clerk-sdk-ruby 7.0.0 → 8.0.1

data/lib/clerk/utils/retries.rb

@@ -4,6 +4,7 @@
 # frozen_string_literal: true
 
 require 'faraday/retry'
+require 'time'
 
 
 module Clerk
@@ -67,16 +68,57 @@ module Clerk
         if @strategy == 'backoff' && @backoff
           retry_options[:backoff_factor] = @backoff.exponent unless @backoff.exponent.nil?
           retry_options[:interval] = (@backoff.initial_interval.to_f / 1000) unless @backoff.initial_interval.nil?
-          retry_options[:max_interval] = @backoff.max_interval unless @backoff.max_interval.nil?
+          retry_options[:max_interval] = (@backoff.max_interval.to_f / 1000) unless @backoff.max_interval.nil?
 
           unless @backoff.max_elapsed_time.nil?
             stop_time = initial_time + (@backoff.max_elapsed_time.to_f / 1000)
             retry_options[:retry_if] = ->(_env, _exc) { Time.now < stop_time }
           end
+
         end
 
         retry_options
       end
     end
+
+    class RetryMiddleware < Faraday::Retry::Middleware
+      
+
+      
+      def calculate_sleep_amount(retries, env)
+        retry_after = [calculate_retry_after(env), calculate_rate_limit_reset(env)].compact.max
+        retry_interval = calculate_retry_interval(retries)
+        return retry_interval if retry_after.nil?
+
+        # unlike the stock middleware, cap server delays at max_interval rather
+        # than abandoning the retry
+        [[retry_after, @options.max_interval].min, retry_interval].max
+      end
+
+      private
+
+      
+      def calculate_retry_after(env)
+        response_headers = env[:response_headers]
+        return unless response_headers
+
+        ms_value = response_headers['retry-after-ms']
+        return ms_value.to_f / 1000 if ms_value&.match?(/\A\s*\d+\s*\z/)
+
+        value = response_headers['retry-after']
+        return if value.nil? || value.strip.empty?
+        return value.to_f if value.match?(/\A\s*\d+\s*\z/)
+
+        begin
+          Time.httpdate(value) - Time.now
+        rescue ArgumentError
+          begin
+            Time.iso8601(value) - Time.now
+          rescue ArgumentError
+            nil
+          end
+        end
+      end
+    end
   end
 end

data/lib/clerk/utils/utils.rb

@@ -78,11 +78,15 @@ module Clerk
 
     
     def self.match_content_type(content_type, pattern)
-      return true if content_type == pattern || ['*', '*/*'].include?(pattern)
+      return true if ['*', '*/*'].include?(pattern)
+
+      # Media types are case-insensitive (RFC 9110 section 8.3.1).
+      pattern = pattern.strip.downcase
+      return true if content_type.strip.downcase == pattern
 
       pieces = content_type.split(';')
       pieces.each do |piece|
-        return true if pattern == piece.strip
+        return true if pattern == piece.strip.downcase
       end
 
       false

data/lib/clerk/waitlistentries.rb

@@ -72,10 +72,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -88,7 +88,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.get(url) do |req|
           req.headers.merge!(headers)
@@ -125,13 +125,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -205,10 +205,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -221,7 +221,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -258,13 +258,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -359,10 +359,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -375,7 +375,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -412,13 +412,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -504,10 +504,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -520,7 +520,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.delete(url) do |req|
           req.headers.merge!(headers)
@@ -556,13 +556,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -659,10 +659,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -675,7 +675,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.body = body
@@ -712,13 +712,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -804,10 +804,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -820,7 +820,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -856,13 +856,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')

data/lib/clerk/webhooks.rb

@@ -69,10 +69,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -85,7 +85,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -121,13 +121,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')
@@ -205,10 +205,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -221,7 +221,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.delete(url) do |req|
           req.headers.merge!(headers)
@@ -257,13 +257,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['204'])
         http_response = @sdk_configuration.hooks.after_success(
@@ -332,10 +332,10 @@ module Clerk
 
       timeout = (timeout_ms.to_f / 1000) unless timeout_ms.nil?
       timeout ||= @sdk_configuration.timeout
-      
+
 
       connection = @sdk_configuration.client.dup
-      connection.request :retry, retry_options
+      connection.use Utils::RetryMiddleware, retry_options
 
       hook_ctx = SDKHooks::HookContext.new(
         config: @sdk_configuration,
@@ -348,7 +348,7 @@ module Clerk
       error = nil
       http_response = nil
       
