casdoor-ruby-sdk 1.0.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: c0b990a9cbd0382d5af8e70e090df98adcacc9c2b4bfd79d15d16f9a40c0688a
+  data.tar.gz: 3d09b80f3e1d36b0f582436bb647fa9e1ba297ba4a934c45b4d372585fa5465a
+SHA512:
+  metadata.gz: 6895b1b555053be338f78204090ecb63f9112830685905d899a868aeb010fd46e822c7438c1f29de75438803f7fd18911ce4a37aa37188b7018f21873181cfc7
+  data.tar.gz: 803e4c91c0dfb4c325af1bc22a0300b8eca03762fe465f6934b4d513ba84bbbc5dae15940acce0133e3ebff9e0960e1cabe0ef6acc057c19e64e8ccf2fb18e93

data/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/README.md

@@ -0,0 +1,193 @@
+# casdoor-ruby-sdk
+
+[![CI](https://github.com/casdoor/casdoor-ruby-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/casdoor/casdoor-ruby-sdk/actions/workflows/ci.yml)
+[![Gem Version](https://img.shields.io/gem/v/casdoor-ruby-sdk.svg)](https://rubygems.org/gems/casdoor-ruby-sdk)
+[![Gem Downloads](https://img.shields.io/gem/dt/casdoor-ruby-sdk.svg)](https://rubygems.org/gems/casdoor-ruby-sdk)
+[![Ruby](https://img.shields.io/badge/ruby-%3E%3D%202.7-CC342D.svg?logo=ruby)](https://www.ruby-lang.org/)
+[![Code Style: RuboCop](https://img.shields.io/badge/code_style-rubocop-brightgreen.svg)](https://github.com/rubocop/rubocop)
+[![License](https://img.shields.io/github/license/casdoor/casdoor-ruby-sdk.svg)](LICENSE)
+[![Discord](https://img.shields.io/discord/1022748306096537660?logo=discord&label=discord&color=5865F2)](https://discord.gg/5rPsrAzK7S)
+
+The Ruby SDK of [Casdoor](https://casdoor.ai/). It lets a Ruby application (Rails, Sinatra, Hanami, ...) sign users in
+with Casdoor, verify the tokens issued by Casdoor, and manage the users, applications, roles, permissions and the
+other objects of Casdoor through its API.
+
+## Installation
+
+Add it to the `Gemfile`:
+
+```ruby
+gem 'casdoor-ruby-sdk'
+```
+
+or install it directly with `gem install casdoor-ruby-sdk`.
+
+It requires Ruby 2.7 or later, and depends only on the [jwt](https://github.com/jwt/ruby-jwt) gem.
+
+## Configuration
+
+```ruby
+require 'casdoor'
+
+client = Casdoor::Client.new(
+  endpoint: 'https://door.casdoor.com',      # the URL of your Casdoor
+  client_id: 'xxx',                          # "Client ID" of the application in Casdoor
+  client_secret: 'xxx',                      # "Client secret" of the application in Casdoor
+  certificate: File.read('cert.pem'),        # "Certificate" of the application's cert, only needed to verify tokens
+  organization_name: 'casbin',               # the organization of the users
+  application_name: 'app-example'            # the application in Casdoor
+)
+```
+
+The certificate is the public certificate shown on the edit page of the cert that the application uses
+("Certs" → the application's cert → "Certificate"). A public key in PEM format works too.
+
+`Casdoor::Client.new` also accepts `headers:` (added to every request), `open_timeout:` and `read_timeout:`.
+
+## Signing users in
+
+Casdoor signs users in with the OAuth 2.0 authorization code flow:
+
+```ruby
+# 1. Redirect the browser to the sign-in page of Casdoor
+redirect_to client.get_signin_url('https://your-app.example.com/callback', state: session[:state] = SecureRandom.hex)
+
+# 2. Casdoor redirects back to the callback with "code" and "state", exchange the code for the tokens
+raise 'Invalid state' unless params[:state] == session[:state]
+token = client.get_oauth_token(params[:code])
+# => {"access_token" => "...", "id_token" => "...", "refresh_token" => "...", "expires_in" => 604800, ...}
+
+# 3. Verify the access token and read the user in it
+claims = client.parse_jwt_token(token['access_token'])
+claims.name          # => "alice"
+claims.owner         # => "casbin", the organization
+claims.email
+claims.user          # => Casdoor::User with the fields of the user
+```
+
+`parse_jwt_token` verifies the signature with the certificate, the expiration time, and that the token is issued to
+this application (its client ID); otherwise it raises `Casdoor::InvalidTokenError`.
