descope 1.0.7 → 1.2.0

data/spec/lib.descope/api/v1/management/user_spec.rb

@@ -58,7 +58,7 @@ describe Descope::Api::V1::Management::User do
     }
 
     it 'is expected to create a user with user data' do
-      expect(@instance).to receive(:post).with(USER_CREATE_PATH, params)
+      expect(@instance).to receive(:mgmt_post).with(USER_CREATE_PATH, params)
 
       expect do
         @instance.create_user(**args)
@@ -67,7 +67,7 @@ describe Descope::Api::V1::Management::User do
 
     it 'is expected to create a test user with user data' do
       params[:test] = true
-      expect(@instance).to receive(:post).with(TEST_USER_CREATE_PATH, params)
+      expect(@instance).to receive(:mgmt_post).with(TEST_USER_CREATE_PATH, params)
 
       expect do
         args[:test] = true
@@ -101,7 +101,7 @@ describe Descope::Api::V1::Management::User do
           }
         ]
       }
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_CREATE_BATCH_PATH, users_params
       )
 
@@ -117,7 +117,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it "is expected to post #{USER_CREATE_PATH} with invite true" do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_CREATE_PATH, {
           loginId: 'name@mail.com',
           email: 'name@mail.com',
@@ -143,7 +143,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a user update method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_PATH, {
           loginId: 'name@mail.com',
           email: 'name@mail.com',
@@ -171,7 +171,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a user delete method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_DELETE_PATH, { loginId: 'name@mail.com' }
       )
 
@@ -183,7 +183,7 @@ describe Descope::Api::V1::Management::User do
 
   context '.delete_all_user' do
     it 'is expected to respond to a user delete method' do
-      expect(@instance).to receive(:delete).with(USER_DELETE_ALL_TEST_USERS_PATH)
+      expect(@instance).to receive(:mgmt_delete).with(USER_DELETE_ALL_TEST_USERS_PATH)
 
       expect do
         @instance.delete_all_test_users
@@ -197,7 +197,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it "is expected to get #{USER_LOAD_PATH} with login_id" do
-      expect(@instance).to receive(:get).with(
+      expect(@instance).to receive(:mgmt_get).with(
         USER_LOAD_PATH, { loginId: 'someone' }
       )
       expect { @instance.load_user('someone') }.not_to raise_error
@@ -206,7 +206,7 @@ describe Descope::Api::V1::Management::User do
 
   context '.load_by_user_id' do
     it "is expected to get #{USER_LOAD_PATH} with user_id" do
-      allow(@instance).to receive(:get).with(
+      allow(@instance).to receive(:mgmt_get).with(
         USER_LOAD_PATH, { userId: 'ABCD' }
       )
       expect { @instance.load_by_user_id('ABCD') }.not_to raise_error
@@ -215,7 +215,7 @@ describe Descope::Api::V1::Management::User do
 
   context '.logout_user' do
     it 'is expected to respond to a logout user method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_LOGOUT_PATH, { loginId: 'name@mail.com' }
       )
 
@@ -225,7 +225,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a logout user by id method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_LOGOUT_PATH, { userId: 'U2ZpARjKAJJmq0fzU2lXNNCGnF4j' }
       )
 
@@ -241,7 +241,7 @@ describe Descope::Api::V1::Management::User do
 
       tenant_role_ids = { 'tenant1' => ['roleA', 'roleB'] }
       tenant_role_names = { 'tenant1' => ['roleName1', 'roleName2'] }
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USERS_SEARCH_PATH, {
           loginId: 'someone@example.com',
           tenantIds: [],
@@ -284,7 +284,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a get_provider_token method' do
       expect(@instance).to respond_to(:get_provider_token)
 
