getstack 1.0.0__tar.gz → 1.2.0__tar.gz

{getstack-1.0.0 → getstack-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: getstack
-Version: 1.0.0
+Version: 1.2.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk

{getstack-1.0.0 → getstack-1.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "1.0.0"
+version = "1.2.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"

{getstack-1.0.0 → getstack-1.2.0}/src/getstack/_async/inbound_webhooks.py

@@ -32,6 +32,14 @@ class AsyncInboundWebhookService:
         res = await self._client.get("/v1/operator/inbound-webhooks")
         return list(res.get("webhooks", []))
 
+    async def set_provider_signing_secret(self, webhook_id: str, signing_secret: str, downstream_signing_secret: Optional[str] = None) -> dict[str, Any]:
+        """Configure the incoming provider key. If a generic downstream key is omitted, STACK generates and returns its replacement once."""
+        from urllib.parse import quote
+        return await self._client.put(
+            f"/v1/operator/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json={"signing_secret": signing_secret, **({"downstream_signing_secret": downstream_signing_secret} if downstream_signing_secret is not None else {})},
+        )
+
     async def get(self, webhook_id: str) -> dict[str, Any]:
         return await self._client.get(f"/v1/operator/inbound-webhooks/{webhook_id}")
 

{getstack-1.0.0 → getstack-1.2.0}/src/getstack/_async/partner_tenants.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from typing import Any, Literal, Optional
+from urllib.parse import quote
 
 from ..client import AsyncHttpClient
 
@@ -54,6 +55,19 @@ class AsyncPartnerTenantsService:
             json=body,
         )
 
+    async def set_inbound_webhook_signing_secret(
+        self, tenant_id: str, webhook_id: str, signing_secret: str,
+        downstream_signing_secret: Optional[str] = None,
+    ) -> dict[str, Any]:
+        """Configure signing with direct partner admin authentication; returns status only."""
+        body = {"signing_secret": signing_secret}
+        if downstream_signing_secret is not None:
+            body["downstream_signing_secret"] = downstream_signing_secret
+        return await self._client.put(
+            f"/v1/partner/tenants/{quote(tenant_id, safe='')}/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json=body,
+        )
+
     async def issue_passport(
         self,
         tenant_id: str,

{getstack-1.0.0 → getstack-1.2.0}/src/getstack/inbound_webhooks.py

@@ -1,8 +1,9 @@
 """Hosted inbound webhook surface (Phase 5.5).
 
-Operator creates a webhook row + receives a STACK-hosted URL + HMAC
-secret. Paste both into a provider's (AgentMail / generic) webhook
-config; STACK runs the prompt-injection detector on inbound content
+Operator creates a webhook row + receives a STACK-hosted URL and distinct
+incoming/downstream HMAC secrets. Generic providers sign with the incoming secret. AgentMail endpoints
+require their provider signing secret through set_provider_signing_secret.
+STACK runs the prompt-injection detector on inbound content
 before forwarding to a downstream URL.
 """
 
@@ -31,9 +32,10 @@ class InboundWebhookService:
         """Create a hosted inbound webhook.
 
         Returns a dict with keys: id, provider, slug, webhook_url,
-        webhook_secret (plaintext, returned ONLY at create), agent_id,
-        forward_url, created_at. Capture webhook_secret immediately —
-        STACK never returns it again. If lost, revoke + recreate.
+        webhook_secret (downstream verification key, returned ONLY at create),
+        incoming_signing_secret (generic only, returned ONLY at create), agent_id,
+        forward_url, created_at. Capture both immediately. STACK never returns
+        them through list/get. If lost, revoke + recreate.
         """
         body: dict[str, Any] = {"provider": provider, "agent_id": agent_id}
         if forward_url is not None:
@@ -47,6 +49,14 @@ class InboundWebhookService:
         res = self._client.get("/v1/operator/inbound-webhooks")
         return list(res.get("webhooks", []))
 
+    def set_provider_signing_secret(self, webhook_id: str, signing_secret: str, downstream_signing_secret: Optional[str] = None) -> dict[str, Any]:
+        """Configure the incoming provider key. If a generic downstream key is omitted, STACK generates and returns its replacement once."""
+        from urllib.parse import quote
+        return self._client.put(
+            f"/v1/operator/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json={"signing_secret": signing_secret, **({"downstream_signing_secret": downstream_signing_secret} if downstream_signing_secret is not None else {})},
+        )
+
     def get(self, webhook_id: str) -> dict[str, Any]:
         """Get a single inbound webhook by id. Never returns the plaintext secret."""
         return self._client.get(f"/v1/operator/inbound-webhooks/{webhook_id}")

{getstack-1.0.0 → getstack-1.2.0}/src/getstack/partner_tenants.py

@@ -8,6 +8,7 @@ their customers via this service.
 from __future__ import annotations
 
 from typing import Any, Literal, Optional
+from urllib.parse import quote
 
 from .client import HttpClient
 
@@ -59,6 +60,19 @@ class PartnerTenantsService:
             json=body,
         )
 
