casdoor-ruby-sdk 1.0.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c0b990a9cbd0382d5af8e70e090df98adcacc9c2b4bfd79d15d16f9a40c0688a
-  data.tar.gz: 3d09b80f3e1d36b0f582436bb647fa9e1ba297ba4a934c45b4d372585fa5465a
+  metadata.gz: c7442875c53f487dff6e4968e27e7aec47b23a2143799305b7c324ca32594479
+  data.tar.gz: 3fb25488582dc9fa39ee6ad226eab7514bc23ced81f946b3562a7e5fa9b5fb4d
 SHA512:
-  metadata.gz: 6895b1b555053be338f78204090ecb63f9112830685905d899a868aeb010fd46e822c7438c1f29de75438803f7fd18911ce4a37aa37188b7018f21873181cfc7
-  data.tar.gz: 803e4c91c0dfb4c325af1bc22a0300b8eca03762fe465f6934b4d513ba84bbbc5dae15940acce0133e3ebff9e0960e1cabe0ef6acc057c19e64e8ccf2fb18e93
+  metadata.gz: de59e3233811816621ad27f50b3d8639e780f8ce1fbf50ca9e361e466f9458eb1ec455a990991ca7ed1af6f181331c1572583cb1df658fc6bee43020b01f2e15
+  data.tar.gz: bc47f66464a2f7d9206e97437c8babb9aa99ea2a13e70c2798de0fdf701f1434f3ebdcb76f7985d2707872d443148dc0704ba557d1613f0775a1ec571017132e

data/README.md

@@ -9,9 +9,13 @@
 [![Discord](https://img.shields.io/discord/1022748306096537660?logo=discord&label=discord&color=5865F2)](https://discord.gg/5rPsrAzK7S)
 
 The Ruby SDK of [Casdoor](https://casdoor.ai/). It lets a Ruby application (Rails, Sinatra, Hanami, ...) sign users in
-with Casdoor, verify the tokens issued by Casdoor, and manage the users, applications, roles, permissions and the
+with Casdoor, verify the tokens issued by Casdoor, and manage the users, applications, roles, permissions and all the
 other objects of Casdoor through its API.
 
+It has the same APIs as the [Go SDK](https://github.com/casdoor/casdoor-go-sdk), in snake_case: `GetUsers()` is
+`get_users`, `UpdateUserForColumns(user, columns)` is `update_user_for_columns(user, columns)`, and so on. The files
+under `lib/casdoor/` match the files of the Go SDK's `casdoorsdk` package.
+
 ## Installation
 
 Add it to the `Gemfile`:
@@ -26,23 +30,36 @@ It requires Ruby 2.7 or later, and depends only on the [jwt](https://github.com/
 
 ## Configuration
 
+| Name              | Must | Description                                                                         |
+|-------------------|------|-------------------------------------------------------------------------------------|
+| endpoint          | Yes  | The URL of Casdoor, such as `https://door.casdoor.com`                              |
+| client_id         | Yes  | The "Client ID" of the application                                                  |
+| client_secret     | Yes  | The "Client secret" of the application                                              |
+| certificate       | No   | The "Certificate" of the application's cert (PEM), only needed to verify JWT tokens |
+| organization_name | Yes  | The organization of the users                                                       |
+| application_name  | Yes  | The name of the application                                                         |
+
+Like the Go SDK, either create a client:
+
 ```ruby
 require 'casdoor'
 
-client = Casdoor::Client.new(
-  endpoint: 'https://door.casdoor.com',      # the URL of your Casdoor
-  client_id: 'xxx',                          # "Client ID" of the application in Casdoor
-  client_secret: 'xxx',                      # "Client secret" of the application in Casdoor
-  certificate: File.read('cert.pem'),        # "Certificate" of the application's cert, only needed to verify tokens
-  organization_name: 'casbin',               # the organization of the users
-  application_name: 'app-example'            # the application in Casdoor
-)
+client = Casdoor.new_client(endpoint, client_id, client_secret, certificate, organization_name, application_name)
+users = client.get_users
+```
+
+or initialize the global client, then call the APIs on the `Casdoor` module:
+
+```ruby
+Casdoor.init_config(endpoint, client_id, client_secret, certificate, organization_name, application_name)
+users = Casdoor.get_users
 ```
 
-The certificate is the public certificate shown on the edit page of the cert that the application uses
-("Certs" → the application's cert → "Certificate"). A public key in PEM format works too.
+`Casdoor::Client.new` takes the same settings as keyword arguments, plus `custom_headers:` (added to every request),
+`open_timeout:` and `read_timeout:`.
 
