auth0 4.11.0 → 5.20.0

data/lib/auth0/api/v2/tickets.rb

@@ -12,9 +12,14 @@ module Auth0
         # @param ttl_sec [integer] The ticket's lifetime in seconds starting from the moment of creation.
         # After expiration, the ticket cannot be used to verify the user's email. If not specified or if
         # you send 0, the Auth0 default lifetime of five days will be applied
+        # @param identity [hash] Used to verify secondary, federated, and passwordless-email identities.
+        #   * :user_id [string] user_id of the identity.
+        #   * :provider [string] provider of the identity.
+        # @param client_id [string] client id
+        # @param organization_id [string] organization id
         #
         # @return [json] Returns the created ticket url.
-        def post_email_verification(user_id, result_url: nil, ttl_sec: nil)
+        def post_email_verification(user_id, result_url: nil, ttl_sec: nil, identity: nil, client_id: nil, organization_id: nil)
           if user_id.to_s.empty?
             raise Auth0::InvalidParameter, 'Must supply a valid user id to post an email verification'
           end
@@ -24,6 +29,16 @@ module Auth0
             result_url: result_url,
             ttl_sec: ttl_sec.is_a?(Integer) ? ttl_sec : nil
           }
+          request_params[:client_id] = client_id unless client_id.nil?
+          request_params[:organization_id] = organization_id unless organization_id.nil?
+
+          if identity
+            unless identity.is_a? Hash
+              raise Auth0::InvalidParameter, 'Identity must be a hash to post an email verification'
+            end
+            request_params[:identity] = identity
+          end
+
           post(path, request_params)
         end
 
@@ -42,6 +57,8 @@ module Auth0
         # @param includeEmailInRedirect [boolean] Whether or not we include the email as part of the returnUrl
         # in the reset_email
         # @param new_password [string] The password to be set for the user once the ticket is used.
+        # @param client_id [string] client id
+        # @param organization_id [string] organization id
         #
         # @return [json] Returns the created ticket url.
         def post_password_change(
@@ -52,7 +69,10 @@ module Auth0
             ttl_sec: nil,
             mark_email_as_verified: nil,
             includeEmailInRedirect: nil,
-            new_password: nil)
+            new_password: nil,
+            client_id: nil,
+            organization_id: nil
+          )
 
           booleans = [true, false]
           path = "#{tickets_path}/password-change"
@@ -66,6 +86,9 @@ module Auth0
             includeEmailInRedirect: booleans.include?(includeEmailInRedirect) ? includeEmailInRedirect : nil,
             new_password: new_password
           }
+          request_params[:client_id] = client_id unless client_id.nil?
+          request_params[:organization_id] = organization_id unless organization_id.nil?
+
           post(path, request_params)
         end
 

data/lib/auth0/api/v2/users.rb

@@ -1,7 +1,7 @@
 module Auth0
   module Api
     module V2
-      # Methods to use the users endpoints
+      # Methods to use the users' endpoints
       module Users
         include Auth0::Mixins::Validation
 
@@ -43,13 +43,15 @@ module Auth0
         # The attribute connection is always mandatory but depending on the type of connection you are using there
         # could be others too. For instance, Auth0 DB Connections require email and password.
         # @see https://auth0.com/docs/api/v2#!/Users/post_users
-        # @param name [string] The user name.
-        # @param options [hash]
-        #   * :connection [string] The connection the user belongs to.
+        # @param connection [string]  The connection the user belongs to.
+        # @param options [hash] See https://auth0.com/docs/api/management/v2#!/Users/post_users for available options
         # @return [json] Returns the created user.
-        def create_user(name, options = {})
+        def create_user(connection, options = {})
+          if !connection.is_a?(String) || connection.empty?
+            raise Auth0::MissingParameter, 'Must supply a valid connection'
+          end
           request_params = Hash[options.map { |(k, v)| [k.to_sym, v] }]
-          request_params[:name] = name
+          request_params[:connection] = connection
           post(users_path, request_params)
         end
 
@@ -92,10 +94,10 @@ module Auth0
         # Some considerations:
         # The properties of the new object will replace the old ones.
         # The metadata fields are an exception to this rule (user_metadata and app_metadata). These properties are
-        # merged instead of being replaced but be careful, the merge only occurs on the first level.
+        # merged instead of being replaced, but be careful, the merge only occurs on the first level.
         # If you are updating email_verified, phone_verified, username or password you need to specify the connection
         # property too.
-        # If your are updating email or phone_number you need to specify the connection and the client_id properties.
+        # If you are updating email or phone_number you need to specify the connection and the client_id properties.
         # @see https://auth0.com/docs/api/v2#!/Users/patch_users_by_id
         # @param user_id [string] The user_id of the user to update.
         # @param body [hash] The optional parameters to update.
@@ -109,6 +111,15 @@ module Auth0
         end
         alias update_user patch_user
 
+        # Delete all authenticators
+        # @see https://auth0.com/docs/api/management/v2#!/Users/delete_authenticators
+        # @param user_id [string] The user_id of the user to delete all authenticators
+        def delete_user_authenticators(user_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+          path = "#{users_path}/#{user_id}/authenticators"
+          delete(path)
+        end
+
         # Delete a user's multifactor provider
         # @see https://auth0.com/docs/api/v2#!/Users/delete_multifactor_by_provider
         # @param user_id [string] The user_id of the user to delete the multifactor provider from.
@@ -126,7 +137,7 @@ module Auth0
         # update:current_user_identities scope. In this case only the link_with param is required in the body,
         # containing the JWT obtained upon the secondary account's authentication.
         # 2. With an API V2 generated token with update:users scope. In this case you need to send provider and user_id
-        # in the body. Optionally you can also send the connection_id param which is suitable for identifying a
+        # in the body. Optionally, you can also send the connection_id param, which is suitable for identifying a
         # particular database connection for the 'auth0' provider.
         # @see https://auth0.com/docs/api/v2#!/Users/post_identities
         # @param user_id [string] The user_id of the primary identity where you are linking the secondary account to.
@@ -213,7 +224,7 @@ module Auth0
         # @see https://auth0.com/docs/api/management/v2#!/Users/delete_user_roles
         #
         # @param user_id [string] The user_id of the roles to remove.
-        # @param roles [array] An array of role names to remove.
+        # @param roles [array] An array of role ids to remove.
         def remove_user_roles(user_id, roles)
           raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
           validate_strings_array roles
@@ -248,11 +259,22 @@ module Auth0
         # @see https://auth0.com/docs/api/management/v2#!/Users/get_permissions
         #
         # @param user_id [string] The user_id of the permissions to get.
+        # @param options [hash] A hash of options for getting permissions
+        #   * :per_page [integer] The amount of permissions per page. (optional)
+        #   * :page [integer]  The page number. Zero based. (optional)
+        #   * :include_totals [boolean] True if a query summary must be included in the result. (optional)
         #
         # @return [json] Returns permissions for the given user_id.
-        def get_user_permissions(user_id)
+        def get_user_permissions(user_id, options = {})
           raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
-          get "#{users_path}/#{user_id}/permissions"
+
+          request_params = {
+            per_page: options.fetch(:per_page, nil),
+            page: options.fetch(:page, nil),
+            include_totals: options.fetch(:include_totals, nil)
+          }
+
+          get "#{users_path}/#{user_id}/permissions", request_params
         end
 
         # Remove one or more permissions from a specific user.
@@ -283,7 +305,7 @@ module Auth0
         # @param user_id [string] The user_id of the recovery codes to regenerate.
         def generate_recovery_code(user_id)
           raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
-          post "#{users_path}/#{user_id}/recovery-code-generation"
+          post "#{users_path}/#{user_id}/recovery-code-regeneration"
         end
 
         # Invalidate all remembered browsers for all authentication factors for a specific user.
@@ -295,13 +317,193 @@ module Auth0
           post "#{users_path}/#{user_id}/multifactor/actions/invalidate-remember-browser"
         end
 
+
+        # Get a list of organizations for a user.
+        #
+        # @param user_id [string] The user_id of the permissions to get.
+        #
+        # @return [json] Returns organizations for the given user_id.
+        def get_user_organizations(user_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+
+          get "#{users_path}/#{user_id}/organizations"
+        end
+
+        # Get the available authentication methods for a user.
+        #
+        # @param user_id [string] The user ID of the authentication methods to get
+        # @param options [hash] A hash of options for getting permissions
+        #   * :per_page [integer] The amount of permissions per page. (optional)
+        #   * :page [integer]  The page number. Zero based. (optional)
+        #   * :include_totals [boolean] True if a query summary must be included in the result. (optional)
+        # @return [json] The user's authentication methods
+        # @see https://auth0.com/docs/api/management/v2#!/Users/get_authentication_methods
+        def user_authentication_methods(user_id, options = {})
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+
+          request_params = {
+            per_page: options.fetch(:per_page, nil),
+            page: options.fetch(:page, nil),
+            include_totals: options.fetch(:include_totals, nil)
+          }
+
+          get "#{users_path}/#{user_id}/authentication-methods", request_params
+        end
+        alias get_user_authentication_methods user_authentication_methods
+
+        # Get a specific authentication method for a user.
+        #
+        # @param user_id [string] The user ID of the authentication methods to get
+        # @param authentication_method_id [string] The ID of the authentication method
+        # @return [json] The user authentication method
+        # @see https://auth0.com/docs/api/management/v2#!/Users/get_authentication_methods_by_authentication_method_id
+        def user_authentication_method(user_id, authentication_method_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+          raise Auth0::MissingParameter, 'Must supply a valid authentication_method_id' if authentication_method_id.to_s.empty?
+
+          get "#{users_path}/#{user_id}/authentication-methods/#{authentication_method_id}"
+        end
+        alias get_user_authentication_method user_authentication_method
+
+        # Create an authentication method for a user
+        #
+        # @param user_id [string] The user ID of the authentication methods to get
+        # @param body [hash] The post body content
+        #   * :type [string] "phone" or "email" or "totp" or "webauthn-roaming"
+        #   * :name [string] A human-readable label to identify the authentication method (optional)
+        #   * :totp_secret [string] Base32 encoded secret for TOTP generation (optional)
+        #   * :phone_number [string] Applies to phone authentication methods only. The destination phone number used to send verification codes via text and voice (optional)
+        #   * :email [string] Applies to email authentication methods only. The email address used to send verification messages (optional)
+        #   * :preferred_authentication_method [string] Preferred phone authentication method (optional)
+        #   * :key_id [string] Applies to email webauthn authenticators only. The id of the credential (optional)
+        #   * :public_key [string] Applies to email webauthn authenticators only. The public key (optional)
+        #   * :relying_party_identifier [string] Applies to email webauthn authenticators only. The relying party identifier (optional)
+        # @see https://auth0.com/docs/api/management/v2#!/Users/post_authentication_methods
+        def post_user_authentication_method(user_id, body)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+          raise Auth0::MissingParameter, 'Must supply a body' if body.to_s.empty?
+
+          post "#{users_path}/#{user_id}/authentication-methods", body
+        end
+        alias create_user_authentication_method post_user_authentication_method
+
+        # Updates all authentication methods by replacing them with the given ones
+        #
+        # @param user_id [string] The user ID of the authentication methods to get
+        # @param body [hash array] The mehods to update
+        #   * :type [string] "phone" or "email" or "totp" or "webauthn-roaming"
+        #   * :name [string] A human-readable label to identify the authentication method (optional)
+        #   * :totp_secret [string] Base32 encoded secret for TOTP generation (optional)
+        #   * :phone_number [string] Applies to phone authentication methods only. The destination phone number used to send verification codes via text and voice (optional)
+        #   * :email [string] Applies to email authentication methods only. The email address used to send verification messages (optional)
