fix: final fixes

Author: varonix0

README.md

@@ -63,17 +63,29 @@ client.secrets.list(project_id: "...", environment: "dev", secret_path: "/")
 # secret per key unless skip_unique_validation: true is passed.
 client.secrets.list(project_id: "...", environment: "dev", recursive: true)
 
+# Export fetched secrets into the process environment (never overrides
+# variables that already have a value):
+client.secrets.list(project_id: "...", environment: "dev", attach_to_process_env: true)
+ENV.fetch("DATABASE_URL")
+
 client.secrets.get("DATABASE_URL", project_id: "...", environment: "dev")
 client.secrets.create("DATABASE_URL", "postgres://...", project_id: "...", environment: "dev")
 client.secrets.update("DATABASE_URL", project_id: "...", environment: "dev", secret_value: "postgres://...")
 client.secrets.delete("DATABASE_URL", project_id: "...", environment: "dev")
+
+# create and update accept skip_multiline_encoding: true to disable the
+# API's encoding of multi-line values.
 ```
 
+Each returned secret exposes `secret_key`, `secret_value`, `secret_comment`,
+`secret_path`, `version`, `metadata` (an array of key/value entries), and
+`tags` (an array with `id`, `slug`, `name`, and `color`).
+
 ### Error handling
 
 Every error raised by the SDK inherits from `Infisical::Error`. API failures
-raise `Infisical::APIError` (with `status`, `url`, `method`, and `request_id`
-readers), and well-known statuses raise a dedicated subclass:
+raise `Infisical::APIError` (with `status`, `url`, `http_method`, and
+`request_id` readers), and well-known statuses raise a dedicated subclass:
 
 ```ruby
 begin
@@ -83,7 +95,7 @@ rescue Infisical::NotFoundError        # 404
 rescue Infisical::AuthenticationError  # 401: bad or expired credentials
   # re-authenticate
 rescue Infisical::APIError => e        # anything else the API rejected
-  # e.status, e.url, e.method, e.request_id
+  # e.status, e.url, e.http_method, e.request_id
 end
 ```
 
@@ -98,6 +110,9 @@ connection resets) raise `Infisical::RequestError` after retries.
 client = Infisical::Client.new(site_url: "https://your-infisical-instance.com")
 ```
 
+A trailing `/api` on the site URL (as used with some other Infisical SDKs) is
+accepted and normalized away.
+
 ## Documentation
 
 You can find the documentation for the Ruby SDK on our [SDK documentation page](https://infisical.com/docs/sdks/languages/ruby).

lib/infisical/auth.rb

@@ -25,9 +25,12 @@ def initialize(http_client)
     #   this client
     # @raise [AuthenticationError] if the credentials are rejected
     def universal_auth_login(client_id:, client_secret:)
+      # auth: false keeps any previously stored (possibly expired) bearer
+      # token off the login request; the API breaks on stale tokens there.
       response = @http_client.post(
         UNIVERSAL_AUTH_LOGIN_PATH,
-        body: { clientId: client_id, clientSecret: client_secret }
+        body: { clientId: client_id, clientSecret: client_secret },
+        auth: false
       )
 
       access_token(response["accessToken"])

lib/infisical/client.rb

@@ -8,7 +8,7 @@
 
 module Infisical
   # Entry point for the SDK. Construct one, authenticate via {#auth}, then
-  # use {#secrets} (and future resource clients) to talk to Infisical.
+  # use {#secrets} to talk to Infisical.
   #
   # @example Fetch a secret
   #   client = Infisical::Client.new
@@ -20,12 +20,13 @@ class Client
     ALLOWED_SCHEMES = %w[http https].freeze
 
     # @param site_url [String] base URL of the Infisical instance; defaults to
-    #   Infisical Cloud, so only self-hosted deployments need to set it
+    #   Infisical Cloud, so only self-hosted deployments need to set it. A
+    #   trailing "/api" is tolerated and stripped.
     # @param timeout [Numeric] open/read timeout in seconds for each request
     # @raise [ArgumentError] if site_url is not an http(s) URL
     def initialize(site_url: DEFAULT_SITE_URL, timeout: HTTPClient::DEFAULT_TIMEOUT)
       validate_site_url!(site_url)
-      @http_client = HTTPClient.new(base_url: site_url, timeout: timeout)
+      @http_client = HTTPClient.new(base_url: normalize_site_url(site_url), timeout: timeout)
     end
 
