clerk-sdk-ruby 5.1.3 → 6.0.0

data/lib/clerk/users.rb

@@ -184,7 +184,7 @@ module Clerk
       # create - Create a new user
       # Creates a new user. Your user management settings determine how you should setup your user model.
       #
-      # Any email address and phone number created using this method will be marked as verified.
+      # By default, any email address and phone number created using this method is marked as verified. Use the `email_address_identification_status` and `phone_number_identification_status` arrays to instead create some or all of them as reserved (unverified but usable for sign-in and locked so no other user can claim them).
       #
       # Note: If you are performing a migration, check out our guide on [zero downtime migrations](https://clerk.com/docs/deployments/migrate-overview).
       #
@@ -307,7 +307,7 @@ module Clerk
         else
           raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
         end
-      elsif Utils.match_status_code(http_response.status, ['400', '401', '403', '422'])
+      elsif Utils.match_status_code(http_response.status, ['400', '401', '402', '403', '422'])
         if Utils.match_content_type(content_type, 'application/json')
           http_response = @sdk_configuration.hooks.after_success(
             hook_ctx: SDKHooks::AfterSuccessHookContext.new(
@@ -2265,6 +2265,170 @@ module Clerk
 
 
     
+    def replace_metadata(user_id:, body: nil, retries: nil, timeout_ms: nil, http_headers: nil)
+      # replace_metadata - Replace a user's metadata
+      # Replace a user's metadata attributes with the provided values.
+      #
+      # Unlike `PATCH /v1/users/{user_id}/metadata` (merge semantics), this endpoint
+      # replaces the supplied metadata columns entirely — the prior contents of each
+      # supplied column are discarded. Columns omitted from the request body are
+      # left unchanged.
+      #
+      # Prefer the `PATCH` endpoint for partial updates. Use `PUT` only when you
+      # explicitly intend to overwrite a metadata column wholesale.
+      request = Models::Operations::ReplaceUserMetadataRequest.new(
+        user_id: user_id,
+        body: body
+      )
+      url, params = @sdk_configuration.get_server_details
+      base_url = Utils.template_url(url, params)
+      url = Utils.generate_url(
+        Models::Operations::ReplaceUserMetadataRequest,
+        base_url,
+        '/users/{user_id}/metadata',
+        request
+      )
+      headers = {}
+      
+      req_content_type, data, form = Utils.serialize_request_body(request, false, false, :body, :json)
+      headers['content-type'] = req_content_type
+
+      if form && !form.empty?
+        body = Utils.encode_form(form)
+      elsif Utils.match_content_type(req_content_type, 'application/x-www-form-urlencoded')
+        body = URI.encode_www_form(data)
+      else
+        body = data
+      end
+      headers['Accept'] = 'application/json'
+      headers['user-agent'] = @sdk_configuration.user_agent
+      retries ||= @sdk_configuration.retry_config
+      retries ||= Utils::RetryConfig.new(
+        backoff: Utils::BackoffStrategy.new(
+          exponent: 1.5,
+          initial_interval: 500,
+          max_elapsed_time: 3_600_000,
+          max_interval: 60_000
+        ),
+        retry_connection_errors: true,
+        strategy: 'backoff'
+      )
+      retry_options = retries.to_faraday_retry_options(initial_time: Time.now)
+      retry_options[:retry_statuses] = [500, 501, 502, 503, 504, 505]
+
+      security = @sdk_configuration.security_source&.call
+
+      timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
+      timeout ||= @sdk_configuration.timeout
+      
+
+      connection = @sdk_configuration.client.dup
+      connection.request :retry, retry_options
+
+      hook_ctx = SDKHooks::HookContext.new(
+        config: @sdk_configuration,
+        base_url: base_url,
+        oauth2_scopes: nil,
+        operation_id: 'ReplaceUserMetadata',
+        security_source: @sdk_configuration.security_source
+      )
+
+      error = nil
+      http_response = nil
+      
+      
+      begin
+        http_response = connection.put(url) do |req|
+          req.body = body
+          req.headers.merge!(headers)
+          req.options.timeout = timeout unless timeout.nil?
+          Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
+
+          @sdk_configuration.hooks.before_request(
+            hook_ctx: SDKHooks::BeforeRequestHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            request: req
+          )
+        end
+      rescue StandardError => e
+        error = e
+      ensure
+        if http_response.nil? || Utils.error_status?(http_response.status)
+          http_response = @sdk_configuration.hooks.after_error(
+            error: error,
+            hook_ctx: SDKHooks::AfterErrorHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+        else
+          http_response = @sdk_configuration.hooks.after_success(
+            hook_ctx: SDKHooks::AfterSuccessHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+        end
+        
+        if http_response.nil?
+          raise error if !error.nil?
+          raise 'no response'
+        end
+      end
+      
+      content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
+      if Utils.match_status_code(http_response.status, ['200'])
+        if Utils.match_content_type(content_type, 'application/json')
+          http_response = @sdk_configuration.hooks.after_success(
+            hook_ctx: SDKHooks::AfterSuccessHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+          response_data = http_response.env.response_body
+          obj = Crystalline.unmarshal_json(JSON.parse(response_data), Models::Components::User)
+          response = Models::Operations::ReplaceUserMetadataResponse.new(
+            status_code: http_response.status,
+            content_type: content_type,
+            raw_response: http_response,
+            user: obj
+          )
+
+          return response
+        else
+          raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
+        end
+      elsif Utils.match_status_code(http_response.status, ['400', '401', '404', '422'])
+        if Utils.match_content_type(content_type, 'application/json')
+          http_response = @sdk_configuration.hooks.after_success(
+            hook_ctx: SDKHooks::AfterSuccessHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+          response_data = http_response.env.response_body
+          obj = Crystalline.unmarshal_json(JSON.parse(response_data), Models::Errors::ClerkErrors)
+          obj.raw_response = http_response
+          raise obj
+        else
+          raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
+        end
+      elsif Utils.match_status_code(http_response.status, ['4XX'])
+        raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'API error occurred'
+      elsif Utils.match_status_code(http_response.status, ['5XX'])
+        raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'API error occurred'
+      else
+        raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown status code received'
+
+      end
+    end
+
+
+    
     def get_billing_subscription(user_id:, retries: nil, timeout_ms: nil, http_headers: nil)
       # get_billing_subscription - Retrieve a user's billing subscription
       # Retrieves the billing subscription for the specified user.