+
+Other helpers:
+
+```ruby
+client.get_signup_url                                  # the sign-up page of the application
+client.get_user_profile_url('alice', access_token)     # the profile page of a user
+client.get_my_profile_url(access_token)                # the profile page of the signed-in user
+client.refresh_oauth_token(token['refresh_token'])
+client.get_oauth_token_by_password('alice', 'password') # needs the "password" grant type in the application
+client.get_oauth_token_by_client_credentials           # needs the "client_credentials" grant type
+client.introspect_token(token['access_token'])         # => {"active" => true, ...}
+client.logout(token['access_token'])                   # signs the user out of Casdoor
+```
+
+## Calling the API as a user
+
+By default the client calls the API as the application, with the client ID and secret, which has the permissions of
+an admin of the application's organization. To call the API as the signed-in user instead:
+
+```ruby
+user_client = client.with_access_token(token['access_token'])
+user = user_client.get_account
+user.display_name = 'Alice'
+user_client.update_user(user)
+```
+
+## Managing users
+
+```ruby
+user = client.get_user('alice')                 # in the client's organization, or client.get_user('org/alice')
+user.display_name = 'Alice Smith'
+user.email = 'alice@example.com'
+user.properties = (user.properties || {}).merge('department' => 'R&D')
+client.update_user(user)                         # => true when something changed
+
+client.update_user(user, columns: %i[display_name email])   # only update these fields
+
+client.add_user(Casdoor::User.new(name: 'bob', display_name: 'Bob', password: '123456'))
+client.delete_user('bob')
+
+client.get_users                                 # => [Casdoor::User]
+users, total = client.get_pagination_users(1, 20, sort_field: 'created_time', sort_order: 'descend')
+client.get_user_by_email('alice@example.com')
+client.get_user_by_phone('13800000000')
+client.get_user_by_user_id('uuid')               # by the "id" field of the user
+client.get_user_count
+client.set_password('casbin', 'alice', 'new-password')
+client.check_user_password(name: 'alice', password: 'password')  # => true or false
+```
+
+The objects (`Casdoor::User`, `Casdoor::Application`, ...) keep all the fields returned by Casdoor, so an object that is
+read, changed and updated never loses the fields this SDK doesn't know about. The fields can be read and written in
+snake_case (`user.display_name`, `user.is_admin?`), or with their names in Casdoor (`user['displayName']`). The fields
+whose names are taken by Ruby (e.g. `hash` of a user) can only be accessed with `[]`.
+
+## Managing the other objects
+
+The same methods exist for all the objects of Casdoor: adapters, applications, certs, enforcers, groups,
+invitations, models, orders, organizations, payments, permissions, plans, pricings, products, providers, resources,
+roles, subscriptions, syncers, tokens, transactions, users and webhooks.
+
+```ruby
+client.get_roles                                  # => [Casdoor::Role]
+client.get_pagination_roles(1, 20)                # => [[Casdoor::Role], total]
+client.get_role('admin')                          # => Casdoor::Role or nil
+client.add_role(Casdoor::Role.new(name: 'admin', users: ['casbin/alice']))
+client.update_role(role, columns: %i[users])
+client.delete_role('admin')                       # by name, or by the object
+```
+
+Organizations, applications and tokens belong to `admin`, the other objects belong to the client's organization.
+A different owner can be given by `"owner/name"`, by the `owner` field of the object, or by `owner:` in the list
+methods. Extra query parameters of the list methods can be given in snake_case, e.g.
+`client.get_applications(organization: 'casbin')`.
+
+## Checking permissions
+
+```ruby
+client.enforce(%w[alice data1 read], permission_id: 'casbin/permission-1')   # => true or false
+client.batch_enforce([%w[alice data1 read], %w[bob data2 write]], model_id: 'casbin/model-1')
+# => [[true, false]], the results for each permission
+```
+
+One of `permission_id:`, `model_id:`, `resource_id:`, `enforcer_id:` or `owner:` chooses the policies to check.
+
+## Errors
+
+- `Casdoor::ApiError`: Casdoor rejected the request, e.g. "Unauthorized operation", or an OAuth error
+- `Casdoor::HttpError`: an unexpected HTTP status, with `status` and `body`
+- `Casdoor::InvalidTokenError`: `parse_jwt_token` can't verify the token
+- All of them inherit from `Casdoor::Error`.
