descope 1.0.4 → 1.0.5

data/examples/ruby-on-rails-api/descope/package-lock.json

@@ -9854,10 +9854,9 @@
       }
     },
     "node_modules/ip": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.0.tgz",
-      "integrity": "sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ==",
-      "license": "MIT"
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
+      "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ=="
     },
     "node_modules/ipaddr.js": {
       "version": "2.1.0",
@@ -18386,16 +18385,16 @@
       }
     },
     "node_modules/typescript": {
-      "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.3.tgz",
-      "integrity": "sha512-pXWcraxM0uxAS+tN0AG/BF2TyqmHO014Z070UsJ+pFvYuRSq8KH8DmWpnbXe0pEPDHXZV3FcAbJkijJ5oNEnWw==",
+      "version": "4.9.5",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.9.5.tgz",
+      "integrity": "sha512-1FXk9E2Hm+QzZQ7z+McJiHL4NW1F2EzMu9Nq9i3zAaGqibafqYwCVU6WyWAuyQRRzOlxou8xZSyXLEN8oKj24g==",
       "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
       },
       "engines": {
-        "node": ">=14.17"
+        "node": ">=4.2.0"
       }
     },
     "node_modules/unbox-primitive": {

data/examples/ruby-on-rails-api/descope/yarn.lock

@@ -5680,9 +5680,9 @@ internal-slot@^1.0.5:
     side-channel "^1.0.4"
 
 ip@^2.0.0:
-  version "2.0.0"
-  resolved "https://registry.npmjs.org/ip/-/ip-2.0.0.tgz"
-  integrity sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ==
+  version "2.0.1"
+  resolved "https://registry.yarnpkg.com/ip/-/ip-2.0.1.tgz#e8f3595d33a3ea66490204234b77636965307105"
+  integrity sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ==
 
 ipaddr.js@1.9.1:
   version "1.9.1"

data/lib/descope/api/v1/auth.rb

@@ -41,8 +41,21 @@ module Descope
           jwt_response
         end
 
-        def exchange_access_key(access_key = nil)
-          post(EXCHANGE_AUTH_ACCESS_KEY_PATH, {}, {}, access_key)
+        def exchange_access_key(access_key: nil, login_options: {}, audience: nil)
+          # Return a new session token for the given access key
+          #   Args:
+          #     access_key (str): The access key
+          #     audience (str|Iterable[str]|nil): Optional recipients that the JWT is intended for
+          #              (must be equal to the 'aud' claim on the provided token)
+          #     login_options (hash): Optional advanced controls over login parameters
+          #     Return value (Hash): returns the session token from the server together with the expiry and key id
+          #                          (sessionToken:Hash, keyId:str, expiration:int)
+          unless (access_key.is_a?(String) || access_key.nil?) && !access_key.to_s.empty?
+            raise Descope::AuthException, 'Access key should be a string!'
+          end
+
+          res = post(EXCHANGE_AUTH_ACCESS_KEY_PATH, { loginOptions: login_options, audience: }, {}, access_key)
+          generate_auth_info(res, nil, false, audience)
         end
 
         def select_tenant(tenant_id: nil, refresh_token: nil)
@@ -223,16 +236,18 @@ module Descope
 
           # validate the session token if sessionJwt is not empty
           st_jwt = response_body.fetch('sessionJwt', '')
-          if st_jwt
-            jwt_response[SESSION_TOKEN_NAME] = validate_token(st_jwt, audience)
+          unless st_jwt.empty?
+            @logger.debug "validating session token with refresh_token: #{refresh_token}" if st_jwt
+            jwt_response[SESSION_TOKEN_NAME] = validate_token(st_jwt, audience) if st_jwt
           end
 
           # validate refresh token if refresh_token was passed or if refreshJwt is not empty
           rt_jwt = response_body.fetch('refreshJwt', '')
 
-          if refresh_token
+          if !refresh_token.nil? || !refresh_token.to_s.empty?
+            @logger.debug "validating refresh token: #{refresh_token}" if refresh_token
             jwt_response[REFRESH_SESSION_TOKEN_NAME] = validate_token(refresh_token, audience)
-          elsif rt_jwt
+          elsif !rt_jwt.empty?
             jwt_response[REFRESH_SESSION_TOKEN_NAME] = validate_token(rt_jwt, audience)
           end
 

data/lib/descope/api/v1/management/access_key.rb

@@ -9,22 +9,23 @@ module Descope
           include Descope::Mixins::Validation
           include Descope::Api::V1::Management::Common
 