-      
+
       begin
         http_response = connection.post(url) do |req|
           req.headers.merge!(headers)
@@ -384,13 +384,13 @@ module Clerk
             response: http_response
           )
         end
-        
+
         if http_response.nil?
           raise error if !error.nil?
           raise 'no response'
         end
       end
-      
+
       content_type = http_response.headers.fetch('Content-Type', 'application/octet-stream')
       if Utils.match_status_code(http_response.status, ['200'])
         if Utils.match_content_type(content_type, 'application/json')

data/lib/clerk_sdk_ruby.rb

@@ -43,6 +43,8 @@ module Clerk
   autoload :Billing, 'clerk/billing'
   autoload :OrganizationPermissions, 'clerk/organizationpermissions'
   autoload :RoleSets, 'clerk/rolesets'
+  autoload :ScimDirectories, 'clerk/scimdirectories'
+  autoload :Directories, 'clerk/directories'
   autoload :AdminPortalLinkTokens, 'clerk/admin_portal_link_tokens'
   autoload :APIKeys, 'clerk/api_keys'
   autoload :M2m, 'clerk/m2m'

data/test/clerk/jwks_cache_scoping_test.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'base64'
+require 'faraday'
+require 'faraday/adapter/test'
+require 'json'
+require 'jwt'
+require 'minitest/autorun'
+require 'openssl'
+require_relative '../../lib/clerk'
+
+# Regression test for AISEC-84. The JWKS cache was a single class variable
+# shared by every Clerk::SDK in the process, and verify_token performs no
+# issuer check. While the cache held one instance's keys, a token minted by
+# that instance verified against any other instance's SDK.
+class JwksCacheScopingTest < Minitest::Test
+  Tenant = Struct.new(:sdk, :token, :fetches)
+
+  def test_cached_keys_are_not_served_to_another_instance
+    tenant_a = build_tenant('tenant_a')
+    tenant_b = build_tenant('tenant_b')
+
+    # A legitimate tenant-B verification loads tenant B's keys.
+    claims = tenant_b.sdk.verify_token(tenant_b.token)
+    assert_equal 'user_tenant_b', claims['sub']
+    assert_equal ['tenant_b'], tenant_b.fetches
+
+    # The same token under tenant A must not resolve against tenant B's keys.
+    assert_raises(JWT::DecodeError) do
+      tenant_a.sdk.verify_token(tenant_b.token)
+    end
+    refute_empty tenant_a.fetches, 'tenant A must fetch its own JWKS'
+  end
+
+  def test_scope_differs_per_secret_key
+    sdk_a = ::Clerk::SDK.new(secret_key: 'sk_test_a', server_url: 'https://api.clerk.com/v1')
+    sdk_b = ::Clerk::SDK.new(secret_key: 'sk_test_b', server_url: 'https://api.clerk.com/v1')
+    sdk_a_again = ::Clerk::SDK.new(secret_key: 'sk_test_a', server_url: 'https://api.clerk.com/v1')
+
+    refute_equal sdk_a.jwks_cache_scope, sdk_b.jwks_cache_scope
+    # The cache must still be shared across SDKs for the same instance, since
+    # authenticate_request builds a fresh SDK per request.
+    assert_equal sdk_a.jwks_cache_scope, sdk_a_again.jwks_cache_scope
+    assert_same ::Clerk::SDK.jwks_cache(sdk_a.jwks_cache_scope),
+                ::Clerk::SDK.jwks_cache(sdk_a_again.jwks_cache_scope)
+  end
+
+  private
+
+  def build_tenant(name)
+    key = OpenSSL::PKey::RSA.generate(2048)
+    kid = "ins_#{name}"
+    jwk = {
+      kty: 'RSA', use: 'sig', alg: 'RS256', kid: kid,
+      n: b64(key.n.to_s(2)),
+      e: b64(key.e.to_s(2))
+    }
+
+    fetches = []
+    stubs = Faraday::Adapter::Test::Stubs.new
+    stubs.get('/v1/jwks') do
+      fetches << name
+      [200, {'Content-Type' => 'application/json'}, JSON.generate(keys: [jwk])]
+    end
+    client = Faraday.new { |builder| builder.adapter :test, stubs }
+
+    sdk = ::Clerk::SDK.new(
+      secret_key: "sk_test_#{name}",
+      client: client,
+      server_url: 'https://api.clerk.com/v1'
+    )
+    token = JWT.encode(
+      {sub: "user_#{name}", exp: Time.now.to_i + 3600},
+      key, 'RS256', {kid: kid}
+    )
+
+    Tenant.new(sdk, token, fetches)
+  end
+
+  def b64(bytes)
+    Base64.urlsafe_encode64(bytes, padding: false)
+  end
+end

