descope 1.0.7 → 1.2.0

data/lib/descope/api/v1/management/third_party_application.rb

@@ -0,0 +1,190 @@
+# frozen_string_literal: true
+
+module Descope
+  module Api
+    module V1
+      module Management
+        # Management API calls for third party applications
+        module ThirdPartyApplication
+          include Descope::Api::V1::Management::Common
+
+          def create_application(
+            name: nil,
+            id: nil,
+            description: nil,
+            logo: nil,
+            login_page_url: nil,
+            approved_callback_urls: nil,
+            permissions_scopes: nil,
+            attributes_scopes: nil,
+            jwt_bearer_settings: nil,
+            custom_attributes: nil,
+            force_pkce: nil,
+            default_audience: nil
+          )
+            # Create a new third party application with the given name. Application IDs are provisioned automatically,
+            # but can be provided explicitly if needed. Both the name and ID must be unique per project.
+            body = compose_create_update_body(
+              name:,
+              id:,
+              description:,
+              logo:,
+              login_page_url:,
+              approved_callback_urls:,
+              permissions_scopes:,
+              attributes_scopes:,
+              jwt_bearer_settings:,
+              custom_attributes:,
+              force_pkce:,
+              default_audience:
+            )
+            mgmt_post(THIRD_PARTY_APP_CREATE_PATH, body)
+          end
+
+          def update_application(
+            id: nil,
+            name: nil,
+            description: nil,
+            logo: nil,
+            login_page_url: nil,
+            approved_callback_urls: nil,
+            permissions_scopes: nil,
+            attributes_scopes: nil,
+            jwt_bearer_settings: nil,
+            custom_attributes: nil,
+            force_pkce: nil,
+            default_audience: nil
+          )
+            # Update an existing third party application with the given parameters. IMPORTANT: All parameters are used as
+            # overrides to the existing application. Empty fields will override populated fields. Use carefully.
+            body = compose_create_update_body(
+              name:,
+              id:,
+              description:,
+              logo:,
+              login_page_url:,
+              approved_callback_urls:,
+              permissions_scopes:,
+              attributes_scopes:,
+              jwt_bearer_settings:,
+              custom_attributes:,
+              force_pkce:,
+              default_audience:
+            )
+            mgmt_post(THIRD_PARTY_APP_UPDATE_PATH, body)
+          end
+
+          def patch_application(
+            id: nil,
+            name: nil,
+            description: nil,
+            logo: nil,
+            login_page_url: nil,
+            approved_callback_urls: nil,
+            permissions_scopes: nil,
+            attributes_scopes: nil,
+            jwt_bearer_settings: nil,
+            custom_attributes: nil,
+            force_pkce: nil,
+            default_audience: nil
+          )
+            # Patch an existing third party application. Only the provided fields will be updated.
+            body = compose_create_update_body(
+              name:,
+              id:,
+              description:,
+              logo:,
+              login_page_url:,
+              approved_callback_urls:,
+              permissions_scopes:,
+              attributes_scopes:,
+              jwt_bearer_settings:,
+              custom_attributes:,
+              force_pkce:,
+              default_audience:
+            )
+            mgmt_post(THIRD_PARTY_APP_PATCH_PATH, body)
+          end
+
+          def delete_application(id)
+            # Delete an existing third party application. IMPORTANT: This operation is irreversible. Use carefully.
+            mgmt_post(THIRD_PARTY_APP_DELETE_PATH, { id: })
+          end
+
+          def load_application(id)
+            # Load an existing third party application.
+            mgmt_get(THIRD_PARTY_APP_LOAD_PATH, { id: })
+          end
+
+          def load_all_applications
+            # Load all third party applications.
+            mgmt_get(THIRD_PARTY_APP_LOAD_ALL_PATH, {})
+          end
+
+          def get_application_secret(id)
+            # Get the cleartext secret of an existing third party application.
+            mgmt_get(THIRD_PARTY_APP_SECRET_PATH, { id: })
+          end
+
+          def rotate_application_secret(id)
+            # Rotate the secret of an existing third party application, returning the new cleartext secret.
+            mgmt_post(THIRD_PARTY_APP_ROTATE_PATH, { id: })
+          end
+
+          def delete_consents(app_id: nil, consent_ids: nil, user_ids: nil, tenant_id: nil)
+            # Delete consents of a third party application.
+            body = {}
+            body[:consentIds] = consent_ids if consent_ids
+            body[:appId] = app_id if app_id
+            body[:userIds] = user_ids if user_ids
+            body[:tenantId] = tenant_id if tenant_id
+            mgmt_post(THIRD_PARTY_APP_DELETE_CONSENTS_PATH, body)
+          end
+
+          def delete_tenant_consents(app_id: nil, consent_ids: nil, tenant_id: nil)
+            # Delete consents of a third party application for a specific tenant.
+            body = {}
+            body[:consentIds] = consent_ids if consent_ids
+            body[:appId] = app_id if app_id
+            body[:tenantId] = tenant_id if tenant_id
+            mgmt_post(THIRD_PARTY_APP_DELETE_TENANT_CONSENTS_PATH, body)
+          end
+
+          private
+
+          # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+          def compose_create_update_body(
+            name: nil,
+            id: nil,
+            description: nil,
+            logo: nil,
+            login_page_url: nil,
+            approved_callback_urls: nil,
+            permissions_scopes: nil,
+            attributes_scopes: nil,
+            jwt_bearer_settings: nil,
+            custom_attributes: nil,
+            force_pkce: nil,
+            default_audience: nil
+          )
+            body = {}
+            body[:id] = id if id
+            body[:name] = name if name
+            body[:description] = description if description
+            body[:logo] = logo if logo
+            body[:loginPageUrl] = login_page_url if login_page_url
+            body[:approvedCallbackUrls] = approved_callback_urls if approved_callback_urls
+            body[:permissionsScopes] = permissions_scopes if permissions_scopes
+            body[:attributesScopes] = attributes_scopes if attributes_scopes
+            body[:jwtBearerSettings] = jwt_bearer_settings if jwt_bearer_settings
+            body[:customAttributes] = custom_attributes if custom_attributes
+            body[:forcePkce] = force_pkce unless force_pkce.nil?
+            body[:defaultAudience] = default_audience if default_audience
+            body
+          end
+          # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+        end
+      end
+    end
+  end
+end

