descope 1.0.7 → 1.2.0

data/lib/descope/mixins/initializer.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'descope/http_client'
 
 module Descope
   module Mixins
     # Helper class for initializing the Descope API
     module Initializer
       attr_accessor :public_keys, :mlock
+      attr_reader :base_uri, :headers
 
       def initialize(config)
         options = Hash[config.map { |(k, v)| [k.to_sym, v] }]
@@ -16,8 +18,10 @@ module Descope
         @headers['x-descope-project-id'] = @project_id
         @public_key = options[:public_key] || ENV['DESCOPE_PUBLIC_KEY']
         @mlock = Mutex.new
-        log_level = options[:log_level] || ENV['DESCOPE_LOG_LEVEL'] || 'info'
-        @logger ||= Descope::Mixins::Logging.logger_for(self.class.name, log_level, @project_id)
+        @logger = options[:logger] || begin
+          log_level = options[:log_level] || ENV['DESCOPE_LOG_LEVEL'] || 'info'
+          Descope::Mixins::Logging.logger_for(self.class.name, log_level, @project_id)
+        end
 
         @logger.debug("Initializing Descope API with project_id: #{@project_id} and base_uri: #{@base_uri}")
 
@@ -31,7 +35,10 @@ module Descope
         @skip_verify = options[:skip_verify]
         @secure = !@skip_verify
         @management_key = options[:management_key] || ENV['DESCOPE_MANAGEMENT_KEY']
-        @logger.debug("Management Key ID: #{@management_key}")
+        # Sent with every authentication request so that methods whose public access has been
+        # disabled can still be used. Never sent on management requests, and can - and probably
+        # should - be a different management key than @management_key.
+        @auth_management_key = options[:auth_management_key] || ENV['DESCOPE_AUTH_MANAGEMENT_KEY']
         @timeout_seconds = options[:timeout_seconds] || Common::DEFAULT_TIMEOUT_SECONDS
         @jwt_validation_leeway = options[:jwt_validation_leeway] || Common::DEFAULT_JWT_VALIDATION_LEEWAY
 
@@ -58,16 +65,21 @@ module Descope
 
       end
 
-      def authorization_header(pswd = nil)
-        pswd = @default_pswd if pswd.nil? || pswd.empty?
-        bearer = "#{@project_id}:#{pswd}"
-        add_headers('Authorization' => "Bearer #{bearer}")
-      end
-
       def initialize_api(options)
         initialize_v1(options)
-        @default_pswd = options.fetch(:management_key, ENV['DESCOPE_MANAGEMENT_KEY'])
-        authorization_header
+        @auth_http = http_client(@auth_management_key)
+        @mgmt_http = http_client(@management_key)
+      end
+
+      def http_client(key)
+        HttpClient.new(
+          base_uri: @base_uri,
+          project_id: @project_id,
+          key: key,
+          headers: @headers,
+          logger: @logger,
+          timeout: @timeout_seconds
+        )
       end
 
       def initialize_v1(_options)

data/lib/descope/mixins/requests.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'descope/mixins/http'
+
+module Descope
+  module Mixins
+    # Routes an API call to the HTTP client that holds the right key: the bare verbs serve the
+    # authentication APIs and go out with the auth management key, the mgmt_ prefixed verbs serve
+    # the management APIs and go out with the management key.
+    module Requests
+      attr_reader :auth_http, :mgmt_http
+
+      Descope::Mixins::HTTP::HTTP_METHODS.each do |method|
+        define_method(method) do |*args|
+          @auth_http.public_send(method, *args)
+        end
+
+        define_method(:"mgmt_#{method}") do |*args|
+          @mgmt_http.public_send(method, *args)
+        end
+      end
+    end
+  end
+end

