descope 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: beb56da5c28d3ae76435ec8ffd7641e39b08f89bc67a7f166f1f8278f191186a
-  data.tar.gz: e3abb55707b28c5678e09d0b0fcdfb9449b38b32b0d3f28d032ada03cd226acf
+  metadata.gz: 46b46c0f4ea895abb2c02d5728cf7aac05b1f3928cf5b3c605597618d151bfb9
+  data.tar.gz: dc6763494e5bc8caaf3cde6b40f9f84a8d4d297c34d42db54aac94d192e3633e
 SHA512:
-  metadata.gz: fac54ea06b4b828bfc89a342c7acc0bb5ad50b0fea589d0d9860ef69923dc60919fcad3684f3317a51dfdcdc2e46392e0144d21f4f02440964f7155f8a5424fe
-  data.tar.gz: 62a41f8f2c5e4df22fbe259bc657608c66e86b9994fd803a4ba1ba7c4075cc376ceef49237256cb18acbb8915163bdf6bef03b66223318509c2fd30970abe2e1
+  metadata.gz: 3cbbe031f32d0fae0044d03e957abd674acc5257a426069082fcb01b097417a2b547255eee816b3b7c9c35b96b9d5a779b46eb561c95cbc31a45b3929e03904a
+  data.tar.gz: fde06107b8aa690dbb9867b4a028e1bb523dd25f077afbae29262d2a326aa12a0a5c6f1cd5bcbf03c116f3824363433325a9965e6e19b7757a1e579be622e504

data/.github/workflows/ci.yaml

@@ -33,9 +33,9 @@ jobs:
         ci_node_index: [0, 1, 2, 3]
     steps:
       - name: Checkout Code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: ruby/setup-ruby@8aeb6ff8030dd539317f8e1769a044873b56ea71 # v1.268.0
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
         with:
           bundler-cache: true  # Cache bundle based on Gemfile.lock
 
@@ -49,9 +49,9 @@ jobs:
       contents: read
     steps:
       - name: Checkout Code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: ruby/setup-ruby@8aeb6ff8030dd539317f8e1769a044873b56ea71 # v1.268.0
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
         with:
           bundler-cache: true  # Cache bundle based on Gemfile.lock
 

data/.github/workflows/publish-gem.yaml

@@ -10,12 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: main
           fetch-depth: 0
 
-      - uses: ruby/setup-ruby@8aeb6ff8030dd539317f8e1769a044873b56ea71 # v1.268.0
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1.327.0
         with:
           # We are not letting this step to run bundle install, we will do it later
           bundler-cache: false

data/.github/workflows/release-please.yaml

@@ -19,7 +19,7 @@ jobs:
           private_key: ${{ secrets.RELEASE_APP_PEM }}
           app_id: ${{ secrets.RELEASE_APP_ID }}
 
-      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: release
         with:
           # The release-please-config.json and .release-please-manifest.json files

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.1.0"
+  ".": "1.2.0"
 }

data/.rubocop.yml

@@ -1,5 +1,5 @@
 inherit_from: .rubocop_todo.yml
-require:
+plugins:
   - rubocop-rails
 Rails:
   Enabled: False

data/.rubocop_todo.yml

@@ -2,7 +2,7 @@ Metrics/MethodLength:
   Enabled: false
 Metrics/BlockLength:
   Enabled: false
-Metrics/LineLength:
+Layout/LineLength:
   Max: 121
 Metrics/ParameterLists:
   Enabled: false

