authsignal-ruby 5.2.1 → 5.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eb8afa36ec62970a06618e860b3f343d4e7d7c81ce70e45d905e69c5cccf9c83
-  data.tar.gz: a55a775d64b0569d044f1f4f4362717a160fbb214f63f56af2e11c5d391dc1de
+  metadata.gz: bf8ccfc3244f86d9e99c7c481d5c23fb9f341aad018e371522f3755908e9bc9d
+  data.tar.gz: c6b7cc9b3c50fcc043ffdd73cbd14dd7114fa8b7977f654f1ade619444061b9d
 SHA512:
-  metadata.gz: 1d0bf703634455560509482b03ff746828ac10dd824ebe4d83bfc2795e5c6f8db7f45c1a7655233bfb762a0034b8fa98285275510170b4acd03194b4e9630ffd
-  data.tar.gz: 6d724b25f111840ff0517ccf6e7c6c5a203c4de48e00a459e296b3ab6ea15a86ba6c31fb3db9961cc5ca0616e82fb7cec5b8c8e52027459a231561409ad249cc
+  metadata.gz: c83bb4ab1de9b24b12820ebe82328741150e7f3821e954588f79df4b8e8b2d4ccfc3b259c36a0b86d23424940e0dda04107b8dfd33bb0e2fee9514bed41a3f2a
+  data.tar.gz: 97b80dcf590ec5f8f0ffa196e908669dcfdefaf5ea90a8228e2378add33d522a565488373c8ac8884936f3119c91965c48ea2aa7df5d1f003aa309694399d846

data/.editorconfig

@@ -0,0 +1,19 @@
+# EditorConfig helps maintain consistent coding styles
+# https://editorconfig.org
+
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+

data/.rubocop.yml

@@ -0,0 +1,50 @@
+AllCops:
+  NewCops: enable
+  TargetRubyVersion: 2.6
+  SuggestExtensions: false
+  Exclude:
+    - 'vendor/**/*'
+
+# Enforce 2-space indentation
+Layout/IndentationWidth:
+  Width: 2
+
+Layout/LineLength:
+  Max: 150
+
+# Be lenient in specs and gemspec
+Metrics/BlockLength:
+  Exclude:
+    - 'spec/**/*'
+    - '*.gemspec'
+
+# SDK methods can have more parameters
+Metrics/ParameterLists:
+  Max: 15
+
+# SDK classes/modules can be longer
+Metrics/ClassLength:
+  Max: 250
+
+Metrics/ModuleLength:
+  Max: 150
+
+Metrics/MethodLength:
+  Max: 25
+
+Metrics/AbcSize:
+  Max: 30
+
+# Skip documentation requirement for SDK
+Style/Documentation:
+  Enabled: false
+
+# Gemspec specific
+Gemspec/DevelopmentDependencies:
+  Enabled: false
+
+Gemspec/RequireMFA:
+  Enabled: false
+
+Gemspec/OrderedDependencies:
+  Enabled: false

data/.ruby-version

@@ -0,0 +1 @@
+2.6.10

data/Gemfile

@@ -1,10 +1,11 @@
 # frozen_string_literal: true
 
-source "https://rubygems.org"
+source 'https://rubygems.org'
 
 # Specify your gem's dependencies in authsignal-ruby.gemspec
 gemspec
 
-group :test do
+group :development, :test do
   gem 'dotenv'
+  gem 'rubocop', require: false
 end