data/lib/descope/mixins.rb

@@ -4,6 +4,7 @@ require 'logger'
 require 'jwt'
 require 'descope/mixins/headers'
 require 'descope/mixins/http'
+require 'descope/mixins/requests'
 require 'descope/mixins/initializer'
 require 'descope/mixins/validation'
 require 'descope/mixins/logging'
@@ -15,7 +16,7 @@ module Descope
   module Mixins
     include Descope::Mixins::Common
     include Descope::Mixins::Headers
-    include Descope::Mixins::HTTP
+    include Descope::Mixins::Requests
     include Descope::Mixins::Initializer
     include Descope::Mixins::Logging
   end

data/lib/descope/version.rb

@@ -2,6 +2,6 @@
 
 # Current version of gem
 module Descope
-  VERSION = '1.0.7'
+  VERSION = '1.2.0'
   SDK_VERSION = '1.0.0'
 end

data/spec/integration/lib.descope/api/v1/auth/enchantedlink_spec.rb

@@ -3,31 +3,25 @@
 require 'spec_helper'
 
 def poll_for_session(descope_client, pending_ref)
-  max_tries = 15
-  i = 0
-  done = false
-  while !done && i < max_tries
+  @client.logger.info('Waiting for session to be created...')
+  
+  SpecUtils.wait_for_condition(max_wait: 60, interval: 3, description: 'enchanted link session') do
     begin
-      i += 1
-      @client.logger.info('waiting 4 seconds for session to be created...')
-      sleep(4)
-      print '.'
       @client.logger.info("Getting session for pending_ref: #{pending_ref}...")
       jwt_response = descope_client.enchanted_link_get_session(pending_ref)
-      done = true
+      
+      if jwt_response
+        @client.logger.info("jwt_response: #{jwt_response}")
+        refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME]['jwt']
+        @client.logger.info("refresh_token: #{refresh_token}")
+        return refresh_token
+      end
+      
+      false
     rescue Descope::AuthException, Descope::Unauthorized => e
-      @client.logger.info("Failed pending session, err: #{e}")
-     nil
+      @client.logger.info("Waiting for session, err: #{e}")
+      false
     end
-
-    next unless jwt_response
-
-    @client.logger.info("jwt_response: #{jwt_response}")
-    refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME]['jwt']
-
-    @client.logger.info("refresh_token: #{refresh_token}")
-    done = true
-    return refresh_token
   end
 end
 
@@ -62,7 +56,11 @@ describe Descope::Api::V1::Auth::EnchantedLink do
     all_users['users'].each do |user|
       if user['middleName'] == "#{SpecUtils.build_prefix}Ruby-SDK-User" 
         @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
-        @client.delete_user(user['loginIds'][0])
+        begin
+          @client.delete_user(user['loginIds'][0])
+        rescue Descope::NotFound => e
+          @client.logger.info("User already deleted: #{e.message}")
+        end
       end
     end
   end

data/spec/integration/lib.descope/api/v1/auth/magiclink_spec.rb

@@ -13,7 +13,11 @@ describe Descope::Api::V1::Auth::MagicLink do
     all_users['users'].each do |user|
       if user['middleName'] == "#{SpecUtils.build_prefix}Ruby-SDK-User" 
         @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
-        @client.delete_user(user['loginIds'][0])
+        begin
+          @client.delete_user(user['loginIds'][0])
+        rescue Descope::NotFound => e
+          @client.logger.info("User already deleted: #{e.message}")
+        end
       end
     end
   end

data/spec/integration/lib.descope/api/v1/auth/otp_spec.rb

@@ -21,7 +21,11 @@ describe Descope::Api::V1::Auth::OTP do
     all_users['users'].each do |user|
       if user['middleName'] == "#{SpecUtils.build_prefix}Ruby-SDK-User" 
         @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
-        @client.delete_user(user['loginIds'][0])
+        begin
+          @client.delete_user(user['loginIds'][0])
+        rescue Descope::NotFound => e
+          @client.logger.info("User already deleted: #{e.message}")
+        end
       end
     end
   end

