descope 1.1.0 → 1.2.0

data/lib/descope/http_client.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require 'descope/mixins/http'
+
+module Descope
+  # Performs the SDK's HTTP calls. One instance is created per kind of request so that the two
+  # management keys are never sent together: the management client carries the management key, the
+  # authentication client carries the auth management key.
+  class HttpClient
+    include Descope::Mixins::HTTP
+
+    def initialize(base_uri:, project_id:, headers:, logger:, key: nil, timeout: nil, retry_count: nil)
+      @base_uri = base_uri
+      @project_id = project_id
+      @key = key
+      @headers = headers.dup
+      @logger = logger
+      @timeout = timeout
+      @retry_count = retry_count
+    end
+
+    # Bearer <project_id>[:<pswd>][:<key>] where pswd is a refresh token or access key presented by
+    # the caller and key is this client's management key. Blank parts are skipped, so callers do
+    # not have to branch on what happens to be configured.
+    def authorization_header(pswd = nil)
+      bearer = [@project_id, pswd, @key].reject { |part| part.nil? || part.to_s.empty? }.join(':')
+      { 'Authorization' => "Bearer #{bearer}" }
+    end
+  end
+end

data/lib/descope/mixins/common.rb

@@ -81,6 +81,7 @@ module Descope
         VERIFY_ENCHANTEDLINK_AUTH_PATH = '/v1/auth/enchantedlink/verify'
         GET_SESSION_ENCHANTEDLINK_AUTH_PATH = '/v1/auth/enchantedlink/pending-session'
         UPDATE_USER_EMAIL_ENCHANTEDLINK_PATH = '/v1/auth/enchantedlink/update/email'
+        UPDATE_USER_PHONE_ENCHANTEDLINK_PATH = '/v1/auth/enchantedlink/update/phone'
 
         # oauth
         OAUTH_START_PATH = '/v1/auth/oauth/authorize'

data/lib/descope/mixins/http.rb

@@ -18,13 +18,18 @@ module Descope
       MIN_REQUEST_RETRY_DELAY = 250
       BASE_DELAY = 100
 
-      %i[get post post_file post_form put patch delete delete_with_body].each do |method|
+      HTTP_METHODS = %i[get post put patch delete].freeze
+
+      HTTP_METHODS.each do |method|
         define_method(method) do |uri, body = {}, extra_headers = {}, pswd = nil|
           body = body.delete_if { |_, v| v.nil? }
-          authorization_header(pswd) # This will set the pswd if provided, else default to the @default_pswd
+
+          # The Authorization header travels with the request rather than being merged into the
+          # shared @headers, so concurrent requests cannot send each other's credentials.
+          headers = authorization_header(pswd).merge(extra_headers || {})
 
           @logger.debug "request => method: #{method}, uri: #{uri}, body: #{body}, extra_headers: #{extra_headers}}"
-          request_with_retry(method, uri, body, extra_headers)
+          request_with_retry(method, uri, body, headers)
         end
       end
 
@@ -118,6 +123,15 @@ module Descope
         @headers.merge!(h.to_hash)
       end
 
+      # Everything after the project ID in the bearer is either a token or a management key, so
+      # none of it belongs in a log line.
+      def mask_authorization(headers)
+        authorization = headers['Authorization']
+        return headers if authorization.nil?
+
+        headers.merge('Authorization' => authorization.sub(/\A(Bearer [^:]*):.*\z/, '\1:***'))
+      end
+
       def request_with_retry(method, uri, body = {}, extra_headers = {}, pswd = nil)
         Retryable.retryable(retry_options) do
           request(method, uri, body, extra_headers)
@@ -125,23 +139,16 @@ module Descope
       end
 
       def request(method, uri, body = {}, extra_headers = {})
-        # @headers is getting the authorization header merged in initializer.rb
-        headers_debug = @headers.dup
-        if headers_debug['Authorization']
-          headers_debug['Authorization'] = headers_debug['Authorization'].gsub(/(.{10})\z/, '***********')
-        end
+        request_headers = @headers.merge(extra_headers)
 
