clerk-sdk-ruby 7.0.0 → 8.0.1

data/lib/clerk/sdk.rb

@@ -3,6 +3,7 @@
 require 'clerk/jwks_cache'
 require 'clerk/openapiclient'
 # require 'clerk/version'
+require 'digest'
 require 'jwt'
 
 module Clerk
@@ -16,16 +17,33 @@ module Clerk
     # How often (in seconds) should JWKs be refreshed
     JWKS_CACHE_LIFETIME = 3600 # 1 hour
 
+    # One JWKS cache per Clerk instance. A single process-wide cache would let a
+    # token minted by one instance verify against another, since the keys it
+    # holds are whichever instance refreshed last and no issuer check runs.
+    # The cache still outlives individual SDK objects, because
+    # `authenticate_request` builds a fresh SDK per request.
     # rubocop:disable Style/ClassVars
-    @@jwks_cache = JWKSCache.new(JWKS_CACHE_LIFETIME)
+    @@jwks_caches = {}
+    @@jwks_caches_mutex = Mutex.new
     # rubocop:enable Style/ClassVars
-    
-    def self.jwks_cache
-      @@jwks_cache
+
+    # Returns the JWKS cache for a single Clerk instance. `scope` must identify
+    # that instance; see #jwks_cache_scope.
+    def self.jwks_cache(scope)
+      @@jwks_caches_mutex.synchronize do
+        @@jwks_caches[scope] ||= JWKSCache.new(JWKS_CACHE_LIFETIME)
+      end
     end
 
+    # Opaque identifier for the Clerk instance this SDK talks to. The secret key
+    # is hashed so it is never retained as a cache key.
+    attr_reader :jwks_cache_scope
+
     def initialize(client: nil, retry_config: nil, timeout_ms: nil, secret_key: nil, security_source: nil, server_idx: nil, server_url: nil, url_params: nil)
       secret_key ||= Clerk.configuration.secret_key
+      @jwks_cache_scope = Digest::SHA256.hexdigest(
+        [server_url, server_idx, secret_key].join("\0")
+      )
       super(
         client: client,
         retry_config: retry_config,
@@ -56,7 +74,7 @@ module Clerk
       jwk_loader = lambda do |options|
         # JWT.decode requires that the 'keys' key in the Hash is a symbol (as
         # opposed to a string which our SDK returns by default)
-        {keys: SDK.jwks_cache.fetch(self, kid_not_found: options[:invalidate] || options[:kid_not_found], force_refresh: force_refresh_jwks)}
+        {keys: SDK.jwks_cache(@jwks_cache_scope).fetch(self, kid_not_found: options[:invalidate] || options[:kid_not_found], force_refresh: force_refresh_jwks)}
       end
 
       begin
@@ -90,6 +108,10 @@ module Clerk
 
     private
 
+    # Decodes the `fea`/`o.per`/`o.fpm` triple of a v2 session token into
+    # `org:<feature>:<action>` permission strings. Anything that cannot be
+    # decoded with confidence is skipped rather than guessed at, so malformed
+    # claims can only ever narrow the permission set, never widen it.
     def compute_org_permissions_from_v2_token(claims)
       features    = claims['fea'] ? claims['fea'].split(',') : []
       permissions = claims['o']['per'] ? claims['o']['per'].split(',') : []
@@ -97,12 +119,28 @@ module Clerk
       org_permissions = []
 
       mappings.each_with_index do |mapping, i|
+        # Each mapping is positionally aligned to a feature. A mapping without a
+        # matching feature entry cannot be attributed to anything, so skip it.
+        next if features[i].nil?
+
         scope, feature = features[i].split(':')
 
