ -75,4 +75,10 @@ describe Zyphr::ApplicationSelf do
     end
   end
 
+  describe 'test attribute "password_disallow_breached"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
 end

data/spec/models/set_self_application_test_recipients_request_spec.rb

@@ -43,4 +43,10 @@ describe Zyphr::SetSelfApplicationTestRecipientsRequest do
     end
   end
 
+  describe 'test attribute "password_disallow_breached"' do
+    it 'should work' do
+      # assertion here. ref: https://rspec.info/features/3-12/rspec-expectations/built-in-matchers/
+    end
+  end
+
 end

data/zyphr.gemspec

@@ -17,7 +17,7 @@ require "zyphr/version"
 
 Gem::Specification.new do |s|
   s.name        = "zyphr"
-  s.version = '0.1.52'
+  s.version = '0.1.53'
   s.platform    = Gem::Platform::RUBY
   s.authors     = ["Zyphr"]
   s.email       = ["support@zyphr.dev"]

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: zyphr
 version: !ruby/object:Gem::Version
-  version: 0.1.52
+  version: 0.1.53
 platform: ruby
 authors:
 - Zyphr