         @logger.debug "base url: #{@base_uri}"
-        @logger.debug "request method: #{method}, uri: #{uri}, body: #{body}, extra_headers: #{extra_headers}, headers: #{headers_debug}"
+        @logger.debug "request method: #{method}, uri: #{uri}, body: #{body}, " \
+                      "headers: #{mask_authorization(request_headers)}"
         result = case method
-                 when :get
-                   get_headers = @headers.merge({ params: body }).merge(extra_headers)
-                   call(:get, encode_uri(uri), timeout, get_headers)
-                 when :delete
-                   delete_headers = @headers.merge({ params: body })
-                   call(:delete, encode_uri(uri), timeout, delete_headers)
+                 when :get, :delete
+                   call(method, encode_uri(uri), timeout, request_headers.merge({ params: body }))
                  else
-                   call(method, encode_uri(uri), timeout, @headers, body.to_json)
+                   call(method, encode_uri(uri), timeout, request_headers, body.to_json)
                  end
 
         raise Descope::Unsupported.new('No response from server', code: 400) unless result.respond_to?(:code)

data/lib/descope/mixins/initializer.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
 require 'json'
+require 'descope/http_client'
 
 module Descope
   module Mixins
     # Helper class for initializing the Descope API
     module Initializer
       attr_accessor :public_keys, :mlock
+      attr_reader :base_uri, :headers
 
       def initialize(config)
         options = Hash[config.map { |(k, v)| [k.to_sym, v] }]
@@ -33,7 +35,10 @@ module Descope
         @skip_verify = options[:skip_verify]
         @secure = !@skip_verify
         @management_key = options[:management_key] || ENV['DESCOPE_MANAGEMENT_KEY']
-        @logger.debug("Management Key ID: #{@management_key}")
+        # Sent with every authentication request so that methods whose public access has been
+        # disabled can still be used. Never sent on management requests, and can - and probably
+        # should - be a different management key than @management_key.
+        @auth_management_key = options[:auth_management_key] || ENV['DESCOPE_AUTH_MANAGEMENT_KEY']
         @timeout_seconds = options[:timeout_seconds] || Common::DEFAULT_TIMEOUT_SECONDS
         @jwt_validation_leeway = options[:jwt_validation_leeway] || Common::DEFAULT_JWT_VALIDATION_LEEWAY
 
@@ -60,16 +65,21 @@ module Descope
 
       end
 
-      def authorization_header(pswd = nil)
-        pswd = @default_pswd if pswd.nil? || pswd.empty?
-        bearer = "#{@project_id}:#{pswd}"
-        add_headers('Authorization' => "Bearer #{bearer}")
-      end
-
       def initialize_api(options)
         initialize_v1(options)
-        @default_pswd = options.fetch(:management_key, ENV['DESCOPE_MANAGEMENT_KEY'])
-        authorization_header
+        @auth_http = http_client(@auth_management_key)
+        @mgmt_http = http_client(@management_key)
+      end
+
+      def http_client(key)
+        HttpClient.new(
+          base_uri: @base_uri,
+          project_id: @project_id,
+          key: key,
+          headers: @headers,
+          logger: @logger,
+          timeout: @timeout_seconds
+        )
       end
 
       def initialize_v1(_options)

data/lib/descope/mixins/requests.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+require 'descope/mixins/http'
+
+module Descope
+  module Mixins
+    # Routes an API call to the HTTP client that holds the right key: the bare verbs serve the
+    # authentication APIs and go out with the auth management key, the mgmt_ prefixed verbs serve
+    # the management APIs and go out with the management key.
+    module Requests
+      attr_reader :auth_http, :mgmt_http
+
+      Descope::Mixins::HTTP::HTTP_METHODS.each do |method|
+        define_method(method) do |*args|
+          @auth_http.public_send(method, *args)
+        end
+
+        define_method(:"mgmt_#{method}") do |*args|
+          @mgmt_http.public_send(method, *args)
+        end
+      end
+    end
+  end
+end

data/lib/descope/mixins.rb

@@ -4,6 +4,7 @@ require 'logger'
 require 'jwt'
 require 'descope/mixins/headers'
 require 'descope/mixins/http'
+require 'descope/mixins/requests'
 require 'descope/mixins/initializer'
 require 'descope/mixins/validation'
 require 'descope/mixins/logging'
@@ -15,7 +16,7 @@ module Descope
   module Mixins
     include Descope::Mixins::Common
     include Descope::Mixins::Headers
-    include Descope::Mixins::HTTP
+    include Descope::Mixins::Requests
     include Descope::Mixins::Initializer
     include Descope::Mixins::Logging
   end