data/lib/descope/api/v1/management/user.rb

@@ -27,7 +27,7 @@ module Descope
             request_params = {
               users: users_params
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           # Create a new test user.
@@ -102,7 +102,7 @@ module Descope
               hashed_password:,
               sso_app_ids:
             )
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           # Delete a user, using a valid management key.
@@ -113,12 +113,12 @@ module Descope
             request_params = {
               loginId: login_id
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           def delete_all_test_users
             path = Common::USER_DELETE_ALL_TEST_USERS_PATH
-            delete(path)
+            mgmt_delete(path)
           end
 
           # Load a user's data, using a valid management key.
@@ -132,7 +132,7 @@ module Descope
               loginId: login_id
             }
             path = Common::USER_LOAD_PATH
-            get(path, request_params)
+            mgmt_get(path, request_params)
           end
 
           # Load a user's data, using a valid management key by user id.
@@ -146,7 +146,7 @@ module Descope
             request_params = {
               userId: user_id
             }
-            get(path, request_params)
+            mgmt_get(path, request_params)
           end
 
           # Log a user out of all sessions, using a valid management key.
@@ -157,7 +157,7 @@ module Descope
             request_params = {
               loginId: login_id
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           def logout_user_by_id(user_id)
@@ -166,7 +166,7 @@ module Descope
             request_params = {
               userId: user_id
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           # Search for users, using a valid management key.
@@ -216,7 +216,7 @@ module Descope
             body[:roleNames] = role_names unless role_names.empty?
             body[:tenantRoleIds] = map_to_values_object(tenant_role_ids) unless tenant_role_ids.nil? || tenant_role_ids.empty?
             body[:tenantRoleNames] = map_to_values_object(tenant_role_names) unless tenant_role_names.nil? || tenant_role_names.empty?
-            post(Common::USERS_SEARCH_PATH, body)
+            mgmt_post(Common::USERS_SEARCH_PATH, body)
           end
 
           def map_to_values_object(input_map)
@@ -234,7 +234,7 @@ module Descope
               loginId: login_id,
               provider: provider
             }
-            get(path, request_params)
+            mgmt_get(path, request_params)
           end
 
