clerk-sdk-ruby 5.1.2 → 6.0.0

data/lib/clerk/utils/security.rb

@@ -13,25 +13,36 @@ module Clerk
     
 
     
-    def self.configure_request_security(req, security)
+    def self.configure_request_security(req, security, allowed_fields = nil)
       return if security.nil?
-      security.fields.each do |sec_field|
+
+      sec_fields = if allowed_fields.nil?
+        security.fields
+      else
+        allowed_fields.filter_map { |name| security.fields.find { |f| f.name == name } }
+      end
+
+      sec_fields.each do |sec_field|
         value = security.send(sec_field.name)
         next if value.nil?
 
         metadata = sec_field.metadata[:security]
         next if metadata.nil?
 
-        _parse_security_option(req, value) if metadata[:option]
+        if metadata[:option]
+          _parse_security_option(req, value)
+          break unless metadata[:composite]
+        end
+
+        next unless metadata[:scheme]
 
-        if metadata[:scheme]
-          # Special case for basic auth which could be a flattened struct
-          if metadata[:sub_type] == 'basic' && !value.respond_to?(:fields)
-            _parse_security_scheme(req, metadata, security)
-          else
-            _parse_security_scheme(req, metadata, value)
-          end
+        # Special case for basic auth which could be a flattened struct
+        if metadata[:sub_type] == 'basic' && !value.respond_to?(:fields)
+          _parse_security_scheme(req, metadata, security)
+        else
+          _parse_security_scheme(req, metadata, value)
         end
+        break unless metadata[:composite]
       end
     end
 

data/lib/clerk/utils/url.rb

@@ -83,9 +83,8 @@ module Clerk
     end
 
     # Percent-encode characters that are invalid in URI path segments
-    
     def self._encode_path_param(value)
-      value.gsub(/[<>{}\[\]|\\^`\s?#%]/) { |c| format('%%%02X', c.ord) }
+      value.gsub(%r{[<>{}\[\]|\\^`\s?#%/.]}) { |c| format('%%%02X', c.ord) }
     end
 
     

data/lib/clerk/utils.rb

@@ -28,6 +28,14 @@ module Clerk
         [filtered_routes, filtered_wildcard_routes]
       end
 
+      # Percent-decoded request path, normalized to match the form the
+      # downstream framework (Sinatra/Rails) uses when matching routes.
+      def decoded_path(request)
+        ::Rack::Utils.unescape_path(request.path.to_s)
+      rescue ArgumentError
+        request.path.to_s
+      end
+
       def retrieve_header_from_request(request, key)
         (request.env[key] || request.env[key.downcase]).to_s
       end

data/lib/clerk/waitlistentries.rb

@@ -38,8 +38,10 @@ module Clerk
     end
 
 
+
+
     
-    def list(request:, retries: nil, timeout_ms: nil)
+    def list(request:, retries: nil, timeout_ms: nil, http_headers: nil)
       # list - List all waitlist entries
       # Retrieve a list of waitlist entries for the instance.
       # Entries are ordered by creation date in descending order by default.
@@ -93,6 +95,9 @@ module Clerk
           req.options.timeout = timeout unless timeout.nil?
           req.params = query_params
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -161,7 +166,7 @@ module Clerk
 
 
     
-    def create(request: nil, retries: nil, timeout_ms: nil)
+    def create(request: nil, retries: nil, timeout_ms: nil, http_headers: nil)
       # create - Create a waitlist entry
       # Creates a new waitlist entry for the given email address.
       # If the email address is already on the waitlist, no new entry will be created and the existing waitlist entry will be returned.
@@ -223,6 +228,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -306,7 +314,7 @@ module Clerk
 
 
     
-    def bulk_create(request: nil, retries: nil, timeout_ms: nil)
+    def bulk_create(request: nil, retries: nil, timeout_ms: nil, http_headers: nil)
       # bulk_create - Create multiple waitlist entries
       # Creates multiple waitlist entries for the provided email addresses.
       # You can choose whether to send confirmation emails by setting the `notify` parameter to `true` or `false` for each entry.
@@ -374,6 +382,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -457,7 +468,7 @@ module Clerk
 
 
     
-    def delete(waitlist_entry_id:, retries: nil, timeout_ms: nil)
+    def delete(waitlist_entry_id:, retries: nil, timeout_ms: nil, http_headers: nil)
       # delete - Delete a pending waitlist entry
       # Delete a pending waitlist entry.
       request = Models::Operations::DeleteWaitlistEntryRequest.new(
@@ -515,6 +526,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -598,7 +612,7 @@ module Clerk
 
 
     
-    def invite(waitlist_entry_id:, body: nil, retries: nil, timeout_ms: nil)
+    def invite(waitlist_entry_id:, body: nil, retries: nil, timeout_ms: nil, http_headers: nil)
       # invite - Invite a waitlist entry
       # Send an invite to the email address in a waitlist entry.
       request = Models::Operations::InviteWaitlistEntryRequest.new(
@@ -668,6 +682,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -751,7 +768,7 @@ module Clerk
 
 
     
-    def reject(waitlist_entry_id:, retries: nil, timeout_ms: nil)
+    def reject(waitlist_entry_id:, retries: nil, timeout_ms: nil, http_headers: nil)
       # reject - Reject a waitlist entry
       # Reject a waitlist entry.
       request = Models::Operations::RejectWaitlistEntryRequest.new(
@@ -809,6 +826,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -889,5 +909,5 @@ module Clerk
 
       end
     end
-  end
+end
 end

data/lib/clerk/webhooks.rb

@@ -38,8 +38,10 @@ module Clerk
     end
 
 
+
+
     
-    def create_svix_app(retries: nil, timeout_ms: nil)
+    def create_svix_app(retries: nil, timeout_ms: nil, http_headers: nil)
       # create_svix_app - Create a Svix app
       # Create a Svix app and associate it with the current instance
       url, params = @sdk_configuration.get_server_details
@@ -89,6 +91,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -172,7 +177,7 @@ module Clerk
 
 
     
-    def delete_svix_app(retries: nil, timeout_ms: nil)
+    def delete_svix_app(retries: nil, timeout_ms: nil, http_headers: nil)
       # delete_svix_app - Delete a Svix app
       # Delete a Svix app and disassociate it from the current instance
       url, params = @sdk_configuration.get_server_details
@@ -222,6 +227,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -296,7 +304,7 @@ module Clerk
 
 
     
-    def generate_svix_auth_url(retries: nil, timeout_ms: nil)
+    def generate_svix_auth_url(retries: nil, timeout_ms: nil, http_headers: nil)
       # generate_svix_auth_url - Create a Svix Dashboard URL
       # Generate a new URL for accessing the Svix's management dashboard for that particular instance
       url, params = @sdk_configuration.get_server_details
@@ -346,6 +354,9 @@ module Clerk
           req.headers.merge!(headers)
           req.options.timeout = timeout unless timeout.nil?
           Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
 
           @sdk_configuration.hooks.before_request(
             hook_ctx: SDKHooks::BeforeRequestHookContext.new(
@@ -426,5 +437,5 @@ module Clerk
 
       end
     end
-  end
+end
 end

data/lib/clerk_sdk_ruby.rb

@@ -36,11 +36,14 @@ module Clerk
   autoload :SignUps, 'clerk/signups'
   autoload :OauthApplications, 'clerk/oauthapplications'
   autoload :SamlConnections, 'clerk/samlconnections'
+  autoload :EnterpriseConnections, 'clerk/enterpriseconnections'
   autoload :TestingTokens, 'clerk/testingtokens'
+  autoload :AgentTasks, 'clerk/agenttasks'
   autoload :WaitlistEntries, 'clerk/waitlistentries'
   autoload :Billing, 'clerk/billing'
   autoload :OrganizationPermissions, 'clerk/organizationpermissions'
   autoload :RoleSets, 'clerk/rolesets'
+  autoload :AdminPortalLinkTokens, 'clerk/admin_portal_link_tokens'
   autoload :APIKeys, 'clerk/api_keys'
   autoload :M2m, 'clerk/m2m'
   autoload :OauthAccessTokens, 'clerk/oauthaccesstokens'

data/lib/crystalline/types.rb

@@ -14,7 +14,7 @@ module Crystalline
 
   class Hash
     attr_accessor :key_type, :value_type
-    
+
     def initialize(key_type, value_type)
       @key_type = key_type
       @value_type = value_type
@@ -23,7 +23,7 @@ module Crystalline
 
   class Union
     attr_accessor :types
-    
+
     def initialize(*types)
       @types = types
     end
@@ -31,7 +31,7 @@ module Crystalline
 
   class Nilable
     attr_accessor :inner_type
-    
+
     def initialize(inner_type)
       @inner_type = inner_type
     end
@@ -142,6 +142,14 @@ module Crystalline
       @val
     end
 