data/.ruby-version

@@ -1 +1 @@
-3.4.7
+3.4.11

data/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Change Log
 
+## [1.2.0](https://github.com/descope/descope-ruby-sdk/compare/descope/v1.1.0...descope/v1.2.0) (2026-10-19)
+
+
+### Features
+
+* **auth:** support an auth management key for disabled auth methods ([#230](https://github.com/descope/descope-ruby-sdk/issues/230)) ([b746320](https://github.com/descope/descope-ruby-sdk/commit/b746320b1e69b53d0a75767e774f3ae1afbbced9))
+* **enchantedlink:** add SMS support alongside the existing email routes ([#234](https://github.com/descope/descope-ruby-sdk/issues/234)) ([cc122b1](https://github.com/descope/descope-ruby-sdk/commit/cc122b13a87cb2a056f42321e586327cf03ef3fd))
+* **lists:** add list_check_texts to check multiple texts in one call ([#244](https://github.com/descope/descope-ruby-sdk/issues/244)) ([2f62cde](https://github.com/descope/descope-ruby-sdk/commit/2f62cdeee6aa8e9f2891fe5a9e9f759eaab6f2bb))
+* **management:** add missing management modules for go-sdk parity ([#209](https://github.com/descope/descope-ruby-sdk/issues/209)) ([17c34e0](https://github.com/descope/descope-ruby-sdk/commit/17c34e0059a50cab5a9839de9c476cbe3112cfe1))
+
 ## [1.1.0](https://github.com/descope/descope-ruby-sdk/compare/descope-v1.0.7...descope/v1.1.0) (2025-12-13)
 
 

data/Gemfile

@@ -4,18 +4,18 @@ source 'https://rubygems.org'
 gemspec
 
 group :development do
-  gem 'rubocop', '1.81.7', require: false
-  gem 'rubocop-rails', '2.34.0', require: false
+  gem 'rubocop', '1.91.0', require: false
+  gem 'rubocop-rails', '2.38.0', require: false
 end
 
 group :test do
-  gem 'factory_bot', '6.5.6', require: false
+  gem 'factory_bot', '6.6.0', require: false
   gem 'faker', require: false
   gem 'parallel_tests', require: false
   gem 'rack-test', '2.2.0', require: false
   gem 'rotp', '6.3.0', require: false
   gem 'rspec', '3.13.2', require: false
-  gem 'selenium-webdriver', '4.38.0', require: false
+  gem 'selenium-webdriver', '4.49.0', require: false
   gem 'simplecov', '0.22.0', require: false
-  gem 'super_diff', '0.18.0', require: false
+  gem 'super_diff', '0.19.0', require: false
 end

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    descope (1.1.0)
+    descope (1.2.0)
       addressable (~> 2.8)
       jwt (~> 2.7)
       rest-client (~> 2.1)
@@ -11,16 +11,16 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.2.3)
+    activesupport (7.2.4)
       base64
       benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
-      connection_pool (>= 2.2.5)
+      connection_pool (>= 2.2.5, < 3)
       drb
       i18n (>= 1.6, < 2)
       logger (>= 1.4.2)
-      minitest (>= 5.1)
+      minitest (>= 5.1, < 6)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
     addressable (2.8.6)
@@ -30,25 +30,25 @@ GEM
     base64 (0.3.0)
     benchmark (0.5.0)
     bigdecimal (3.3.1)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.8)
     connection_pool (2.5.5)
     diff-lcs (1.6.2)
     docile (1.4.0)
     domain_name (0.6.20240107)
     drb (2.2.3)
-    factory_bot (6.5.6)
+    factory_bot (6.6.0)
       activesupport (>= 6.1.0)
     faker (3.3.1)
       i18n (>= 1.8.11, < 2)
     http-accept (1.7.0)
     http-cookie (1.0.5)
       domain_name (~> 0.5)
-    i18n (1.14.7)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    json (2.18.0)
+    json (2.21.2)
     jwt (2.8.1)
       base64
-    language_server-protocol (3.17.0.5)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     logger (1.7.0)
     mime-types (3.5.2)
@@ -57,22 +57,22 @@ GEM
     minitest (5.27.0)
     netrc (0.11.0)
     optimist (3.2.1)
-    parallel (1.27.0)
+    parallel (1.28.0)
     parallel_tests (5.5.0)
       parallel
-    parser (3.3.10.0)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
     patience_diff (1.2.0)
       optimist (~> 3.0)
-    prism (1.6.0)
+    prism (1.9.0)
     public_suffix (5.0.5)
     racc (1.8.1)
-    rack (3.2.4)
+    rack (3.2.7)
     rack-test (2.2.0)
       rack (>= 1.3)
     rainbow (3.1.1)
-    regexp_parser (2.11.3)
+    regexp_parser (2.13.1)
     rest-client (2.1.0)
       http-accept (>= 1.7.0, < 2.0)
       http-cookie (>= 1.0.2, < 2.0)
@@ -94,30 +94,30 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.6)
-    rubocop (1.81.7)
-      json (~> 2.3)
+    rubocop (1.91.0)
+      json (>= 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.47.1, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.48.0)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
-      prism (~> 1.4)
-    rubocop-rails (2.34.0)
+      prism (~> 1.7)
+    rubocop-rails (2.38.0)
       activesupport (>= 4.2.0)
       lint_roller (~> 1.1)
       rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
       rubocop-ast (>= 1.44.0, < 2.0)
     ruby-progressbar (1.13.0)
     rubyzip (2.4.1)
     securerandom (0.4.1)
-    selenium-webdriver (4.38.0)
+    selenium-webdriver (4.49.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -129,10 +129,10 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
-    super_diff (0.18.0)
-      attr_extras (>= 6.2.4)
-      diff-lcs
-      patience_diff
+    super_diff (0.19.0)
+      attr_extras (>= 6.2.4, < 8)
+      diff-lcs (~> 1.5)
+      patience_diff (~> 1.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.6.0)
@@ -147,17 +147,17 @@ PLATFORMS
 