-          def create_access_key(name: nil, expire_time: nil, role_names: nil, key_tenants: nil)
+          def create_access_key(name: nil, expire_time: nil, role_names: nil, key_tenants: nil, custom_claims: nil)
             # Create a new access key.'
             # @see https://docs.descope.com/api/openapi/accesskeymanagement/operation/CreateAccessKey/
 
             role_names ||= []
             key_tenants ||= []
             validate_tenants(key_tenants)
-            post(ACCESS_KEY_CREATE_PATH, access_key_compose_create_body(name, expire_time, role_names, key_tenants))
+            post(ACCESS_KEY_CREATE_PATH, access_key_compose_create_body(name, expire_time, role_names, key_tenants, custom_claims))
           end
 
-          def access_key_compose_create_body(name, expire_time, role_names, key_tenants)
+          def access_key_compose_create_body(name, expire_time, role_names, key_tenants, custom_claims)
             {
               name:,
               expireTime: expire_time,
               roleNames: role_names,
-              keyTenants: associated_tenants_to_hash_array(key_tenants)
+              keyTenants: associated_tenants_to_hash_array(key_tenants),
+              customClaims: custom_claims
             }
           end
 

data/lib/descope/api/v1/management/common.rb

@@ -15,7 +15,7 @@ module Descope
           TENANT_SEARCH_ALL_PATH = '/v1/mgmt/tenant/search'
           PASSWORD_SETTINGS_PATH = '/v1/mgmt/password/settings'
 
-          # userUSER_CREATE_PATH
+          # user
           USER_CREATE_PATH = '/v1/mgmt/user/create'
           USER_CREATE_BATCH_PATH = '/v1/mgmt/user/create/batch'
           USER_UPDATE_PATH = '/v1/mgmt/user/update'
@@ -34,6 +34,8 @@ module Descope
           USER_UPDATE_CUSTOM_ATTRIBUTE_PATH = '/v1/mgmt/user/update/customAttribute'
           USER_ADD_ROLE_PATH = '/v1/mgmt/user/update/role/add'
           USER_REMOVE_ROLE_PATH = '/v1/mgmt/user/update/role/remove'
+          USER_SET_TEMPORARY_PASSWORD_PATH = '/v1/mgmt/user/password/set/temporary'
+          USER_SET_ACTIVE_PASSWORD_PATH = '/v1/mgmt/user/password/set/active'
           USER_SET_PASSWORD_PATH = '/v1/mgmt/user/password/set'
           USER_EXPIRE_PASSWORD_PATH = '/v1/mgmt/user/password/expire'
           USER_ADD_TENANT_PATH = '/v1/mgmt/user/update/tenant/add'
@@ -80,6 +82,7 @@ module Descope
           ROLE_UPDATE_PATH = '/v1/mgmt/role/update'
           ROLE_DELETE_PATH = '/v1/mgmt/role/delete'
           ROLE_LOAD_ALL_PATH = '/v1/mgmt/role/all'
+          ROLE_SEARCH_PATH = '/v1/mgmt/role/search'
 
           # flow
           FLOW_LIST_PATH = '/v1/mgmt/flow/list'

data/lib/descope/api/v1/management/role.rb

@@ -8,18 +8,19 @@ module Descope
         module Role
           include Descope::Api::V1::Management::Common
 
-          def create_role(name: nil, description: nil, permission_names: nil)
+          def create_role(name: nil, description: nil, permission_names: nil, tenant_id: nil)
             # Create a new role.
             permission_names ||= []
             request_params = {
               name:,
               description:,
-              permissionNames: permission_names
+              permissionNames: permission_names,
+              tenantId: tenant_id
             }
             post(ROLE_CREATE_PATH, request_params)
           end
 
-          def update_role(name: nil, new_name: nil, description: nil, permission_names: nil)
+          def update_role(name: nil, new_name: nil, description: nil, permission_names: nil, tenant_id: nil)
             # Update an existing role with the given various fields. IMPORTANT: All parameters are used as overrides
             # to the existing role. Empty fields will override populated fields. Use carefully.
             permission_names ||= []
@@ -27,20 +28,35 @@ module Descope
               name:,
               newName: new_name,
               description:,
-              permissionNames: permission_names
+              permissionNames: permission_names,
+              tenantId: tenant_id
             }
             post(ROLE_UPDATE_PATH, request_params)
           end
 