+    def to_s
+      serialize.to_s
+    end
+
+    def inspect
+      "#<#{self.class} #{serialize.inspect}>"
+    end
+
     def known?
       self.class.instance_variable_get(:@mapping)&.value?(self) || false
     end

data/test/clerk/encode_path_param_test.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'minitest/autorun'
+require_relative '../../lib/clerk/utils/url'
+
+class EncodePathParamTest < Minitest::Test
+  def test_encodes_forward_slash
+    assert_equal '%2F', Clerk::Utils._encode_path_param('/')
+  end
+
+  def test_encodes_dot
+    assert_equal '%2E', Clerk::Utils._encode_path_param('.')
+  end
+
+  def test_encodes_dots_and_slashes_in_composite_value
+    encoded = Clerk::Utils._encode_path_param('a.b/c.d')
+    refute_includes encoded, '/'
+    refute_includes encoded, '.'
+  end
+
+  def test_still_encodes_previously_handled_characters
+    {
+      '<' => '%3C', '>' => '%3E', '{' => '%7B', '}' => '%7D',
+      '[' => '%5B', ']' => '%5D', '|' => '%7C', '\\' => '%5C',
+      '^' => '%5E', '`' => '%60', ' ' => '%20', '?' => '%3F',
+      '#' => '%23', '%' => '%25'
+    }.each do |char, expected|
+      assert_equal expected, Clerk::Utils._encode_path_param(char), "char: #{char.inspect}"
+    end
+  end
+
+  def test_leaves_typical_resource_id_untouched
+    id = 'user_2abcXYZ_def-ghi~jkl'
+    assert_equal id, Clerk::Utils._encode_path_param(id)
+  end
+
+  def test_already_encoded_value_is_double_encoded_safely
+    assert_equal '%252F', Clerk::Utils._encode_path_param('%2F')
+  end
+end

data/test/clerk/rack_middleware_test.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'minitest/autorun'
+require 'rack'
+require 'rack/mock'
+require 'sinatra/base'
+require_relative '../../lib/clerk/rack_middleware'
+
+module Clerk
+  module Rack
+    class ReverificationTest < Minitest::Test
+      class FakeProxy
+        def user_needs_reverification?(_preset)
+          true
+        end
+
+        def user_reverification_rack_response(_preset)
+          [403, {'content-type' => 'application/json'}, ['{"reverification":"required"}']]
+        end
+      end
+
+      def sinatra_app
+        Sinatra.new do
+          disable :show_exceptions, :logging, :dump_errors
+          get('/admin') { 'admin ok' }
+          get('/admin/users') { 'admin users ok' }
+        end
+      end
+
+      def build_stack(routes:)
+        downstream = sinatra_app
+        reverification = Clerk::Rack::Reverification.new(downstream, routes: routes)
+        lambda do |env|
+          env['clerk.initialized'] = true
+          env['clerk'] = FakeProxy.new
+          reverification.call(env)
+        end
+      end
+
+      def request(app, path)
+        env = ::Rack::MockRequest.env_for(path)
+        app.call(env)
+      end
+
+      def test_protected_route_returns_reverification_error
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/admin')
+        assert_equal 403, status
+      end
+
+      def test_unknown_route_passes_through_to_app_404
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/does-not-exist')
+        assert_equal 404, status
+      end
+
+      def test_percent_encoded_path_matches_decoded_exact_route
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/%61dmin')
+        assert_equal 403, status
+      end
+
+      def test_percent_encoded_path_matches_decoded_wildcard_route
+        app = build_stack(routes: ['/admin/*'])
+        status, = request(app, '/%61dmin/users')
+        assert_equal 403, status
+      end
+
+      def test_case_sensitive_encoded_path_not_matched_and_app_404s
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/%41DMIN')
+        assert_equal 404, status
+      end
+
+      def test_raises_when_middleware_not_initialized_first
+        reverification = Clerk::Rack::Reverification.new(sinatra_app, routes: ['/admin'])
+        env = ::Rack::MockRequest.env_for('/admin')
+        assert_raises(Clerk::ConfigurationError) { reverification.call(env) }
+      end
+    end
+  end
+end