clerk-sdk-ruby 6.0.0 → 8.0.0

data/lib/clerk/utils/retries.rb

@@ -4,6 +4,7 @@
 # frozen_string_literal: true
 
 require 'faraday/retry'
+require 'time'
 
 
 module Clerk
@@ -67,16 +68,57 @@ module Clerk
         if @strategy == 'backoff' && @backoff
           retry_options[:backoff_factor] = @backoff.exponent unless @backoff.exponent.nil?
           retry_options[:interval] = (@backoff.initial_interval.to_f / 1000) unless @backoff.initial_interval.nil?
-          retry_options[:max_interval] = @backoff.max_interval unless @backoff.max_interval.nil?
+          retry_options[:max_interval] = (@backoff.max_interval.to_f / 1000) unless @backoff.max_interval.nil?
 
           unless @backoff.max_elapsed_time.nil?
             stop_time = initial_time + (@backoff.max_elapsed_time.to_f / 1000)
             retry_options[:retry_if] = ->(_env, _exc) { Time.now < stop_time }
           end
+
         end
 
         retry_options
       end
     end
+
+    class RetryMiddleware < Faraday::Retry::Middleware
+      
+
+      
+      def calculate_sleep_amount(retries, env)
+        retry_after = [calculate_retry_after(env), calculate_rate_limit_reset(env)].compact.max
+        retry_interval = calculate_retry_interval(retries)
+        return retry_interval if retry_after.nil?
+
+        # unlike the stock middleware, cap server delays at max_interval rather
+        # than abandoning the retry
+        [[retry_after, @options.max_interval].min, retry_interval].max
+      end
+
+      private
+
+      
+      def calculate_retry_after(env)
+        response_headers = env[:response_headers]
+        return unless response_headers
+
+        ms_value = response_headers['retry-after-ms']
+        return ms_value.to_f / 1000 if ms_value&.match?(/\A\s*\d+\s*\z/)
+
+        value = response_headers['retry-after']
+        return if value.nil? || value.strip.empty?
+        return value.to_f if value.match?(/\A\s*\d+\s*\z/)
+
+        begin
+          Time.httpdate(value) - Time.now
+        rescue ArgumentError
+          begin
+            Time.iso8601(value) - Time.now
+          rescue ArgumentError
+            nil
+          end
+        end
+      end
+    end
   end
 end

data/lib/clerk/waitlistentries.rb

@@ -72,10 +72,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -88,7 +88,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.get(url) do |req|
           req.headers.merge!(headers)
@@ -125,13 +125,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -205,10 +205,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -221,7 +221,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -258,13 +258,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -359,10 +359,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -375,7 +375,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -412,13 +412,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -504,10 +504,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -520,7 +520,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.delete(url) do |req|
           req.headers.merge!(headers)
@@ -556,13 +556,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -659,10 +659,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -675,7 +675,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -712,13 +712,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -804,10 +804,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -820,7 +820,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -856,13 +856,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')

data/lib/clerk/webhooks.rb

@@ -69,10 +69,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -85,7 +85,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -121,13 +121,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -205,10 +205,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -221,7 +221,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.delete(url) do |req|
           req.headers.merge!(headers)
@@ -257,13 +257,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['204'])
         http_response = @sdk_configuration.hooks.after_success(
@@ -332,10 +332,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -348,7 +348,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -384,13 +384,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')

data/lib/clerk_sdk_ruby.rb

@@ -43,6 +43,7 @@ module Clerk
   autoload :Billing, 'clerk/billing'
   autoload :OrganizationPermissions, 'clerk/organizationpermissions'
   autoload :RoleSets, 'clerk/rolesets'
+  autoload :ScimDirectories, 'clerk/scimdirectories'
   autoload :AdminPortalLinkTokens, 'clerk/admin_portal_link_tokens'
   autoload :APIKeys, 'clerk/api_keys'
   autoload :M2m, 'clerk/m2m'