data/spec/integration/lib.descope/api/v1/auth/session_spec.rb

@@ -5,6 +5,20 @@ require 'spec_helper'
 describe Descope::Api::V1::Session do
   before(:all) do
     @client = DescopeClient.new(Configuration.config)
+    
+    # Cleanup any existing test users before starting
+    @client.logger.info('Cleaning up any existing test users before starting...')
+    all_users = @client.search_all_users
+    all_users['users'].each do |user|
+      if user['middleName'] == "#{SpecUtils.build_prefix}Ruby-SDK-User" 
+        @client.logger.info("Deleting existing ruby spec test user #{user['loginIds'][0]}")
+        begin
+          @client.delete_user(user['loginIds'][0])
+        rescue Descope::NotFound => e
+          @client.logger.info("User already deleted: #{e.message}")
+        end
+      end
+    end
   end
 
   after(:all) do
@@ -13,7 +27,11 @@ describe Descope::Api::V1::Session do
     all_users['users'].each do |user|
       if user['middleName'] == "#{SpecUtils.build_prefix}Ruby-SDK-User" 
         @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
-        @client.delete_user(user['loginIds'][0])
+        begin
+          @client.delete_user(user['loginIds'][0])
+        rescue Descope::NotFound => e
+          @client.logger.info("User already deleted: #{e.message}")
+        end
       end
     end
   end
@@ -21,9 +39,10 @@ describe Descope::Api::V1::Session do
   context 'test session methods' do
     it 'should refresh session with refresh token' do
       @password = SpecUtils.generate_password
-      user = build(:user)
+      # Add timestamp to ensure unique login_id across multiple test runs
+      user = build(:user, login_id: "session_test_#{Time.now.to_i}_#{SecureRandom.hex(4)}")
 
-      @client.logger.info('1. Sign up with password')
+      @client.logger.info("1. Sign up with password for user: #{user[:login_id]}")
       res = @client.password_sign_up(login_id: user[:login_id], password: @password, user:)
       @client.logger.info("sign up with password res: #{res}")
       original_refresh_token = res[REFRESH_SESSION_TOKEN_NAME]['jwt']
@@ -32,8 +51,8 @@ describe Descope::Api::V1::Session do
       login_res = @client.password_sign_in(login_id: user[:login_id], password: @password)
       @client.logger.info("sign_in res: #{login_res}")
 
-      @client.logger.info('3. sleep 1 second before calling refresh_session')
-      sleep(1)
+      @client.logger.info('3. Wait briefly to ensure token timestamps differ')
+      sleep(2)  # Wait 2 seconds to ensure new token will have different 'iat' timestamp
 
       @client.logger.info('4. Refresh session')
       refresh_session_res = @client.refresh_session(refresh_token: login_res[REFRESH_SESSION_TOKEN_NAME]['jwt'])

data/spec/integration/lib.descope/api/v1/auth/totp_spec.rb

@@ -14,7 +14,11 @@ describe Descope::Api::V1::Auth::TOTP do
     all_users['users'].each do |user|
       if user['middleName'] == "#{SpecUtils.build_prefix}Ruby-SDK-User" 
         @client.logger.info("Deleting ruby spec test user #{user['loginIds'][0]}")
-        @client.delete_user(user['loginIds'][0])
+        begin
+          @client.delete_user(user['loginIds'][0])
+        rescue Descope::NotFound => e
+          @client.logger.info("User already deleted: #{e.message}")
+        end
       end
     end
   end

data/spec/integration/lib.descope/api/v1/management/access_key_spec.rb

@@ -30,8 +30,16 @@ describe Descope::Api::V1::Management::AccessKey do
       @tenant_id = @client.create_tenant(name: 'some-new-tenant')['id']
       @client.logger.info('creating access key')
       @access_key = @client.create_access_key(name: @key_name, key_tenants: [{ tenant_id: @tenant_id }])
-      @client.logger.info("waiting for access key #{@access_key['key']['id']} to be active 60 seconds")
-      sleep 60
+      @client.logger.info("waiting for access key #{@access_key['key']['id']} to be active")
+      SpecUtils.wait_for_condition(max_wait: 65, interval: 3, description: 'access key to be active') do
+        begin
+          key = @client.load_access_key(@access_key['key']['id'])
+          key['key']['status'] == 'active'
+        rescue StandardError => e
+          @client.logger.info("Waiting for key activation: #{e.message}")
+          false
+        end
+      end
     end
 