-          def delete_role(name)
+          def delete_role(name: nil, tenant_id: nil)
             # Delete an existing role. IMPORTANT: This action is irreversible. Use carefully.
-            post(ROLE_DELETE_PATH, { name: })
+            raise Descope::ArgumentError, 'name is required' if name.nil? || name.empty?
+
+            request_params = { name: }
+            request_params[:tenantId] = tenant_id if tenant_id
+            post(ROLE_DELETE_PATH, request_params)
           end
 
           def load_all_roles
             # Load all roles.
             get(ROLE_LOAD_ALL_PATH)
           end
+
+          def search_roles(role_names: nil, tenant_ids: nil, role_name_like: nil, permission_names: nil)
+            # Search for roles using the given parameters.
+            request_params = {}
+            request_params[:roleNames] = role_names if role_names
+            request_params[:tenantIds] = tenant_ids if tenant_ids
+            request_params[:roleNameLike] = role_name_like if role_name_like
+            request_params[:permissionNames] = permission_names if permission_names
+            post(ROLE_SEARCH_PATH, request_params)
+          end
         end
       end
     end

data/lib/descope/api/v1/management/user.rb

@@ -385,6 +385,23 @@ module Descope
             post(Common::USER_REMOVE_TENANT_PATH, body)
           end
 
+          def set_temporary_password(login_id: nil, password: nil)
+            body = {
+              loginId: login_id,
+              password:
+            }
+            post(Common::USER_SET_TEMPORARY_PASSWORD_PATH, body)
+          end
+
+          def set_active_password(login_id: nil, password: nil)
+            body = {
+              loginId: login_id,
+              password:
+            }
+            post(Common::USER_SET_ACTIVE_PASSWORD_PATH, body)
+          end
+
+		  # Deprecated (use set_temporary_password(..) instead)
           def set_password(login_id: nil, password: nil)
             body = {
               loginId: login_id,

data/lib/descope/mixins/common.rb

@@ -9,7 +9,7 @@ module Descope
       DEFAULT_BASE_URL = 'https://api.descope.com' # pragma: no cover
       DEFAULT_TIMEOUT_SECONDS = 60
       DEFAULT_JWT_VALIDATION_LEEWAY = 5
-      PHONE_REGEX = %r{^(?:\(?(?:00|\+)([1-4]\d\d|[1-9]\d?)\)?)?[-./ \\]?(?:(?:\(?\d{1,}\)?[-./ \\]?){0,})(?:[-./ \\]?(?:#|ext\.?|extension|x)[-./ \\]?(\d+))?$}.freeze
+      PHONE_REGEX = %r{^(?:\(?(?:00|\+)([1-4]\d\d|[1-9]\d?)\)?)?[-./ \\]?(?:(?:\(?\d{1,}\)?[-./ \\]?){0,})(?:[-./ \\]?(?:#|ext\.?|extension|x)[-./ \\]?(\d+))?$}
 
       SESSION_COOKIE_NAME = 'DS'
       REFRESH_SESSION_COOKIE_NAME = 'DSR'
@@ -50,7 +50,7 @@ module Descope
         VALIDATE_SESSION_PATH = '/v1/auth/validate'
         ME_PATH = '/v1/auth/me'
 
-        # accesskey
+        # access key
         EXCHANGE_AUTH_ACCESS_KEY_PATH = '/v1/auth/accesskey/exchange'
 
         # otp
@@ -114,16 +114,6 @@ module Descope
       module EndpointsV2
         PUBLIC_KEY_PATH = '/v2/keys'
       end
-
-      module LoginOptions
-        attr_accessor :stepup, :mfa, :custom_claims
-
-        def initialize
-          @stepup = stepup || false
-          @mfa ||= false
-          @custom_claims ||= {}
-        end
-      end
     end
   end
 end

data/lib/descope/mixins/http.rb

@@ -96,7 +96,7 @@ module Descope
 
         raise Descope::Unsupported.new("No response from server", code: 400) unless result && result.respond_to?(:code)
 