+        #   * :preferred_authentication_method [string] Preferred phone authentication method (optional)
+        # @see https://auth0.com/docs/api/management/v2#!/Users/put_authentication_methods
+        def put_all_user_authentication_methods(user_id, body)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+          raise Auth0::MissingParameter, 'Must supply a body' if body.to_s.empty?
+
+          put "#{users_path}/#{user_id}/authentication-methods", body
+        end
+        alias update_all_user_authentication_methods put_all_user_authentication_methods
+
+        # Updates a user authentication method
+        #
+        # @param user_id [string] The user ID of the authentication methods to get
+        # @param body [hash array] The mehods to update
+        #   * :name [string] A human-readable label to identify the authentication method (optional)
+        #   * :preferred_authentication_method [string] Preferred phone authentication method (optional)
+        # @see https://auth0.com/docs/api/management/v2#!/Users/put_authentication_methods
+        def patch_user_authentication_method(user_id, authentication_method_id, body)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+          raise Auth0::MissingParameter, 'Must supply an authentication_method_id' if authentication_method_id.to_s.empty?
+          raise Auth0::MissingParameter, 'Must supply a body' if body.to_s.empty?
+
+          patch "#{users_path}/#{user_id}/authentication-methods/#{authentication_method_id}", body
+        end
+        alias update_user_authentication_method patch_user_authentication_method
+
+        # Deletes all of the user's authentication methods
+        #
+        # @param user_id [string] The user ID
+        # @see https://auth0.com/docs/api/management/v2#!/Users/delete_authentication_methods
+        def delete_user_authentication_methods(user_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+
+          delete "#{users_path}/#{user_id}/authentication-methods"          
+        end
+ 
+        
+        # Deletes the user's authentication method specified by authentication_method_id
+        #
+        # @param user_id [string] The user ID
+        # @param authentication_method_id [string] The ID of the authentication method
+        # @see https://auth0.com/docs/api/management/v2#!/Users/delete_authentication_methods_by_authentication_method_id
+        def delete_user_authentication_method(user_id, authentication_method_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+          raise Auth0::MissingParameter, 'Must supply an authentication_method_id' if authentication_method_id.to_s.empty?
+
+          delete "#{users_path}/#{user_id}/authentication-methods/#{authentication_method_id}"
+        end
+
+        # Delete all sessions for a user.
+        #
+        # @param user_id [string] The user ID
+        # @see https://auth0.com/docs/api/management/v2/users/delete-sessions-for-user
+        def delete_user_sessions(user_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+
+          delete "#{users_path}/#{user_id}/sessions"
+        end
+
+        # Retrieve details for a user's sessions.
+        #
+        # @param user_id [string] The user ID
+        # @see https://auth0.com/docs/api/management/v2/users/get-sessions-for-user
+        def user_sessions(user_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+
+          get "#{users_path}/#{user_id}/sessions"
+        end
+
+        # Retrieve details for a user's refresh tokens.
+        # @see https://auth0.com/docs/api/management/v2/users/get-refresh-tokens-for-user
+        #
+        # @param use_id [String] The user ID
+        # @param options [hash] A hash of options for getting permissions
+        #   * :take [Integer] Number of results per page. Defaults to 50.
+        #   * :from [String] Optional token ID from which to start selection (exclusive).
+        #   * :include_totals [boolean] Return results inside an object that contains the total result count (true)
+        #     or as a direct array of results (false, default)
+        #
+        # @return [json] Returns refresh tokens for the given user_id.
+        def user_refresh_tokens(user_id, options = {})
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+
+          request_params = {
+            take: options.fetch(:take, nil),
+            from: options.fetch(:from, nil),
+            include_totals: options.fetch(:include_totals, nil)
+          }
+
+          get "#{users_path}/#{user_id}/refresh-tokens", request_params
+        end
+
+        # Delete all refresh tokens for a user.
+        #
+        # @param user_id [String] ID of the user to get remove refresh tokens for
+        # @see https://auth0.com/docs/api/management/v2/users/delete-refresh-tokens-for-user
+        def delete_user_refresh_tokens(user_id)
+          raise Auth0::MissingUserId, 'Must supply a valid user_id' if user_id.to_s.empty?
+
+          delete "#{users_path}/#{user_id}/refresh-tokens"
+        end
+
         private
 