-`Casdoor::Client.new` also accepts `headers:` (added to every request), `open_timeout:` and `read_timeout:`.
+The certificate is shown on the edit page of the cert that the application uses ("Certs" → the application's cert →
+"Certificate"). A public key in PEM format works too.
 
 ## Signing users in
 
@@ -54,14 +71,13 @@ redirect_to client.get_signin_url('https://your-app.example.com/callback', state
 
 # 2. Casdoor redirects back to the callback with "code" and "state", exchange the code for the tokens
 raise 'Invalid state' unless params[:state] == session[:state]
-token = client.get_oauth_token(params[:code])
+token = client.get_oauth_token(params[:code], params[:state])
 # => {"access_token" => "...", "id_token" => "...", "refresh_token" => "...", "expires_in" => 604800, ...}
 
 # 3. Verify the access token and read the user in it
 claims = client.parse_jwt_token(token['access_token'])
 claims.name          # => "alice"
 claims.owner         # => "casbin", the organization
-claims.email
 claims.user          # => Casdoor::User with the fields of the user
 ```
 
@@ -71,20 +87,21 @@ this application (its client ID); otherwise it raises `Casdoor::InvalidTokenErro
 Other helpers:
 
 ```ruby
-client.get_signup_url                                  # the sign-up page of the application
-client.get_user_profile_url('alice', access_token)     # the profile page of a user
-client.get_my_profile_url(access_token)                # the profile page of the signed-in user
+client.get_signup_url(true, '')                          # the sign-up page of the application
+client.get_user_profile_url('alice', access_token)       # the profile page of a user
+client.get_my_profile_url(access_token)                  # the profile page of the signed-in user
 client.refresh_oauth_token(token['refresh_token'])
-client.get_oauth_token_by_password('alice', 'password') # needs the "password" grant type in the application
-client.get_oauth_token_by_client_credentials           # needs the "client_credentials" grant type
-client.introspect_token(token['access_token'])         # => {"active" => true, ...}
-client.logout(token['access_token'])                   # signs the user out of Casdoor
+client.get_oauth_token_by_password('alice', 'password')   # needs the "password" grant type in the application
+client.impersonate_user('alice', 'master-password')      # an admin acts as a user, with the organization's master password
+client.introspect_token(token['access_token'])           # => {"active" => true, ...}
+client.logout(token['access_token'])                     # signs the user out of all their sessions
+client.logout_current_session(token['access_token'])     # signs the user out of the current session only
 ```
 
 ## Calling the API as a user
 
-By default the client calls the API as the application, with the client ID and secret, which has the permissions of
-an admin of the application's organization. To call the API as the signed-in user instead:
+By default the client calls the API as the application, with the client ID and secret. To call it as the signed-in
+user instead, which is subject to the user's own permissions:
 
 ```ruby
 user_client = client.with_access_token(token['access_token'])
@@ -93,28 +110,29 @@ user.display_name = 'Alice'
 user_client.update_user(user)
 ```
 
-## Managing users
+## Users
 
 ```ruby
 user = client.get_user('alice')                 # in the client's organization, or client.get_user('org/alice')
 user.display_name = 'Alice Smith'
-user.email = 'alice@example.com'
 user.properties = (user.properties || {}).merge('department' => 'R&D')
 client.update_user(user)                         # => true when something changed
-
-client.update_user(user, columns: %i[display_name email])   # only update these fields
+client.update_user_for_columns(user, %w[displayName email])   # only update these fields
 
 client.add_user(Casdoor::User.new(name: 'bob', display_name: 'Bob', password: '123456'))
-client.delete_user('bob')
+client.delete_user(client.get_user('bob'))
 
 client.get_users                                 # => [Casdoor::User]
-users, total = client.get_pagination_users(1, 20, sort_field: 'created_time', sort_order: 'descend')
+users, total = client.get_pagination_users(1, 20, field: 'name', value: 'a', sort_field: 'created_time')
+client.get_sorted_users('created_time', 10)
+client.get_global_users                          # the users of all the organizations
 client.get_user_by_email('alice@example.com')
 client.get_user_by_phone('13800000000')
 client.get_user_by_user_id('uuid')               # by the "id" field of the user
-client.get_user_count
-client.set_password('casbin', 'alice', 'new-password')
-client.check_user_password(name: 'alice', password: 'password')  # => true or false
+client.update_user_by_id('casbin/alice', user)   # e.g. to rename the user
+client.get_user_count('')                        # "" for all, "1" for the online users, "0" for the offline ones
+client.set_password('casbin', 'alice', 'old-password', 'new-password')   # an admin can leave the old password empty
+client.check_user_password(Casdoor::User.new(name: 'alice', password: 'password'))   # => true or false
 ```
 
 The objects (`Casdoor::User`, `Casdoor::Application`, ...) keep all the fields returned by Casdoor, so an object that is
@@ -122,35 +140,96 @@ read, changed and updated never loses the fields this SDK doesn't know about. Th
 snake_case (`user.display_name`, `user.is_admin?`), or with their names in Casdoor (`user['displayName']`). The fields
 whose names are taken by Ruby (e.g. `hash` of a user) can only be accessed with `[]`.
 
-## Managing the other objects
+## The other objects
 
-The same methods exist for all the objects of Casdoor: adapters, applications, certs, enforcers, groups,
-invitations, models, orders, organizations, payments, permissions, plans, pricings, products, providers, resources,
-roles, subscriptions, syncers, tokens, transactions, users and webhooks.
+These methods exist for all the objects: adapters, applications, certs, enforcers, groups, invitations, models,
+orders, organizations, payments, permissions, plans, pricings, products, providers, records, roles, sessions,
+subscriptions, syncers, tokens, transactions, users and webhooks (the same as the Go SDK, e.g. records can't be
+updated or deleted):
 
 ```ruby
 client.get_roles                                  # => [Casdoor::Role]
 client.get_pagination_roles(1, 20)                # => [[Casdoor::Role], total]
 client.get_role('admin')                          # => Casdoor::Role or nil
 client.add_role(Casdoor::Role.new(name: 'admin', users: ['casbin/alice']))
-client.update_role(role, columns: %i[users])
-client.delete_role('admin')                       # by name, or by the object
+client.update_role(role)
+client.update_role_for_columns(role, %w[users])
+client.delete_role(role)
 ```
 
-Organizations, applications and tokens belong to `admin`, the other objects belong to the client's organization.
-A different owner can be given by `"owner/name"`, by the `owner` field of the object, or by `owner:` in the list
-methods. Extra query parameters of the list methods can be given in snake_case, e.g.
-`client.get_applications(organization: 'casbin')`.
+Organizations, applications, tokens and LDAP servers belong to `admin`, the other objects belong to the client's
+organization. A different owner can be given by `"owner/name"` or by the `owner` field of the object.
+
+More APIs of the objects:
+
+```ruby
+client.get_organization_applications                # the applications of the client's organization
+client.get_organization_names
+client.get_global_certs
+client.get_permissions_by_role('admin')
+client.get_invitation_info('CODE', 'app-example')
+client.get_session('alice', 'app-example')
+client.get_user_orders('alice')
+client.cancel_order('order-1')
+client.get_user_payments('alice')
+client.notify_payment(payment)
+client.invoice_payment(payment)
+client.get_user_transactions('alice')
+affected, transaction_id = client.add_transaction(transaction)
+client.add_transaction_with_dry_run(transaction, true)
+```
 
-## Checking permissions
+## Permissions and policies
 
 ```ruby
-client.enforce(%w[alice data1 read], permission_id: 'casbin/permission-1')   # => true or false
-client.batch_enforce([%w[alice data1 read], %w[bob data2 write]], model_id: 'casbin/model-1')
-# => [[true, false]], the results for each permission
+# One of the permission ID, model ID, resource ID, enforcer ID or owner chooses the policies to check
+client.enforce('casbin/permission-1', '', '', '', '', %w[alice data1 read])   # => true or false
+client.batch_enforce('', '', '', 'casbin/enforcer-1', '', [%w[alice data1 read], %w[bob data2 write]])
+# => [[true, false]], the results of each permission
+
+rule = Casdoor::CasbinRule.new(ptype: 'p', v0: 'alice', v1: 'data1', v2: 'read')
+client.add_policy(enforcer, rule)
+client.update_policy(enforcer, rule, new_rule)
+client.remove_policy(enforcer, rule)
+client.get_policies('enforcer-1', '')
+client.get_filtered_policies('casbin/enforcer-1', [Casdoor::PolicyFilter.new(ptype: 'p', field_index: 0, field_values: ['alice'])])
 ```
 
-One of `permission_id:`, `model_id:`, `resource_id:`, `enforcer_id:` or `owner:` chooses the policies to check.
+## Orders and payments
+
+```ruby
+order = client.place_order([Casdoor::ProductInfo.new(name: 'product-1', quantity: 1)], 'alice')
+payment = client.pay_order(order.name, 'provider_payment_dummy')
+order = client.buy_product('product-1', 'provider_payment_dummy', 'alice')
+```
+
+## Resources, emails, SMS and notifications
+
+```ruby
+file_url, name = client.upload_resource('alice', 'avatar', '', 'alice.png', File.binread('alice.png'))
+client.get_resources('casbin', 'alice', '', '', '', '')
+client.delete_resource(client.get_resource("casbin/#{name}"))
+
+client.send_email('Title', 'Content', 'sender', 'alice@example.com', 'bob@example.com')
+client.send_email_by_provider('Title', 'Content', 'sender', 'provider_email', 'alice@example.com')
+client.send_sms('Your code is 123456', '+15555550100')
+client.send_sms_by_provider('Your code is 123456', 'provider_sms', '+15555550100')
+client.send_notification('Content', 'recipient')
+```
+
+## MFA and LDAP
+
+```ruby
+response = client.initiate('casbin', 'app', 'alice')    # => {"status" => "ok", "data" => {"secret" => ..., "url" => ...}}
+client.verify('casbin', 'app', 'alice', secret, passcode)
+client.enable('casbin', 'app', 'alice', secret, recovery_code)
+client.set_preferred('casbin', 'app', 'alice', secret)
+client.delete('casbin', 'alice')                        # disables the MFA of the user
+
+client.get_ldaps
+client.get_ldap_users('ldap-id')                        # => {"users" => [Casdoor::LdapUser], ...}
+client.sync_ldap_users_from_server('ldap-id')           # imports the LDAP users into Casdoor
+```
 
 ## Errors
 
@@ -161,14 +240,14 @@ One of `permission_id:`, `model_id:`, `resource_id:`, `enforcer_id:` or `owner:`
 
 ## Other APIs
 
-The SDK covers the common APIs. Any other API of Casdoor (see [the Swagger docs](https://door.casdoor.com/swagger))
-can be called with the authentication of the client:
+Like `DoGetBytes` and `DoPost` of the Go SDK, any other API of Casdoor (see
+[the Swagger docs](https://door.casdoor.com/swagger)) can be called with the authentication of the client:
 
 ```ruby
-client.get_data('get-organization-applications', owner: 'admin', organization: 'casbin')  # GET, returns "data"
-client.get_response('get-sessions', owner: 'casbin')    # GET, returns the whole response, e.g. "data2"
-client.post_json('add-ldap', {}, ldap)                  # POST with a JSON body
-client.post_form('set-password', {}, form)              # POST with a form body
+client.do_get_bytes(client.get_url('get-organization-applications', 'owner' => 'admin', 'organization' => 'casbin'))
+client.do_get_response(client.get_url('get-sessions', 'owner' => 'casbin'))   # the whole response, e.g. "data2"
+client.do_post('add-ldap', nil, ldap)                   # POST with a JSON body
+client.do_post('set-password', nil, form, true)         # POST with a form body
 ```
 
 ## Development
@@ -179,8 +258,8 @@ bundle exec rubocop
 bundle exec rspec
 ```
 
-The integration tests run against a real Casdoor, they are skipped unless `CASDOOR_TEST_ENDPOINT` is set. Start a
-Casdoor with the test data, then run them:
+Like the Go SDK, the tests of the APIs (`spec/<object>_spec.rb`, one for each `<object>_test.go`) run against a local
+Casdoor started with `.ci/casdoor/init_data.json`; they are skipped unless `CASDOOR_TEST_ENDPOINT` is set:
 
 ```shell
 docker run -d -p 8000:8000 -e driverName=sqlite -e dataSourceName='file:casdoor.db?cache=shared' \

data/lib/casdoor/adapter.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  class Adapter < Entity; end
+
+  # The adapter APIs, the counterpart of adapter.go of the Go SDK
+  class Client
+    def get_adapters
+      get_objects('get-adapters', Adapter, 'owner' => organization_name)
+    end
+
+    # Returns the objects of the page and the total count. query_map can filter and sort them, e.g.
+    # { field: "name", value: "alice", sort_field: "created_time", sort_order: "descend" }
+    def get_pagination_adapters(page, page_size, query_map = {})
+      get_pagination_objects('get-adapters', Adapter, organization_name, page, page_size, query_map)
+    end
+
+    def get_adapter(name)
+      get_object('get-adapter', Adapter, 'id' => get_id(name))
+    end
+
+    def update_adapter(adapter)
+      modify_object('update-adapter', Adapter, adapter, organization_name)
+    end
+
+    def add_adapter(adapter)
+      modify_object('add-adapter', Adapter, adapter, organization_name)
+    end
+
+    def delete_adapter(adapter)
+      modify_object('delete-adapter', Adapter, adapter, organization_name)
+    end
+  end
+end

data/lib/casdoor/application.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  class Application < Entity; end
+
+  # The application APIs, the counterpart of application.go of the Go SDK
+  class Client
+    def get_applications
+      get_objects('get-applications', Application, 'owner' => 'admin')
+    end
+
+    # The applications of the client's organization
+    def get_organization_applications
+      get_objects('get-organization-applications', Application,
+                  'owner' => 'admin', 'organization' => organization_name)
+    end
+
+    def get_application(name)
+      get_object('get-application', Application, 'id' => get_admin_id(name))
+    end
+
+    def add_application(application)
+      modify_object('add-application', Application, application, 'admin')
+    end
+
+    def delete_application(application)
+      modify_object('delete-application', Application, application, 'admin')
+    end
+
+    def update_application(application)
+      modify_object('update-application', Application, application, 'admin')
+    end
+  end
+end

data/lib/casdoor/auth.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  # The core configuration. The first step to use this SDK is to create a Client with it, or to initialize the global
+  # client with Casdoor.init_config.
+  AuthConfig = Struct.new(:endpoint, :client_id, :client_secret, :certificate, :organization_name,
+                          :application_name, keyword_init: true)
+
+  # The client of the Casdoor API. By default it calls the API as the application, authenticated by the client ID
+  # and the client secret. Use with_access_token to call the API as a user instead.
+  #
+  #   client = Casdoor::Client.new(
+  #     endpoint: "https://door.casdoor.com",
+  #     client_id: "...",
+  #     client_secret: "...",
+  #     certificate: File.read("token_jwt_key.pem"),
+  #     organization_name: "casbin",
+  #     application_name: "app-example"
+  #   )
+  class Client
+    attr_reader :endpoint, :client_id, :client_secret, :certificate, :organization_name, :application_name,
+                :access_token
+    # Headers added to all the requests, e.g. to pass a gateway
+    attr_accessor :custom_headers, :open_timeout, :read_timeout
+
+    # certificate is the public certificate (or public key) of the application's cert in Casdoor, in PEM format.
+    # It's only needed by parse_jwt_token.
+    def initialize(endpoint:, client_id:, client_secret:, organization_name:, application_name:, certificate: nil,
+                   custom_headers: {}, access_token: nil, open_timeout: 10, read_timeout: 30)
+      @endpoint = endpoint.to_s.chomp('/')
+      @client_id = client_id
+      @client_secret = client_secret
+      @certificate = certificate
+      @organization_name = organization_name
+      @application_name = application_name
+      @custom_headers = custom_headers.dup
+      @access_token = access_token
+      @open_timeout = open_timeout
+      @read_timeout = read_timeout
+    end
+
+    def auth_config
+      AuthConfig.new(endpoint: endpoint, client_id: client_id, client_secret: client_secret, certificate: certificate,
+                     organization_name: organization_name, application_name: application_name)
+    end
+
+    # Returns a copy of the client that calls the API as the user who owns the access token, instead of as the
+    # application. The access token is the user's OAuth access token returned by get_oauth_token,
+    # refresh_oauth_token, get_oauth_token_by_password or impersonate_user. The original client keeps using the
+    # client ID and secret, so it's safe to create one client per user request:
+    #
+    #   token = client.get_oauth_token(code, state)
+    #   user = client.with_access_token(token["access_token"]).get_account
+    #
+    # The APIs are still subject to the permission check of Casdoor, so a normal user can only access their own data.