+
+## Other APIs
+
+The SDK covers the common APIs. Any other API of Casdoor (see [the Swagger docs](https://door.casdoor.com/swagger))
+can be called with the authentication of the client:
+
+```ruby
+client.get_data('get-organization-applications', owner: 'admin', organization: 'casbin')  # GET, returns "data"
+client.get_response('get-sessions', owner: 'casbin')    # GET, returns the whole response, e.g. "data2"
+client.post_json('add-ldap', {}, ldap)                  # POST with a JSON body
+client.post_form('set-password', {}, form)              # POST with a form body
+```
+
+## Development
+
+```shell
+bundle install
+bundle exec rubocop
+bundle exec rspec
+```
+
+The integration tests run against a real Casdoor, they are skipped unless `CASDOOR_TEST_ENDPOINT` is set. Start a
+Casdoor with the test data, then run them:
+
+```shell
+docker run -d -p 8000:8000 -e driverName=sqlite -e dataSourceName='file:casdoor.db?cache=shared' \
+  -e initDataFile=/init_data.json -v "$PWD/.ci/casdoor/init_data.json:/init_data.json:ro" casbin/casdoor-all-in-one
+CASDOOR_TEST_ENDPOINT=http://localhost:8000 bundle exec rspec
+```
+
+## License
+
+[Apache-2.0](LICENSE)

data/lib/casdoor/api/auth.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'jwt'
+require 'openssl'
+
+module Casdoor
+  module Api
+    # Signing users in with OAuth 2.0 / OIDC, and verifying the JWT tokens issued by Casdoor.
+    #
+    # The OAuth tokens are returned as the hashes of the Casdoor token API, e.g.
+    #   {"access_token" => "...", "id_token" => "...", "refresh_token" => "...", "token_type" => "Bearer",
+    #    "expires_in" => 604800, "scope" => "read"}
+    module Auth
+      JWT_ALGORITHMS = %w[RS256 RS384 RS512 ES256 ES384 ES512 PS256 PS384 PS512].freeze
+
+      # The URL of the sign-in page that the browser is redirected to. After signing in, Casdoor redirects back to
+      # redirect_uri with "code" and "state" in the query, and the code is exchanged with get_oauth_token.
+      def get_signin_url(redirect_uri, state: application_name, scope: 'read')
+        query = { 'client_id' => client_id, 'response_type' => 'code', 'redirect_uri' => redirect_uri,
+                  'scope' => scope, 'state' => state }
+        "#{endpoint}/login/oauth/authorize?#{URI.encode_www_form(query)}"
+      end
+
+      # The URL of the sign-up page. Without redirect_uri, it's the plain sign-up page of the application, otherwise
+      # the user is signed in and redirected back to redirect_uri like get_signin_url.
+      def get_signup_url(redirect_uri = nil, state: application_name, scope: 'read')
+        return "#{endpoint}/signup/#{application_name}" if redirect_uri.nil?
+
+        url = get_signin_url(redirect_uri, state: state, scope: scope)
+        url.sub('/login/oauth/authorize', '/signup/oauth/authorize')
+      end
+
+      def get_user_profile_url(user_name, access_token = nil)
+        url = "#{endpoint}/users/#{organization_name}/#{user_name}"
+        access_token ? "#{url}?#{URI.encode_www_form('access_token' => access_token)}" : url
+      end
+
+      def get_my_profile_url(access_token = nil)
+        url = "#{endpoint}/account"
+        access_token ? "#{url}?#{URI.encode_www_form('access_token' => access_token)}" : url
+      end
+
+      # Exchanges the code that Casdoor passed to the redirect URI for the OAuth tokens
+      def get_oauth_token(code)
+        request_oauth_token('authorization_code', 'code' => code)
+      end
+
+      def refresh_oauth_token(refresh_token, scope: nil)
+        request_oauth_token('refresh_token', 'refresh_token' => refresh_token, 'scope' => scope)
+      end
+
+      # The "password" grant type, it must be enabled in the "Grant types" of the application in Casdoor.
+      # username is the user's name in the application's organization, like "alice".
+      def get_oauth_token_by_password(username, password)
+        request_oauth_token('password', 'username' => username, 'password' => password)
+      end
+
+      # A token of the application itself, the "client_credentials" grant type must be enabled in the application
+      def get_oauth_token_by_client_credentials
+        request_oauth_token('client_credentials')
+      end
+
+      # Verifies a JWT token (the access token or the ID token) with the certificate of the client, and returns its
+      # claims. The token must not be expired, and must be issued to this application: pass audience: to check a
+      # different audience (e.g. the resource of RFC 8707), or audience: false to skip the check.
