getstack 1.0.0__tar.gz → 1.1.0__tar.gz

{getstack-1.0.0 → getstack-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: getstack
-Version: 1.0.0
+Version: 1.1.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk

{getstack-1.0.0 → getstack-1.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "1.0.0"
+version = "1.1.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"

{getstack-1.0.0 → getstack-1.1.0}/src/getstack/_async/inbound_webhooks.py

@@ -32,6 +32,14 @@ class AsyncInboundWebhookService:
         res = await self._client.get("/v1/operator/inbound-webhooks")
         return list(res.get("webhooks", []))
 
+    async def set_provider_signing_secret(self, webhook_id: str, signing_secret: str, downstream_signing_secret: Optional[str] = None) -> dict[str, Any]:
+        """Human/admin setup: generic 32-256 byte key, or AgentMail whsec_ key and optional downstream key. Keys are never returned."""
+        from urllib.parse import quote
+        return await self._client.put(
+            f"/v1/operator/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json={"signing_secret": signing_secret, **({"downstream_signing_secret": downstream_signing_secret} if downstream_signing_secret is not None else {})},
+        )
+
     async def get(self, webhook_id: str) -> dict[str, Any]:
         return await self._client.get(f"/v1/operator/inbound-webhooks/{webhook_id}")
 

{getstack-1.0.0 → getstack-1.1.0}/src/getstack/_async/partner_tenants.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from typing import Any, Literal, Optional
+from urllib.parse import quote
 
 from ..client import AsyncHttpClient
 
@@ -54,6 +55,19 @@ class AsyncPartnerTenantsService:
             json=body,
         )
 
+    async def set_inbound_webhook_signing_secret(
+        self, tenant_id: str, webhook_id: str, signing_secret: str,
+        downstream_signing_secret: Optional[str] = None,
+    ) -> dict[str, Any]:
+        """Configure signing with direct partner admin authentication; returns status only."""
+        body = {"signing_secret": signing_secret}
+        if downstream_signing_secret is not None:
+            body["downstream_signing_secret"] = downstream_signing_secret
+        return await self._client.put(
+            f"/v1/partner/tenants/{quote(tenant_id, safe='')}/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json=body,
+        )
+
     async def issue_passport(
         self,
         tenant_id: str,

{getstack-1.0.0 → getstack-1.1.0}/src/getstack/inbound_webhooks.py

@@ -1,8 +1,9 @@
 """Hosted inbound webhook surface (Phase 5.5).
 
 Operator creates a webhook row + receives a STACK-hosted URL + HMAC
-secret. Paste both into a provider's (AgentMail / generic) webhook
-config; STACK runs the prompt-injection detector on inbound content
+secret. Generic providers sign with this secret. AgentMail endpoints
+require their provider signing secret through set_provider_signing_secret.
+STACK runs the prompt-injection detector on inbound content
 before forwarding to a downstream URL.
 """
 
@@ -47,6 +48,14 @@ class InboundWebhookService:
         res = self._client.get("/v1/operator/inbound-webhooks")
         return list(res.get("webhooks", []))
 
+    def set_provider_signing_secret(self, webhook_id: str, signing_secret: str, downstream_signing_secret: Optional[str] = None) -> dict[str, Any]:
+        """Human/admin setup: generic 32-256 byte key, or AgentMail whsec_ key and optional downstream key. Keys are never returned."""
+        from urllib.parse import quote
+        return self._client.put(
+            f"/v1/operator/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json={"signing_secret": signing_secret, **({"downstream_signing_secret": downstream_signing_secret} if downstream_signing_secret is not None else {})},
+        )
+
     def get(self, webhook_id: str) -> dict[str, Any]:
         """Get a single inbound webhook by id. Never returns the plaintext secret."""
         return self._client.get(f"/v1/operator/inbound-webhooks/{webhook_id}")

{getstack-1.0.0 → getstack-1.1.0}/src/getstack/partner_tenants.py

@@ -8,6 +8,7 @@ their customers via this service.
 from __future__ import annotations
 
 from typing import Any, Literal, Optional
+from urllib.parse import quote
 
 from .client import HttpClient
 
@@ -59,6 +60,19 @@ class PartnerTenantsService:
             json=body,
         )
 
+    def set_inbound_webhook_signing_secret(
+        self, tenant_id: str, webhook_id: str, signing_secret: str,
+        downstream_signing_secret: Optional[str] = None,
+    ) -> dict[str, Any]:
+        """Configure signing with direct partner admin authentication; returns status only."""
+        body = {"signing_secret": signing_secret}
+        if downstream_signing_secret is not None:
+            body["downstream_signing_secret"] = downstream_signing_secret
+        return self._client.put(
+            f"/v1/partner/tenants/{quote(tenant_id, safe='')}/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json=body,
+        )
+
     def issue_passport(
         self,
         tenant_id: str,

{getstack-1.0.0 → getstack-1.1.0}/tests/test_parity.py

@@ -52,6 +52,7 @@ EXPECTED_SERVICES = [
 # (service, method) pairs that must exist on both clients — the integration-
 # critical surface, incl. the gaps GET-244 closed.
 EXPECTED_METHODS = [
+    ("inbound_webhooks", "set_provider_signing_secret"),
     ("services", "connect"),
     ("services", "connect_custom"),
     ("services", "grant_agent_access"),

getstack-1.1.0/tests/test_partner_signing.py

@@ -0,0 +1,36 @@
+"""Tenant signing setup sends fixture keys in the body, never the URL."""
+import asyncio
+import sys
+from pathlib import Path
+from unittest.mock import AsyncMock, Mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from getstack.partner_tenants import PartnerTenantsService
+from getstack._async.partner_tenants import AsyncPartnerTenantsService
+
+
+def test_sync_tenant_signing():
+    client = Mock()
+    client.put.return_value = {"configured": True}
+    result = PartnerTenantsService(client).set_inbound_webhook_signing_secret(
+        "tenant fixture", "wh/fixture", "synthetic-provider", "synthetic-downstream",
+    )
+    assert result == {"configured": True}
+    client.put.assert_called_once_with(
+        "/v1/partner/tenants/tenant%20fixture/inbound-webhooks/wh%2Ffixture/provider-signing-secret",
+        json={"signing_secret": "synthetic-provider", "downstream_signing_secret": "synthetic-downstream"},
+    )
+
+
+def test_async_tenant_signing():
+    client = Mock()
+    client.put = AsyncMock(return_value={"configured": True})
+    result = asyncio.run(AsyncPartnerTenantsService(client).set_inbound_webhook_signing_secret(
+        "tenant fixture", "wh/fixture", "synthetic-provider",
+    ))
+    assert result == {"configured": True}
+    client.put.assert_awaited_once_with(
+        "/v1/partner/tenants/tenant%20fixture/inbound-webhooks/wh%2Ffixture/provider-signing-secret",
+        json={"signing_secret": "synthetic-provider"},
+    )