+    def set_inbound_webhook_signing_secret(
+        self, tenant_id: str, webhook_id: str, signing_secret: str,
+        downstream_signing_secret: Optional[str] = None,
+    ) -> dict[str, Any]:
+        """Configure signing with direct partner admin authentication; returns status only."""
+        body = {"signing_secret": signing_secret}
+        if downstream_signing_secret is not None:
+            body["downstream_signing_secret"] = downstream_signing_secret
+        return self._client.put(
+            f"/v1/partner/tenants/{quote(tenant_id, safe='')}/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",
+            json=body,
+        )
+
     def issue_passport(
         self,
         tenant_id: str,

getstack-1.2.0/tests/test_inbound_webhooks.py

@@ -0,0 +1,51 @@
+"""Inbound webhook directional-key wire contract."""
+
+from __future__ import annotations
+
+import asyncio
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from getstack._async.inbound_webhooks import AsyncInboundWebhookService  # noqa: E402
+from getstack.inbound_webhooks import InboundWebhookService  # noqa: E402
+
+
+class CaptureClient:
+    def __init__(self) -> None:
+        self.path: str | None = None
+        self.body: dict | None = None
+
+    def put(self, path: str, json: dict | None = None):
+        self.path = path
+        self.body = json
+        return {"configured": True, "webhook_secret": "synthetic-generated-downstream"}
+
+
+class AsyncCaptureClient(CaptureClient):
+    async def put(self, path: str, json: dict | None = None):
+        return super().put(path, json=json)
+
+
+def test_sync_signing_setup_keeps_directional_keys_in_the_body() -> None:
+    client = CaptureClient()
+    result = InboundWebhookService(client).set_provider_signing_secret(  # type: ignore[arg-type]
+        "iwh fixture", "synthetic-incoming", "synthetic-downstream"
+    )
+    assert client.path == "/v1/operator/inbound-webhooks/iwh%20fixture/provider-signing-secret"
+    assert client.body == {
+        "signing_secret": "synthetic-incoming",
+        "downstream_signing_secret": "synthetic-downstream",
+    }
+    assert result == {"configured": True, "webhook_secret": "synthetic-generated-downstream"}
+
+
+def test_async_signing_setup_matches_sync() -> None:
+    client = AsyncCaptureClient()
+    result = asyncio.run(AsyncInboundWebhookService(client).set_provider_signing_secret(  # type: ignore[arg-type]
+        "iwh fixture", "synthetic-incoming"
+    ))
+    assert client.path == "/v1/operator/inbound-webhooks/iwh%20fixture/provider-signing-secret"
+    assert client.body == {"signing_secret": "synthetic-incoming"}
+    assert result == {"configured": True, "webhook_secret": "synthetic-generated-downstream"}

{getstack-1.0.0 → getstack-1.2.0}/tests/test_parity.py

@@ -52,6 +52,7 @@ EXPECTED_SERVICES = [
 # (service, method) pairs that must exist on both clients — the integration-
 # critical surface, incl. the gaps GET-244 closed.
 EXPECTED_METHODS = [
+    ("inbound_webhooks", "set_provider_signing_secret"),
     ("services", "connect"),
     ("services", "connect_custom"),
     ("services", "grant_agent_access"),

getstack-1.2.0/tests/test_partner_signing.py

@@ -0,0 +1,36 @@
+"""Tenant signing setup sends fixture keys in the body, never the URL."""
+import asyncio
+import sys
+from pathlib import Path
+from unittest.mock import AsyncMock, Mock
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from getstack.partner_tenants import PartnerTenantsService
+from getstack._async.partner_tenants import AsyncPartnerTenantsService
+
+
+def test_sync_tenant_signing():
+    client = Mock()
+    client.put.return_value = {"configured": True}
+    result = PartnerTenantsService(client).set_inbound_webhook_signing_secret(
+        "tenant fixture", "wh/fixture", "synthetic-provider", "synthetic-downstream",
+    )
+    assert result == {"configured": True}
+    client.put.assert_called_once_with(
+        "/v1/partner/tenants/tenant%20fixture/inbound-webhooks/wh%2Ffixture/provider-signing-secret",
+        json={"signing_secret": "synthetic-provider", "downstream_signing_secret": "synthetic-downstream"},
+    )
+
+
+def test_async_tenant_signing():
+    client = Mock()
+    client.put = AsyncMock(return_value={"configured": True})
+    result = asyncio.run(AsyncPartnerTenantsService(client).set_inbound_webhook_signing_secret(
+        "tenant fixture", "wh/fixture", "synthetic-provider",
+    ))
+    assert result == {"configured": True}
+    client.put.assert_awaited_once_with(
+        "/v1/partner/tenants/tenant%20fixture/inbound-webhooks/wh%2Ffixture/provider-signing-secret",
+        json={"signing_secret": "synthetic-provider"},
+    )