           # Updates an existing user's status, using a valid management key.
@@ -246,7 +246,7 @@ module Descope
               loginId: login_id,
               status: 'enabled'
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           def deactivate(login_id)
@@ -256,7 +256,7 @@ module Descope
               loginId: login_id,
               status: 'disabled'
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           # Updates an existing user's login ID, using a valid management key.
@@ -268,7 +268,7 @@ module Descope
               loginId: login_id,
               newLoginId: new_login_id
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           # Updates an existing user's email, using a valid management key.
@@ -281,7 +281,7 @@ module Descope
               email:,
               verified:
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           # Updates an existing user's phone number, using a valid management key.
@@ -293,7 +293,7 @@ module Descope
               phone:,
               verified:
             }
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           # Updates an existing user's display name, using a valid management key.
@@ -310,7 +310,7 @@ module Descope
             body[:givenName] = given_name unless given_name.nil?
             body[:middleName] = middle_name unless middle_name.nil?
             body[:familyName] = family_name unless family_name.nil?
-            post(Common::USER_UPDATE_NAME_PATH, body)
+            mgmt_post(Common::USER_UPDATE_NAME_PATH, body)
           end
 
           # Update an existing user's profile picture, using a valid management key.
@@ -320,7 +320,7 @@ module Descope
               loginId: login_id,
               picture: picture
             }
-            post(Common::USER_UPDATE_PICTURE_PATH, body)
+            mgmt_post(Common::USER_UPDATE_PICTURE_PATH, body)
           end
 
           # Update an existing user's custom attributes, using a valid management key.
@@ -332,7 +332,7 @@ module Descope
               attributeKey: attribute_key,
               attributeValue: attribute_value
             }
-            post(Common::USER_UPDATE_CUSTOM_ATTRIBUTE_PATH, body)
+            mgmt_post(Common::USER_UPDATE_CUSTOM_ATTRIBUTE_PATH, body)
           end
 
           def patch_user(
@@ -377,7 +377,7 @@ module Descope
               hashed_password:,
               sso_app_ids:
             )
-            patch(path, request_params)
+            mgmt_patch(path, request_params)
           end
 
           def update_jwt(jwt: nil, custom_claims: nil)
@@ -385,7 +385,7 @@ module Descope
               jwt:,
               customClaims: custom_claims,
             }
-            post(Common::UPDATE_JWT_PATH, body)
+            mgmt_post(Common::UPDATE_JWT_PATH, body)
           end
 
           #
@@ -395,7 +395,7 @@ module Descope
               roleNames: role_names,
               tenantId: tenant_id
             }
-            post(Common::USER_ADD_ROLE_PATH, body)
+            mgmt_post(Common::USER_ADD_ROLE_PATH, body)
           end
 
           def user_remove_roles(login_id: nil, tenant_id:nil, role_names: [])
@@ -404,7 +404,7 @@ module Descope
               roleNames: role_names,
               tenantId: tenant_id
             }
-            post(Common::USER_REMOVE_ROLE_PATH, body)
+            mgmt_post(Common::USER_REMOVE_ROLE_PATH, body)
           end
 
           def user_add_tenant(login_id: nil, tenant_id: nil)
@@ -412,7 +412,7 @@ module Descope
               loginId: login_id,
               tenantId: tenant_id
             }
-            post(Common::USER_ADD_TENANT_PATH, body)
+            mgmt_post(Common::USER_ADD_TENANT_PATH, body)
           end
 