-        @logger.info "http status code: #{result.code}"
+        @logger.info("API Request: [#{method}] #{uri} - Response Code: #{result.code}")
         case result.code
         when 200...226 then safe_parse_json(result.body)
         when 400       then raise Descope::BadRequest.new(result.body, code: result.code, headers: result.headers)

data/lib/descope/version.rb

@@ -2,6 +2,6 @@
 
 # Current version of gem
 module Descope
-  VERSION = '1.0.4'
+  VERSION = '1.0.5'
   SDK_VERSION = '1.0.0'
 end

data/spec/integration/lib.descope/api/v1/auth/enchantedlink_spec.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+def poll_for_session(descope_client, pending_ref)
+  max_tries = 15
+  i = 0
+  done = false
+  while !done && i < max_tries
+    begin
+      i += 1
+      @client.logger.info('waiting 4 seconds for session to be created...')
+      sleep(4)
+      print '.'
+      @client.logger.info("Getting session for pending_ref: #{pending_ref}...")
+      jwt_response = descope_client.enchanted_link_get_session(pending_ref)
+      done = true
+    rescue Descope::AuthException, Descope::Unauthorized => e
+      @client.logger.info("Failed pending session, err: #{e}")
+     nil
+    end
+
+    next unless jwt_response
+
+    @client.logger.info("jwt_response: #{jwt_response}")
+    refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME]['jwt']
+
+    @client.logger.info("refresh_token: #{refresh_token}")
+    done = true
+    return refresh_token
+  end
+end
+
+def verify_session(descope_client: nil, res: nil, user: nil)
+  raise StandardError, 'Missing required parameters' if descope_client.nil? || res.nil? || user.nil?
+
+  token = res['link'].match(/.+verify\?t=(.+)/)[1]
+  @client.logger.info("token: #{token}")
+
+  expect do
+    descope_client.enchanted_link_verify_token(token)
+    @client.logger.info('EnchantedLink Token Verified! now getting session information...')
+    @client.logger.info('Polling for session...')
+    refresh_token = poll_for_session(descope_client, res['pendingRef'])
+    my_details = descope_client.me(refresh_token)
+    expect(my_details['email']).to eq(user['email'])
+    @client.logger.info('EnchantedLink Token Verified via sign in!')
+  rescue StandardError => e
+    raise StandardError, "Verification failed - Could not verify token #{e.message}"
+
+  end.to_not raise_error
+end
+
+describe Descope::Api::V1::Auth::EnchantedLink do
+  before(:all) do
+    @client = DescopeClient.new(Configuration.config)
+  end
+
+  after(:all) do
+    @client.logger.info('Cleaning up test users...')
+    all_users = @client.search_all_users
+    all_users['users'].each do |user|
+      if user['middleName'] == 'Ruby SDK User'
+        @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
+        @client.delete_user(user['loginIds'][0])
+      end
+    end
+  end
+
+  context 'test EnchantedLink for test user' do
+    it 'should sign in with enchanted link' do
+      user = build(:user)
+      test_user = @client.create_test_user(**user)['user']
+      @client.logger.info("Should sign in a test user => #{test_user['loginIds'][0]} with enchanted link...")
+      res = @client.generate_enchanted_link_for_test_user(login_id: test_user['loginIds'][0], uri: 'http://localhost:3000/verify')
+      @client.logger.info("res: #{res}")
+      @client.logger.info('Verifying session...')
+      verify_session(descope_client: @client, res:, user: test_user)
+    end
+  end
+end

data/spec/integration/lib.descope/api/v1/auth/magiclink_spec.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Descope::Api::V1::Auth::MagicLink do
+  before(:all) do
+    @client = DescopeClient.new(Configuration.config)
+  end
+
+  after(:all) do
+    @client.logger.info('Cleaning up test users...')
+    all_users = @client.search_all_users
+    all_users['users'].each do |user|
+      if user['middleName'] == 'Ruby SDK User'
+        @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
+        @client.delete_user(user['loginIds'][0])
+      end
+    end
+  end
+
+  context 'test Magiclink for test user' do
+    it 'should sign in with magiclink' do
+      user = build(:user)
+      test_user = @client.create_test_user(**user)['user']
+      @client.create_test_user(**user)
+      res = @client.generate_magic_link_for_test_user(
+        method: Descope::Mixins::Common::DeliveryMethod::EMAIL,
+        login_id: test_user['loginIds'][0],
+        uri: 'http://localhost:3000/verify'
+      )
+      @client.logger.info("res: #{res}")
+      token = res['link'].match(/^http.+verify\?t=(.+)/)[1]
+      @client.logger.info("token: #{token}")
+
+      expect do
+        @client.logger.info('Verifying token...')
+        jwt_response = @client.magiclink_verify_token(token)
+        @client.logger.info("jwt_response #{jwt_response}")
+        my_details = @client.me(jwt_response['refreshSessionToken']['jwt'])
+        @client.logger.info('verifying session...')
+        expect(my_details['email']).to eq(test_user['email'])
+        @client.logger.info('Magiclink Token Verified via sign in!')
+      rescue StandardError => e
+        raise StandardError, "Verification failed - Could not verify token: #{e.message}"
+
+      end.to_not raise_error
+    end
+  end
+end