     it 'should create the access key and load it' do

data/spec/integration/lib.descope/api/v1/management/authz_spec.rb

@@ -12,7 +12,12 @@ describe Descope::Api::V1::Management::Authz do
 
   context 'authz ops' do
     before(:all) do
-      @client.authz_delete_schema
+      # Instead of deleting the entire schema, we'll work with it
+      # This allows parallel test execution
+      # Only delete schema if we're running in isolation
+      if ENV['AUTHZ_FULL_TEST'] == 'true'
+        @client.authz_delete_schema
+      end
     end
 
     it 'should create a new schema' do
@@ -160,13 +165,17 @@ describe Descope::Api::V1::Management::Authz do
     end
 
     it 'should create a relation between a resource and user' do
+      # Use unique resource name to avoid conflicts between parallel tests
+      unique_resource = "#{SpecUtils.build_prefix}some-doc"
+      unique_user = "#{SpecUtils.build_prefix}user1"
+      
       @client.authz_create_relations(
         [
           {
-            "resource": 'some-doc',
+            "resource": unique_resource,
             "relationDefinition": 'owner',
             "namespace": 'note',
-            "target": 'user1'
+            "target": unique_user
           }
         ]
       )
@@ -176,14 +185,26 @@ describe Descope::Api::V1::Management::Authz do
       relations = @client.authz_has_relations?(
         [
           {
-            "resource": 'some-doc',
+            "resource": unique_resource,
             "relationDefinition": 'viewer',
             "namespace": 'note',
-            "target": 'user1'
+            "target": unique_user
           }
         ]
       )
       expect(relations['relationQueries'][0]['hasRelation']).to be_truthy
+      
+      # Clean up the test relations
+      @client.authz_delete_relations(
+        [
+          {
+            "resource": unique_resource,
+            "relationDefinition": 'owner',
+            "namespace": 'note',
+            "target": unique_user
+          }
+        ]
+      )
     end
   end
 end

data/spec/integration/lib.descope/api/v1/management/permissions_spec.rb

@@ -7,16 +7,34 @@ describe Descope::Api::V1::Management::Permission do
     raise 'DESCOPE_MANAGEMENT_KEY is not set' if ENV['DESCOPE_MANAGEMENT_KEY'].nil?
 
     @client = DescopeClient.new(Configuration.config)
+    @test_description = "#{SpecUtils.build_prefix} Ruby SDK"
+    
+    # Cleanup any leftover permissions from previous failed runs
     @client.load_all_permissions['permissions'].each do |perm|
-      if perm['description'] == "#{SpecUtils.build_prefix} Ruby SDK"
+      if perm['description'] == @test_description
         puts "Deleting permission: #{perm['name']}"
         @client.delete_permission(perm['name'])
       end
     end
   end
+  
+  after(:all) do
+    # Safety cleanup to ensure no test permissions are left behind
+    @client.logger.info('Cleaning up test permissions...')
+    begin
+      @client.load_all_permissions['permissions'].each do |perm|
+        if perm['description'] == @test_description
+          @client.logger.info("Deleting leftover permission: #{perm['name']}")
+          @client.delete_permission(perm['name'])
+        end
+      end
+    rescue StandardError => e
+      @client.logger.info("Error during permission cleanup: #{e.message}")
+    end
+  end
 
   it 'should create update and delete a permission' do
-    @client.create_permission(name: 'test_permission', description: "#{SpecUtils.build_prefix} Ruby SDK")
+    @client.create_permission(name: 'test_permission', description: @test_description)
     all_permissions = @client.load_all_permissions['permissions']
     expect(all_permissions.any? { |perm| perm['name'] == 'test_permission' }).to eq(true)
     @client.update_permission(name: 'test_permission', new_name: 'test_permission_2')

