getstack 1.1.0__tar.gz → 1.2.0__tar.gz

{getstack-1.1.0 → getstack-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: getstack
-Version: 1.1.0
+Version: 1.2.0
 Summary: Python SDK for STACK — trust infrastructure for AI agents
 Project-URL: Homepage, https://getstack.run
 Project-URL: Documentation, https://getstack.run/docs/sdk

{getstack-1.1.0 → getstack-1.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "getstack"
-version = "1.1.0"
+version = "1.2.0"
 description = "Python SDK for STACK — trust infrastructure for AI agents"
 readme = "README.md"
 license = "MIT"

{getstack-1.1.0 → getstack-1.2.0}/src/getstack/_async/inbound_webhooks.py

@@ -33,7 +33,7 @@ class AsyncInboundWebhookService:
         return list(res.get("webhooks", []))
 
     async def set_provider_signing_secret(self, webhook_id: str, signing_secret: str, downstream_signing_secret: Optional[str] = None) -> dict[str, Any]:
-        """Human/admin setup: generic 32-256 byte key, or AgentMail whsec_ key and optional downstream key. Keys are never returned."""
+        """Configure the incoming provider key. If a generic downstream key is omitted, STACK generates and returns its replacement once."""
         from urllib.parse import quote
         return await self._client.put(
             f"/v1/operator/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",

{getstack-1.1.0 → getstack-1.2.0}/src/getstack/inbound_webhooks.py

@@ -1,7 +1,7 @@
 """Hosted inbound webhook surface (Phase 5.5).
 
-Operator creates a webhook row + receives a STACK-hosted URL + HMAC
-secret. Generic providers sign with this secret. AgentMail endpoints
+Operator creates a webhook row + receives a STACK-hosted URL and distinct
+incoming/downstream HMAC secrets. Generic providers sign with the incoming secret. AgentMail endpoints
 require their provider signing secret through set_provider_signing_secret.
 STACK runs the prompt-injection detector on inbound content
 before forwarding to a downstream URL.
@@ -32,9 +32,10 @@ class InboundWebhookService:
         """Create a hosted inbound webhook.
 
         Returns a dict with keys: id, provider, slug, webhook_url,
-        webhook_secret (plaintext, returned ONLY at create), agent_id,
-        forward_url, created_at. Capture webhook_secret immediately —
-        STACK never returns it again. If lost, revoke + recreate.
+        webhook_secret (downstream verification key, returned ONLY at create),
+        incoming_signing_secret (generic only, returned ONLY at create), agent_id,
+        forward_url, created_at. Capture both immediately. STACK never returns
+        them through list/get. If lost, revoke + recreate.
         """
         body: dict[str, Any] = {"provider": provider, "agent_id": agent_id}
         if forward_url is not None:
@@ -49,7 +50,7 @@ class InboundWebhookService:
         return list(res.get("webhooks", []))
 
     def set_provider_signing_secret(self, webhook_id: str, signing_secret: str, downstream_signing_secret: Optional[str] = None) -> dict[str, Any]:
-        """Human/admin setup: generic 32-256 byte key, or AgentMail whsec_ key and optional downstream key. Keys are never returned."""
+        """Configure the incoming provider key. If a generic downstream key is omitted, STACK generates and returns its replacement once."""
         from urllib.parse import quote
         return self._client.put(
             f"/v1/operator/inbound-webhooks/{quote(webhook_id, safe='')}/provider-signing-secret",

getstack-1.2.0/tests/test_inbound_webhooks.py

@@ -0,0 +1,51 @@
+"""Inbound webhook directional-key wire contract."""
+
+from __future__ import annotations
+
+import asyncio
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from getstack._async.inbound_webhooks import AsyncInboundWebhookService  # noqa: E402
+from getstack.inbound_webhooks import InboundWebhookService  # noqa: E402
+
+
+class CaptureClient:
+    def __init__(self) -> None:
+        self.path: str | None = None
+        self.body: dict | None = None
+
+    def put(self, path: str, json: dict | None = None):
+        self.path = path
+        self.body = json
+        return {"configured": True, "webhook_secret": "synthetic-generated-downstream"}
+
+
+class AsyncCaptureClient(CaptureClient):
+    async def put(self, path: str, json: dict | None = None):
+        return super().put(path, json=json)
+
+
+def test_sync_signing_setup_keeps_directional_keys_in_the_body() -> None:
+    client = CaptureClient()
+    result = InboundWebhookService(client).set_provider_signing_secret(  # type: ignore[arg-type]
+        "iwh fixture", "synthetic-incoming", "synthetic-downstream"
+    )
+    assert client.path == "/v1/operator/inbound-webhooks/iwh%20fixture/provider-signing-secret"
+    assert client.body == {
+        "signing_secret": "synthetic-incoming",
+        "downstream_signing_secret": "synthetic-downstream",
+    }
+    assert result == {"configured": True, "webhook_secret": "synthetic-generated-downstream"}
+
+
+def test_async_signing_setup_matches_sync() -> None:
+    client = AsyncCaptureClient()
+    result = asyncio.run(AsyncInboundWebhookService(client).set_provider_signing_secret(  # type: ignore[arg-type]
+        "iwh fixture", "synthetic-incoming"
+    ))
+    assert client.path == "/v1/operator/inbound-webhooks/iwh%20fixture/provider-signing-secret"
+    assert client.body == {"signing_secret": "synthetic-incoming"}
+    assert result == {"configured": True, "webhook_secret": "synthetic-generated-downstream"}