data/spec/integration/lib.descope/api/v1/auth/otp_spec.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Descope::Api::V1::Auth::OTP do
+  before(:all) do
+    @client = DescopeClient.new(Configuration.config)
+  end
+
+  after(:all) do
+    @client.logger.info('Cleaning up test users...')
+    all_users = @client.search_all_users
+    all_users['users'].each do |user|
+      if user['middleName'] == 'Ruby SDK User'
+        @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
+        @client.delete_user(user['loginIds'][0])
+      end
+    end
+  end
+
+  context 'test otp sign-in with test user' do
+    it 'should sign in with otp' do
+      user = build(:user)
+      test_user = @client.create_test_user(**user)['user']
+      @client.create_test_user(**user)
+      res = @client.generate_otp_for_test_user(
+        method: Descope::Mixins::Common::DeliveryMethod::EMAIL,
+        login_id: test_user['loginIds'][0]
+      )
+      @client.logger.info("res: #{res}")
+      @client.otp_verify_code(
+        method: Descope::Mixins::Common::DeliveryMethod::EMAIL,
+        login_id: user[:login_id],
+        code: res['code']
+      )
+    end
+  end
+end

data/spec/integration/lib.descope/api/v1/auth/password_spec.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'rotp'
+
+describe Descope::Api::V1::Auth::Password do
+  before(:all) do
+    @password = SpecUtils.generate_password
+    @new_password = SpecUtils.generate_password
+    @user = build(:user)
+    @client = DescopeClient.new(Configuration.config)
+  end
+
+  context 'test password methods' do
+    it 'should get password policy' do
+      # Get the configured password policy for the project.
+      res = @client.get_password_policy
+      @client.logger.info("Password policy: #{res}")
+    end
+
+    it 'should sign up with password' do
+      res = @client.password_sign_up(login_id: @user[:login_id], password: @password, user: @user)
+      expect { res }.not_to raise_error
+    end
+
+    it 'should sign in with password' do
+      res = @client.password_sign_in(login_id: @user[:login_id], password: @password)
+      expect { res }.not_to raise_error
+    end
+
+    it 'should replace the password' do
+      res = @client.password_replace(login_id: @user[:login_id], old_password: @password, new_password: @new_password)
+      expect { res }.not_to raise_error
+    end
+
+    it 'should login with new password' do
+      res = @client.password_sign_in(login_id: @user[:login_id], password: @new_password)
+      expect { res }.not_to raise_error
+    end
+  end
+end

