Modernize the SDK: Lists, List items, Events, privacy requests and webhook verification - #161
Closed
bartes wants to merge 7 commits into
Closed
Modernize the SDK: Lists, List items, Events, privacy requests and webhook verification#161bartes wants to merge 7 commits into
bartes wants to merge 7 commits into
Conversation
…on APIs Introduce the Lists API (createList, getAllLists, getList, queryLists, updateList, deleteList) and the List items API (createListItem, createListItemsBatch, getListItem, queryListItems, countListItems, updateListItem, archiveListItem, unarchiveListItem) on CastleApi. Add requestUserData for privacy data requests and the Events API (eventsSchema, queryEvents, groupEvents). Add Castle#verifyWebhookSignature for verifying the X-Castle-Signature header against the raw request body using HMAC-SHA256. Bump version to 2.2.0.
Add a Supported APIs section to the README listing the modern API surface (scoring, generic requests, lists, list items, privacy, events, webhooks) alongside the previous, deprecated-but-supported endpoints, and bump the quickstart dependency snippet to 2.2.0.
bartes
changed the title
Adds CastleApi#deleteUserData(payload) issuing DELETE /v1/privacy/users, alongside the existing requestUserData. Documents it in the README and CHANGELOG and covers it with an HTTP test.
Change archiveListItem to issue DELETE /v1/lists/{listId}/items/{itemId}/archive
instead of PUT, and update the HTTP test accordingly.
Replace the reflective Field.modifiers hack in SdkMockUtil by making the internal restApiFactory field non-final, build the separate-classloader test runner classpath from java.class.path instead of casting the system class loader to URLClassLoader, and open java.base packages to the test runtime on JDK 9+ so the environment-variable rule keeps working.
Run the test suite on Temurin 8, 11 and 17 on every push and pull request, and pin Java 17 for local development via .tool-versions.
Drop the Authenticate (authenticate/authenticateAsync), Track (track), device (approve/report/userDevices/device), impersonation (impersonateStart/impersonateEnd) and removeUser endpoints, along with the authenticate failover strategy configuration and the doNotTrack option, leaving the modern surface: risk/filter/log, generic requests, Lists, List items, Privacy (requestUserData/deleteUserData), Events, webhook verification and secureUserID. Bump the version to 3.0.0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Modernizes the SDK around the current Castle API surface while keeping the previous endpoints available for backward compatibility.
Added (modern API)
createList,getAllLists,getList,queryLists,updateList,deleteList.createListItem,createListItemsBatch,getListItem,queryListItems,countListItems,updateListItem,archiveListItem,unarchiveListItem.requestUserData(POST /v1/privacy/users),deleteUserData(DELETE /v1/privacy/users).eventsSchema,queryEvents,groupEvents.Castle#verifyWebhookSignature, verifying theX-Castle-Signatureheader against the raw request body using a base64-encoded HMAC-SHA256 of the body and a constant-time comparison. Overloads accept either the signature string or anHttpServletRequest.New endpoints are thin wrappers over the existing generic request layer and return
CastleResponse, mirroringrisk/filter/log.Supported APIs matrix
Modern API (recommended)
risk,filter,logget,post,put,deletecreateList,getAllLists,getList,queryLists,updateList,deleteListcreateListItem,createListItemsBatch,getListItem,queryListItems,countListItems,updateListItem,archiveListItem,unarchiveListItemrequestUserData,deleteUserDataeventsSchema,queryEvents,groupEventsverifyWebhookSignaturesecureUserIDPrevious API (deprecated, still supported)
authenticate,authenticateAsyncrisk/filtertracklogapprove,report,userDevices,deviceimpersonateStart,impersonateEndremoveUserrequestUserData/deleteUserDataDocuments the modern and previous surface in the README and bumps the version to
2.2.0.