     # Authentication operations. Logging in through this authenticates the
@@ -45,6 +46,15 @@ def secrets
 
     private
 
+    # Users coming from other Infisical SDKs are used to passing the site
+    # URL with an "/api" suffix; the SDK adds that segment itself, so strip
+    # it (and any trailing slashes) rather than requesting ".../api/api/...".
+    def normalize_site_url(site_url)
+      url = site_url.dup
+      url.chomp!("/") while url.end_with?("/")
+      url.delete_suffix("/api")
+    end
+
     def validate_site_url!(site_url)
       uri = URI.parse(site_url)
       return if ALLOWED_SCHEMES.include?(uri.scheme) && uri.host

lib/infisical/errors.rb

@@ -17,7 +17,7 @@ class APIError < Error
     attr_reader :url
 
     # @return [String] uppercase HTTP method of the failed request, e.g. "GET"
-    attr_reader :method
+    attr_reader :http_method
 
     # @return [String, nil] server-assigned request id, when the response carried one
     attr_reader :request_id
@@ -42,15 +42,15 @@ def self.for_status(status)
     # @param message [String] human-readable error detail from the API
     # @param status [Integer] HTTP status code
     # @param url [String] full URL the request was sent to
-    # @param method [String] HTTP method of the request
+    # @param http_method [String] HTTP method of the request
     # @param request_id [String, nil] server-assigned request id, if any
-    def initialize(message, status:, url:, method:, request_id: nil)
+    def initialize(message, status:, url:, http_method:, request_id: nil)
       @status = status
       @url = url
-      @method = method
+      @http_method = http_method
       @request_id = request_id
 
-      context = "[Method=#{method}] [URL=#{url}] [StatusCode=#{status}]"
+      context = "[Method=#{http_method}] [URL=#{url}] [StatusCode=#{status}]"
       context += " [RequestId=#{request_id}]" if request_id
 
       super("#{context} #{message}")

lib/infisical/http_client.rb

@@ -6,6 +6,7 @@
 require "time"
 
 require_relative "errors"
+require_relative "version"
 
 module Infisical
   # Thin wrapper around Net::HTTP that knows how to talk to the Infisical
@@ -14,6 +15,8 @@ module Infisical
   #
   # @api private Internal plumbing; use {Client} instead.
   class HTTPClient
+    USER_AGENT = "infisical-ruby-sdk/v#{VERSION}".freeze
+
     DEFAULT_TIMEOUT = 10 # seconds
     DEFAULT_MAX_RETRIES = 4
     DEFAULT_INITIAL_DELAY = 1.0 # seconds
@@ -48,8 +51,10 @@ def get(path, params: {})
       request(:get, path, params: params)
     end
 
-    def post(path, body: nil, params: {})
-      request(:post, path, body: body, params: params)
+    # auth: false sends the request without the stored access token, for
+    # endpoints like login where a stale bearer token must not be attached.
+    def post(path, body: nil, params: {}, auth: true)
+      request(:post, path, body: body, params: params, auth: auth)
     end
 
     def patch(path, body: nil, params: {})
@@ -68,12 +73,12 @@ def self.backoff_delay(attempt, initial_delay: DEFAULT_INITIAL_DELAY, backoff_fa
 
     private
 
-    def request(method, path, body: nil, params: {})
+    def request(method, path, body: nil, params: {}, auth: true)
       uri = build_uri(path, params)
 
       attempt = 0
       begin
-        response = perform(method, uri, body)
+        response = perform(method, uri, body, auth)
         handle_response(response, method: method, uri: uri)
       rescue *RETRYABLE_EXCEPTIONS => e
         raise RequestError, "request to #{uri} failed: #{e.message}" if attempt >= @max_retries
@@ -97,17 +102,17 @@ def build_uri(path, params)
       uri
     end
 
-    def perform(method, uri, body)
+    def perform(method, uri, body, auth)
       http = Net::HTTP.new(uri.host, uri.port)
       http.use_ssl = uri.scheme == "https"
       http.open_timeout = @timeout
       http.read_timeout = @timeout
 
-      request = build_request(method, uri, body)
+      request = build_request(method, uri, body, auth)
       http.request(request)
     end
 