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    authsignal-ruby (5.2.1)
+    authsignal-ruby (5.3.0)
       base64
       faraday (>= 2.0.1)
       faraday-retry (~> 2.2)
@@ -9,52 +9,69 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
-    base64 (0.2.0)
-    bigdecimal (3.1.8)
-    crack (1.0.0)
+    addressable (2.8.8)
+      public_suffix (>= 2.0.2, < 8.0)
+    ast (2.4.3)
+    base64 (0.3.0)
+    bigdecimal (4.0.1)
+    crack (1.0.1)
       bigdecimal
       rexml
-    diff-lcs (1.5.1)
-    dotenv (3.1.7)
-    faraday (2.12.0)
-      faraday-net_http (>= 2.0, < 3.4)
-      json
-      logger
-    faraday-net_http (3.3.0)
-      net-http
-    faraday-retry (2.2.1)
+    diff-lcs (1.6.2)
+    dotenv (2.8.1)
+    faraday (2.8.1)
+      base64
+      faraday-net_http (>= 2.0, < 3.1)
+      ruby2_keywords (>= 0.0.4)
+    faraday-net_http (3.0.2)
+    faraday-retry (2.4.0)
       faraday (~> 2.0)
-    hashdiff (1.1.1)
-    json (2.7.2)
-    logger (1.6.1)
-    net-http (0.4.1)
-      uri
-    public_suffix (6.0.1)
-    rake (13.2.1)
-    rexml (3.3.8)
-    rspec (3.13.0)
+    hashdiff (1.2.1)
+    json (2.7.6)
+    parallel (1.24.0)
+    parser (3.3.10.0)
+      ast (~> 2.4.1)
+      racc
+    public_suffix (5.1.1)
+    racc (1.8.1)
+    rainbow (3.1.1)
+    rake (13.3.1)
+    regexp_parser (2.11.3)
+    rexml (3.4.4)
+    rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
       rspec-mocks (~> 3.13.0)
-    rspec-core (3.13.2)
+    rspec-core (3.13.6)
       rspec-support (~> 3.13.0)
-    rspec-expectations (3.13.3)
+    rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.2)
+    rspec-mocks (3.13.7)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-support (3.13.1)
-    uri (0.13.1)
-    webmock (3.24.0)
+    rspec-support (3.13.6)
+    rubocop (1.50.2)
+      json (~> 2.3)
+      parallel (~> 1.10)
+      parser (>= 3.2.0.0)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
+      rexml (>= 3.2.5, < 4.0)
+      rubocop-ast (>= 1.28.0, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 3.0)
+    rubocop-ast (1.30.0)
+      parser (>= 3.2.1.0)
+    ruby-progressbar (1.13.0)
+    ruby2_keywords (0.0.5)
+    unicode-display_width (2.6.0)
+    webmock (3.26.1)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
 
 PLATFORMS
-  arm64-darwin-24
   ruby
 
 DEPENDENCIES
@@ -62,7 +79,8 @@ DEPENDENCIES
   dotenv
   rake (~> 13.0)
   rspec (~> 3.2)
+  rubocop
   webmock (~> 3.14)
 
 BUNDLED WITH
-   2.5.14
+   1.17.2

data/Rakefile

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require "bundler/gem_tasks"
-require "rspec/core/rake_task"
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
 
 RSpec::Core::RakeTask.new(:spec)
 
-task default: :spec
+task default: :spec

data/bin/console

@@ -1,8 +1,8 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require "bundler/setup"
-require "authsignal"
+require 'bundler/setup'
+require 'authsignal'
 
 # You can add fixtures and/or initialization code here to make experimenting
 # with your gem easier. You can also use a different console, if you like.
@@ -11,5 +11,5 @@ require "authsignal"
 # require "pry"
 # Pry.start
 
-require "irb"
+require 'irb'
 IRB.start(__FILE__)

data/lib/authsignal/api_error.rb

@@ -25,7 +25,7 @@ module Authsignal
     end
 
     def format_description(error_code, error_description)
-      error_description && error_description.length > 0 ? error_description : error_code
+      error_description&.length&.positive? ? error_description : error_code
     end
   end
 end

data/lib/authsignal/client.rb

@@ -1,117 +1,259 @@
+# frozen_string_literal: true
+
 require 'erb'
 