data/lib/clerk/utils/security.rb

@@ -13,25 +13,36 @@ module Clerk
     
 
     
-    def self.configure_request_security(req, security)
+    def self.configure_request_security(req, security, allowed_fields = nil)
       return if security.nil?
-      security.fields.each do |sec_field|
+
+      sec_fields = if allowed_fields.nil?
+        security.fields
+      else
+        allowed_fields.filter_map { |name| security.fields.find { |f| f.name == name } }
+      end
+
+      sec_fields.each do |sec_field|
         value = security.send(sec_field.name)
         next if value.nil?
 
         metadata = sec_field.metadata[:security]
         next if metadata.nil?
 
-        _parse_security_option(req, value) if metadata[:option]
+        if metadata[:option]
+          _parse_security_option(req, value)
+          break unless metadata[:composite]
+        end
+
+        next unless metadata[:scheme]
 
-        if metadata[:scheme]
-          # Special case for basic auth which could be a flattened struct
-          if metadata[:sub_type] == 'basic' && !value.respond_to?(:fields)
-            _parse_security_scheme(req, metadata, security)
-          else
-            _parse_security_scheme(req, metadata, value)
-          end
+        # Special case for basic auth which could be a flattened struct
+        if metadata[:sub_type] == 'basic' && !value.respond_to?(:fields)
+          _parse_security_scheme(req, metadata, security)
+        else
+          _parse_security_scheme(req, metadata, value)
         end
+        break unless metadata[:composite]
       end
     end
 

data/lib/clerk/utils/url.rb

@@ -83,9 +83,8 @@ module Clerk
     end
 
     # Percent-encode characters that are invalid in URI path segments
-    
     def self._encode_path_param(value)
-      value.gsub(/[<>{}\[\]|\\^`\s?#%]/) { |c| format('%%%02X', c.ord) }
+      value.gsub(%r{[<>{}\[\]|\\^`\s?#%/.]}) { |c| format('%%%02X', c.ord) }
     end
 
     

data/lib/clerk/utils.rb

@@ -28,6 +28,14 @@ module Clerk
         [filtered_routes, filtered_wildcard_routes]
       end
 
+      # Percent-decoded request path, normalized to match the form the
+      # downstream framework (Sinatra/Rails) uses when matching routes.
+      def decoded_path(request)
+        ::Rack::Utils.unescape_path(request.path.to_s)
+      rescue ArgumentError
+        request.path.to_s
+      end
+
       def retrieve_header_from_request(request, key)
         (request.env[key] || request.env[key.downcase]).to_s
       end