-      expect(@instance).to receive(:get).with(
+      expect(@instance).to receive(:mgmt_get).with(
         USER_GET_PROVIDER_TOKEN, {
           loginId: 'someone@example.com',
           provider: 'google-oauth2'
@@ -304,7 +304,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a activate method' do
       expect(@instance).to respond_to(:activate)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_STATUS_PATH, {
           loginId: 'someone@example.com',
           status: 'enabled'
@@ -321,7 +321,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a activate method' do
       expect(@instance).to respond_to(:activate)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_STATUS_PATH, {
           loginId: 'someone@example.com',
           status: 'disabled'
@@ -338,7 +338,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_email method' do
       expect(@instance).to respond_to(:update_email)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_EMAIL_PATH, {
           loginId: 'someone@example.com',
           email: 'tester@test.com',
@@ -360,7 +360,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_phone method' do
       expect(@instance).to respond_to(:update_phone)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_PHONE_PATH, {
           loginId: 'someone@example.com',
           phone: '1234567890',
@@ -382,7 +382,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_display_name method' do
       expect(@instance).to respond_to(:update_display_name)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_NAME_PATH, {
           loginId: 'someone@example.com',
           name: 'some guy',
@@ -408,7 +408,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_picture method' do
       expect(@instance).to respond_to(:update_picture)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_PICTURE_PATH, {
           loginId: 'someone@example.com',
           picture: 'https://www.example.com/picture.png'
@@ -428,7 +428,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_custom_attribute method' do
       expect(@instance).to respond_to(:update_custom_attribute)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_CUSTOM_ATTRIBUTE_PATH, {
           loginId: 'someone@example.com',
           attributeKey: 'OU',
@@ -450,7 +450,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a add_roles method' do
       expect(@instance).to respond_to(:user_add_roles)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_ADD_ROLE_PATH, {
           loginId: 'someone@example.com',
           roleNames: %w[role1 role2],
@@ -472,7 +472,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a user_remove_roles method' do
       expect(@instance).to respond_to(:user_remove_roles)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_REMOVE_ROLE_PATH, {
           loginId: 'someone@example.com',
           roleNames: %w[role1 role2],
@@ -494,7 +494,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a add_tenant method' do
       expect(@instance).to respond_to(:user_add_tenant)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_ADD_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1'
@@ -514,7 +514,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a remove_tenant method' do
       expect(@instance).to respond_to(:user_remove_tenant)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_REMOVE_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1'
@@ -534,7 +534,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a add_tenant_role method' do
       expect(@instance).to respond_to(:add_tenant_role)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_ADD_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1',
@@ -556,7 +556,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a remove_tenant_role method' do
       expect(@instance).to respond_to(:user_remove_tenant_roles)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_REMOVE_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1',
@@ -578,7 +578,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a set_temporary_password method' do
       expect(@instance).to respond_to(:set_temporary_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_SET_TEMPORARY_PASSWORD_PATH, {
           loginId: 'someone@example.com',
           password: 's3cr3t'
@@ -598,7 +598,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a set_active_password method' do
       expect(@instance).to respond_to(:set_active_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_SET_ACTIVE_PASSWORD_PATH, {
           loginId: 'someone@example.com',
           password: 's3cr3t'
@@ -618,7 +618,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a set_password method' do
       expect(@instance).to respond_to(:set_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_SET_PASSWORD_PATH, {
           loginId: 'someone@example.com',
           password: 's3cr3t'
@@ -638,7 +638,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a expire_password method' do
       expect(@instance).to respond_to(:expire_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_EXPIRE_PASSWORD_PATH, { loginId: 'someone@example.com' }
       )
 
@@ -650,7 +650,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a generate_otp_for_test method' do
       expect(@instance).to respond_to(:generate_otp_for_test_user)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_GENERATE_OTP_FOR_TEST_PATH, {
           loginId: 'someone@example.com',
           deliveryMethod: 'email'
@@ -670,7 +670,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a generate_enchanted_link_for_test method' do
       expect(@instance).to respond_to(:generate_enchanted_link_for_test_user)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_GENERATE_ENCHANTED_LINK_FOR_TEST_PATH, {
           loginId: 'someone@example.com',
           URI: 'https://www.example.com'
@@ -690,7 +690,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_jwt method' do
       expect(@instance).to respond_to(:update_jwt)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         UPDATE_JWT_PATH, {
           jwt: 'eyJ3abcde12345',
           customClaims: { 'claim1' => 'value1', 'claim2' => 'value2' }
@@ -717,7 +717,7 @@ describe Descope::Api::V1::Management::User do
         customClaims: { 'abc': '123' }
       }
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_GENERATE_EMBEDDED_LINK_PATH,
         request_params
       )
@@ -737,7 +737,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a user patch method' do
-      expect(@instance).to receive(:patch).with(
+      expect(@instance).to receive(:mgmt_patch).with(
         USER_PATCH_PATH, {
           loginId: 'name@mail.com',
           email: 'name@mail.com',
@@ -765,7 +765,7 @@ describe Descope::Api::V1::Management::User do
 
       tenant_role_ids = { 'tenant1' => ['roleA', 'roleB'] }
       tenant_role_names = { 'tenant1' => ['roleName1', 'roleName2'] }
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         TEST_USERS_SEARCH_PATH, {
           tenantIds: %w[t1 t2],
           roleNames: %w[r1 r2],

data/spec/lib.descope/auth_management_key_spec.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+# Covers the Authorization header the SDK actually sends. The auth management key rides along with
+# every authentication request so that methods whose public access has been disabled can still be
+# used, and it is never sent on management requests - those carry the management key instead.
+describe 'auth management key' do
+  let(:project_id) { 'P2abcde12345' }
+  let(:management_key) { 'mgmt-key' }
+  let(:auth_management_key) { 'auth-key' }
+  let(:refresh_token) { 'refresh-token' }
+
+  # Stubs the RestClient boundary on both of the client's HTTP clients and hands back the
+  # Authorization header of whichever one ends up being used.
+  def authorization_for(client)
+    captured = nil
+    [client.auth_http, client.mgmt_http].each do |http|
+      allow(http).to receive(:call) do |_method, _url, _timeout, headers, _body|
+        captured = headers['Authorization']
+        double('response', code: 200, body: '{}', cookies: {}, headers: {})
+      end
+    end
+    yield
+    captured
+  end
+
+  def build_client(**options)
+    Descope::Client.new({ project_id: project_id, log_level: 'fatal' }.merge(options))
+  end
+
+  # An authentication request that presents no token of its own.
+  def sign_up(client)
+    client.otp_sign_up(method: Descope::Mixins::Common::DeliveryMethod::EMAIL, login_id: 'someone@example.com')
+  end
+
+  around do |example|
+    keys = %w[DESCOPE_MANAGEMENT_KEY DESCOPE_AUTH_MANAGEMENT_KEY]
+    saved = keys.to_h { |var| [var, ENV[var]] }
+    keys.each { |var| ENV.delete(var) }
+    example.run
+  ensure
+    saved.each { |var, value| ENV[var] = value }
+  end
+
+  context 'on authentication requests' do
+    it 'sends only the project ID when no auth management key is configured' do
+      client = build_client
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}")
+    end
+
+    it 'appends the auth management key when one is configured' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+
+    it 'appends the auth management key after a refresh token' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.me(refresh_token) }
+      expect(header).to eq("Bearer #{project_id}:#{refresh_token}:#{auth_management_key}")
+    end
+
+    it 'never sends the management key' do
+      client = build_client(management_key: management_key, auth_management_key: auth_management_key)
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+      expect(header).to_not include(management_key)
+    end
+
+    # DummyClass swallows extra_headers, so only a real client exercises this argument.
+    it 'tolerates a nil extra_headers from the caller' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.post(SIGN_IN_PASSWORD_PATH, {}, nil, refresh_token) }
+      expect(header).to eq("Bearer #{project_id}:#{refresh_token}:#{auth_management_key}")
+    end
+
+    it 'signs in with an enchanted link' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) do
+        client.enchanted_link_sign_in(login_id: 'someone@example.com', uri: 'https://example.com')
+      end
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+
+    it 'does not substitute a key for an empty refresh token' do
+      client = build_client(management_key: management_key, auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.sign_out('') }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+  end
+
+  context 'on management requests' do
+    it 'appends the management key' do
+      client = build_client(management_key: management_key)
+      header = authorization_for(client) { client.load_all_tenants }
+      expect(header).to eq("Bearer #{project_id}:#{management_key}")
+    end
+
+    it 'never sends the auth management key' do
+      client = build_client(management_key: management_key, auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.load_all_tenants }
+      expect(header).to eq("Bearer #{project_id}:#{management_key}")
+      expect(header).to_not include(auth_management_key)
+    end
+
+    it 'sends only the project ID when no management key is configured' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.load_all_tenants }
+      expect(header).to eq("Bearer #{project_id}")
+    end
+  end
+
+  context 'configuration' do
+    it 'falls back to the DESCOPE_AUTH_MANAGEMENT_KEY env var' do
+      ENV['DESCOPE_AUTH_MANAGEMENT_KEY'] = 'env-auth-key'
+      client = build_client
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:env-auth-key")
+    end
+
+    it 'prefers the configured key over the env var' do
+      ENV['DESCOPE_AUTH_MANAGEMENT_KEY'] = 'env-auth-key'
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+
+    it 'keeps the two keys distinct' do
+      ENV['DESCOPE_MANAGEMENT_KEY'] = management_key
+      ENV['DESCOPE_AUTH_MANAGEMENT_KEY'] = auth_management_key
+      client = build_client
+      expect(client.auth_http.authorization_header).to eq(
+        { 'Authorization' => "Bearer #{project_id}:#{auth_management_key}" }
+      )
+      expect(client.mgmt_http.authorization_header).to eq(
+        { 'Authorization' => "Bearer #{project_id}:#{management_key}" }
+      )
+    end
+  end
+
+  describe 'debug logging' do
+    it 'masks everything after the project ID' do
+      client = build_client(auth_management_key: auth_management_key)
+      masked = client.auth_http.mask_authorization(client.auth_http.authorization_header)
+      expect(masked['Authorization']).to eq("Bearer #{project_id}:***")
+      expect(masked['Authorization']).to_not include(auth_management_key)
+    end
+  end
+end

data/spec/lib.descope/mixins/http_spec.rb

@@ -94,6 +94,17 @@ describe Descope::Mixins::HTTP do
         expect(result['cookies']['DSR']).to eq('refresh_jwt_token')
       end
 
+      it 'parses cookies from Set-Cookie headers with symbol key (real RestClient behavior)' do
+        # RestClient returns headers with symbol keys like :set_cookie, not string keys
+        mock_headers = { set_cookie: set_cookie_headers }
+
+        result = @instance.safe_parse_json(mock_body, cookies: {}, headers: mock_headers)
+
+        expect(result['cookies']).to_not be_nil
+        expect(result['cookies']['DS']).to eq('session_jwt_token')
+        expect(result['cookies']['DSR']).to eq('refresh_jwt_token')
+      end
+
       it 'parses cookies from Set-Cookie header when headers is a string' do
         mock_headers = { 'Set-Cookie' => set_cookie_headers.first }
 
@@ -120,7 +131,7 @@ describe Descope::Mixins::HTTP do
           "DS=#{jwt_session}; Path=/; Domain=custom.example.com; HttpOnly; Secure; SameSite=None",
           "DSR=#{jwt_refresh}; Path=/; Domain=custom.example.com; HttpOnly; Secure; SameSite=None; Max-Age=2592000"
         ]
-        mock_headers = { 'set-cookie' => complex_headers }
+        mock_headers = { set_cookie: complex_headers }
 
         result = @instance.safe_parse_json(mock_body, cookies: {}, headers: mock_headers)
         
@@ -134,7 +145,7 @@ describe Descope::Mixins::HTTP do
           'CLOUDFLARE_SESSION=cf_token; Path=/; Domain=.example.com; HttpOnly',
           'DSR=refresh_token; Path=/; Domain=dev.example.com; HttpOnly'
         ]
-        mock_headers = { 'set-cookie' => mixed_headers }
+        mock_headers = { set_cookie: mixed_headers }
 
         result = @instance.safe_parse_json(mock_body, cookies: {}, headers: mock_headers)
         
@@ -175,7 +186,7 @@ describe Descope::Mixins::HTTP do
           'DS=; Path=/; Domain=example.com',  # Empty value
           '=value_without_name; Path=/',       # No name
         ]
-        mock_headers = { 'set-cookie' => malformed_headers }
+        mock_headers = { set_cookie: malformed_headers }
 
         result = @instance.safe_parse_json(mock_body, cookies: {}, headers: mock_headers)
         
@@ -186,7 +197,7 @@ describe Descope::Mixins::HTTP do
       it 'prefers RestClient cookies over Set-Cookie headers when both available' do
         mock_cookies = { 'DS' => 'restclient_token' }
         set_cookie_headers = ['DS=header_token; Path=/; Domain=example.com']
-        mock_headers = { 'set-cookie' => set_cookie_headers }
+        mock_headers = { set_cookie: set_cookie_headers }
 
         result = @instance.safe_parse_json(mock_body, cookies: mock_cookies, headers: mock_headers)
         
@@ -204,7 +215,7 @@ describe Descope::Mixins::HTTP do
       allow(mock_response).to receive(:body).and_return('{"success": true}')
       allow(mock_response).to receive(:cookies).and_return({})
       allow(mock_response).to receive(:headers).and_return({
-        'set-cookie' => ['DS=test_token; Domain=custom.example.com']
+        set_cookie: ['DS=test_token; Domain=custom.example.com']
       })
 
       allow(@instance).to receive(:call).and_return(mock_response)
@@ -215,4 +226,4 @@ describe Descope::Mixins::HTTP do
       expect(result['cookies']['DS']).to eq('test_token')
     end
   end
-end
+end

data/spec/support/client_config.rb

@@ -11,6 +11,7 @@ module Configuration
       descope_base_uri: ENV.fetch('DESCOPE_BASE_URI', Descope::Mixins::Common::DEFAULT_BASE_URL),
       project_id: ENV.fetch('DESCOPE_PROJECT_ID', nil),
       management_key: ENV.fetch('DESCOPE_MANAGEMENT_KEY', nil),
+      auth_management_key: ENV.fetch('DESCOPE_AUTH_MANAGEMENT_KEY', nil),
       log_level: ENV.fetch('DESCOPE_LOG_LEVEL', 'info')
     }
   end

data/spec/support/dummy_class.rb

@@ -33,18 +33,21 @@ class DummyClass
     @headers.merge!(h.to_hash)
   end
 
+  # Mirrors Descope::HttpClient#authorization_header. Specs that need to assert on the real bearer
+  # should drive a Descope::Client instead - see spec/lib.descope/auth_management_key_spec.rb.
   def authorization_header(pswd = nil)
-    pswd = @default_pswd if pswd.nil? || pswd.empty?
-    bearer = "#{@project_id}:#{pswd}"
-    add_headers('Authorization' => "Bearer #{bearer}")
+    bearer = [@project_id, pswd, @key].reject { |part| part.nil? || part.to_s.empty? }.join(':')
+    { 'Authorization' => "Bearer #{bearer}" }
   end
 
-  %i[get post post_file post_form put patch delete delete_with_body].each do |method|
-    define_method(method) do |uri, body = {}, extra_headers = {}, pswd = nil|
-      body = body.delete_if { |_, v| v.nil? }
-      authorization_header(pswd) unless pswd.nil? || pswd.empty?
-      {}
+  # The bare verbs stand in for authentication requests, the mgmt_ prefixed ones for management
+  # requests, matching how Descope::Client routes them to its two HTTP clients.
+  Descope::Mixins::HTTP::HTTP_METHODS.each do |method|
+    [method, :"mgmt_#{method}"].each do |name|
+      define_method(name) do |_uri, _body = {}, _extra_headers = {}, pswd = nil|
+        add_headers(authorization_header(pswd)) unless pswd.nil? || pswd.empty?
+        {}
+      end
     end
   end
-
 end

data/spec/support/utils.rb

@@ -35,4 +35,19 @@ module SpecUtils
     prefix = ENV['GITHUB_RUN_NUMBER'] || ENV['GITHUB_RUN_ID']
     prefix ? "build#{prefix}-" : "local-#{Time.now.to_i}-"
   end
+
+  def wait_for_condition(max_wait: 60, interval: 2, description: 'condition')
+    start = Time.now
+    loop do
+      result = yield
+      return result if result
+
+      elapsed = Time.now - start
+      if elapsed > max_wait
+        raise "Timeout after #{max_wait}s waiting for #{description}"
+      end
+
+      sleep interval
+    end
+  end
 end