 module Authsignal
-    class Client
-        USER_AGENT = "authsignal-ruby"
-        NO_API_KEY_MESSAGE  = "No Authsignal API Secret Key Set"
-
-        RETRY_OPTIONS = {
-          max: 3,
-          interval: 0.1,
-          interval_randomness: 0.5,
-          backoff_factor: 2,
-        }.freeze
-        private_constant :RETRY_OPTIONS
-
-        def initialize(retry_options: RETRY_OPTIONS)
-            @api_key = require_api_key
-
-            @client = Faraday.new do |builder|
-                builder.url_prefix = Authsignal.configuration.api_url
-                builder.adapter :net_http
-                builder.request :authorization, :basic, @api_key, nil
-
-                builder.headers['Accept'] = 'application/json'
-                builder.headers['Content-Type'] = 'application/json'
-                builder.headers['User-Agent'] = USER_AGENT
-                builder.headers['X-Authsignal-Version'] = Authsignal::VERSION
-
-                builder.request :json
-                builder.response :json, parser_options: { symbolize_names: true }
-
-                builder.use Middleware::JsonRequest
-                builder.use Middleware::JsonResponse
-
-                builder.request :retry, retry_options if Authsignal.configuration.retry
-                builder.response :logger, ::Logger.new(STDOUT), bodies: true if Authsignal.configuration.debug
-            end
-        end
-
-        def get_user(user_id:)
-            path = "users/#{url_encode(user_id)}"
-            make_request(:get, path)
-        end
-
-        def update_user(user_id:, attributes:)
-            make_request(:post, "users/#{url_encode(user_id)}", body: attributes)
-        end
-
-        def delete_user(user_id:)
-            make_request(:delete, "users/#{url_encode(user_id)}")
-        end
-
-        def get_authenticators(user_id:)
-            make_request(:get, "users/#{url_encode(user_id)}/authenticators")
-        end
-
-        def enroll_verified_authenticator(user_id:, attributes:)
-            make_request(:post, "users/#{url_encode(user_id)}/authenticators", body: attributes)
-        end
-
-        def delete_authenticator(user_id:, user_authenticator_id:)
-            make_request(:delete, "users/#{url_encode(user_id)}/authenticators/#{url_encode(user_authenticator_id)}")
-        end
-
-        def track(user_id:, action:, attributes:)
-            path = "users/#{user_id}/actions/#{action}"
-
-            make_request(:post, path, body: attributes)
-        end
-
-        def validate_challenge(token:, user_id: nil, action: nil)
-            path = "validate"
-            body = { user_id: user_id, token: token, action: action }
-
-            make_request(:post, path, body: body)
-        end
-
-        def get_action(user_id:, action:, idempotency_key:)
-            make_request(:get, "users/#{url_encode(user_id)}/actions/#{action}/#{url_encode(idempotency_key)}")
-        end
-
-        def update_action(user_id:, action:, idempotency_key:, attributes:) 
-            make_request(:patch, "users/#{url_encode(user_id)}/actions/#{action}/#{url_encode(idempotency_key)}", body: attributes)
-        end
-
-        ##
-        # TODO: delete identify?
-        def identify(user_id, user_payload)
-            make_request(:post , "users/#{url_encode(user_id)}", body: user_payload)
-        end
-
-        private
-
-        def url_encode(s)
-            ERB::Util.url_encode(s)
-        end
-
-        def version
-            Authsignal.configuration.version
-        end
-
-        def print_api_key_warning
-            $stderr.puts(NO_API_KEY_MESSAGE)
-        end
-
-        def require_api_key
-            Authsignal.configuration.api_secret_key || print_api_key_warning
-        end
-
-        def make_request(method, path, body: nil, headers: nil)
-            if body.is_a?(Hash)
-                body = body.reject { |_, v| v.nil? }
-            end
-            @client.public_send(method, path, body, headers)
-        end
+  class Client
+    USER_AGENT = 'authsignal-ruby'
+    NO_API_KEY_MESSAGE = 'No Authsignal API Secret Key Set'
+
+    RETRY_OPTIONS = {
+      max: 3,
+      interval: 0.1,
+      interval_randomness: 0.5,
+      backoff_factor: 2
+    }.freeze
+    private_constant :RETRY_OPTIONS
+
+    def initialize(retry_options: RETRY_OPTIONS)
+      @api_key = require_api_key
+
+      @client = Faraday.new do |builder|
+        builder.url_prefix = Authsignal.configuration.api_url
+        builder.adapter :net_http
+        builder.request :authorization, :basic, @api_key, nil
+
+        builder.headers['Accept'] = 'application/json'
+        builder.headers['Content-Type'] = 'application/json'
+        builder.headers['User-Agent'] = USER_AGENT
+        builder.headers['X-Authsignal-Version'] = Authsignal::VERSION
+
+        builder.request :json
+        builder.response :json, parser_options: { symbolize_names: true }
+
+        builder.use Middleware::JsonRequest
+        builder.use Middleware::JsonResponse
+
+        builder.request :retry, retry_options if Authsignal.configuration.retry
+        builder.response :logger, ::Logger.new($stdout), bodies: true if Authsignal.configuration.debug
+      end
+    end
+
+    def get_user(user_id:)
+      path = "users/#{url_encode(user_id)}"
+      make_request(:get, path)
+    end
+
+    def update_user(user_id:, attributes:)
+      make_request(:post, "users/#{url_encode(user_id)}", body: attributes)
+    end
+
+    def delete_user(user_id:)
+      make_request(:delete, "users/#{url_encode(user_id)}")
+    end
+
+    def query_users(
+      username: nil,
+      email: nil,
+      phone_number: nil,
+      token: nil,
+      limit: nil,
+      last_evaluated_user_id: nil
+    )
+      params = {
+        username: username,
+        email: email,
+        phoneNumber: phone_number,
+        token: token,
+        limit: limit&.to_s,
+        lastEvaluatedUserId: last_evaluated_user_id
+      }.compact
+
+      path = params.empty? ? 'users' : "users?#{URI.encode_www_form(params)}"
+      make_request(:get, path)
+    end
+
+    def get_authenticators(user_id:)
+      make_request(:get, "users/#{url_encode(user_id)}/authenticators")
+    end
+
+    def enroll_verified_authenticator(user_id:, attributes:)
+      make_request(:post, "users/#{url_encode(user_id)}/authenticators", body: attributes)
+    end
+
+    def delete_authenticator(user_id:, user_authenticator_id:)
+      make_request(:delete, "users/#{url_encode(user_id)}/authenticators/#{url_encode(user_authenticator_id)}")
+    end
+
+    def track(user_id:, action:, attributes:)
+      path = "users/#{user_id}/actions/#{action}"
+
+      make_request(:post, path, body: attributes)
+    end
+
+    def validate_challenge(token:, user_id: nil, action: nil)
+      path = 'validate'
+      body = { user_id: user_id, token: token, action: action }
+
+      make_request(:post, path, body: body)
+    end
+
+    def get_action(user_id:, action:, idempotency_key:)
+      make_request(:get, "users/#{url_encode(user_id)}/actions/#{action}/#{url_encode(idempotency_key)}")
+    end
+
+    def query_user_actions(
+      user_id:,
+      from_date: nil,
+      action_codes: [],
+      state: nil
+    )
+      params = {
+        fromDate: from_date,
+        codes: action_codes.empty? ? nil : action_codes.join(','),
+        state: state
+      }.compact
+
+      base_path = "users/#{url_encode(user_id)}/actions"
+      path = params.empty? ? base_path : "#{base_path}?#{URI.encode_www_form(params)}"
+      make_request(:get, path)
+    end
+
+    def update_action(user_id:, action:, idempotency_key:, attributes:)
+      make_request(:patch, "users/#{url_encode(user_id)}/actions/#{action}/#{url_encode(idempotency_key)}", body: attributes)
+    end
+
+    def challenge(
+      verification_method:,
+      action:,
+      idempotency_key: nil,
+      user_id: nil,
+      email: nil,
+      phone_number: nil,
+      sms_channel: nil,
+      locale: nil,
+      device_id: nil,
+      ip_address: nil,
+      user_agent: nil,
+      custom: nil,
+      scope: nil
+    )
+      body = {
+        verification_method: verification_method,
+        action: action,
+        idempotency_key: idempotency_key,
+        user_id: user_id,
+        email: email,
+        phone_number: phone_number,
+        sms_channel: sms_channel,
+        locale: locale,
+        device_id: device_id,
+        ip_address: ip_address,
+        user_agent: user_agent,
+        custom: custom,
+        scope: scope
+      }
+      make_request(:post, 'challenge', body: body)
+    end
+
+    def verify(challenge_id:, verification_code:)
+      body = {
+        challenge_id: challenge_id,
+        verification_code: verification_code
+      }
+      make_request(:post, 'verify', body: body)
+    end
+
+    def claim_challenge(
+      challenge_id:,
+      user_id:,
+      skip_verification_check: nil
+    )
+      body = {
+        challenge_id: challenge_id,
+        user_id: user_id,
+        skip_verification_check: skip_verification_check
+      }
+      make_request(:post, 'claim', body: body)
+    end
+
+    def get_challenge(
+      challenge_id: nil,
+      user_id: nil,
+      action: nil,
+      verification_method: nil
+    )
+      params = {}
+      params[:challengeId] = challenge_id if challenge_id
+      params[:userId] = user_id if user_id
+      params[:action] = action if action
+      params[:verificationMethod] = verification_method if verification_method
+
+      query_string = URI.encode_www_form(params) unless params.empty?
+      path = query_string ? "challenges?#{query_string}" : 'challenges'
+
+      make_request(:get, path)
+    end
+
+    def create_session(client_id:, token:, action: nil)
+      body = {
+        client_id: client_id,
+        token: token,
+        action: action
+      }.compact
+      make_request(:post, 'sessions', body: body)
+    end
+
+    def validate_session(access_token:, client_ids: nil)
+      body = {
+        access_token: access_token,
+        client_ids: client_ids
+      }.compact
+      make_request(:post, 'sessions/validate', body: body)
+    end
+
+    def refresh_session(refresh_token:)
+      body = { refresh_token: refresh_token }
+      make_request(:post, 'sessions/refresh', body: body)
+    end
+
+    def revoke_session(access_token:)
+      body = { access_token: access_token }
+      make_request(:post, 'sessions/revoke', body: body)
+    end
+
+    def revoke_user_sessions(user_id:)
+      body = { user_id: user_id }
+      make_request(:post, 'sessions/user/revoke', body: body)
+    end
+
+    ##
+    # TODO: delete identify?
+    def identify(user_id, user_payload)
+      make_request(:post, "users/#{url_encode(user_id)}", body: user_payload)
+    end
+
+    private
+
+    def url_encode(str)
+      ERB::Util.url_encode(str)
+    end
+
+    def version
+      Authsignal.configuration.version
+    end
+
+    def print_api_key_warning
+      warn(NO_API_KEY_MESSAGE)
+    end
+
+    def require_api_key
+      Authsignal.configuration.api_secret_key || print_api_key_warning
+    end
+
+    def make_request(method, path, body: nil, headers: nil)
+      body = body.compact if body.is_a?(Hash)
+      @client.public_send(method, path, body, headers)
     end
+  end
 end

data/lib/authsignal/configuration.rb

@@ -1,52 +1,55 @@
-require "ostruct"
+# frozen_string_literal: true
 
 module Authsignal
   class Configuration
-        def self.config_option(name)
-            define_method(name) do
-                read_value(name)
-            end
-
-            define_method("#{name}=") do |value|
-                set_value(name, value)
-            end
-        end
-  
-        config_option :api_secret_key
-        config_option :api_url
-        config_option :debug
-        config_option :retry
-
-        def initialize
-            @config_values = {}
-      
-            # set default attribute values
-            @defaults = OpenStruct.new({
-                api_url: 'https://signal.authsignal.com/v1/',
-                retry: false,
-                debug: false
-            })
-        end
-
-        def [](key)
-            read_value(key)
-        end
-    
-        def []=(key, value)
-            set_value(key, value)
-        end
-
-        private
-        def read_value(name)
-            if @config_values.has_key?(name)
-                @config_values[name]
-            else
-                @defaults.send(name)
-            end
-        end
-
-        def set_value(name, value)
-            @config_values[name] = value
-        end
-  end    
+    attr_reader :defaults
+
+    def self.config_option(name)
+      define_method(name) do
+        read_value(name)
+      end
+
+      define_method("#{name}=") do |value|
+        set_value(name, value)
+      end
+    end
+
+    config_option :api_secret_key
+    config_option :api_url
+    config_option :debug
+    config_option :retry
+
+    def initialize
+      @config_values = {}
+
+      # set default attribute values
+      @defaults = {
+        api_url: 'https://signal.authsignal.com/v1/',
+        retry: false,
+        debug: false
+      }
+    end
+
+    def [](key)
+      read_value(key)
+    end
+
+    def []=(key, value)
+      set_value(key, value)
+    end
+
+    private
+
+    def read_value(name)
+      if @config_values.key?(name)
+        @config_values[name]
+      else
+        @defaults[name]
+      end
+    end
+
+    def set_value(name, value)
+      @config_values[name] = value
+    end
+  end
 end

data/lib/authsignal/invalid_signature_error.rb

@@ -1,7 +1,6 @@
+# frozen_string_literal: true
+
 module Authsignal
   class InvalidSignatureError < StandardError
-    def initialize(message)
-      super(message)
-    end
   end
 end

data/lib/authsignal/middleware/json_request.rb

@@ -7,9 +7,7 @@ module Authsignal
         return if env.body.nil?
 
         parsed_body = JSON.parse(env.body)
-        if parsed_body.is_a?(Hash)
-          env.body = camelcase_keys(parsed_body).to_json
-        end
+        env.body = camelcase_keys(parsed_body).to_json if parsed_body.is_a?(Hash)
       rescue JSON::ParserError
         # noop
       end

data/lib/authsignal/middleware/json_response.rb

@@ -9,7 +9,7 @@ module Authsignal
         # Otherwise, we can safe guard with: env.response_headers['content-type'] =~ /application\/json/
         parsed_body = JSON.parse(env.body)
         if parsed_body.is_a?(Hash)
-          parsed_body.delete("actionCode") # Remove deprecated actionCode from response
+          parsed_body.delete('actionCode') # Remove deprecated actionCode from response
           env.body = transform_to_snake_case(parsed_body)
         end
       rescue JSON::ParserError
@@ -20,9 +20,10 @@ module Authsignal
 
       def underscore(camelcased)
         return camelcased.to_s unless /[A-Z-]|::/.match?(camelcased)
-        word = camelcased.to_s.gsub("::", "/")
-        word.gsub!(/([A-Z])(?=[A-Z][a-z])|([a-z\d])(?=[A-Z])/) { ($1 || $2) << "_" }
-        word.tr!("-", "_")
+
+        word = camelcased.to_s.gsub('::', '/')
+        word.gsub!(/([A-Z])(?=[A-Z][a-z])|([a-z\d])(?=[A-Z])/) { (::Regexp.last_match(1) || ::Regexp.last_match(2)) << '_' }
+        word.tr!('-', '_')
         word.downcase!
         word
       end

data/lib/authsignal/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Authsignal
-  VERSION = "5.2.1"
+  VERSION = '5.3.0'
 end

data/lib/authsignal/webhook.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'openssl'
 require 'json'
 require 'base64'
@@ -6,7 +8,7 @@ module Authsignal
   DEFAULT_TOLERANCE = 5
 
   class Webhook
-    VERSION = "v2"
+    VERSION = 'v2'
 
     attr_reader :api_secret_key
 
@@ -19,8 +21,8 @@ module Authsignal
 
       seconds_since_epoch = Time.now.to_i
 
-      if tolerance > 0 && parsed_signature[:timestamp] < seconds_since_epoch - (tolerance * 60)
-        raise InvalidSignatureError, "Timestamp is outside the tolerance zone."
+      if tolerance.positive? && parsed_signature[:timestamp] < seconds_since_epoch - (tolerance * 60)
+        raise InvalidSignatureError, 'Timestamp is outside the tolerance zone.'
       end
 
       hmac_content = "#{parsed_signature[:timestamp]}.#{payload}"
@@ -41,34 +43,29 @@ module Authsignal
         end
       end
 
-      unless match
-        raise InvalidSignatureError, "Signature mismatch."
-      end
+      raise InvalidSignatureError, 'Signature mismatch.' unless match
 
       JSON.parse(payload, symbolize_names: true)
     end
 
     def parse_signature(value)
-      result = {
-        timestamp: -1,
-        signatures: []
-      }
+      handle_invalid_signature unless value
 
-      return handle_invalid_signature unless value
+      result = extract_signature_parts(value)
+      handle_invalid_signature if result[:timestamp] == -1 || result[:signatures].empty?
 
-      value.split(',').each do |item|
-        kv = item.split('=')
-        next unless kv.length == 2
+      result
+    end
 
-        if kv[0] == 't'
-          result[:timestamp] = kv[1].to_i
-        elsif kv[0] == VERSION
-          result[:signatures] << kv[1]
-        end
-      end
+    def extract_signature_parts(value)
+      result = { timestamp: -1, signatures: [] }
+
+      value.split(',').each do |item|
+        key, val = item.split('=')
+        next unless key && val
 
-      if result[:timestamp] == -1 || result[:signatures].empty?
-        handle_invalid_signature
+        result[:timestamp] = val.to_i if key == 't'
+        result[:signatures] << val if key == VERSION
       end
 
       result
@@ -77,7 +74,7 @@ module Authsignal
     private
 
     def handle_invalid_signature
-      raise InvalidSignatureError, "Signature format is invalid."
+      raise InvalidSignatureError, 'Signature format is invalid.'
     end
   end
 end

data/lib/authsignal.rb

@@ -1,133 +1,202 @@
-require "faraday"
-require "faraday/retry"
-require "authsignal/version"
-require "authsignal/client"
-require "authsignal/configuration"
-require "authsignal/api_error"
-require "authsignal/invalid_signature_error"
-require "authsignal/webhook"
-require "authsignal/middleware/json_response"
-require "authsignal/middleware/json_request"
+# frozen_string_literal: true
+
+require 'faraday'
+require 'faraday/retry'
+require 'authsignal/version'
+require 'authsignal/client'
+require 'authsignal/configuration'
+require 'authsignal/api_error'
+require 'authsignal/invalid_signature_error'
+require 'authsignal/webhook'
+require 'authsignal/middleware/json_response'
+require 'authsignal/middleware/json_request'
 
 module Authsignal
-    NON_API_METHODS = [:setup, :configuration, :default_configuration, :webhook]
+  NON_API_METHODS = %i[setup configuration default_configuration webhook].freeze
 
-    class << self
-        attr_writer :configuration
+  class << self
+    attr_writer :configuration
 
-        def setup
-            yield(configuration)
-        end
+    def setup
+      yield(configuration)
+    end
+
+    def configuration
+      @configuration ||= Authsignal::Configuration.new
+    end
+
+    def default_configuration
+      configuration.defaults
+    end
+
+    def webhook
+      @webhook ||= Webhook.new(configuration.api_secret_key)
+    end
+
+    def get_user(user_id:)
+      response = Client.new.get_user(user_id: user_id)
+
+      handle_response(response)
+    end
+
+    def query_users(**options)
+      response = Client.new.query_users(**options)
+
+      handle_response(response)
+    end
+
+    def update_user(user_id:, attributes:)
+      response = Client.new.update_user(user_id: user_id, attributes: attributes)
+
+      handle_response(response)
+    end
+
+    def delete_user(user_id:)
+      response = Client.new.delete_user(user_id: user_id)
+
+      handle_response(response)
+    end
+
+    def get_authenticators(user_id:)
+      response = Client.new.get_authenticators(user_id: user_id)
+
+      handle_response(response)
+    end
+
+    def enroll_verified_authenticator(user_id:, attributes:)
+      response = Client.new.enroll_verified_authenticator(user_id: user_id, attributes: attributes)
+
+      handle_response(response)
+    end
+
+    def delete_authenticator(user_id:, user_authenticator_id:)
+      response = Client.new.delete_authenticator(user_id: user_id, user_authenticator_id: user_authenticator_id)
+
+      handle_response(response)
+    end
+
+    def track(user_id:, action:, attributes:)
+      response = Client.new.track(user_id: user_id, action: action, attributes: attributes)
+      handle_response(response)
+    end
 
-        def configuration
-            @configuration ||= Authsignal::Configuration.new
-        end
+    def validate_challenge(token:, user_id: nil, action: nil)
+      response = Client.new.validate_challenge(token: token, user_id: user_id, action: action)
 
-        def default_configuration
-            configuration.defaults
-        end
+      handle_response(response)
+    end
+
+    def get_action(user_id:, action:, idempotency_key:)
+      response = Client.new.get_action(user_id: user_id, action: action, idempotency_key: idempotency_key)
+
+      handle_response(response)
+    end
+
+    def query_user_actions(user_id:, **options)
+      response = Client.new.query_user_actions(user_id: user_id, **options)
 
-        def webhook
-            @webhook ||= Webhook.new(configuration.api_secret_key)
-        end
+      handle_response(response)
+    end
 
-        def get_user(user_id:)
-            response = Client.new.get_user(user_id: user_id)
+    def update_action(user_id:, action:, idempotency_key:, attributes:)
+      response = Client.new.update_action(user_id: user_id, action: action, idempotency_key: idempotency_key, attributes: attributes)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def update_user(user_id:, attributes:)
-            response = Client.new.update_user(user_id: user_id, attributes: attributes)
+    def challenge(verification_method:, action:, **options)
+      response = Client.new.challenge(verification_method: verification_method, action: action, **options)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def delete_user(user_id:)
-            response = Client.new.delete_user(user_id: user_id)
+    def verify(challenge_id:, verification_code:)
+      response = Client.new.verify(challenge_id: challenge_id, verification_code: verification_code)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def get_authenticators(user_id:)
-            response = Client.new.get_authenticators(user_id: user_id)
+    def claim_challenge(challenge_id:, user_id:, **options)
+      response = Client.new.claim_challenge(challenge_id: challenge_id, user_id: user_id, **options)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def enroll_verified_authenticator(user_id:, attributes:)
-            response = Client.new.enroll_verified_authenticator(user_id: user_id, attributes: attributes)
+    def get_challenge(**options)
+      response = Client.new.get_challenge(**options)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def delete_authenticator(user_id:, user_authenticator_id:)
-            response = Client.new.delete_authenticator(user_id: user_id, user_authenticator_id: user_authenticator_id)
+    def create_session(client_id:, token:, action: nil)
+      response = Client.new.create_session(client_id: client_id, token: token, action: action)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def track(user_id:, action:, attributes:)
-            response = Client.new.track(user_id: user_id, action: action, attributes: attributes)
-            handle_response(response)
-        end
+    def validate_session(access_token:, client_ids: nil)
+      response = Client.new.validate_session(access_token: access_token, client_ids: client_ids)
 