+      #
+      #   claims = client.parse_jwt_token(token["access_token"])
+      #   claims.name          # => "alice"
+      #   claims.owner         # => "casbin"
+      #   claims.user          # => Casdoor::User
+      def parse_jwt_token(token, audience: nil)
+        # The expiration and the "not before" time are verified by default
+        payload, = JWT.decode(token, jwt_public_key, true, algorithms: JWT_ALGORITHMS)
+        check_audience(payload['aud'], audience) unless audience == false
+        Claims.new(payload)
+      rescue JWT::DecodeError => e
+        raise InvalidTokenError, e.message
+      end
+
+      # Asks Casdoor whether the token is active, see RFC 7662. Returns a hash like {"active" => true, ...}.
+      def introspect_token(token, token_type_hint: 'access_token')
+        request = Net::HTTP::Post.new(get_url('login/oauth/introspect'))
+        request.set_form_data('token' => token, 'token_type_hint' => token_type_hint)
+        check_oauth_response(send_request(request))
+      end
+
+      # Signs the user out of Casdoor, from all their sessions or only the session of the access token
+      def logout(access_token, all_sessions: true)
+        with_access_token(access_token).post_form('sso-logout', { 'logoutAll' => all_sessions }, {})
+        true
+      end
+
+      private
+
+      def request_oauth_token(grant_type, params = {})
+        form = { 'grant_type' => grant_type, 'client_id' => client_id, 'client_secret' => client_secret }
+        form.merge!(params.compact)
+
+        request = Net::HTTP::Post.new(get_url('login/oauth/access_token'))
+        request.set_form_data(form)
+        token = check_oauth_response(send_request(request, auth: false))
+
+        # Older Casdoor versions put the error into the access token
+        if token['access_token'].to_s.start_with?('error:')
+          raise ApiError, token['access_token'].delete_prefix('error:').strip
+        end
+
+        token
+      end
+
+      def check_oauth_response(body)
+        if body['error']
+          message = [body['error'], body['error_description']].compact.reject(&:empty?).join(': ')
+          raise ApiError, message
+        end
+
+        check_response(body)
+      end
+
+      def jwt_public_key
+        pem = certificate.to_s
+        raise Error, 'The certificate of the client is required to parse JWT tokens' if pem.strip.empty?
+
+        pem.include?('CERTIFICATE') ? OpenSSL::X509::Certificate.new(pem).public_key : OpenSSL::PKey.read(pem)
+      end
+
+      # Casdoor issues the tokens to the client ID, or to "<client ID>-org-<organization>" for shared applications
+      def check_audience(aud, audience)
+        auds = Array(aud)
+        valid = if audience
+                  auds.include?(audience)
+                else
+                  auds.any? { |item| item == client_id || item.to_s.start_with?("#{client_id}-org-") }
+                end
+        raise InvalidTokenError, "The token is issued to #{auds.inspect}, not this application" unless valid
+      end
+    end
+  end
+end

data/lib/casdoor/api/crud.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  module Api
+    # The add/get/update/delete APIs that all the Casdoor objects share. For each object, e.g. the user, it defines:
+    #
+    #   get_users(**query)                         # => [User]
+    #   get_pagination_users(page, page_size, **query) # => [[User], total count]
+    #   get_user(name)                             # => User or nil, name can be "name" or "owner/name"
+    #   add_user(user)                             # => true if added
+    #   update_user(user, columns: nil)            # => true if changed, columns limits the updated fields
+    #   delete_user(user_or_name)                  # => true if deleted
+    #
+    # The objects belong to the client's organization, except the ones in ADMIN_OWNED, which belong to "admin".
+    # A different owner can be passed with "owner/name", the owner field of the object, or owner: in the query.
+    # Extra query parameters of the list APIs can be passed in snake_case, e.g. get_users(sort_field: "name").
+    module Crud
+      OBJECTS = {
+        adapter: Adapter,
+        application: Application,
+        cert: Cert,
+        enforcer: Enforcer,
+        group: Group,
+        invitation: Invitation,
+        model: Model,
+        order: Order,
+        organization: Organization,
+        payment: Payment,
+        permission: Permission,
+        plan: Plan,
+        pricing: Pricing,
+        product: Product,
+        provider: Provider,
+        resource: Resource,
+        role: Role,
+        subscription: Subscription,
+        syncer: Syncer,
+        token: Token,
+        transaction: Transaction,
+        user: User,
+        webhook: Webhook
+      }.freeze
+
+      ADMIN_OWNED = %i[application organization token].freeze
+
+      OBJECTS.each do |object, klass|
+        plural = "#{object}s"
+
+        define_method("get_#{plural}") do |**query|
+          data = get_data("get-#{plural}", list_query(object, query)) || []
+          data.map { |item| klass.new(item) }
+        end
+
+        define_method("get_pagination_#{plural}") do |page, page_size, **query|
+          query = list_query(object, query).merge('p' => page, 'pageSize' => page_size)
+          response = get_response("get-#{plural}", query)
+          [(response['data'] || []).map { |item| klass.new(item) }, response['data2'].to_i]
+        end
+
+        define_method("get_#{object}") do |name|
+          data = get_data("get-#{object}", 'id' => object_id_of(object, name))
+          data && klass.new(data)
+        end
+
+        define_method("add_#{object}") do |entity|
+          modify_object("add-#{object}", object, entity)
+        end
+
+        define_method("update_#{object}") do |entity, columns: nil|
+          modify_object("update-#{object}", object, entity, columns: columns)
+        end
+
+        # Casdoor deletes an object by the whole object, e.g. an application is only deleted when its organization
+        # matches too, so the object is fetched first when only its name is given
+        define_method("delete_#{object}") do |entity|
+          entity = send("get_#{object}", entity) unless entity.is_a?(Entity)
+          return false if entity.nil?
+
+          modify_object("delete-#{object}", object, entity)
+        end
+      end
+
+      private
+
+      def default_owner(object)
+        ADMIN_OWNED.include?(object) ? 'admin' : organization_name
+      end
+
+      def object_id_of(object, name)
+        name.to_s.include?('/') ? name.to_s : "#{default_owner(object)}/#{name}"
+      end
+
+      def list_query(object, query)
+        query = query.each_with_object({}) { |(key, value), hash| hash[Entity.camelize(key)] = value }
+        { 'owner' => default_owner(object) }.merge(query)
+      end
+
+      def modify_object(action, object, entity, columns: nil, query: {})
+        entity = OBJECTS.fetch(object).new(entity) if entity.is_a?(Hash)
+        entity.owner = default_owner(object) if entity.owner.to_s.empty?
+
+        query = { 'id' => "#{entity.owner}/#{entity.name}" }.merge(query)
+        query['columns'] = Array(columns).map { |column| Entity.camelize(column) }.join(',') if columns
+        post_json(action, query, entity)['data'] == 'Affected'
+      end
+    end
+  end
+end

data/lib/casdoor/api/enforce.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  module Api
+    # The permission checks of Casdoor. Pass one of permission_id, model_id, resource_id, enforcer_id or owner
+    # ("owner/name" for the IDs) to choose which policies to check against.
+    module Enforce
+      # request is a Casbin request like ["alice", "data1", "read"]. Returns true if any of the checked
+      # permissions allows it.
+      def enforce(request, permission_id: nil, model_id: nil, resource_id: nil, enforcer_id: nil, owner: nil)
+        query = enforce_query(permission_id, model_id, resource_id, enforcer_id, owner)
+        Array(post_json('enforce', query, request)['data']).any?(true)
+      end
+
+      # requests is a list of Casbin requests. Returns a list of results for each checked permission, like
+      # [[true, false]] for two requests checked against one permission.
+      def batch_enforce(requests, permission_id: nil, model_id: nil, resource_id: nil, enforcer_id: nil, owner: nil)
+        query = enforce_query(permission_id, model_id, resource_id, enforcer_id, owner)
+        post_json('batch-enforce', query, requests)['data'] || []
+      end
+
+      private
+
+      def enforce_query(permission_id, model_id, resource_id, enforcer_id, owner)
+        { 'permissionId' => permission_id, 'modelId' => model_id, 'resourceId' => resource_id,
+          'enforcerId' => enforcer_id, 'owner' => owner }
+      end
+    end
+  end
+end

data/lib/casdoor/api/users.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  module Api
+    # The user APIs besides the ones in Crud
+    module Users
+      # The user that the client is authenticated as, meant to be used with with_access_token:
+      #
+      #   user = client.with_access_token(access_token).get_account
+      def get_account
+        data = get_data('get-account')
+        data && User.new(data)
+      end
+
+      # The users of all the organizations, only allowed for global admins
+      def get_global_users
+        (get_data('get-global-users') || []).map { |item| User.new(item) }
+      end
+
+      def get_sorted_users(sorter, limit)
+        query = { 'owner' => organization_name, 'sorter' => sorter, 'limit' => limit }
+        (get_data('get-sorted-users', query) || []).map { |item| User.new(item) }
+      end
+
+      # is_online: nil counts all the users, true or false counts the online or offline ones
+      def get_user_count(is_online: nil)
+        online = { nil => '', true => '1', false => '0' }.fetch(is_online)
+        query = { 'owner' => organization_name, 'isOnline' => online }
+        get_data('get-user-count', query).to_i
+      end
+
+      def get_user_by_email(email)
+        find_user('email' => email)
+      end
+
+      def get_user_by_phone(phone)
+        find_user('phone' => phone)
+      end
+
+      # user_id is the "id" field of the user (a UUID), not "owner/name"
+      def get_user_by_user_id(user_id)
+        find_user('userId' => user_id)
+      end
+
+      # Sets the user's password. old_password can be empty when an admin sets the password of another user.