data/test/clerk/jwks_cache_scoping_test.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'faraday'
+require 'faraday/adapter/test'
+require 'json'
+require 'jwt'
+require 'minitest/autorun'
+require 'openssl'
+require_relative '../../lib/clerk'
+
+# Regression test for AISEC-84. The JWKS cache was a single class variable
+# shared by every Clerk::SDK in the process, and verify_token performs no
+# issuer check. While the cache held one instance's keys, a token minted by
+# that instance verified against any other instance's SDK.
+class JwksCacheScopingTest < Minitest::Test
+  Tenant = Struct.new(:sdk, :token, :fetches)
+
+  def test_cached_keys_are_not_served_to_another_instance
+    tenant_a = build_tenant('tenant_a')
+    tenant_b = build_tenant('tenant_b')
+
+    # A legitimate tenant-B verification loads tenant B's keys.
+    claims = tenant_b.sdk.verify_token(tenant_b.token)
+    assert_equal 'user_tenant_b', claims['sub']
+    assert_equal ['tenant_b'], tenant_b.fetches
+
+    # The same token under tenant A must not resolve against tenant B's keys.
+    assert_raises(JWT::DecodeError) do
+      tenant_a.sdk.verify_token(tenant_b.token)
+    end
+    refute_empty tenant_a.fetches, 'tenant A must fetch its own JWKS'
+  end
+
+  def test_scope_differs_per_secret_key
+    sdk_a = ::Clerk::SDK.new(secret_key: 'sk_test_a', server_url: 'https://api.clerk.com/v1')
+    sdk_b = ::Clerk::SDK.new(secret_key: 'sk_test_b', server_url: 'https://api.clerk.com/v1')
+    sdk_a_again = ::Clerk::SDK.new(secret_key: 'sk_test_a', server_url: 'https://api.clerk.com/v1')
+
+    refute_equal sdk_a.jwks_cache_scope, sdk_b.jwks_cache_scope
+    # The cache must still be shared across SDKs for the same instance, since
+    # authenticate_request builds a fresh SDK per request.
+    assert_equal sdk_a.jwks_cache_scope, sdk_a_again.jwks_cache_scope
+    assert_same ::Clerk::SDK.jwks_cache(sdk_a.jwks_cache_scope),
+                ::Clerk::SDK.jwks_cache(sdk_a_again.jwks_cache_scope)
+  end
+
+  private
+
+  def build_tenant(name)
+    key = OpenSSL::PKey::RSA.generate(2048)
+    kid = "ins_#{name}"
+    jwk = {
+      kty: 'RSA', use: 'sig', alg: 'RS256', kid: kid,
+      n: b64(key.n.to_s(2)),
+      e: b64(key.e.to_s(2))
+    }
+
+    fetches = []
+    stubs = Faraday::Adapter::Test::Stubs.new
+    stubs.get('/v1/jwks') do
+      fetches << name
+      [200, {'Content-Type' => 'application/json'}, JSON.generate(keys: [jwk])]
+    end
+    client = Faraday.new { |builder| builder.adapter :test, stubs }
+
+    sdk = ::Clerk::SDK.new(
+      secret_key: "sk_test_#{name}",
+      client: client,
+      server_url: 'https://api.clerk.com/v1'
+    )
+    token = JWT.encode(
+      {sub: "user_#{name}", exp: Time.now.to_i + 3600},
+      key, 'RS256', {kid: kid}
+    )
+
+    Tenant.new(sdk, token, fetches)
+  end
+
+  def b64(bytes)
+    Base64.urlsafe_encode64(bytes, padding: false)
+  end
+end

data/test/clerk/proxy_test.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require 'minitest/autorun'
+require_relative '../../lib/clerk/constants'
+require_relative '../../lib/clerk/proxy'
+
+module Clerk
+  class ProxyReverificationTest < Minitest::Test
+    def proxy(fva:, extra_claims: {})
+      claims = {'sub' => 'user_123'}
+      claims['fva'] = fva unless fva == :omitted
+      Clerk::Proxy.new(session_claims: claims.merge(extra_claims))
+    end
+
+    # A policy that both factors satisfy comfortably, so any failure below comes
+    # from the 'fva' handling rather than from the ages themselves.
+    def lenient
+      {after_minutes: 10, level: :second_factor}
+    end
+
+    # --- omitted 'fva' (AISEC-49) ---------------------------------------------
+
+    def test_omitted_fva_is_not_reverified
+      %i[first_factor second_factor multi_factor].each do |level|
+        p = proxy(fva: :omitted)
+        refute p.user_reverified?({after_minutes: 10, level: level}),
+               "expected level #{level} to be unsatisfied when 'fva' is omitted"
+        assert p.user_needs_reverification?({after_minutes: 10, level: level})
+      end
+    end
+
+    def test_omitted_fva_fails_every_preset
+      [StepUp::Preset::STRICT_MFA, StepUp::Preset::STRICT,
+       StepUp::Preset::MODERATE, StepUp::Preset::LAX].each do |preset|
+        assert proxy(fva: :omitted).user_needs_reverification?(preset),
+               "expected preset #{preset} to require reverification when 'fva' is omitted"
+      end
+    end
+
+    def test_omitted_fva_yields_to_require_reverification_block
+      yielded = false
+      proxy(fva: :omitted).user_require_reverification!(StepUp::Preset::STRICT) { yielded = true }
+      assert yielded
+    end
+
+    def test_explicit_null_fva_is_not_reverified
+      refute proxy(fva: nil).user_reverified?(lenient)
+    end
+
+    # --- well-formed 'fva' ----------------------------------------------------
+
+    def test_recent_second_factor_satisfies_second_factor_policy
+      assert proxy(fva: [0, 0]).user_reverified?({after_minutes: 10, level: :second_factor})
+    end
+
+    def test_stale_second_factor_fails_second_factor_policy
+      refute proxy(fva: [0, 60]).user_reverified?({after_minutes: 10, level: :second_factor})
+    end
+
+    def test_second_factor_policy_falls_back_to_first_when_2fa_not_enabled
+      assert proxy(fva: [0, -1]).user_reverified?({after_minutes: 10, level: :second_factor})
+      refute proxy(fva: [60, -1]).user_reverified?({after_minutes: 10, level: :second_factor})
+    end
+
+    def test_first_factor_not_enabled_fails_levels_that_consult_it
+      %i[first_factor multi_factor].each do |level|
+        refute proxy(fva: [-1, 0]).user_reverified?({after_minutes: 10, level: level}),
+               "expected level #{level} to be unsatisfied when the first factor is not enabled"
+      end
+    end
+
+    # With 2FA enabled, the :second_factor level rests on the second factor
+    # alone and doesn't consult the first. Matches clerk-sdk-go's
+    # SessionClaims#NeedsReverification.
+    def test_second_factor_level_ignores_first_factor_when_2fa_enabled
+      assert proxy(fva: [-1, 0]).user_reverified?({after_minutes: 10, level: :second_factor})
+      refute proxy(fva: [-1, 60]).user_reverified?({after_minutes: 10, level: :second_factor})
+    end
+
+    def test_multi_factor_requires_both_when_2fa_enabled
+      assert proxy(fva: [0, 0]).user_reverified?({after_minutes: 10, level: :multi_factor})
+      refute proxy(fva: [0, 60]).user_reverified?({after_minutes: 10, level: :multi_factor})
+      refute proxy(fva: [60, 0]).user_reverified?({after_minutes: 10, level: :multi_factor})
+    end
+
+    def test_age_equal_to_policy_window_is_stale
+      refute proxy(fva: [10, 10]).user_reverified?({after_minutes: 10, level: :second_factor})
+      assert proxy(fva: [9, 9]).user_reverified?({after_minutes: 10, level: :second_factor})
+    end
+
+    # --- policy and session guards --------------------------------------------
+
+    def test_signed_out_session_is_not_reverified
+      refute Clerk::Proxy.new(session_claims: nil).user_reverified?(lenient)
+    end
+
+    def test_missing_or_incomplete_policy_is_not_reverified
+      [{}, {level: :second_factor}, {after_minutes: 10}].each do |params|
+        refute proxy(fva: [0, 0]).user_reverified?(params),
+               "expected policy #{params.inspect} to be rejected"
+      end
+    end
+
+    def test_unrecognized_level_is_not_reverified
+      refute proxy(fva: [0, 0]).user_reverified?({after_minutes: 10, level: :third_factor})
+    end
+  end
+end