data/lib/descope/version.rb

@@ -2,6 +2,6 @@
 
 # Current version of gem
 module Descope
-  VERSION = '1.1.0'
+  VERSION = '1.2.0'
   SDK_VERSION = '1.0.0'
 end

data/spec/integration/lib.descope/api/v1/management/user_spec.rb

@@ -242,7 +242,7 @@ describe Descope::Api::V1::Management::User do
     begin
       @client.expire_password(user['loginIds'][0])
       @client.password_sign_in(login_id: user['loginIds'][0], password:)
-    rescue Descope::ServerError => e
+    rescue Descope::Unauthorized => e
       expect(e.message).to match(/"errorCode":"E062909"/)
     end
   end

data/spec/lib.descope/api/v1/auth/enchantedlink_spec.rb

@@ -30,7 +30,7 @@ describe Descope::Api::V1::EnchantedLink do
       expect(@instance).to receive(:post).with(
         enchanted_link_compose_signin_url,
         request_params,
-        nil,
+        {},
         'refresh_token'
       )
 
@@ -60,6 +60,48 @@ describe Descope::Api::V1::EnchantedLink do
         @instance.send(:validate_refresh_token_provided, { mfa: true, stepup: true }, '')
       end.to raise_error(Descope::AuthException, 'Missing refresh token for stepup/mfa')
     end
+
+    it 'is expected to respond to sign in with phone' do
+      expect(@instance).to respond_to(:enchanted_link_sign_in_with_phone)
+    end
+
+    it 'is expected to sign in with enchanted link via sms' do
+      request_params = {
+        loginId: '+1234567890',
+        redirectUrl: 'https://some-uri/sms',
+        loginOptions: {
+          stepup: false,
+          customClaims: { 'abc': '123' },
+          mfa: false,
+          ssoAppId: 'sso-id'
+        },
+        providerId: 'provider-id',
+        templateId: 'template-id'
+      }
+
+      expect(@instance).to receive(:post).with(
+        '/v1/auth/enchantedlink/signin/sms',
+        request_params,
+        {},
+        'refresh_token'
+      ).and_return({ 'linkId' => '1', 'pendingRef' => 'ref', 'maskedPhone' => '+1******890' })
+
+      res = @instance.enchanted_link_sign_in_with_phone(
+        login_id: '+1234567890',
+        uri: 'https://some-uri/sms',
+        login_options: {
+          stepup: false,
+          custom_claims: { 'abc': '123' },
+          mfa: false,
+          sso_app_id: 'sso-id'
+        },
+        provider_id: 'provider-id',
+        template_id: 'template-id',
+        refresh_token: 'refresh_token'
+      )
+
+      expect(res['maskedPhone']).to eq('+1******890')
+    end
   end
 
   context '.sign_up' do
@@ -88,6 +130,36 @@ describe Descope::Api::V1::EnchantedLink do
         )
       end.not_to raise_error
     end
+
+    it 'is expected to respond to sign up with phone' do
+      expect(@instance).to respond_to(:enchanted_link_sign_up_with_phone)
+    end
+
+    it 'is expected to sign up with enchanted link via sms' do
+      request_params = {
+        loginId: '+1234567890',
+        redirectUrl: 'https://some-uri/sms',
+        user: { loginId: 'user1', phone: '+1234567890' },
+        phone: '+1234567890',
+        providerId: 'provider-id',
+        templateId: 'template-id'
+      }
+
+      expect(@instance).to receive(:post).with(
+        '/v1/auth/enchantedlink/signup/sms',
+        request_params
+      ).and_return({ 'linkId' => '1', 'pendingRef' => 'ref', 'maskedPhone' => '+1******890' })
+
+      res = @instance.enchanted_link_sign_up_with_phone(
+        login_id: '+1234567890',
+        uri: 'https://some-uri/sms',
+        user: { login_id: 'user1', phone: '+1234567890' },
+        provider_id: 'provider-id',
+        template_id: 'template-id'
+      )
+
+      expect(res['maskedPhone']).to eq('+1******890')
+    end
   end
 