data/spec/integration/lib.descope/api/v1/management/project_spec.rb

@@ -8,15 +8,29 @@ describe Descope::Api::V1::Management::Project do
 
     @client = DescopeClient.new(Configuration.config)
     @export_output = @client.export_project
+    @original_project_name = nil
   end
 
   context 'Test project methods' do
+    before(:all) do
+      # Get the current project name before we modify it
+      # Store it so we can restore it later
+      begin
+        @original_project_name = @client.export_project['project']['name']
+      rescue StandardError
+        @original_project_name = 'Ruby-SDK-Prod'
+      end
+    end
+
     after(:all) do
-      @client.rename_project('Ruby-SDK-Prod')
+      # Restore the original project name
+      @client.rename_project(@original_project_name) if @original_project_name
     end
 
     it 'should rename a project' do
-      @client.rename_project('TEST-Ruby-SDK-Prod')
+      # Use a unique name based on build prefix to avoid conflicts
+      unique_name = "#{SpecUtils.build_prefix}TEST-Ruby-SDK-Prod"
+      @client.rename_project(unique_name)
     end
 
     it 'should export a project' do

data/spec/integration/lib.descope/api/v1/management/roles_spec.rb

@@ -7,74 +7,144 @@ describe Descope::Api::V1::Management::Role do
     raise 'DESCOPE_MANAGEMENT_KEY is not set' if ENV['DESCOPE_MANAGEMENT_KEY'].nil?
 
     @client = DescopeClient.new(Configuration.config)
-    @client.logger.info('Staring cleanup before tests...')
-    @client.logger.info('Deleting all permissions for Ruby SDK...')
+    @test_prefix = SpecUtils.build_prefix
+    @client.logger.info("Starting cleanup before tests with prefix: #{@test_prefix}...")
+    
+    # Define resource names with unique prefix for parallel execution
+    @permission_viewer = "#{@test_prefix}viewer"
+    @permission_editor = "#{@test_prefix}editor"
+    @permission_admin = "#{@test_prefix}admin"
+    @role_viewer = "#{@test_prefix}Ruby-SDK-test-viewer"
+    @role_editor = "#{@test_prefix}Ruby-SDK-test-editor"
+    @role_admin = "#{@test_prefix}Ruby-SDK-test-admin"
+    @tenant_name = "#{@test_prefix}Ruby-SDK-test"
+    @description = "#{@test_prefix}Ruby SDK"
+    
+    # Cleanup any leftover resources from previous failed runs
+    @client.logger.info('Deleting all permissions for this test run...')
     @client.load_all_permissions['permissions'].each do |perm|
-      if perm['description'] =~ /Ruby SDK/
+      if perm['description'] == @description
         @client.logger.info("Deleting permission: #{perm['name']}")
         @client.delete_permission(perm['name'])
       end
     end
 
-    @client.logger.info('Deleting all roles for Ruby SDK...')
+    @client.logger.info('Deleting all roles for this test run...')
     @client.load_all_roles['roles'].each do |role|
-      puts "got role: #{role}"
-      if role['description'] == 'Ruby SDK'
+      if role['description'] == @description
         @client.logger.info("Deleting role: #{role['name']}")
         @client.delete_role(name: role['name'], tenant_id: role['tenantId'])
       end
     end
 