         # Users API path
         def users_path
           @users_path ||= '/api/v2/users'
         end
-
       end
     end
   end

data/lib/auth0/api/v2.rb

@@ -1,11 +1,17 @@
+require 'auth0/api/v2/grants'
+require 'auth0/api/v2/actions'
 require 'auth0/api/v2/anomaly'
 require 'auth0/api/v2/blacklists'
+require 'auth0/api/v2/branding'
 require 'auth0/api/v2/clients'
 require 'auth0/api/v2/client_grants'
 require 'auth0/api/v2/connections'
 require 'auth0/api/v2/device_credentials'
 require 'auth0/api/v2/emails'
 require 'auth0/api/v2/jobs'
+require 'auth0/api/v2/prompts'
+require 'auth0/api/v2/organizations'
+require 'auth0/api/v2/refresh_tokens'
 require 'auth0/api/v2/rules'
 require 'auth0/api/v2/roles'
 require 'auth0/api/v2/stats'
@@ -15,32 +21,44 @@ require 'auth0/api/v2/user_blocks'
 require 'auth0/api/v2/tenants'
 require 'auth0/api/v2/tickets'
 require 'auth0/api/v2/logs'
+require 'auth0/api/v2/log_streams'
 require 'auth0/api/v2/resource_servers'
 require 'auth0/api/v2/guardian'
+require 'auth0/api/v2/attack_protection'
+require 'auth0/api/v2/sessions'
 
 module Auth0
   module Api
     # https://auth0.com/docs/apiv2
     module V2
+      include Auth0::Api::V2::Grants
+      include Auth0::Api::V2::Actions
       include Auth0::Api::V2::Anomaly
       include Auth0::Api::V2::Blacklists
+      include Auth0::Api::V2::Branding
       include Auth0::Api::V2::Clients
       include Auth0::Api::V2::ClientGrants
       include Auth0::Api::V2::Connections
       include Auth0::Api::V2::DeviceCredentials
       include Auth0::Api::V2::Emails
+      include Auth0::Api::V2::Guardian
       include Auth0::Api::V2::Jobs
+      include Auth0::Api::V2::Logs
+      include Auth0::Api::V2::LogStreams
+      include Auth0::Api::V2::Prompts
+      include Auth0::Api::V2::Organizations
+      include Auth0::Api::V2::RefreshTokens
       include Auth0::Api::V2::Rules
       include Auth0::Api::V2::Roles
       include Auth0::Api::V2::Stats
       include Auth0::Api::V2::Users
       include Auth0::Api::V2::UsersByEmail
       include Auth0::Api::V2::UserBlocks
+      include Auth0::Api::V2::ResourceServers
       include Auth0::Api::V2::Tenants
       include Auth0::Api::V2::Tickets
-      include Auth0::Api::V2::Logs
-      include Auth0::Api::V2::ResourceServers
-      include Auth0::Api::V2::Guardian
+      include Auth0::Api::V2::AttackProtection
+      include Auth0::Api::V2::Sessions
     end
   end
 end

data/lib/auth0/client_assertion.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'jwt'
+
+module Auth0
+  module ClientAssertion
+    CLIENT_ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'.freeze
+
+    # Adds keys into the supplied hash for either the client secret, or client assertion. If `client_assertion_signing_key` is not nil,
+    # it takes precedence over `client_secret`.
+    # @param [hash] The hash to add the keys to
+    # @param client_id [string] The client ID
+    # @param client_secret [string] The client secret
+    # @param client_assertion_signing_key [PKey] The key used to sign the client assertion JWT
+    # @param client_assertion_signing_alg [string] The algorithm used when signing the client assertion JWT
+    def populate_client_assertion_or_secret(hash, 
+      domain: @domain,
+      client_id: @client_id, 
+      client_secret: @client_secret,
+      client_assertion_signing_key: @client_assertion_signing_key,
+      client_assertion_signing_alg: @client_assertion_signing_alg)
+
+      if !client_assertion_signing_key.nil?
+        # Create JWT
+        now = Time.now.to_i
+
+        payload = {
+          iss: client_id,
+          sub: client_id,
+          aud: "https://#{domain}/",
+          iat: now,
+          exp: now + 180,
+          jti: SecureRandom.uuid
+        }
+
+        jwt = JWT.encode payload, client_assertion_signing_key, client_assertion_signing_alg
+
+        hash[:client_assertion] = jwt
+        hash[:client_assertion_type] = Auth0::ClientAssertion::CLIENT_ASSERTION_TYPE
+      else
+        hash[:client_secret] = client_secret
+      end
+    end
+  end
+end

data/lib/auth0/exception.rb

@@ -38,25 +38,36 @@ module Auth0
   class MissingUserId < Auth0::Exception; end
   # exception for unset client_id
   class MissingClientId < Auth0::Exception; end
+  # exception for unset organization_id
+  class MissingOrganizationId < Auth0::Exception; end
+  # exception for unset trigger_id
+  class MissingTriggerId < Auth0::Exception; end
+  # exception for unset action_name
+  class MissingActionName < Auth0::Exception; end
+  # exception for unset action_id
+  class MissingActionId < Auth0::Exception; end
+  # exception for unset execution_id
+  class MissingExecutionId < Auth0::Exception; end
+  # exception for unset trigger_id
+  class MissingTriggerId < Auth0::Exception; end
   # exception for an unset parameter
   class MissingParameter < Auth0::Exception; end
+  # exception for unset version_id
+  class MissingVersionId < Auth0::Exception; end
   # Api v2 access denied
   class AccessDenied < Auth0::HTTPError; end
   # Invalid parameter passed, e.g. empty where ID is required
   class InvalidParameter < Auth0::Exception; end
-  # Invalid Auth0 credentials either client_id/secret for API v1
-  # or JWT for API v2/
+  # Invalid JWT
   class InvalidCredentials < Auth0::Exception; end
   # Invalid Auth0 API namespace
   class InvalidApiNamespace < Auth0::Exception; end
   # Auth0 API rate-limiting encountered
-  # TODO: When making API-breaking changes, make this a subclass
-  # of Auth0::HTTPError directly rather than Auth0::Unsupported.
-  # It's currently under Unsupported to avoid breaking compatibility
-  # with prior gem versions that treated 429 errors as unknown errors.
-  class RateLimitEncountered < Auth0::Unsupported
+  class RateLimitEncountered < Auth0::HTTPError
     def reset
-      Time.at(headers['X-RateLimit-Reset']).utc
+      Time.at(Integer(headers[:x_ratelimit_reset])).utc
     end
   end
+
+  class InvalidIdToken < Auth0::Exception; end
 end

data/lib/auth0/mixins/access_token_struct.rb

@@ -1,4 +1,4 @@
-AccessToken = Struct.new(
+Auth0::AccessToken = Struct.new(
   :access_token,
   :expires_in,
   :refresh_token,
@@ -17,4 +17,4 @@ AccessToken = Struct.new(
   def token
     access_token
   end
-end
+end

data/lib/auth0/mixins/api_token_struct.rb

@@ -1,5 +1,4 @@
-ApiToken = Struct.new :access_token, :scope, :expires_in do
-
+Auth0::ApiToken = Struct.new :access_token, :scope, :expires_in do
   def token
     access_token
   end
@@ -7,4 +6,4 @@ ApiToken = Struct.new :access_token, :scope, :expires_in do
   def scopes
     scope.split
   end
-end
+end