data/test/clerk/org_permissions_v2_test.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require 'minitest/autorun'
+require_relative '../../lib/clerk'
+
+module Clerk
+  # Coverage for Clerk::SDK#compute_org_permissions_from_v2_token, which decodes
+  # the `fea` / `o.per` / `o.fpm` triple of a v2 session token into
+  # `org:<feature>:<action>` strings.
+  class OrgPermissionsV2Test < Minitest::Test
+    ACTIONS = (0...64).map { |n| "act_#{n}" }.freeze
+
+    def sdk
+      @sdk ||= Clerk::SDK.new(secret_key: 'sk_test_not_used')
+    end
+
+    def permissions_for(fea:, per:, fpm:)
+      claims = {'fea' => fea, 'o' => {'per' => per, 'fpm' => fpm}}
+      sdk.send(:compute_org_permissions_from_v2_token, claims)
+    end
+
+    # --- happy path (regression guard) ----------------------------------------
+
+    def test_small_masks_decode_with_bit_zero_least_significant
+      result = permissions_for(
+        fea: 'o:leads,o:whatsapp',
+        per: 'chat_read,chat_send,connect,view_history',
+        fpm: '3,10'
+      )
+
+      assert_equal ['org:leads:chat_read', 'org:leads:chat_send',
+                    'org:whatsapp:chat_send', 'org:whatsapp:view_history'], result
+    end
+
+    def test_zero_mask_grants_nothing
+      assert_empty permissions_for(fea: 'o:leads', per: 'chat_read,chat_send', fpm: '0')
+    end
+
+    def test_non_org_scoped_features_are_skipped
+      result = permissions_for(
+        fea: 'u:billing,o:leads',
+        per: 'chat_read,chat_send',
+        fpm: '3,1'
+      )
+
+      assert_equal ['org:leads:chat_read'], result
+    end
+
+    # --- wide masks ------------------------------------------------------------
+
+    def test_mask_with_bit_62_set
+      result = permissions_for(fea: 'o:leads', per: ACTIONS.join(','), fpm: (2**62).to_s)
+
+      assert_equal ['org:leads:act_62'], result
+    end
+
+    def test_positive_bignum_mask_with_bit_63_set
+      # 2**63 + 1 -- above the signed 64-bit range, but Ruby Integers are
+      # arbitrary-precision so this must still decode to indices 0 and 63.
+      result = permissions_for(fea: 'o:leads', per: ACTIONS.join(','), fpm: '9223372036854775809')
+
+      assert_equal ['org:leads:act_0', 'org:leads:act_63'], result
+    end
+
+    # --- the security regression: negative masks must fail closed --------------
+
+    def test_negative_mask_grants_nothing
+      # A signed 64-bit overflow on the producing side yields a negative mask.
+      # `(-9223372036854775807).to_s(2)` is "-111...1", which -- walked character
+      # by character -- would otherwise grant 63 permissions.
+      result = permissions_for(fea: 'o:leads', per: ACTIONS.join(','), fpm: '-9223372036854775807')
+
+      assert_empty result
+    end
+
+    def test_negative_mask_does_not_affect_other_features
+      result = permissions_for(
+        fea: 'o:leads,o:whatsapp',
+        per: ACTIONS.join(','),
+        fpm: '3,-9223372036854775807'
+      )
+
+      assert_equal ['org:leads:act_0', 'org:leads:act_1'], result
+    end
+
+    def test_non_numeric_masks_grant_nothing
+      ['abc', '1e3', '0x10', ' 3', '3 ', '1.5', '+3', ''].each do |mask|
+        assert_empty permissions_for(fea: 'o:leads', per: ACTIONS.join(','), fpm: mask),
+                     "expected mask #{mask.inspect} to grant nothing"
+      end
+    end
+
+    # --- malformed claims must not raise ---------------------------------------
+
+    def test_more_mappings_than_features_does_not_raise
+      result = permissions_for(fea: 'o:leads', per: 'chat_read,chat_send', fpm: '1,3,7')
+
+      assert_equal ['org:leads:chat_read'], result
+    end
+
+    def test_feature_without_a_scope_separator_does_not_raise
+      result = permissions_for(fea: 'leads,o:whatsapp', per: 'chat_read', fpm: '1,1')
+
+      assert_equal ['org:whatsapp:chat_read'], result
+    end
+
+    def test_missing_claims_do_not_raise
+      assert_empty permissions_for(fea: nil, per: nil, fpm: nil)
+      assert_empty permissions_for(fea: 'o:leads', per: nil, fpm: '3')
+      assert_empty permissions_for(fea: nil, per: 'chat_read', fpm: '3')
+    end
+
+    # --- masks wider than the permission vocabulary ----------------------------
+
+    def test_mask_wider_than_permission_list_does_not_emit_empty_permissions
+      # 0b1111 against a two-action vocabulary: only the first two bits map.
+      result = permissions_for(fea: 'o:leads', per: 'chat_read,chat_send', fpm: '15')
+
+      assert_equal ['org:leads:chat_read', 'org:leads:chat_send'], result
+      refute(result.any? { |permission| permission.end_with?(':') },
+             "expected no permissions with an empty action name, got #{result.inspect}")
+    end
+
+    def test_high_bit_beyond_permission_list_is_ignored
+      result = permissions_for(fea: 'o:leads', per: 'chat_read', fpm: (2**63 | 1).to_s)
+
+      assert_equal ['org:leads:chat_read'], result
+    end
+  end
+end