+      def set_password(owner, name, new_password, old_password: '')
+        form = { 'userOwner' => owner, 'userName' => name, 'oldPassword' => old_password,
+                 'newPassword' => new_password }
+        post_form('set-password', {}, form)['status'] == 'ok'
+      end
+
+      # Checks the password of a user, e.g. User.new(owner: "casbin", name: "alice", password: "123")
+      def check_user_password(user)
+        user = User.new(user) if user.is_a?(Hash)
+        user.owner = organization_name if user.owner.to_s.empty?
+        post_json('check-user-password', { 'id' => "#{user.owner}/#{user.name}" }, user)['status'] == 'ok'
+      rescue ApiError
+        false
+      end
+
+      private
+
+      def find_user(query)
+        data = get_data('get-user', { 'owner' => organization_name }.merge(query))
+        data && User.new(data)
+      end
+    end
+  end
+end

data/lib/casdoor/client.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'json'
+require 'net/http'
+require 'uri'
+
+module Casdoor
+  # The client of the Casdoor API. By default it calls the API as the application, authenticated by the client ID
+  # and the client secret. Use with_access_token to call the API as a user instead.
+  #
+  #   client = Casdoor::Client.new(
+  #     endpoint: "https://door.casdoor.com",
+  #     client_id: "...",
+  #     client_secret: "...",
+  #     certificate: File.read("token_jwt_key.pem"),
+  #     organization_name: "casbin",
+  #     application_name: "app-example"
+  #   )
+  class Client
+    include Api::Auth
+    include Api::Crud
+    include Api::Users
+    include Api::Enforce
+
+    attr_reader :endpoint, :client_id, :client_secret, :certificate, :organization_name, :application_name,
+                :access_token, :headers, :open_timeout, :read_timeout
+
+    # certificate is the public certificate (or public key) of the application's cert in Casdoor, in PEM format.
+    # It's only needed by parse_jwt_token.
+    # headers are added to all the requests, e.g. to pass a gateway.
+    def initialize(endpoint:, client_id:, client_secret:, organization_name:, application_name:, certificate: nil,
+                   headers: {}, access_token: nil, open_timeout: 10, read_timeout: 30)
+      @endpoint = endpoint.to_s.chomp('/')
+      @client_id = client_id
+      @client_secret = client_secret
+      @certificate = certificate
+      @organization_name = organization_name
+      @application_name = application_name
+      @headers = headers.dup.freeze
+      @access_token = access_token
+      @open_timeout = open_timeout
+      @read_timeout = read_timeout
+    end
+
+    # Returns a copy of the client that calls the API as the user who owns the access token, instead of as the
+    # application. The API is still subject to the permission check of Casdoor, so a normal user can only access
+    # their own data:
+    #
+    #   token = client.get_oauth_token(code)
+    #   user = client.with_access_token(token["access_token"]).get_account
+    def with_access_token(access_token)
+      Client.new(endpoint: endpoint, client_id: client_id, client_secret: client_secret,
+                 organization_name: organization_name, application_name: application_name, certificate: certificate,
+                 headers: headers, access_token: access_token, open_timeout: open_timeout, read_timeout: read_timeout)
+    end
+
+    def get_url(action, query = {})
+      query = query.compact
+      url = "#{endpoint}/api/#{action}"
+      url += "?#{URI.encode_www_form(query)}" unless query.empty?
+      URI(url)
+    end
+
+    # Calls a GET API, and returns the whole response like {"status" => "ok", "data" => ..., "data2" => ...}
+    def get_response(action, query = {})
+      request = Net::HTTP::Get.new(get_url(action, query))
+      check_response(send_request(request))
+    end
+
+    # Calls a GET API, and returns the "data" of the response
+    def get_data(action, query = {})
+      get_response(action, query)['data']
+    end
+
+    # Calls a POST API with a JSON body, and returns the whole response
+    def post_json(action, query, body)
+      request = Net::HTTP::Post.new(get_url(action, query), 'Content-Type' => 'application/json')
+      request.body = body.to_json
+      check_response(send_request(request))
+    end
+
+    # Calls a POST API with a form body, and returns the whole response
+    def post_form(action, query, form)
+      request = Net::HTTP::Post.new(get_url(action, query))
+      request.set_form_data(form)
+      check_response(send_request(request))
+    end
+
+    private
+
+    # Sends the request and returns the parsed JSON body. Errors of the HTTP layer are raised, while the
+    # {"status": "error"} responses are left to the caller.
+    def send_request(request, auth: true)
+      if auth
+        if access_token
+          request['Authorization'] = "Bearer #{access_token}"
+        else
+          request.basic_auth(client_id.to_s, client_secret.to_s)
+        end
+      end
+      request['Accept'] = 'application/json'
+      headers.each { |key, value| request[key] = value }
+
+      uri = request.uri
+      response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == 'https',
+                                                     open_timeout: open_timeout, read_timeout: read_timeout) do |http|
+        http.request(request)
+      end
+
+      begin
+        body = JSON.parse(response.body.to_s)
+      rescue JSON::ParserError
+        raise HttpError.new(response.code.to_i, response.body)
+      end
+
+      return body if response.is_a?(Net::HTTPSuccess)
+      # Casdoor answers some errors with a non-2xx status and a JSON body that explains the error
+      return body if body.is_a?(Hash) && (body['status'] == 'error' || body['error'])
+
+      raise HttpError.new(response.code.to_i, response.body)
+    end
+
+    def check_response(body)
+      raise ApiError, body['msg'].to_s if body.is_a?(Hash) && body['status'] == 'error'
+
+      body
+    end
+  end
+end

data/lib/casdoor/entity.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'json'
+
+module Casdoor
+  # An object of Casdoor, like a user or an application. It keeps all the JSON fields returned by Casdoor, so that
+  # updating an object never clears the fields that the SDK doesn't know about, and the fields added by newer
+  # Casdoor versions work without updating the SDK.
+  #
+  # The fields can be read and written in snake_case, which is converted to the camelCase name used by Casdoor:
+  #
+  #   user.display_name             # => user["displayName"]
+  #   user.email = "alice@example.com"
+  #   user.is_admin?                # => true or false
+  #   user[:display_name]           # Symbol keys are converted too
+  #   user["displayName"]           # String keys are used as is
+  #
+  # The fields whose names are taken by Ruby's own methods (e.g. "hash" of a user, "method" of a provider) can
+  # only be accessed with [], like user["hash"].
+  #
+  # Nested objects (e.g. application.providers) are plain hashes with the camelCase keys of Casdoor.
+  class Entity
+    def self.camelize(key)
+      key.to_s.gsub(/_([a-z\d])/) { Regexp.last_match(1).upcase }
+    end
+
+    def initialize(attributes = {})
+      @attributes = {}
+      (attributes || {}).each { |key, value| self[key] = value }
+    end
+
+    def [](key)
+      @attributes[field_name(key)]
+    end
+
+    def []=(key, value)
+      @attributes[field_name(key)] = value
+    end
+
+    def key?(key)
+      @attributes.key?(field_name(key))
+    end
+
+    def to_h
+      @attributes.dup
+    end
+
+    def to_json(*args)
+      @attributes.to_json(*args)
+    end
+
+    def ==(other)
+      other.class == self.class && other.to_h == to_h
+    end
+
+    def inspect
+      "#<#{self.class.name} #{@attributes.inspect}>"
+    end
+
+    def method_missing(method_name, *args)
+      field = method_name.to_s
+      if field.end_with?('=') && args.length == 1
+        self[Entity.camelize(field.chomp('='))] = args.first
+      elsif field.end_with?('?') && args.empty?
+        self[Entity.camelize(field.chomp('?'))] ? true : false
+      elsif args.empty? && field.match?(/\A[a-z][a-z\d_]*\z/)
+        self[Entity.camelize(field)]
+      else
+        super
+      end
+    end
+
+    def respond_to_missing?(method_name, include_private = false)
+      method_name.to_s.match?(/\A[a-z][a-z\d_]*[=?]?\z/) || super
+    end
+
+    private
+
+    # String keys are the exact names of Casdoor, while Symbol keys are snake_case
+    def field_name(key)
+      key.is_a?(Symbol) ? Entity.camelize(key) : key.to_s
+    end
+  end
+
+  class Adapter < Entity; end
+  class Application < Entity; end
+  class Cert < Entity; end
+  class Enforcer < Entity; end
+  class Group < Entity; end
+  class Invitation < Entity; end
+  class Model < Entity; end
+  class Order < Entity; end
+  class Organization < Entity; end
+  class Payment < Entity; end
+  class Permission < Entity; end
+  class Plan < Entity; end
+  class Pricing < Entity; end
+  class Product < Entity; end
+  class Provider < Entity; end
+  class Resource < Entity; end
+  class Role < Entity; end
+  class Session < Entity; end
+  class Subscription < Entity; end
+  class Syncer < Entity; end
+  class Token < Entity; end
+  class Transaction < Entity; end
+  class User < Entity; end
+  class Webhook < Entity; end
+
+  # The claims of a JWT token issued by Casdoor: the fields of the user, plus the standard claims like "exp" and "aud"
+  class Claims < Entity
+    def user
+      User.new(to_h)
+    end
+
+    # Casdoor names the claim "tokenType", or "TokenType" for the "JWT-Custom" token format
+    def refresh_token?
+      (self['tokenType'] || self['TokenType']) == 'refresh-token'
+    end
+  end
+end

data/lib/casdoor/error.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  # Base class of all the errors raised by the SDK
+  class Error < StandardError; end
+
+  # Casdoor answered the request with an error, e.g. {"status": "error", "msg": "..."} or an OAuth error
+  class ApiError < Error; end
+
+  # Casdoor answered with an unexpected HTTP status or a body that isn't JSON
+  class HttpError < Error
+    attr_reader :status, :body
+
+    def initialize(status, body)
+      @status = status
+      @body = body
+      super("Casdoor returned HTTP #{status}: #{body.to_s[0, 500]}")
+    end
+  end
+
+  # The JWT token can't be verified with the certificate, or it has expired, or it's issued to another application
+  class InvalidTokenError < Error; end
+end

data/lib/casdoor/version.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  # Set by semantic-release in CI when a new version is released, see .releaserc.json
+  VERSION = '1.0.0'
+end

data/lib/casdoor-ruby-sdk.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# So that both `require "casdoor-ruby-sdk"` (the gem name) and `require "casdoor"` work
+require_relative 'casdoor'

data/lib/casdoor.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require_relative 'casdoor/version'
+require_relative 'casdoor/error'
+require_relative 'casdoor/entity'
+require_relative 'casdoor/api/auth'
+require_relative 'casdoor/api/crud'
+require_relative 'casdoor/api/users'
+require_relative 'casdoor/api/enforce'
+require_relative 'casdoor/client'

metadata

@@ -0,0 +1,77 @@
+--- !ruby/object:Gem::Specification
+name: casdoor-ruby-sdk
+version: !ruby/object:Gem::Version
+  version: 1.0.0
+platform: ruby
+authors:
+- Yang Luo
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.5'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '4'
+description: 'Ruby SDK for Casdoor: sign users in with OAuth 2.0 / OIDC, verify the
+  JWT tokens, and manage users, organizations, applications, roles, permissions and
+  the other objects of Casdoor.'
+email:
+- hsluoyz@qq.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/casdoor-ruby-sdk.rb
+- lib/casdoor.rb
+- lib/casdoor/api/auth.rb
+- lib/casdoor/api/crud.rb
+- lib/casdoor/api/enforce.rb
+- lib/casdoor/api/users.rb
+- lib/casdoor/client.rb
+- lib/casdoor/entity.rb
+- lib/casdoor/error.rb
+- lib/casdoor/version.rb
+homepage: https://github.com/casdoor/casdoor-ruby-sdk
+licenses:
+- Apache-2.0
+metadata:
+  rubygems_mfa_required: 'true'
+  source_code_uri: https://github.com/casdoor/casdoor-ruby-sdk
+  changelog_uri: https://github.com/casdoor/casdoor-ruby-sdk/releases
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.7.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.6.9
+specification_version: 4
+summary: Ruby SDK for Casdoor
+test_files: []