-    @client.logger.info('Deleting all tenants for Ruby SDK...')
-    @client.search_all_tenants(names: ['Ruby-SDK-test'])['tenants'].each do |tenant|
+    @client.logger.info('Deleting all tenants for this test run...')
+    @client.search_all_tenants(names: [@tenant_name])['tenants'].each do |tenant|
       @client.logger.info("Deleting tenant: #{tenant['name']}")
       @client.delete_tenant(tenant['id'])
     end
     @client.logger.info('Cleanup completed. Starting tests...')
   end
+  
+  after(:all) do
+    # Cleanup after tests to ensure no resources are left behind
+    @client.logger.info('Cleaning up test resources...')
+    
+    begin
+      @client.delete_permission(@permission_viewer) if defined?(@permission_viewer)
+    rescue StandardError => e
+      @client.logger.info("Permission #{@permission_viewer} already deleted or doesn't exist: #{e.message}")
+    end
+    
+    begin
+      @client.delete_permission(@permission_editor) if defined?(@permission_editor)
+    rescue StandardError => e
+      @client.logger.info("Permission #{@permission_editor} already deleted or doesn't exist: #{e.message}")
+    end
+    
+    begin
+      @client.delete_permission(@permission_admin) if defined?(@permission_admin)
+    rescue StandardError => e
+      @client.logger.info("Permission #{@permission_admin} already deleted or doesn't exist: #{e.message}")
+    end
+    
+    # Delete any roles with our test description
+    begin
+      @client.load_all_roles['roles'].each do |role|
+        if role['description'] == @description
+          @client.delete_role(name: role['name'], tenant_id: role['tenantId'])
+        end
+      end
+    rescue StandardError => e
+      @client.logger.info("Error cleaning up roles: #{e.message}")
+    end
+    
+    # Delete tenant
+    begin
+      @client.search_all_tenants(names: [@tenant_name])['tenants'].each do |tenant|
+        @client.delete_tenant(tenant['id'])
+      end
+    rescue StandardError => e
+      @client.logger.info("Error cleaning up tenant: #{e.message}")
+    end
+    
+    @client.logger.info('Cleanup completed.')
+  end
 
   it 'should create update and delete a role' do
     @client.logger.info('Testing role creation, update, deletion and search...')
 
     # Create permissions
     @client.logger.info('creating viewer permission for role')
-    @client.create_permission(name: 'viewer', description: 'Viewer Permission Ruby SDK')
+    @client.create_permission(name: @permission_viewer, description: @description)
 
     @client.logger.info('creating editor permission for role')
-    @client.create_permission(name: 'editor', description: 'Editor Permission Ruby SDK')
+    @client.create_permission(name: @permission_editor, description: @description)
 
     @client.logger.info('creating admin permission for role')
-    @client.create_permission(name: 'admin', description: 'Admin Permission Ruby SDK')
+    @client.create_permission(name: @permission_admin, description: @description)
 
     # Create tenants
-    @client.logger.info('creating Ruby-SDK-test tenant')
-    tenant_id = @client.create_tenant(name: 'Ruby-SDK-test')['id']
+    @client.logger.info("creating #{@tenant_name} tenant")
+    tenant_id = @client.create_tenant(name: @tenant_name)['id']
+    @client.logger.info("Created tenant with id: #{tenant_id}")
+    
+    # Wait for tenant to be available (polling, up to 5 seconds)
+    timeout = 5.0
+    interval = 0.1
+    waited = 0.0
+    loop do
+      tenants = @client.search_all_tenants(names: [@tenant_name])['tenants']
+      break if tenants.any? { |t| t['id'] == tenant_id }
+      raise "Tenant #{@tenant_name} not available after #{timeout} seconds" if waited >= timeout
+      sleep(interval)
+      waited += interval
+    end
 
     # Create roles
-    @client.logger.info('creating Ruby-SDK-test role')
-    @client.create_role(name: 'Ruby-SDK-test-viewer', description: 'Ruby SDK', permission_names: ['viewer'])
-    @client.logger.info('creating Ruby-SDK-test-admin role')
-    @client.create_role(name: 'Ruby-SDK-test-admin', description: 'Ruby SDK', permission_names: ['admin'], tenant_id:)
+    @client.logger.info("creating #{@role_viewer} role")
+    @client.create_role(name: @role_viewer, description: @description, permission_names: [@permission_viewer])
+    @client.logger.info("creating #{@role_admin} role")
+    @client.create_role(name: @role_admin, description: @description, permission_names: [@permission_admin], tenant_id:)
 
     # check all roles matching the correct permission
     @client.logger.info('check all roles matching the correct permission (load roles)')
     roles = @client.load_all_roles['roles']
     roles.each do |role|
-      expect(role['permissionNames']).to include('viewer') if role['name'] == 'Ruby-SDK-test-viewer'
-      expect(role['permissionNames']).to include('admin') if role['name'] == 'Ruby-SDK-test-admin'
+      expect(role['permissionNames']).to include(@permission_viewer) if role['name'] == @role_viewer
+      expect(role['permissionNames']).to include(@permission_admin) if role['name'] == @role_admin
     end
 
     @client.logger.info('updating role')
     @client.update_role(
-      name: 'Ruby-SDK-test-viewer',
-      new_name: 'Ruby-SDK-test-editor',
-      description: 'Ruby SDK',
-      permission_names: ['editor']
+      name: @role_viewer,
+      new_name: @role_editor,
+      description: @description,
+      permission_names: [@permission_editor]
     )
 
     @client.logger.info('searching for roles by role names...')
-    all_roles = @client.search_roles(role_names: %w[Ruby-SDK-test-admin Ruby-SDK-test-editor])['roles']
-    expected_roles = %w[Ruby-SDK-test-editor Ruby-SDK-test-admin]
+    all_roles = @client.search_roles(role_names: [@role_admin, @role_editor])['roles']
+    expected_roles = [@role_editor, @role_admin]
     role_count = 0
     expected_roles.each do |expected_role|
       expect(all_roles.map { |role| role['name'] }).to include(expected_role)
@@ -83,8 +153,8 @@ describe Descope::Api::V1::Management::Role do
     expect(role_count).to eq(2)
 
     @client.logger.info('searching for roles with role name like...')
-    all_roles = @client.search_roles(role_name_like: 'Ruby-SDK-test')['roles']
-    expected_roles = %w[Ruby-SDK-test-editor Ruby-SDK-test-admin]
+    all_roles = @client.search_roles(role_name_like: "#{@test_prefix}Ruby-SDK-test")['roles']
+    expected_roles = [@role_editor, @role_admin]
     role_count = 0
     expected_roles.each do |expected_role|
       expect(all_roles.map { |role| role['name'] }).to include(expected_role)
@@ -94,25 +164,33 @@ describe Descope::Api::V1::Management::Role do
     expect(role_count).to eq(2)
 
     @client.logger.info('searching for roles with permission names...')
-    all_roles = @client.search_roles(permission_names: %w[admin])['roles']
-    expect(all_roles.map { |role| role['name'] }).to include('Ruby-SDK-test-admin')
+    all_roles = @client.search_roles(permission_names: [@permission_admin])['roles']
+    expect(all_roles.map { |role| role['name'] }).to include(@role_admin)
 
     @client.logger.info('searching for roles with tenant ids...')
-    all_roles = @client.search_roles(role_name_like: 'Ruby-SDK-test', tenant_ids: [tenant_id])['roles']
-    expect(all_roles.map { |role| role['name'] }).to include('Ruby-SDK-test-admin')
+    all_roles = @client.search_roles(role_name_like: "#{@test_prefix}Ruby-SDK-test", tenant_ids: [tenant_id])['roles']
+    expect(all_roles.map { |role| role['name'] }).to include(@role_admin)
 
     @client.logger.info('deleting permission')
 
-    @client.delete_permission('editor')
-    @client.delete_permission('admin')
+    @client.delete_permission(@permission_editor)
+    @client.delete_permission(@permission_admin)
 
     @client.logger.info('deleting editor role')
-    @client.delete_role(name: 'Ruby-SDK-test-editor')
+    @client.delete_role(name: @role_editor)
 
     @client.logger.info('deleting admin role')
-    @client.delete_role(name: 'Ruby-SDK-test-admin', tenant_id:)
+    begin
+      @client.delete_role(name: @role_admin, tenant_id:)
+    rescue Descope::Unauthorized, Descope::NotFound => e
+      @client.logger.info("Admin role already deleted or tenant invalid: #{e.message}")
+    end
 
     @client.logger.info('deleting tenant')
-    @client.delete_tenant(tenant_id)
+    begin
+      @client.delete_tenant(tenant_id)
+    rescue Descope::NotFound => e
+      @client.logger.info("Tenant already deleted: #{e.message}")
+    end
   end
 end