1.1.0

Changed

• BREAKING: InterledgerApiClient.finalizeGrant(OutgoingPayment, String) now requires three
  additional parameters: finalizeGrant(OutgoingPayment outgoingPayment, String interactRef, String hash, String clientNonce, URI grantEndpoint).
  Before the interact_ref returned from the user's wallet is used to finalize the grant, the
  implementation now verifies the hash query parameter returned alongside it on the interaction
  callback, per the GNAP interaction hash check
  (draft-ietf-gnap-core-protocol §4.2.3).
  This prevents a forged callback from being used to hijack a payment grant.

  Migration: callers must now also pass the hash query parameter from the callback URL, the
  clientNonce originally passed to continueGrant(...), and the sender's authServer URI
  (grantEndpoint) used for the original grant request:

  - client.finalizeGrant(outgoingPayment, interactRef);
  + client.finalizeGrant(outgoingPayment, interactRef, hash, clientNonce, sender.authServer);

  If the computed hash doesn't match, finalizeGrant now throws InterledgerClientException
  instead of proceeding with an unverified interact_ref.

Added

• GrantAccessRequest.verifyInteractionHash(String clientNonce, String asNonce, String interactRef, String hash, URI grantEndpoint) -
  static helper implementing the GNAP interaction hash check, usable independently of finalizeGrant.

Full changelog: 1.0.3...1.1.0