   context '.sign_up_or_in' do
@@ -125,6 +197,96 @@ describe Descope::Api::V1::EnchantedLink do
         )
       end.not_to raise_error
     end
+
+    it 'is expected to respond to sign up or in with phone' do
+      expect(@instance).to respond_to(:enchanted_link_sign_up_or_in_with_phone)
+    end
+
+    it 'is expected to sign up or in with enchanted link via sms' do
+      request_params = {
+        loginId: '+1234567890',
+        redirectUrl: 'https://some-uri/sms',
+        loginOptions: {
+          stepup: false,
+          customClaims: { 'abc': '123' },
+          mfa: false,
+          ssoAppId: 'sso-id'
+        },
+        providerId: 'provider-id',
+        templateId: 'template-id'
+      }
+
+      expect(@instance).to receive(:post).with(
+        '/v1/auth/enchantedlink/signup-in/sms',
+        request_params
+      ).and_return({ 'linkId' => '1', 'pendingRef' => 'ref', 'maskedPhone' => '+1******890' })
+
+      res = @instance.enchanted_link_sign_up_or_in_with_phone(
+        login_id: '+1234567890',
+        uri: 'https://some-uri/sms',
+        login_options: {
+          stepup: false,
+          custom_claims: { 'abc': '123' },
+          mfa: false,
+          sso_app_id: 'sso-id'
+        },
+        provider_id: 'provider-id',
+        template_id: 'template-id'
+      )
+
+      expect(res['maskedPhone']).to eq('+1******890')
+    end
+  end
+
+  context '.update_user_phone' do
+    it 'is expected to respond to update user phone' do
+      expect(@instance).to respond_to(:enchanted_link_update_user_phone)
+    end
+
+    it 'is expected to update user phone with enchanted link via sms' do
+      request_params = {
+        loginId: 'test',
+        phone: '+1234567890',
+        addToLoginIDs: true,
+        onMergeUseExisting: true,
+        redirectUrl: 'https://some-uri/sms',
+        providerId: 'provider-id',
+        templateId: 'template-id',
+        templateOptions: { 'abc': '123' }
+      }
+
+      expect(@instance).to receive(:post).with(
+        '/v1/auth/enchantedlink/update/phone/sms',
+        request_params,
+        {},
+        'refresh_token'
+      ).and_return({ 'linkId' => '1', 'pendingRef' => 'ref', 'maskedPhone' => '+1******890' })
+
+      res = @instance.enchanted_link_update_user_phone(
+        login_id: 'test',
+        phone: '+1234567890',
+        uri: 'https://some-uri/sms',
+        add_to_login_ids: true,
+        on_merge_use_existing: true,
+        provider_id: 'provider-id',
+        template_id: 'template-id',
+        template_options: { 'abc': '123' },
+        refresh_token: 'refresh_token'
+      )
+
+      expect(res['maskedPhone']).to eq('+1******890')
+    end
+
+    it 'is expected to raise an error on an invalid phone number' do
+      expect do
+        @instance.enchanted_link_update_user_phone(
+          login_id: 'test',
+          phone: 'not-a-phone',
+          uri: 'https://some-uri/sms',
+          refresh_token: 'refresh_token'
+        )
+      end.to raise_error(Descope::AuthException)
+    end
   end
 
   context '.enchanted_link_verify_token' do

data/spec/lib.descope/api/v1/management/access_key_spec.rb

@@ -15,7 +15,7 @@ describe Descope::Api::V1::Management::AccessKey do
     end
 
     it 'is expected to create access key' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         ACCESS_KEY_CREATE_PATH, {
           name: 'test',
           expireTime: 0,
@@ -46,7 +46,7 @@ describe Descope::Api::V1::Management::AccessKey do
     end
 
     it 'is expected to load an access key' do
-      expect(@instance).to receive(:get).with(
+      expect(@instance).to receive(:mgmt_get).with(
         ACCESS_KEY_LOAD_PATH, { id: '123' }
       )
       expect { @instance.load_access_key('123') }.not_to raise_error
@@ -59,7 +59,7 @@ describe Descope::Api::V1::Management::AccessKey do
     end
 
     it 'is expected to search all access keys' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         ACCESS_KEYS_SEARCH_PATH, { tenantIds: %w[123 456] }
       )
       expect { @instance.search_all_access_keys(%w[123 456]) }.not_to raise_error
@@ -72,7 +72,7 @@ describe Descope::Api::V1::Management::AccessKey do
     end
 