-    def build_request(method, uri, body)
+    def build_request(method, uri, body, auth)
       request_class = {
         get: Net::HTTP::Get,
         post: Net::HTTP::Post,
@@ -117,7 +122,8 @@ def build_request(method, uri, body)
 
       request = request_class.new(uri)
       request["Accept"] = "application/json"
-      request["Authorization"] = "Bearer #{@access_token}" if @access_token
+      request["User-Agent"] = USER_AGENT
+      request["Authorization"] = "Bearer #{@access_token}" if auth && @access_token
 
       unless body.nil?
         request["Content-Type"] = "application/json"
@@ -164,7 +170,7 @@ def build_api_error(response, status, method, uri)
         message.to_s,
         status: status,
         url: uri.to_s,
-        method: method.to_s.upcase,
+        http_method: method.to_s.upcase,
         request_id: data["reqId"]
       )
     end

lib/infisical/models/secret.rb

@@ -3,6 +3,36 @@
 module Infisical
   # Value objects returned by the resource clients.
   module Models
+    # A key/value metadata entry attached to a secret.
+    #
+    # @!attribute key
+    #   @return [String] metadata key
+    # @!attribute value
+    #   @return [String] metadata value
+    SecretMetadata = Struct.new(:key, :value, keyword_init: true) do
+      # @api private
+      def self.from_api(data)
+        new(key: data["key"], value: data["value"])
+      end
+    end
+
+    # A tag attached to a secret.
+    #
+    # @!attribute id
+    #   @return [String] unique id of the tag
+    # @!attribute slug
+    #   @return [String] URL-safe identifier of the tag
+    # @!attribute name
+    #   @return [String] display name of the tag
+    # @!attribute color
+    #   @return [String, nil] display color of the tag
+    SecretTag = Struct.new(:id, :slug, :name, :color, keyword_init: true) do
+      # @api private
+      def self.from_api(data)
+        new(id: data["id"], slug: data["slug"], name: data["name"], color: data["color"])
+      end
+    end
+
     # Value object representing a single Infisical secret.
     #
     # @!attribute id
@@ -23,13 +53,18 @@ module Models
     #   @return [String, nil] comment stored with the secret
     # @!attribute secret_path
     #   @return [String, nil] folder path the secret lives at
+    # @!attribute metadata
+    #   @return [Array<SecretMetadata>] key/value metadata entries
+    # @!attribute tags
+    #   @return [Array<SecretTag>] tags attached to the secret
     # @!attribute created_at
     #   @return [String, nil] ISO 8601 creation timestamp
     # @!attribute updated_at
     #   @return [String, nil] ISO 8601 last-update timestamp
     Secret = Struct.new(
       :id, :workspace, :environment, :version, :type,
       :secret_key, :secret_value, :secret_comment, :secret_path,
+      :metadata, :tags,
       :created_at, :updated_at,
       keyword_init: true
     ) do
@@ -47,6 +82,8 @@ def self.from_api(data)
           secret_value: data["secretValue"],
           secret_comment: data["secretComment"],
           secret_path: data["secretPath"],
+          metadata: Array(data["secretMetadata"]).map { |entry| SecretMetadata.from_api(entry) },
+          tags: Array(data["tags"]).map { |tag| SecretTag.from_api(tag) },
           created_at: data["createdAt"],
           updated_at: data["updatedAt"]
         )

lib/infisical/secrets.rb

@@ -27,10 +27,13 @@ def initialize(http_client)
     # @param skip_unique_validation [Boolean] in recursive mode, duplicate keys
     #   across folders are collapsed to one secret per key (last occurrence
     #   wins) unless this is true, in which case all of them are kept
+    # @param attach_to_process_env [Boolean] export each fetched secret into
+    #   the process environment (ENV), without overriding variables that are
+    #   already set
     # @return [Array<Models::Secret>]
     # @raise [APIError] if the API rejects the request
     def list(project_id:, environment:, secret_path: "/", include_imports: true, recursive: false,
-             skip_unique_validation: false)
+             skip_unique_validation: false, attach_to_process_env: false)
       response = @http_client.get(
         BASE_PATH,
         params: {
@@ -45,7 +48,9 @@ def list(project_id:, environment:, secret_path: "/", include_imports: true, rec
       secrets = Array(response["secrets"]).map { |secret| Models::Secret.from_api(secret) }
       secrets = ensure_unique_secrets_by_key(secrets, skip_unique_validation) if recursive
       secrets = merge_imported_secrets(secrets, response["imports"]) if include_imports
-      secrets.sort_by(&:secret_key)
+      secrets = secrets.sort_by(&:secret_key)
+      attach_to_env(secrets) if attach_to_process_env
+      secrets
     end
 