+    def with_access_token(access_token)
+      Client.new(endpoint: endpoint, client_id: client_id, client_secret: client_secret,
+                 organization_name: organization_name, application_name: application_name, certificate: certificate,
+                 custom_headers: custom_headers, access_token: access_token, open_timeout: open_timeout,
+                 read_timeout: read_timeout)
+    end
+
+    # Exchanges the code that Casdoor passed to the redirect URI for the OAuth tokens. Returns the hash of the token
+    # API, like {"access_token" => "...", "id_token" => "...", "refresh_token" => "...", "token_type" => "Bearer",
+    # "expires_in" => 604800, "scope" => "read"}.
+    def get_oauth_token(code, _state = nil)
+      request_oauth_token('authorization_code', 'code' => code)
+    end
+
+    def refresh_oauth_token(refresh_token)
+      request_oauth_token('refresh_token', 'refresh_token' => refresh_token)
+    end
+
+    # Gets the OAuth token via the "password" grant type, i.e. the "Resource Owner Password Credentials Grant" of
+    # OAuth 2.0. The "password" grant type must be enabled in the application's "Grant types" in Casdoor.
+    # The username is the user's name inside the application's organization, like "alice" instead of "my-org/alice".
+    def get_oauth_token_by_password(username, password)
+      request_oauth_token('password', 'username' => username, 'password' => password)
+    end
+
+    # Gets an OAuth token which acts as the given user, so that an admin can call the APIs on behalf of the user,
+    # without knowing the user's own password. It's the SDK equivalent of the "Impersonation" button in Casdoor.
+    # The master_password is the "Master password" of the user's organization, it needs to be set in Casdoor first:
+    # "Organizations" -> Edit the organization -> "Master password". See: https://casdoor.ai/docs/user/impersonation
+    def impersonate_user(username, master_password)
+      get_oauth_token_by_password(username, master_password)
+    end
+
+    private
+
+    def request_oauth_token(grant_type, params)
+      form = { 'grant_type' => grant_type, 'client_id' => client_id, 'client_secret' => client_secret }.merge(params)
+      request = Net::HTTP::Post.new(URI(get_url('login/oauth/access_token')))
+      request.set_form_data(form)
+      token = check_oauth_response(send_request(request, auth: false))
+
+      # Older Casdoor versions put the error into the access token, like "error: invalid client_id"
+      if token['access_token'].to_s.start_with?('error:')
+        raise ApiError, token['access_token'].delete_prefix('error:').strip
+      end
+
+      token
+    end
+
+    def check_oauth_response(body)
+      if body['error']
+        message = [body['error'], body['error_description']].compact.reject(&:empty?).join(': ')
+        raise ApiError, message
+      end
+
+      check_response(body)
+    end
+  end
+
+  # The global client used by the module functions like Casdoor.get_users, see global.rb
+  def self.init_config(endpoint, client_id, client_secret, certificate, organization_name, application_name)
+    @global_client = new_client(endpoint, client_id, client_secret, certificate, organization_name, application_name)
+  end
+
+  def self.new_client(endpoint, client_id, client_secret, certificate, organization_name, application_name)
+    new_client_with_conf(AuthConfig.new(endpoint: endpoint, client_id: client_id, client_secret: client_secret,
+                                        certificate: certificate, organization_name: organization_name,
+                                        application_name: application_name))
+  end
+
+  def self.new_client_with_conf(config)
+    Client.new(**config.to_h)
+  end
+end

data/lib/casdoor/cert.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  class Cert < Entity; end
+
+  # The cert APIs, the counterpart of cert.go of the Go SDK
+  class Client
+    # The certs of all the organizations, only allowed for global admins
+    def get_global_certs
+      get_objects('get-global-certs', Cert, nil)
+    end
+
+    def get_certs
+      get_objects('get-certs', Cert, 'owner' => organization_name)
+    end
+
+    def get_cert(name)
+      get_object('get-cert', Cert, 'id' => get_id(name))
+    end
+
+    def add_cert(cert)
+      modify_object('add-cert', Cert, cert, organization_name)
+    end
+
+    def update_cert(cert)
+      modify_object('update-cert', Cert, cert, organization_name)
+    end
+
+    def delete_cert(cert)
+      modify_object('delete-cert', Cert, cert, organization_name)
+    end
+  end
+end

data/lib/casdoor/email.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+# Copyright 2026 The Casdoor Authors. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Casdoor
+  # Sending emails with the email provider of the application, the counterpart of email.go of the Go SDK
+  class Client
+    def send_email(title, content, sender, *receivers)
+      form = { 'title' => title, 'content' => content, 'sender' => sender, 'receivers' => receivers.flatten }
+      do_post('send-email', nil, form)
+      true
+    end
+
+    # Sends with the given email provider instead of the application's one
+    def send_email_by_provider(title, content, sender, provider, *receivers)
+      form = { 'title' => title, 'content' => content, 'sender' => sender, 'receivers' => receivers.flatten }
+      do_post('send-email', { 'provider' => provider }, form)
+      true
+    end
+  end
+end