stable -> master

.github/workflows/back-merge-handler.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref_name == 'master'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.ref_name == 'stable'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 

.github/workflows/back-merge.yaml

@@ -0,0 +1,16 @@
+name: Back Merge
+
+on:
+  push:
+    branches:
+      - master
+      - stable
+
+jobs:
+  back-merge:
+    uses: regulaforensics/reusable-workflows/.github/workflows/back-merge.yaml@f9848fa9ec1ae1e6285b56200ac1f24fbfaee0c3 # main
+    with:
+      source_branch: ${{ github.ref_name }}
+      merge_pairs: "master:stable,stable:develop"
+    secrets:
+      token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/run-smoke-test.yml

@@ -11,9 +11,9 @@ jobs:
   run_smoke_test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
         with:
           python-version: 3.9
       - name: Install pipenv

.github/workflows/sast.yaml

@@ -1,4 +1,8 @@
-name: Semgrep SAST
+# This repository is public and cannot call reusable workflows from a private
+# repository (regulaforensics/reusable-workflows). The logic below is a local
+# copy that mirrors the reusable workflow exactly. SHA pins are kept up-to-date
+# by Renovate (see renovate.json).
+name: SAST
 
 on:
   pull_request:
@@ -10,49 +14,32 @@ on:
       - main
       - master
 
-env:
-  # Fail workflow or not if vulnerabilities found
-  FAIL_ON_VULNERABILITIES: true
-  # List of paths (space separated) to ignore
-  # Supports PATTERNS
-  # EXCLUDE_PATHS: 'foo bar/baz file.txt dir/*.yml'
-  EXCLUDE_PATHS: 'generator-templates regula/documentreader/webclient/gen .github'
-  # List of rules (space separated) to ignore
-  # EXCLUDE_RULES: 'generic.secrets.security.detected-aws-account-id.detected-aws-account-id'
-  # See https://github.com/semgrep/semgrep-rules for rules registry
-  EXCLUDE_RULES: ''
-
 jobs:
   semgrep:
     name: semgrep-oss/scan
     runs-on: ubuntu-latest
     container:
-      image: semgrep/semgrep
+      image: semgrep/semgrep@sha256:65dcd4408adda7c183a6b4550cb1e9b19f7f627a6fbb7e0559bd466bedc44d7b
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Scan
         shell: bash
+        env:
+          EXCLUDE_PATHS: 'generator-templates regula/documentreader/webclient/gen .github'
+          EXCLUDE_RULES: ''
         run: |
           EXCLUDED_PATHS=()
-          if [[ ! -z $EXCLUDE_PATHS ]]; then
+          if [[ -n "$EXCLUDE_PATHS" ]]; then
             for path in $EXCLUDE_PATHS; do
-              EXCLUDED_PATHS+=("--exclude $path")
+              EXCLUDED_PATHS+=("--exclude" "$path")
             done
           fi
 
           EXCLUDED_RULES=()
-          if [[ ! -z $EXCLUDE_RULES ]]; then
+          if [[ -n "$EXCLUDE_RULES" ]]; then
             for rule in $EXCLUDE_RULES; do
-              EXCLUDED_RULES+=("--exclude-rule $rule")
+              EXCLUDED_RULES+=("--exclude-rule" "$rule")
             done
           fi
 
-          if [[ $FAIL_ON_VULNERABILITIES == "true" ]]; then
-            semgrep scan --config auto ${EXCLUDED_PATHS[@]} ${EXCLUDED_RULES[@]} --error --verbose
-          elif [[ $FAIL_ON_VULNERABILITIES == "false" ]]; then
-            semgrep scan --config auto ${EXCLUDED_PATHS[@]} ${EXCLUDED_RULES[@]} --error --verbose || true
-          else
-            echo "Bad FAIL_ON_VULNERABILITIES env var value"
-            exit 1
-          fi
-
+          semgrep scan --config auto "${EXCLUDED_PATHS[@]}" "${EXCLUDED_RULES[@]}" --error --verbose