           def user_remove_tenant(login_id: nil, tenant_id: nil)
@@ -420,7 +420,7 @@ module Descope
               loginId: login_id,
               tenantId: tenant_id
             }
-            post(Common::USER_REMOVE_TENANT_PATH, body)
+            mgmt_post(Common::USER_REMOVE_TENANT_PATH, body)
           end
 
           def add_tenant_role(login_id: nil, tenant_id: nil, role_names: [])
@@ -429,7 +429,7 @@ module Descope
               tenantId: tenant_id,
               roleNames: role_names
             }
-            post(Common::USER_ADD_TENANT_PATH, body)
+            mgmt_post(Common::USER_ADD_TENANT_PATH, body)
           end
 
           def user_remove_tenant_roles(login_id: nil, tenant_id: nil, role_names: [])
@@ -438,7 +438,7 @@ module Descope
               tenantId: tenant_id,
               roleNames: role_names
             }
-            post(Common::USER_REMOVE_TENANT_PATH, body)
+            mgmt_post(Common::USER_REMOVE_TENANT_PATH, body)
           end
 
           def set_temporary_password(login_id: nil, password: nil)
@@ -446,7 +446,7 @@ module Descope
               loginId: login_id,
               password:
             }
-            post(Common::USER_SET_TEMPORARY_PASSWORD_PATH, body)
+            mgmt_post(Common::USER_SET_TEMPORARY_PASSWORD_PATH, body)
           end
 
           def set_active_password(login_id: nil, password: nil)
@@ -454,7 +454,7 @@ module Descope
               loginId: login_id,
               password:
             }
-            post(Common::USER_SET_ACTIVE_PASSWORD_PATH, body)
+            mgmt_post(Common::USER_SET_ACTIVE_PASSWORD_PATH, body)
           end
 
 		  # Deprecated (use set_temporary_password(..) instead)
@@ -463,7 +463,7 @@ module Descope
               loginId: login_id,
               password:
             }
-            post(Common::USER_SET_PASSWORD_PATH, body)
+            mgmt_post(Common::USER_SET_PASSWORD_PATH, body)
           end
 
           def expire_password(login_id)
@@ -471,7 +471,7 @@ module Descope
             body = {
               loginId: login_id
             }
-            post(Common::USER_EXPIRE_PASSWORD_PATH, body)
+            mgmt_post(Common::USER_EXPIRE_PASSWORD_PATH, body)
           end
 
           def generate_otp_for_test_user(method: nil, login_id: nil)
@@ -479,7 +479,7 @@ module Descope
               loginId: login_id,
               deliveryMethod: get_method_string(method)
             }
-            post(Common::USER_GENERATE_OTP_FOR_TEST_PATH, body)
+            mgmt_post(Common::USER_GENERATE_OTP_FOR_TEST_PATH, body)
           end
 
           def generate_magic_link_for_test_user(method: nil, login_id: nil, uri: nil)
@@ -488,7 +488,7 @@ module Descope
               deliveryMethod: get_method_string(method),
               URI: uri
             }
-            post(Common::USER_GENERATE_MAGIC_LINK_FOR_TEST_PATH, body)
+            mgmt_post(Common::USER_GENERATE_MAGIC_LINK_FOR_TEST_PATH, body)
           end
 
           def generate_enchanted_link_for_test_user(login_id: nil, uri: nil)
@@ -496,7 +496,7 @@ module Descope
               loginId: login_id,
               URI: uri
             }
-            post(Common::USER_GENERATE_ENCHANTED_LINK_FOR_TEST_PATH, body)
+            mgmt_post(Common::USER_GENERATE_ENCHANTED_LINK_FOR_TEST_PATH, body)
           end
 
           def generate_embedded_link(login_id: nil, custom_claims: nil)
@@ -513,7 +513,7 @@ module Descope
               loginId: login_id,
               customClaims: custom_claims.to_h
             }
-            post(USER_GENERATE_EMBEDDED_LINK_PATH, request_params)
+            mgmt_post(USER_GENERATE_EMBEDDED_LINK_PATH, request_params)
           end
 
           # Search for all test users.
@@ -582,7 +582,7 @@ module Descope
             body[:tenantRoleIds] = map_to_values_object(tenant_role_ids) unless tenant_role_ids.nil? || tenant_role_ids.empty?
             body[:tenantRoleNames] = map_to_values_object(tenant_role_names) unless tenant_role_names.nil? || tenant_role_names.empty?
 
-            post(Common::TEST_USERS_SEARCH_PATH, body)
+            mgmt_post(Common::TEST_USERS_SEARCH_PATH, body)
           end
 
 
@@ -647,7 +647,7 @@ module Descope
             )
             return request_params if skip_create
 
-            post(path, request_params)
+            mgmt_post(path, request_params)
           end
 
           def user_compose_create_body(

data/lib/descope/api/v1/management.rb

@@ -14,6 +14,17 @@ require 'descope/api/v1/management/sso_application'
 require 'descope/api/v1/management/sso_settings'
 require 'descope/api/v1/management/scim'
 require 'descope/api/v1/management/password'
+require 'descope/api/v1/management/outbound_app'
+require 'descope/api/v1/management/group'
+require 'descope/api/v1/management/fga'
+require 'descope/api/v1/management/third_party_application'
+require 'descope/api/v1/management/management_key'
+require 'descope/api/v1/management/analytics'
+require 'descope/api/v1/management/descoper'
+require 'descope/api/v1/management/engine'
+require 'descope/api/v1/management/lists'
+require 'descope/api/v1/management/jwt_template'
+require 'descope/api/v1/management/scope_claim_mapping'
 
 module Descope
   module Api
@@ -34,6 +45,17 @@ module Descope
         include Descope::Api::V1::Management::SSOSettings
         include Descope::Api::V1::Management::SCIM
         include Descope::Api::V1::Management::Password
+        include Descope::Api::V1::Management::OutboundApp
+        include Descope::Api::V1::Management::Group
+        include Descope::Api::V1::Management::FGA
+        include Descope::Api::V1::Management::ThirdPartyApplication
+        include Descope::Api::V1::Management::ManagementKey
+        include Descope::Api::V1::Management::Analytics
+        include Descope::Api::V1::Management::Descoper
+        include Descope::Api::V1::Management::Engine
+        include Descope::Api::V1::Management::Lists
+        include Descope::Api::V1::Management::JWTTemplate
+        include Descope::Api::V1::Management::ScopeClaimMapping
       end
     end
   end

data/lib/descope/http_client.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require 'descope/mixins/http'
+
+module Descope
+  # Performs the SDK's HTTP calls. One instance is created per kind of request so that the two
+  # management keys are never sent together: the management client carries the management key, the
+  # authentication client carries the auth management key.
+  class HttpClient
+    include Descope::Mixins::HTTP
+
+    def initialize(base_uri:, project_id:, headers:, logger:, key: nil, timeout: nil, retry_count: nil)
+      @base_uri = base_uri
+      @project_id = project_id
+      @key = key
+      @headers = headers.dup
+      @logger = logger
+      @timeout = timeout
+      @retry_count = retry_count
+    end
+
+    # Bearer <project_id>[:<pswd>][:<key>] where pswd is a refresh token or access key presented by
+    # the caller and key is this client's management key. Blank parts are skipped, so callers do
+    # not have to branch on what happens to be configured.
+    def authorization_header(pswd = nil)
+      bearer = [@project_id, pswd, @key].reject { |part| part.nil? || part.to_s.empty? }.join(':')
+      { 'Authorization' => "Bearer #{bearer}" }
+    end
+  end
+end

data/lib/descope/mixins/common.rb

@@ -81,6 +81,7 @@ module Descope
         VERIFY_ENCHANTEDLINK_AUTH_PATH = '/v1/auth/enchantedlink/verify'
         GET_SESSION_ENCHANTEDLINK_AUTH_PATH = '/v1/auth/enchantedlink/pending-session'
         UPDATE_USER_EMAIL_ENCHANTEDLINK_PATH = '/v1/auth/enchantedlink/update/email'
+        UPDATE_USER_PHONE_ENCHANTEDLINK_PATH = '/v1/auth/enchantedlink/update/phone'
 
         # oauth
         OAUTH_START_PATH = '/v1/auth/oauth/authorize'

data/lib/descope/mixins/http.rb

@@ -18,13 +18,18 @@ module Descope
       MIN_REQUEST_RETRY_DELAY = 250
       BASE_DELAY = 100
 
-      %i[get post post_file post_form put patch delete delete_with_body].each do |method|
+      HTTP_METHODS = %i[get post put patch delete].freeze
+
+      HTTP_METHODS.each do |method|
         define_method(method) do |uri, body = {}, extra_headers = {}, pswd = nil|
           body = body.delete_if { |_, v| v.nil? }
-          authorization_header(pswd) # This will set the pswd if provided, else default to the @default_pswd
+
+          # The Authorization header travels with the request rather than being merged into the
+          # shared @headers, so concurrent requests cannot send each other's credentials.
+          headers = authorization_header(pswd).merge(extra_headers || {})
 
           @logger.debug "request => method: #{method}, uri: #{uri}, body: #{body}, extra_headers: #{extra_headers}}"
-          request_with_retry(method, uri, body, extra_headers)
+          request_with_retry(method, uri, body, headers)
         end
       end
 
@@ -63,9 +68,9 @@ module Descope
         # If no cookies found via RestClient, parse Set-Cookie headers directly
         # This handles custom domain cookies that RestClient filters out
         if extracted_cookies.empty? && headers.respond_to?(:[])
-          set_cookie_headers = headers['set-cookie'] || headers['Set-Cookie'] || []
+          set_cookie_headers = headers[:set_cookie] || headers['set-cookie'] || headers['Set-Cookie'] || []
           set_cookie_headers = [set_cookie_headers] unless set_cookie_headers.is_a?(Array)
-          
+
           set_cookie_headers.each do |cookie_header|
             next unless cookie_header.is_a?(String)
             
@@ -118,6 +123,15 @@ module Descope
         @headers.merge!(h.to_hash)
       end
 
+      # Everything after the project ID in the bearer is either a token or a management key, so
+      # none of it belongs in a log line.
+      def mask_authorization(headers)
+        authorization = headers['Authorization']
+        return headers if authorization.nil?
+
+        headers.merge('Authorization' => authorization.sub(/\A(Bearer [^:]*):.*\z/, '\1:***'))
+      end
+
       def request_with_retry(method, uri, body = {}, extra_headers = {}, pswd = nil)
         Retryable.retryable(retry_options) do
           request(method, uri, body, extra_headers)
@@ -125,23 +139,16 @@ module Descope
       end
 
       def request(method, uri, body = {}, extra_headers = {})
-        # @headers is getting the authorization header merged in initializer.rb
-        headers_debug = @headers.dup
-        if headers_debug['Authorization']
-          headers_debug['Authorization'] = headers_debug['Authorization'].gsub(/(.{10})\z/, '***********')
-        end
+        request_headers = @headers.merge(extra_headers)
 
         @logger.debug "base url: #{@base_uri}"
-        @logger.debug "request method: #{method}, uri: #{uri}, body: #{body}, extra_headers: #{extra_headers}, headers: #{headers_debug}"
+        @logger.debug "request method: #{method}, uri: #{uri}, body: #{body}, " \
+                      "headers: #{mask_authorization(request_headers)}"
         result = case method
-                 when :get
-                   get_headers = @headers.merge({ params: body }).merge(extra_headers)
-                   call(:get, encode_uri(uri), timeout, get_headers)
-                 when :delete
-                   delete_headers = @headers.merge({ params: body })
-                   call(:delete, encode_uri(uri), timeout, delete_headers)
+                 when :get, :delete
+                   call(method, encode_uri(uri), timeout, request_headers.merge({ params: body }))
                  else
-                   call(method, encode_uri(uri), timeout, @headers, body.to_json)
+                   call(method, encode_uri(uri), timeout, request_headers, body.to_json)
                  end
 
         raise Descope::Unsupported.new('No response from server', code: 400) unless result.respond_to?(:code)