 DEPENDENCIES
   descope!
-  factory_bot (= 6.5.6)
+  factory_bot (= 6.6.0)
   faker
   parallel_tests
   rack-test (= 2.2.0)
   rotp (= 6.3.0)
   rspec (= 3.13.2)
-  rubocop (= 1.81.7)
-  rubocop-rails (= 2.34.0)
-  selenium-webdriver (= 4.38.0)
+  rubocop (= 1.91.0)
+  rubocop-rails (= 2.38.0)
+  selenium-webdriver (= 4.49.0)
   simplecov (= 0.22.0)
-  super_diff (= 0.18.0)
+  super_diff (= 0.19.0)
 
 BUNDLED WITH
    2.5.6

data/README.md

@@ -31,9 +31,49 @@ descope_client = Descope::Client.new(
 )
 ```
 
+### Auth Management Key
+
+Authentication methods whose public access has been disabled can still be used by providing an
+auth management key. When set, it is sent along with every authentication request.
+
+Create one in the [Descope Console](https://app.descope.com/settings/company/managementkeys) with
+either the `Authentication` or `Full Access` scope on the project or company.
+
+```ruby
+# Initialized after setting the DESCOPE_PROJECT_ID and DESCOPE_AUTH_MANAGEMENT_KEY env vars
+descope_client = Descope::Client.new({})
+
+# ** Or directly **
+descope_client = Descope::Client.new(
+  {
+    project_id: '<project_id>',
+    auth_management_key: ENV['AUTH_MGMT_KEY']
+  }
+)
+```
+
+**Note**: the auth management key can, and probably should, be a different management key than the
+one provided for [management API usage](#setup-1). The auth management key is never sent on
+management requests, and the management key is never sent on authentication requests.
+
+### Request timeout
+
+Every request is bounded by a 60 second timeout, matching the other Descope server SDKs. Raise it
+for calls that legitimately take longer, such as `export_project` on a large project:
+
+```ruby
+descope_client = Descope::Client.new(
+  {
+    project_id: '<project_id>',
+    timeout_seconds: 180
+  }
+)
+```
+
 ### Important Logging note
 You may pass `log_level: 'debug'` to the client config or use `DESCOPE_LOG_LEVEL` env var.
-Be aware that only the management key is truncated, and the JWT responses are printed on debug
+Be aware that everything after the project ID in the `Authorization` header is masked, but the JWT
+responses are printed on debug
 
 Do not run with log level debug on Production!
 
@@ -172,6 +212,33 @@ pending_ref = res['pendingRef'] # Used to poll for a valid session
 masked_email = res['maskedEmail'] # The email that the message was sent to in a masked format
 ```
 