data/spec/integration/lib.descope/api/v1/auth/totp_spec.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'rotp'
+
+describe Descope::Api::V1::Auth::TOTP do
+  before(:all) do
+    @client = DescopeClient.new(Configuration.config)
+  end
+
+  after(:all) do
+    @client.logger.info('Cleaning up test users...')
+    all_users = @client.search_all_users
+    all_users['users'].each do |user|
+      if user['middleName'] == 'Ruby SDK User'
+        @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
+        @client.delete_user(user['loginIds'][0])
+      end
+    end
+  end
+
+  context 'test totp methods' do
+    it 'should sign up with totp' do
+      # Initiate a TOTP sign-up process for a new end user.
+      # Descope will generate a TOTP key (also called a secret or seed) that will be entered into the end user's
+      # authenticator app so that TOTP codes can be successfully verified.
+      # The new end user will be registered after the full TOTP sign-up flow has successfully completed.
+
+      user = build(:user)
+
+      @client.logger.info('1. Sign up TOTP')
+      totp_key = @client.totp_sign_up(login_id: user[:login_id], user:)['key']
+      totp = ROTP::TOTP.new(totp_key)
+      p "Current OTP: #{totp.now}"
+
+      @client.logger.info('2. TOTP sign in')
+      login_res = @client.totp_sign_in_code(login_id: user[:login_id], code: totp.now)
+      @client.logger.info("login_res: #{login_res}")
+      refresh_token = login_res['refreshSessionToken']['jwt']
+
+      @client.logger.info('3. Verify email')
+      my_details = @client.me(refresh_token)
+      expect(my_details['email']).to eq(user[:email])
+    end
+
+    it 'should add or update totp key' do
+      # Add or update TOTP key for existing end user
+      # Update the email address of an end user, after verifying the authenticity of the end user using OTP.
+
+      user = build(:user)
+
+      @client.logger.info('1. Sign up TOTP')
+      totp_key = @client.totp_sign_up(login_id: user[:login_id], user:)['key']
+      totp = ROTP::TOTP.new(totp_key)
+      p "Current OTP: #{totp.now}"
+
+      @client.logger.info('2. TOTP sign in')
+      login_res = @client.totp_sign_in_code(login_id: user[:login_id], code: totp.now)
+      @client.logger.info("login_res: #{login_res}")
+      refresh_token = login_res['refreshSessionToken']['jwt']
+
+      @client.logger.info('3. Add or update TOTP key')
+      new_key = @client.totp_add_update_key(login_id: user[:login_id], refresh_token:)['key']
+      new_totp = ROTP::TOTP.new(new_key)
+      p "New OTP: #{totp.now}"
+
+      @client.logger.info('4. TOTP sign in with new key')
+      login_res = @client.totp_sign_in_code(login_id: user[:login_id], code: new_totp.now)
+      refresh_token = login_res['refreshSessionToken']['jwt']
+
+      @client.logger.info('5. Verify email')
+      my_details = @client.me(refresh_token)
+      expect(my_details['email']).to eq(user[:email])
+    end
+  end
+end

data/spec/integration/lib.descope/api/v1/management/access_key_spec.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Descope::Api::V1::Management::AccessKey do
+  before(:all) do
+    @client = DescopeClient.new(Configuration.config)
+  end
+
+  context 'perform access key methods like create, delete load' do
+    before(:all) do
+      @key_name = 'Ruby SDK Test Key'
+
+      keys = @client.search_all_access_keys['keys']
+      keys.each do |key|
+        if key['name'] == @key_name
+          @client.delete_access_key(key['id'])
+          @client.logger.info("deleting test access key #{@key_name}")
+        end
+      end
+
+      res = @client.search_all_tenants(names: ['some-new-tenant'])
+      res['tenants'].each do |tenant|
+        @client.delete_tenant(tenant['id'])
+      end
+
+      @client.logger.info('Creating tenant with name: some-new-tenant')
+      @tenant_id = @client.create_tenant(name: 'some-new-tenant')['id']
+      @client.logger.info('creating access key')
+      @access_key = @client.create_access_key(name: @key_name, key_tenants: [{ tenant_id: @tenant_id }])
+      sleep 60
+    end
+
+    it 'should create the access key and load it' do
+      response = @client.load_access_key(@access_key['key']['id'])
+      expect(response['key']['name']).to eq(@key_name)
+    end
+
+    it 'should update the access key' do
+      new_name = 'Ruby SDK Test Key Updated'
+      @client.logger.info("access key id: #{@access_key['key']['id']}")
+      response = @client.update_access_key(id: @access_key['key']['id'], name: new_name)
+      expect(response['key']['name']).to eq(new_name)
+    end
+
+    it 'should deactivate the access key' do
+      response = @client.deactivate_access_key(@access_key['key']['id'])
+      @client.logger.info("deactivate key response: #{response}")
+      # expect(response['key']['status']).to eq('DEACTIVATED')
+    end
+
+    it 'should activate the access key' do
+      response = @client.activate_access_key(@access_key['key']['id'])
+      @client.logger.info("activate key response: #{response}")
+    end
+
+    after(:all) do
+      @client.delete_access_key(@access_key['key']['id'])
+      @client.delete_tenant(@tenant_id)
+    end
+  end
+end

data/spec/integration/lib.descope/api/v1/management/audit_spec.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Descope::Api::V1::Management::Audit do
+  before(:all) do
+    @client = DescopeClient.new(Configuration.config)
+  end
+
+
+  it 'should search the audit trail for user operations' do
+    res = @client.audit_search(actions: ['LoginSucceed'])
+    expect(res).to be_a(Hash)
+    expect(res['audits']).to be_a(Array)
+  end
+end