     it 'is expected to update an access keys' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         ACCESS_KEY_UPDATE_PATH, { id: '123', name: 'test1' }
       )
       expect { @instance.update_access_key(id: '123', name: 'test1') }.not_to raise_error
@@ -85,7 +85,7 @@ describe Descope::Api::V1::Management::AccessKey do
     end
 
     it 'is expected to deactivate an access keys' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         ACCESS_KEY_DEACTIVATE_PATH, { id: '123' }
       )
       expect { @instance.deactivate_access_key('123') }.not_to raise_error
@@ -98,7 +98,7 @@ describe Descope::Api::V1::Management::AccessKey do
     end
 
     it 'is expected to activate an access keys' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         ACCESS_KEY_ACTIVATE_PATH, { id: '123' }
       )
       expect { @instance.activate_access_key('123') }.not_to raise_error
@@ -111,7 +111,7 @@ describe Descope::Api::V1::Management::AccessKey do
     end
 
     it 'is expected to delete an access keys' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         ACCESS_KEY_DELETE_PATH, { id: '123' }
       )
       expect { @instance.delete_access_key('123') }.not_to raise_error

data/spec/lib.descope/api/v1/management/analytics_spec.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Descope::Api::V1::Management::Analytics do
+  before(:all) do
+    dummy_instance = DummyClass.new
+    dummy_instance.extend(Descope::Api::V1::Management::Analytics)
+    @instance = dummy_instance
+  end
+
+  context '.search' do
+    let(:mock_response) do
+      {
+        'analytics' => [
+          {
+            'projectId' => 'abc',
+            'action' => 'get',
+            'created' => '1234567000',
+            'device' => 'mobile',
+            'method' => 'post',
+            'geo' => 'US',
+            'tenant' => 'tenant1',
+            'referrer' => 'referrer1',
+            'cnt' => '5'
+          }
+        ]
+      }
+    end
+
+    before do
+      allow(@instance).to receive(:mgmt_post).with(
+        ANALYTICS_SEARCH_PATH,
+        {
+          from: 1_234_567_000,
+          to: 123_456_789_000,
+          groupByAction: true,
+          groupByDevice: true,
+          groupByMethod: true,
+          groupByGeo: true,
+          groupByTenant: true,
+          groupByReferrer: true,
+          groupByCreated: true,
+          actions: %w[action1 action2],
+          excludedActions: %w[exclude1 exclude2],
+          devices: %w[Bot Mobile Desktop Tablet Unknown],
+          methods: %w[otp totp magiclink oauth saml password],
+          geos: %w[US IL],
+          tenants: %w[tenant1 tenant2]
+        }
+      ).and_return(mock_response)
+    end
+
+    it 'should respond to .analytics_search' do
+      expect(@instance).to respond_to :analytics_search
+    end
+
+    it 'is expected to search analytics and get records' do
+      res = nil # define res outside the block
+      expect do
+        res = @instance.analytics_search(
+          from_ts: 1_234_567_000,
+          to_ts: 123_456_789_000,
+          group_by_action: true,
+          group_by_device: true,
+          group_by_method: true,
+          group_by_geo: true,
+          group_by_tenant: true,
+          group_by_referrer: true,
+          group_by_created: true,
+          actions: %w[action1 action2],
+          excluded_actions: %w[exclude1 exclude2],
+          devices: %w[Bot Mobile Desktop Tablet Unknown],
+          methods: %w[otp totp magiclink oauth saml password],
+          geos: %w[US IL],
+          tenants: %w[tenant1 tenant2]
+        )
+      end.not_to raise_error
+      expect(res['analytics'][0]['projectId']).to eq('abc')
+    end
+  end
+end

data/spec/lib.descope/api/v1/management/audit_spec.rb

@@ -31,7 +31,7 @@ describe Descope::Api::V1::Management::Audit do
     end
 
     before do
-      allow(@instance).to receive(:post).twice.with(
+      allow(@instance).to receive(:mgmt_post).twice.with(
         AUDIT_SEARCH,
         {
           noTenants: true,
@@ -144,7 +144,7 @@ describe Descope::Api::V1::Management::Audit do
     end
 
     it 'is expected to create an audit event' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         '/v1/mgmt/audit/event',
         {
           action: 'get',