     # Fetches a single secret by name.
@@ -80,17 +85,21 @@ def get(secret_name, project_id:, environment:, secret_path: "/", include_import
     # @param environment [String] environment slug, e.g. "dev"
     # @param secret_path [String] folder path to create the secret at
     # @param secret_comment [String, nil] optional comment stored with the secret
+    # @param skip_multiline_encoding [Boolean, nil] disable the API's encoding
+    #   of multi-line values; omitted from the request when nil
     # @return [Models::Secret] the created secret
     # @raise [APIError] if the API rejects the request, e.g. the name is taken
-    def create(secret_name, secret_value, project_id:, environment:, secret_path: "/", secret_comment: nil)
+    def create(secret_name, secret_value, project_id:, environment:, secret_path: "/", secret_comment: nil,
+               skip_multiline_encoding: nil)
       response = @http_client.post(
         secret_path_for(secret_name),
         body: {
           projectId: project_id,
           environment: environment,
           secretPath: secret_path,
           secretValue: secret_value,
-          secretComment: secret_comment
+          secretComment: secret_comment,
+          skipMultilineEncoding: skip_multiline_encoding
         }.compact
       )
 
@@ -105,10 +114,13 @@ def create(secret_name, secret_value, project_id:, environment:, secret_path: "/
     # @param secret_value [String, nil] new value, if changing it
     # @param new_secret_name [String, nil] new key, if renaming
     # @param secret_path [String] folder path the secret lives at
+    # @param skip_multiline_encoding [Boolean, nil] disable the API's encoding
+    #   of multi-line values; omitted from the request when nil
     # @return [Models::Secret] the updated secret
     # @raise [ArgumentError] if neither secret_value nor new_secret_name is given
     # @raise [NotFoundError] if no such secret exists
-    def update(secret_name, project_id:, environment:, secret_value: nil, new_secret_name: nil, secret_path: "/")
+    def update(secret_name, project_id:, environment:, secret_value: nil, new_secret_name: nil, secret_path: "/",
+               skip_multiline_encoding: nil)
       if secret_value.nil? && new_secret_name.nil?
         raise ArgumentError, "update requires at least one of secret_value: or new_secret_name:"
       end
@@ -120,7 +132,8 @@ def update(secret_name, project_id:, environment:, secret_value: nil, new_secret
           environment: environment,
           secretPath: secret_path,
           secretValue: secret_value,
-          newSecretName: new_secret_name
+          newSecretName: new_secret_name,
+          skipMultilineEncoding: skip_multiline_encoding
         }.compact
       )
 
@@ -181,6 +194,15 @@ def merge_imported_secrets(secrets, import_blocks)
       merged
     end
 
+    # Exports secrets into the process environment. A variable that already
+    # has a non-empty value is left untouched; an empty value counts as
+    # unset, matching the Go SDK.
+    def attach_to_env(secrets)
+      secrets.each do |secret|
+        ENV[secret.secret_key] = secret.secret_value if ENV[secret.secret_key].to_s.empty?
+      end
+    end
+
     # Escapes a secret name for safe use as a single URI path segment, so
     # names containing "/", "?", "#", or "%" can't be misread as path
     # separators or query-string tokens.

spec/infisical/auth_spec.rb

@@ -23,6 +23,17 @@
       expect(credential.token_type).to eq("Bearer")
     end
 
+    it "does not send a previously stored (possibly expired) bearer token" do
+      http_client.access_token = "stale-token"
+      stub = stub_request(:post, "#{base_url}/api/v1/auth/universal-auth/login")
+             .with { |request| request.headers["Authorization"].nil? }
+             .to_return(status: 200, body: '{"accessToken":"tok-new"}')
+
+      auth.universal_auth_login(client_id: "id-1", client_secret: "secret-1")
+
+      expect(stub).to have_been_requested
+    end
+
     it "authenticates the shared HTTP client so subsequent requests carry the token" do
       stub_request(:post, "#{base_url}/api/v1/auth/universal-auth/login")
         .to_return(status: 200, body: '{"accessToken":"tok-abc"}')