+        next if scope.nil? || feature.nil? # malformed feature entry
         next if !scope.include?('o') # not an orgs-related permission
+        # Only a non-negative decimal integer is a valid mask. The backend builds
+        # these masks in a signed 64-bit integer, so an action at index 63
+        # overflows into a negative value whose binary representation is a minus
+        # sign followed by ones ("-111...1"); walking that string character by
+        # character would grant every one of those bits. Reject anything that is
+        # not a plain non-negative decimal, mirroring `decimalToBinaryBits` in
+        # @clerk/shared, which fails closed the same way.
+        next if !/\A\d+\z/.match?(mapping)
 
         mapping.to_i.to_s(2).reverse.each_char.each_with_index do |bit, j|
-          org_permissions << "org:#{feature}:#{permissions[j]}" if bit == '1'
+          next if bit != '1'
+          next if permissions[j].nil? # mask has more bits than the permission vocabulary
+
+          org_permissions << "org:#{feature}:#{permissions[j]}"
         end
       end
 

data/lib/clerk/sdkconfiguration.rb

@@ -76,9 +76,9 @@ module Clerk
       end
       @language = 'ruby'
       @openapi_doc_version = '2026-05-12'
-      @sdk_version = '7.0.0'
-      @gen_version = '2.903.0'
-      @user_agent = 'speakeasy-sdk/ruby 7.0.0 2.903.0 2026-05-12 clerk-sdk-ruby'
+      @sdk_version = '8.0.1'
+      @gen_version = '2.938.0'
+      @user_agent = 'speakeasy-sdk/ruby 8.0.1 2.938.0 2026-05-12 clerk-sdk-ruby'
     end
 
     

data/lib/clerk/sessions.rb

@@ -76,10 +76,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -92,7 +92,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.get(url) do |req|
           req.headers.merge!(headers)
@@ -129,13 +129,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -226,10 +226,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -242,7 +242,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -279,13 +279,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -371,10 +371,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -387,7 +387,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.get(url) do |req|
           req.headers.merge!(headers)
@@ -423,13 +423,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -527,10 +527,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -543,7 +543,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -580,13 +580,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -636,6 +636,152 @@ module Clerk
 
 
     
+    def get_reverification(session_id:, reverification_id:, retries: nil, timeout_ms: nil, http_headers: nil)
+      # get_reverification - Retrieve a reverification
+      # Retrieve a reverification scoped to a session. A resource server can use this to validate a reverification id it received from its client: confirm it is real, scoped to the expected session, completed, and how fresh each factor is. Single-use / replay detection is the caller's responsibility (the id is stable, so the caller dedups consumed ids).
+      #
+      request = Models::Operations::GetReverificationRequest.new(
+        session_id: session_id,
+        reverification_id: reverification_id
+      )
+      url, params = @sdk_configuration.get_server_details
+      base_url = Utils.template_url(url, params)
+      url = Utils.generate_url(
+        Models::Operations::GetReverificationRequest,
+        base_url,
+        '/sessions/{session_id}/reverifications/{reverification_id}',
+        request
+      )
+      headers = {}
+      
+      headers['Accept'] = 'application/json'
+      headers['user-agent'] = @sdk_configuration.user_agent
+      retries ||= @sdk_configuration.retry_config
+      retries ||= Utils::RetryConfig.new(
+        backoff: Utils::BackoffStrategy.new(
+          exponent: 1.5,
+          initial_interval: 500,
+          max_elapsed_time: 3_600_000,
+          max_interval: 60_000
+        ),
+        retry_connection_errors: true,
+        strategy: 'backoff'
+      )
+      retry_options = retries.to_faraday_retry_options(initial_time: Time.now)
+      retry_options[:retry_statuses] = [500, 501, 502, 503, 504, 505]
+
+      security = @sdk_configuration.security_source&.call
+
+      timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
+      timeout ||= @sdk_configuration.timeout
+
+
+      connection = @sdk_configuration.client.dup
+      connection.use Utils::RetryMiddleware, retry_options
+
+      hook_ctx = SDKHooks::HookContext.new(
+        config: @sdk_configuration,
+        base_url: base_url,
+        oauth2_scopes: nil,
+        operation_id: 'GetReverification',
+        security_source: @sdk_configuration.security_source
+      )
+
+      error = nil
+      http_response = nil
+      
+
+      begin
+        http_response = connection.get(url) do |req|
+          req.headers.merge!(headers)
+          req.options.timeout = timeout unless timeout.nil?
+          Utils.configure_request_security(req, security)
+          http_headers&.each do |key, value|
+            req.headers[key.to_s] = value
+          end
+
+          @sdk_configuration.hooks.before_request(
+            hook_ctx: SDKHooks::BeforeRequestHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            request: req
+          )
+        end
+      rescue StandardError => e
+        error = e
+      ensure
+        if http_response.nil? || Utils.error_status?(http_response.status)
+          http_response = @sdk_configuration.hooks.after_error(
+            error: error,
+            hook_ctx: SDKHooks::AfterErrorHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+        else
+          http_response = @sdk_configuration.hooks.after_success(
+            hook_ctx: SDKHooks::AfterSuccessHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+        end
+
+        if http_response.nil?
+          raise error if !error.nil?
+          raise 'no response'
+        end
+      end
+
+      content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
+      if Utils.match_status_code(http_response.status, ['200'])
+        if Utils.match_content_type(content_type, 'application/json')
+          http_response = @sdk_configuration.hooks.after_success(
+            hook_ctx: SDKHooks::AfterSuccessHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+          response_data = http_response.env.response_body
+          obj = Crystalline.unmarshal_json(JSON.parse(response_data), Models::Components::Reverification)
+          response = Models::Operations::GetReverificationResponse.new(
+            status_code: http_response.status,
+            content_type: content_type,
+            raw_response: http_response,
+            reverification: obj
+          )
+
+          return response
+        else
+          raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
+        end
+      elsif Utils.match_status_code(http_response.status, ['400', '401', '404'])
+        if Utils.match_content_type(content_type, 'application/json')
+          http_response = @sdk_configuration.hooks.after_success(
+            hook_ctx: SDKHooks::AfterSuccessHookContext.new(
+              hook_ctx: hook_ctx
+            ),
+            response: http_response
+          )
+          response_data = http_response.env.response_body
+          obj = Crystalline.unmarshal_json(JSON.parse(response_data), Models::Errors::ClerkErrors)
+          obj.raw_response = http_response
+          raise obj
+        else
+          raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
+        end
+      elsif Utils.match_status_code(http_response.status, ['4XX'])
+        raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'API error occurred'
+      elsif Utils.match_status_code(http_response.status, ['5XX'])
+        raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'API error occurred'
+      else
+        raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown status code received'
+
+      end
+    end
+
+
+    
     def revoke(session_id:, retries: nil, timeout_ms: nil, http_headers: nil)
       # revoke - Revoke a session
       # Sets the status of a session as "revoked", which is an unauthenticated state.
@@ -673,10 +819,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -689,7 +835,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -725,13 +871,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -828,10 +974,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -844,7 +990,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -881,13 +1027,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -985,10 +1131,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -1001,7 +1147,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -1038,13 +1184,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')

data/lib/clerk/signintokens.rb

@@ -81,10 +81,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -97,7 +97,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -134,13 +134,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -163,7 +163,7 @@ module Clerk
         else
           raise ::Clerk::Models::Errors::APIError.new(status_code: http_response.status, body: http_response.env.response_body, raw_response: http_response), 'Unknown content type received'
         end
-      elsif Utils.match_status_code(http_response.status, ['404', '422'])
+      elsif Utils.match_status_code(http_response.status, ['403', '404', '422'])
         if Utils.match_content_type(content_type, 'application/json')
           http_response = @sdk_configuration.hooks.after_success(
             hook_ctx: SDKHooks::AfterSuccessHookContext.new(
@@ -226,10 +226,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -242,7 +242,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -278,13 +278,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')

data/lib/clerk/signups.rb

@@ -77,10 +77,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -93,7 +93,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.get(url) do |req|
           req.headers.merge!(headers)
@@ -129,13 +129,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -232,10 +232,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -248,7 +248,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.patch(url) do |req|
           req.body = body
@@ -285,13 +285,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')