+The same three calls are available over SMS, as `enchanted_link_sign_up_with_phone`,
+`enchanted_link_sign_in_with_phone` and `enchanted_link_sign_up_or_in_with_phone`. The `login_id` is
+a phone number, and the response carries `maskedPhone` instead of `maskedEmail`.
+
+```ruby
+res = descope_client.enchanted_link_sign_up_or_in_with_phone(
+    login_id: '+11111111111',
+    uri: 'https://myapp.com/verify-enchanted-link', # Set redirect URI here or via console
+    template_id: 'my-text-template-id' # Optional, selects a specific text template
+)
+link_identifier = res['linkId'] # Matches the identifier at the start of the SMS, so the user can confirm it
+pending_ref = res['pendingRef'] # Used to poll for a valid session
+masked_phone = res['maskedPhone'] # The phone number that the message was sent to in a masked format
+```
+
+An existing user's phone number can be updated with an enchanted link sent over SMS, using the
+refresh token of their active session:
+
+```ruby
+res = descope_client.enchanted_link_update_user_phone(
+    login_id: 'someone@example.com',
+    phone: '+11111111111',
+    uri: 'https://myapp.com/verify-enchanted-link',
+    refresh_token: refresh_token
+)
+```
+
 After sending the link, you must poll to receive a valid session using the `pending_ref` from
 the previous step. A valid session will be returned only after the user clicks the right link.
 
@@ -504,6 +571,8 @@ in nature. Please use responsibly.
 
 To use the management API you'll need a `Management Key` along with your `Project ID`.
 Create one in the [Descope Console](https://app.descope.com/settings/company/managementkeys).
+This key is used only for management functions - to reach authentication methods whose public
+access has been disabled, use the [Auth Management Key](#auth-management-key) instead.
 
 ```ruby
 require 'descope'
@@ -1269,6 +1338,160 @@ resp["apps"].each do |app|
 end
 ```
 