-        def validate_challenge(token:, user_id: nil, action: nil)
-            response = Client.new.validate_challenge(token: token,user_id: user_id, action: action)
-            
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def get_action(user_id:, action:, idempotency_key:)
-            response = Client.new.get_action(user_id: user_id, action: action, idempotency_key: idempotency_key)
+    def refresh_session(refresh_token:)
+      response = Client.new.refresh_session(refresh_token: refresh_token)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        def update_action(user_id:, action:, idempotency_key:, attributes:)
-            response = Client.new.update_action(user_id: user_id, action: action, idempotency_key: idempotency_key, attributes: attributes)
+    def revoke_session(access_token:)
+      response = Client.new.revoke_session(access_token: access_token)
 
-            handle_response(response)
-        end
+      handle_response(response)
+    end
 
-        private
+    def revoke_user_sessions(user_id:)
+      response = Client.new.revoke_user_sessions(user_id: user_id)
 
-        def handle_response(response)
-            if response.success?
-                handle_success_response(response)
-            else
-                handle_error_response(response)
-            end
-        end
+      handle_response(response)
+    end
 
-        def handle_success_response(response)
-            if response.body.is_a?(Array)
-                { success?: true, data: response.body }
-            else
-                response.body.merge(success?: true)
-            end
-        end
+    private
 
-        def handle_error_response(response)
-            case response.body
-            when Hash
-                { status_code: response.status, success?: false, error_code: response.body[:error], error_description: response.body[:error_description] }
-            else
-                { status_code: response&.status || 500, success?: false }
-            end
-        end
+    def handle_response(response)
+      if response.success?
+        handle_success_response(response)
+      else
+        handle_error_response(response)
+      end
     end
 
-    methods = Authsignal.singleton_class.public_instance_methods(false)
-    (methods - NON_API_METHODS).each do |method|
-        define_singleton_method("#{method}!") do |*args, **kwargs|
-            send(method, *args, **kwargs).tap do |response|
-                status_code = response[:status_code]
-                error_code = response[:error_code]
-                error_description = response[:error_description]
+    def handle_success_response(response)
+      if response.body.is_a?(Array)
+        { success?: true, data: response.body }
+      else
+        response.body.merge(success?: true)
+      end
+    end
 
-                raise ApiError.new(status_code, error_code, error_description) unless response[:success?]
-            end
-        end
+    def handle_error_response(response)
+      case response.body
+      when Hash
+        { status_code: response.status, success?: false, error_code: response.body[:error],
+          error_description: response.body[:error_description] }
+      else
+        { status_code: response&.status || 500, success?: false }
+      end
+    end
+  end
+
+  methods = Authsignal.singleton_class.public_instance_methods(false)
+  (methods - NON_API_METHODS).each do |method|
+    define_singleton_method("#{method}!") do |*args, **kwargs|
+      send(method, *args, **kwargs).tap do |response|
+        status_code = response[:status_code]
+        error_code = response[:error_code]
+        error_description = response[:error_description]
+
+        raise ApiError.new(status_code, error_code, error_description) unless response[:success?]
+      end
     end
+  end
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authsignal-ruby
 version: !ruby/object:Gem::Version
-  version: 5.2.1
+  version: 5.3.0
 platform: ruby
 authors:
 - justinsoong
+autorequire:
 bindir: exe
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-01-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -101,7 +102,10 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- ".editorconfig"
 - ".rspec"
+- ".rubocop.yml"
+- ".ruby-version"
 - ".tool-versions"
 - CHANGELOG.md
 - Gemfile
@@ -127,6 +131,7 @@ licenses:
 metadata:
   homepage_uri: https://www.authsignal.com
   source_code_uri: https://github.com/authsignal/authsignal-ruby
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -141,7 +146,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.4.19
+signing_key:
 specification_version: 4
 summary: The Authsignal ruby server side signal API.
 test_files: []