data/lib/clerk_sdk_ruby.rb

@@ -36,12 +36,14 @@ module Clerk
   autoload :SignUps, 'clerk/signups'
   autoload :OauthApplications, 'clerk/oauthapplications'
   autoload :SamlConnections, 'clerk/samlconnections'
+  autoload :EnterpriseConnections, 'clerk/enterpriseconnections'
   autoload :TestingTokens, 'clerk/testingtokens'
   autoload :AgentTasks, 'clerk/agenttasks'
   autoload :WaitlistEntries, 'clerk/waitlistentries'
   autoload :Billing, 'clerk/billing'
   autoload :OrganizationPermissions, 'clerk/organizationpermissions'
   autoload :RoleSets, 'clerk/rolesets'
+  autoload :AdminPortalLinkTokens, 'clerk/admin_portal_link_tokens'
   autoload :APIKeys, 'clerk/api_keys'
   autoload :M2m, 'clerk/m2m'
   autoload :OauthAccessTokens, 'clerk/oauthaccesstokens'

data/test/clerk/encode_path_param_test.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require 'minitest/autorun'
+require_relative '../../lib/clerk/utils/url'
+
+class EncodePathParamTest < Minitest::Test
+  def test_encodes_forward_slash
+    assert_equal '%2F', Clerk::Utils._encode_path_param('/')
+  end
+
+  def test_encodes_dot
+    assert_equal '%2E', Clerk::Utils._encode_path_param('.')
+  end
+
+  def test_encodes_dots_and_slashes_in_composite_value
+    encoded = Clerk::Utils._encode_path_param('a.b/c.d')
+    refute_includes encoded, '/'
+    refute_includes encoded, '.'
+  end
+
+  def test_still_encodes_previously_handled_characters
+    {
+      '<' => '%3C', '>' => '%3E', '{' => '%7B', '}' => '%7D',
+      '[' => '%5B', ']' => '%5D', '|' => '%7C', '\\' => '%5C',
+      '^' => '%5E', '`' => '%60', ' ' => '%20', '?' => '%3F',
+      '#' => '%23', '%' => '%25'
+    }.each do |char, expected|
+      assert_equal expected, Clerk::Utils._encode_path_param(char), "char: #{char.inspect}"
+    end
+  end
+
+  def test_leaves_typical_resource_id_untouched
+    id = 'user_2abcXYZ_def-ghi~jkl'
+    assert_equal id, Clerk::Utils._encode_path_param(id)
+  end
+
+  def test_already_encoded_value_is_double_encoded_safely
+    assert_equal '%252F', Clerk::Utils._encode_path_param('%2F')
+  end
+end

data/test/clerk/rack_middleware_test.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'minitest/autorun'
+require 'rack'
+require 'rack/mock'
+require 'sinatra/base'
+require_relative '../../lib/clerk/rack_middleware'
+
+module Clerk
+  module Rack
+    class ReverificationTest < Minitest::Test
+      class FakeProxy
+        def user_needs_reverification?(_preset)
+          true
+        end
+
+        def user_reverification_rack_response(_preset)
+          [403, {'content-type' => 'application/json'}, ['{"reverification":"required"}']]
+        end
+      end
+
+      def sinatra_app
+        Sinatra.new do
+          disable :show_exceptions, :logging, :dump_errors
+          get('/admin') { 'admin ok' }
+          get('/admin/users') { 'admin users ok' }
+        end
+      end
+
+      def build_stack(routes:)
+        downstream = sinatra_app
+        reverification = Clerk::Rack::Reverification.new(downstream, routes: routes)
+        lambda do |env|
+          env['clerk.initialized'] = true
+          env['clerk'] = FakeProxy.new
+          reverification.call(env)
+        end
+      end
+
+      def request(app, path)
+        env = ::Rack::MockRequest.env_for(path)
+        app.call(env)
+      end
+
+      def test_protected_route_returns_reverification_error
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/admin')
+        assert_equal 403, status
+      end
+
+      def test_unknown_route_passes_through_to_app_404
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/does-not-exist')
+        assert_equal 404, status
+      end
+
+      def test_percent_encoded_path_matches_decoded_exact_route
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/%61dmin')
+        assert_equal 403, status
+      end
+
+      def test_percent_encoded_path_matches_decoded_wildcard_route
+        app = build_stack(routes: ['/admin/*'])
+        status, = request(app, '/%61dmin/users')
+        assert_equal 403, status
+      end
+
+      def test_case_sensitive_encoded_path_not_matched_and_app_404s
+        app = build_stack(routes: ['/admin'])
+        status, = request(app, '/%41DMIN')
+        assert_equal 404, status
+      end
+
+      def test_raises_when_middleware_not_initialized_first
+        reverification = Clerk::Rack::Reverification.new(sinatra_app, routes: ['/admin'])
+        env = ::Rack::MockRequest.env_for('/admin')
+        assert_raises(Clerk::ConfigurationError) { reverification.call(env) }
+      end
+    end
+  end
+end