.github/workflows/trivy-scan.yaml

@@ -1,27 +1,32 @@
+# This repository is public and cannot call reusable workflows from a private
+# repository (regulaforensics/reusable-workflows). The logic below is a local
+# copy that mirrors the reusable workflow exactly. SHA pins are kept up-to-date
+# by Renovate (see renovate.json).
 name: Trivy Scan
 
 on:
   pull_request:
     branches:
-      - main
-      - master
       - develop
+      - staging
+      - production
       - stable
+      - main
+      - master
 
 jobs:
   trivy-scan:
-    name: Scanner
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout code
-      uses: actions/checkout@v3
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-    - name: Run Trivy vulnerability scanner in fs mode
-      uses: aquasecurity/trivy-action@v0.35.0
-      with:
-        scan-type: 'fs'
-        exit-code: '1'
-        ignore-unfixed: true
-        severity: 'CRITICAL,HIGH,MEDIUM,LOW'
-      env:
-        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
+      - name: Run Trivy scanner
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: 'fs'
+          exit-code: '1'
+          ignore-unfixed: true
+          severity: 'CRITICAL,HIGH,MEDIUM,LOW'
+        env:
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2

.openapi-generator/FILES

@@ -143,6 +143,7 @@ regula/documentreader/webclient/gen/models/mrz_rows_item.py
 regula/documentreader/webclient/gen/models/mrz_test_quality.py
 regula/documentreader/webclient/gen/models/mrz_test_quality_item.py
 regula/documentreader/webclient/gen/models/mrz_test_quality_result.py
+regula/documentreader/webclient/gen/models/occlusion_check_params.py
 regula/documentreader/webclient/gen/models/ocr_security_text_item.py
 regula/documentreader/webclient/gen/models/ocr_security_text_result.py
 regula/documentreader/webclient/gen/models/one_candidate.py
@@ -177,6 +178,7 @@ regula/documentreader/webclient/gen/models/result_item.py
 regula/documentreader/webclient/gen/models/result_mrz_detector.py
 regula/documentreader/webclient/gen/models/result_mrz_detector_item.py
 regula/documentreader/webclient/gen/models/rfid_a_chip.py
+regula/documentreader/webclient/gen/models/rfid_access_control.py
 regula/documentreader/webclient/gen/models/rfid_access_control_info.py
 regula/documentreader/webclient/gen/models/rfid_access_control_procedure_type.py
 regula/documentreader/webclient/gen/models/rfid_access_key.py

regula/documentreader/webclient/ext/models/recognition_request.py

@@ -69,6 +69,7 @@ def __init__(
             images: List[Union[RecognitionImage, bytes, Base64String]] = None,
             container_list: ContainerList = None, tag=None,
             system_info: ProcessSystemInfo = ProcessSystemInfo(),
+            tenant: str = None, env: str = None
     ):
         input_images = []
         if images:
@@ -81,12 +82,16 @@ def __init__(
                 processParam=process_params,
                 List=input_images,
                 systemInfo=system_info,
-                tag=tag
+                tag=tag,
+                tenant=tenant,
+                env=env
             )
         if container_list:
             super().__init__(
                 processParam=process_params,
                 ContainerList=container_list,
                 systemInfo=system_info,
-                tag=tag
+                tag=tag,
+                tenant=tenant,
+                env=env
             )

regula/documentreader/webclient/gen/__init__.py

@@ -157,6 +157,7 @@
     "MrzPositionItem",
     "OCRSecurityTextItem",
     "OCRSecurityTextResult",
+    "OcclusionCheckParams",
     "OneCandidate",
     "OneCandidateItem",
     "OriginalSymbol",
@@ -197,6 +198,7 @@
     "ResultMRZDetector",
     "ResultMRZDetectorItem",
     "RfidAChip",
+    "RfidAccessControl",
     "RfidAccessControlInfo",
     "RfidAccessControlProcedureType",
     "RfidAccessKey",
@@ -429,6 +431,7 @@
     from regula.documentreader.webclient.gen.models.mrz_position_item import MrzPositionItem as MrzPositionItem
     from regula.documentreader.webclient.gen.models.ocr_security_text_item import OCRSecurityTextItem as OCRSecurityTextItem
     from regula.documentreader.webclient.gen.models.ocr_security_text_result import OCRSecurityTextResult as OCRSecurityTextResult
+    from regula.documentreader.webclient.gen.models.occlusion_check_params import OcclusionCheckParams as OcclusionCheckParams
     from regula.documentreader.webclient.gen.models.one_candidate import OneCandidate as OneCandidate
     from regula.documentreader.webclient.gen.models.one_candidate_item import OneCandidateItem as OneCandidateItem
     from regula.documentreader.webclient.gen.models.original_symbol import OriginalSymbol as OriginalSymbol
@@ -469,6 +472,7 @@
     from regula.documentreader.webclient.gen.models.result_mrz_detector import ResultMRZDetector as ResultMRZDetector
     from regula.documentreader.webclient.gen.models.result_mrz_detector_item import ResultMRZDetectorItem as ResultMRZDetectorItem
     from regula.documentreader.webclient.gen.models.rfid_a_chip import RfidAChip as RfidAChip
+    from regula.documentreader.webclient.gen.models.rfid_access_control import RfidAccessControl as RfidAccessControl
     from regula.documentreader.webclient.gen.models.rfid_access_control_info import RfidAccessControlInfo as RfidAccessControlInfo
     from regula.documentreader.webclient.gen.models.rfid_access_control_procedure_type import RfidAccessControlProcedureType as RfidAccessControlProcedureType
     from regula.documentreader.webclient.gen.models.rfid_access_key import RfidAccessKey as RfidAccessKey
@@ -707,6 +711,7 @@
 from regula.documentreader.webclient.gen.models.mrz_position_item import MrzPositionItem as MrzPositionItem
 from regula.documentreader.webclient.gen.models.ocr_security_text_item import OCRSecurityTextItem as OCRSecurityTextItem
 from regula.documentreader.webclient.gen.models.ocr_security_text_result import OCRSecurityTextResult as OCRSecurityTextResult
+from regula.documentreader.webclient.gen.models.occlusion_check_params import OcclusionCheckParams as OcclusionCheckParams
 from regula.documentreader.webclient.gen.models.one_candidate import OneCandidate as OneCandidate
 from regula.documentreader.webclient.gen.models.one_candidate_item import OneCandidateItem as OneCandidateItem
 from regula.documentreader.webclient.gen.models.original_symbol import OriginalSymbol as OriginalSymbol
@@ -747,6 +752,7 @@
 from regula.documentreader.webclient.gen.models.result_mrz_detector import ResultMRZDetector as ResultMRZDetector
 from regula.documentreader.webclient.gen.models.result_mrz_detector_item import ResultMRZDetectorItem as ResultMRZDetectorItem
 from regula.documentreader.webclient.gen.models.rfid_a_chip import RfidAChip as RfidAChip
+from regula.documentreader.webclient.gen.models.rfid_access_control import RfidAccessControl as RfidAccessControl
 from regula.documentreader.webclient.gen.models.rfid_access_control_info import RfidAccessControlInfo as RfidAccessControlInfo
 from regula.documentreader.webclient.gen.models.rfid_access_control_procedure_type import RfidAccessControlProcedureType as RfidAccessControlProcedureType
 from regula.documentreader.webclient.gen.models.rfid_access_key import RfidAccessKey as RfidAccessKey

regula/documentreader/webclient/gen/models/__init__.py

@@ -141,6 +141,7 @@
     from regula.documentreader.webclient.gen.models.mrz_position_item import MrzPositionItem
     from regula.documentreader.webclient.gen.models.ocr_security_text_item import OCRSecurityTextItem
     from regula.documentreader.webclient.gen.models.ocr_security_text_result import OCRSecurityTextResult
+    from regula.documentreader.webclient.gen.models.occlusion_check_params import OcclusionCheckParams
     from regula.documentreader.webclient.gen.models.one_candidate import OneCandidate
     from regula.documentreader.webclient.gen.models.one_candidate_item import OneCandidateItem
     from regula.documentreader.webclient.gen.models.original_symbol import OriginalSymbol
@@ -181,6 +182,7 @@
     from regula.documentreader.webclient.gen.models.result_mrz_detector import ResultMRZDetector
     from regula.documentreader.webclient.gen.models.result_mrz_detector_item import ResultMRZDetectorItem
     from regula.documentreader.webclient.gen.models.rfid_a_chip import RfidAChip
+    from regula.documentreader.webclient.gen.models.rfid_access_control import RfidAccessControl
     from regula.documentreader.webclient.gen.models.rfid_access_control_info import RfidAccessControlInfo
     from regula.documentreader.webclient.gen.models.rfid_access_control_procedure_type import RfidAccessControlProcedureType
     from regula.documentreader.webclient.gen.models.rfid_access_key import RfidAccessKey
@@ -400,6 +402,7 @@
 from regula.documentreader.webclient.gen.models.mrz_position_item import MrzPositionItem
 from regula.documentreader.webclient.gen.models.ocr_security_text_item import OCRSecurityTextItem
 from regula.documentreader.webclient.gen.models.ocr_security_text_result import OCRSecurityTextResult
+from regula.documentreader.webclient.gen.models.occlusion_check_params import OcclusionCheckParams
 from regula.documentreader.webclient.gen.models.one_candidate import OneCandidate
 from regula.documentreader.webclient.gen.models.one_candidate_item import OneCandidateItem
 from regula.documentreader.webclient.gen.models.original_symbol import OriginalSymbol
@@ -440,6 +443,7 @@
 from regula.documentreader.webclient.gen.models.result_mrz_detector import ResultMRZDetector
 from regula.documentreader.webclient.gen.models.result_mrz_detector_item import ResultMRZDetectorItem
 from regula.documentreader.webclient.gen.models.rfid_a_chip import RfidAChip
+from regula.documentreader.webclient.gen.models.rfid_access_control import RfidAccessControl
 from regula.documentreader.webclient.gen.models.rfid_access_control_info import RfidAccessControlInfo
 from regula.documentreader.webclient.gen.models.rfid_access_control_procedure_type import RfidAccessControlProcedureType
 from regula.documentreader.webclient.gen.models.rfid_access_key import RfidAccessKey

regula/documentreader/webclient/gen/models/image_qa.py

@@ -13,6 +13,7 @@
 from typing import Any, ClassVar, Dict, List, Optional, Union
 from regula.documentreader.webclient.gen.models.glares_check_params import GlaresCheckParams
 from regula.documentreader.webclient.gen.models.input_image_quality_checks import InputImageQualityChecks
+from regula.documentreader.webclient.gen.models.occlusion_check_params import OcclusionCheckParams
 from typing import Optional, Set
 from typing_extensions import Self
 from pydantic import SkipValidation, Field
@@ -31,7 +32,9 @@ class ImageQA(BaseModel):
     document_position_indent: SkipValidation[Optional[int]] = Field(alias="documentPositionIndent", default=None, description="This parameter specifies the necessary margin. Default 0.")
     expected_pass: SkipValidation[Optional[List[InputImageQualityChecks]]] = Field(alias="expectedPass", default=None, description="This parameter controls the quality checks that the image should pass to be considered a valid input during the scanning process.")
     glares_check_params: SkipValidation[Optional[GlaresCheckParams]] = Field(alias="glaresCheckParams", default=None)
-    __properties: ClassVar[List[str]] = ["brightnessThreshold", "dpiThreshold", "angleThreshold", "focusCheck", "glaresCheck", "colornessCheck", "moireCheck", "documentPositionIndent", "expectedPass", "glaresCheckParams"]
+    occlusion_check: SkipValidation[Optional[bool]] = Field(alias="occlusionCheck", default=None, description="This option enables the occlusion detection to identify cases where parts of a document are covered by fingers, hands, or other objects during image capture.")
+    occlusion_check_params: SkipValidation[Optional[OcclusionCheckParams]] = Field(alias="occlusionCheckParams", default=None)
+    __properties: ClassVar[List[str]] = ["brightnessThreshold", "dpiThreshold", "angleThreshold", "focusCheck", "glaresCheck", "colornessCheck", "moireCheck", "documentPositionIndent", "expectedPass", "glaresCheckParams", "occlusionCheck", "occlusionCheckParams"]
 
     model_config = ConfigDict(
         populate_by_name=True,
@@ -77,6 +80,9 @@ def to_dict(self) -> Dict[str, Any]:
         # override the default output from pydantic by calling `to_dict()` of glares_check_params
         if self.glares_check_params and isinstance(self.glares_check_params, GlaresCheckParams):
             _dict['glaresCheckParams'] = self.glares_check_params.to_dict()
+        # override the default output from pydantic by calling `to_dict()` of occlusion_check_params
+        if self.occlusion_check_params and isinstance(self.occlusion_check_params, OcclusionCheckParams):
+            _dict['occlusionCheckParams'] = self.occlusion_check_params.to_dict()
         return _dict
 
     @classmethod
@@ -98,7 +104,9 @@ def from_dict(cls, obj: Optional[Dict[str, Any]]) -> Optional[Self]:
             "moireCheck": obj.get("moireCheck"),
             "documentPositionIndent": obj.get("documentPositionIndent"),
             "expectedPass": obj.get("expectedPass"),
-            "glaresCheckParams": GlaresCheckParams.from_dict(obj["glaresCheckParams"]) if obj.get("glaresCheckParams") is not None else None
+            "glaresCheckParams": GlaresCheckParams.from_dict(obj["glaresCheckParams"]) if obj.get("glaresCheckParams") is not None else None,
+            "occlusionCheck": obj.get("occlusionCheck"),
+            "occlusionCheckParams": OcclusionCheckParams.from_dict(obj["occlusionCheckParams"]) if obj.get("occlusionCheckParams") is not None else None
         })
         return _obj