Remove unowned-response detection; servers now fail closed on bad credentials

[delano]

Summary

Removes the client-side workaround for servers that silently accepted invalid Basic auth and created secrets anonymously. Since onetimesecret/onetimesecret#3945 (merged), presented-but-invalid credentials return 401 on noauth-capable routes, so the heuristic is dead code against current servers — and with no installed base (last gem release 0.5.1, 2013), there is no compat obligation to carry on_unowned: into a fresh release as permanent public API.

• Delete Onetime::Ownership (response body sniffing) and test/ownership_test.rb
• Remove UNOWNED_WARNING, check_ownership/warn_unowned, and the warn-once mutex from Client
• Remove the on_unowned: config option, its default/modes/validation, and its unit tests
• Remove Onetime::UnownedResponseError
• README: replace the warning section, config-table row, and error-table row with a single note that self-hosted servers older than #3945 silently accept invalid credentials

Net: −382/+12 across 8 files.

Test plan

• ruby -Itest -Ilib test/unit_test.rb: 29 runs, 114 assertions, 0 failures
• ruby -c test/live_api_test.rb: syntax OK (not run against network)
• grep -rni 'unowned|ownership': zero remaining references

[greptile-apps]

Confidence Score: 3/5

The old-server ownership regression needs to be addressed before merging, and the stale changelog entry should also be corrected.

Credentialed requests to older self-hosted servers now return successful anonymous records without the previous warning or exception, so callers can mistake ownerless secrets for account-owned ones.

Files Needing Attention: lib/onetime/client.rb, README.md, and CHANGES.txt

Important Files Changed

Filename	Overview
lib/onetime/client.rb	Removes ownership inspection, causing successful anonymous responses from older self-hosted servers to pass through without warning.
lib/onetime/configuration.rb	Removes the unreleased on_unowned option, defaults, accessor, and validation without leaving internal references.
lib/onetime/errors.rb	Removes UnownedResponseError consistently with the deleted detection path.
lib/onetime.rb	Removes the loader reference to the deleted ownership module.
README.md	Replaces the removed API documentation with an old-server warning, but the corresponding 0.6.0 changelog entry remains stale.
test/unit_test.rb	Removes tests for the deleted configuration option while retaining unrelated coverage.

Prompt To Fix All With AI

### Issue 1
README.md:85-89
**Removed feature remains in changelog**

The unreleased 0.6.0 changelog still advertises `Onetime::Ownership` and `on_unowned`, even though this PR deletes both APIs. Consumers following those release notes will encounter missing constants or an unknown keyword during initialization.

### Issue 2
lib/onetime/client.rb:79-82
**Old servers silently lose ownership**

When configured credentials target a self-hosted server older than onetimesecret#3945, the server can return a successful anonymous record after ignoring invalid Basic credentials. Returning that response without the ownership check causes callers to treat the secret as account-owned even though it never appears in their account.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "Remove unowned-response detection; serve..." | Re-trigger Greptile}

[Copilot]

Pull request overview

This PR removes the client-side “unowned response” heuristic (response-body sniffing for anonymously-recorded secrets) and the associated public configuration/error surface, based on updated server behavior that now fails closed (401) on invalid credentials. It simplifies the Ruby client by dropping dead compatibility logic and updating documentation accordingly.

Changes:

• Removed Onetime::Ownership detection, on_unowned: configuration, and Onetime::UnownedResponseError.
• Simplified Onetime::Client#request by removing ownership checks and warn-once state/mutex.
• Updated README to replace the previous warning/configuration docs with a note about older self-hosted servers.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/unit_test.rb	Removes unit tests for the deleted on_unowned: option.
test/ownership_test.rb	Deletes the Ownership and client “unowned response” behavior tests.
README.md	Removes on_unowned documentation and replaces it with a note about older servers accepting invalid credentials.
lib/onetime/ownership.rb	Deletes the Ownership response-body detection implementation.
lib/onetime/errors.rb	Removes Onetime::UnownedResponseError.
lib/onetime/configuration.rb	Removes on_unowned configuration constants/validation and initializer kwarg.
lib/onetime/client.rb	Removes ownership checking, warn-once logic, and the UNOWNED_WARNING message.
lib/onetime.rb	Drops the onetime/ownership require.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.