+### Manage Third Party Applications
+
+You can create, update, patch, delete or load third party (OIDC) applications, and manage their secrets and consents:
+
+```ruby
+# Create a third party application (response includes the generated id and secret)
+resp = descope_client.create_application(
+  name: "My third party app",
+  login_page_url: "https://dummy.com/login"
+)
+id = resp["id"]
+
+# Update (overrides all fields) or patch (only given fields)
+descope_client.update_application(id: id, name: "Updated name", login_page_url: "https://dummy.com/login")
+descope_client.patch_application(id: id, name: "Patched name")
+
+# Load one / all applications
+descope_client.load_application(id)
+descope_client.load_all_applications
+
+# Manage the application secret
+descope_client.get_application_secret(id)
+descope_client.rotate_application_secret(id)
+
+# Delete consents for the application
+descope_client.delete_consents(app_id: id, user_ids: ["U123"])
+
+# Application deletion cannot be undone. Use carefully.
+descope_client.delete_application(id)
+```
+
+### Manage Management Keys
+
+Create and manage management keys for a project:
+
+```ruby
+# Response includes the key metadata and the one-time cleartext value
+resp = descope_client.create_management_key(
+  name: "CI key",
+  description: "used by CI",
+  expires_in: 0, # 0 = no expiration (seconds)
+  permitted_ips: ["1.2.3.4/32"]
+)
+
+descope_client.update_management_key(id: "key-id", name: "renamed CI key")
+descope_client.get_management_key(id: "key-id")
+descope_client.search_management_keys(status: "active")
+descope_client.delete_management_key(id: "key-id")
+```
+
+### Manage Engines
+
+```ruby
+resp = descope_client.create_engine(name: "my-engine") # secret returned only here and on rotate
+descope_client.update_engine(id: resp["id"], name: "renamed-engine")
+descope_client.load_engine(id: resp["id"])
+descope_client.load_all_engines
+descope_client.rotate_engine_secret(id: resp["id"])
+descope_client.delete_engine(id: resp["id"])
+```
+
+### Manage Descopers
+
+```ruby
+descope_client.create_descoper([{ loginId: "admin@descope.com", roleNames: ["Descoper"] }])
+descope_client.update_descoper(id: "U123", attributes: { name: "Admin" })
+descope_client.get_descoper(id: "U123")
+descope_client.search_descopers
+descope_client.delete_descoper(id: "U123")
+```
+
+### Manage Lists
+
+Manage allow/deny lists of IPs and text values:
+
+```ruby
+list = descope_client.create_list(name: "blocklist", type: "ip")
+descope_client.update_list(id: list["id"], name: "blocklist", type: "ip")
+descope_client.load_list(list["id"])
+descope_client.load_list_by_name("blocklist")
+descope_client.load_all_lists
+descope_client.import_lists(lists: [{ name: "blocklist", type: "ip", data: ["1.2.3.4"] }])
+
+# IP entries
+descope_client.list_add_ips(id: list["id"], ips: ["1.2.3.4"])
+descope_client.list_remove_ips(id: list["id"], ips: ["1.2.3.4"])
+descope_client.list_check_ip(id: list["id"], ip: "1.2.3.4")
+
+# Text entries
+descope_client.list_add_texts(id: list["id"], texts: ["blocked"])
+descope_client.list_remove_texts(id: list["id"], texts: ["blocked"])
+descope_client.list_check_text(id: list["id"], text: "blocked")
+# Check up to 100 texts in one call: exists if any of them is in the list, or only if all are with match_all: true
+descope_client.list_check_texts(id: list["id"], texts: ["blocked", "other"])
+descope_client.list_check_texts(id: list["id"], texts: ["blocked", "other"], match_all: true)
+
+descope_client.clear_list(id: list["id"])
+descope_client.delete_list(id: list["id"])
+```
+
+### Manage JWT Templates
+
+```ruby
+descope_client.create_jwt_template(template: { name: "my-template", authSchema: "default" })
+descope_client.update_jwt_template(template: { id: "T123", name: "my-template" })
+descope_client.list_jwt_templates
+descope_client.load_jwt_template(id: "T123")
+descope_client.delete_jwt_template(id: "T123")
+```
+
+### Manage Scope Claim Mapping
+
+Manage the project-wide OIDC scope-to-claim mapping:
+
+```ruby
+descope_client.set_scope_claim_mapping(mappings: [{ scope: "email", claims: ["email"] }])
+descope_client.get_scope_claim_mapping
+descope_client.delete_scope_claim_mapping
+```
+
+### Query SSO Groups
+
+Query the SSO groups synced to a project's tenant:
+
+```ruby
+descope_client.load_all_groups(tenant_id: "T123")
+descope_client.load_all_groups_for_members(tenant_id: "T123", user_ids: ["U123"], login_ids: ["a@b.com"])
+descope_client.load_all_group_members(tenant_id: "T123", group_id: "G123")
+```
+
+### Manage FGA (Fine-Grained Authorization)
+
+Manage a fine-grained authorization schema and relations:
+
+```ruby
+# Save/load the schema (schema is a DSL string)
+descope_client.fga_save_schema(schema: "model\n  schema 1.1\ntype user")
+descope_client.fga_load_schema
+
+# Create, delete and check relations
+tuples = [{ resource: "doc1", resourceType: "document", relation: "owner", target: "u1", targetType: "user" }]
+descope_client.fga_create_relations(tuples: tuples)
+descope_client.fga_check(tuples: tuples)
+descope_client.fga_delete_relations(tuples: tuples)
+```
+
+### Analytics
+
+Search project analytics:
+
+```ruby
+descope_client.analytics_search(from_ts: 1700000000000, to_ts: 1700086400000, group_by_action: true)
+```
+
 
 ## API Rate Limits
 
@@ -1306,6 +1529,15 @@ You can find various usage examples in the [examples folder](https://github.com/
 bundle install
 ```
 
+### Environment variables
+
+```bash
+export DESCOPE_PROJECT_ID=<ProjectID>
+export DESCOPE_MANAGEMENT_KEY=<ManagementKey>
+# Optional, only needed for authentication methods with disabled public access
+export DESCOPE_AUTH_MANAGEMENT_KEY=<AuthManagementKey>
+```
+
 ### Run tests
 
 Running all tests: