descope 1.1.0 → 1.2.0

data/spec/lib.descope/api/v1/management/tenant_spec.rb

@@ -15,7 +15,7 @@ describe Descope::Api::V1::Management::Tenant do
     end
 
     it 'is expected to create a new tenant' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         TENANT_CREATE_PATH, {
           name: 'test',
           id: 'test',
@@ -46,7 +46,7 @@ describe Descope::Api::V1::Management::Tenant do
     end
 
     it 'is expected to update a tenant' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         TENANT_UPDATE_PATH, {
           name: 'test',
           id: 'test',
@@ -77,7 +77,7 @@ describe Descope::Api::V1::Management::Tenant do
     end
 
     it 'is expected to delete a tenant' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         TENANT_DELETE_PATH, { id: 'test' }
       )
       expect { @instance.delete_tenant('test') }.not_to raise_error
@@ -90,7 +90,7 @@ describe Descope::Api::V1::Management::Tenant do
     end
 
     it 'is expected to load a tenant' do
-      expect(@instance).to receive(:get).with(
+      expect(@instance).to receive(:mgmt_get).with(
         TENANT_LOAD_PATH, { id: 'test' }
       )
       expect { @instance.load_tenant('test') }.not_to raise_error
@@ -103,7 +103,7 @@ describe Descope::Api::V1::Management::Tenant do
     end
 
     it 'is expected to load all tenants' do
-      expect(@instance).to receive(:get).with(TENANT_LOAD_ALL_PATH)
+      expect(@instance).to receive(:mgmt_get).with(TENANT_LOAD_ALL_PATH)
       expect { @instance.load_all_tenants }.not_to raise_error
     end
   end
@@ -114,7 +114,7 @@ describe Descope::Api::V1::Management::Tenant do
     end
 
     it 'is expected to search all tenants' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         TENANT_SEARCH_ALL_PATH, {
           ids: %w[test1 test2],
           names: %w[test1 test2],

data/spec/lib.descope/api/v1/management/third_party_application_spec.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Descope::Api::V1::Management::ThirdPartyApplication do
+  before(:all) do
+    dummy_instance = DummyClass.new
+    dummy_instance.extend(Descope::Api::V1::Management::ThirdPartyApplication)
+    @instance = dummy_instance
+  end
+
+  context('.create_application') do
+    it 'should respond to .create_application' do
+      expect(@instance).to respond_to :create_application
+    end
+
+    it 'is expected to create a third party application' do
+      expect(@instance).to receive(:mgmt_post).with(
+        THIRD_PARTY_APP_CREATE_PATH, {
+          id: 'app1',
+          name: 'test',
+          description: 'awesome app',
+          logo: 'https://logo.com',
+          loginPageUrl: 'https://dummy.com/login',
+          approvedCallbackUrls: ['https://dummy.com/callback'],
+          permissionsScopes: [{ name: 'read' }],
+          attributesScopes: [{ name: 'email' }],
+          jwtBearerSettings: [{ tenantId: 'tenant1' }],
+          customAttributes: { key: 'value' },
+          forcePkce: true,
+          defaultAudience: 'aud1'
+        }
+      )
+      expect do
+        @instance.create_application(
+          id: 'app1',
+          name: 'test',
+          description: 'awesome app',
+          logo: 'https://logo.com',
+          login_page_url: 'https://dummy.com/login',
+          approved_callback_urls: ['https://dummy.com/callback'],
+          permissions_scopes: [{ name: 'read' }],
+          attributes_scopes: [{ name: 'email' }],
+          jwt_bearer_settings: [{ tenantId: 'tenant1' }],
+          custom_attributes: { key: 'value' },
+          force_pkce: true,
+          default_audience: 'aud1'
+        )
+      end.not_to raise_error
+    end
+  end
+
+  context('.update_application') do
+    it 'should respond to .update_application' do
+      expect(@instance).to respond_to :update_application
+    end
+
+    it 'is expected to update a third party application' do
+      expect(@instance).to receive(:mgmt_post).with(
+        THIRD_PARTY_APP_UPDATE_PATH, {
+          id: 'app1',
+          name: 'test',
+          description: 'awesome app',
+          logo: 'https://logo.com',
+          loginPageUrl: 'https://dummy.com/login'
+        }
+      )
+      expect do
+        @instance.update_application(
+          id: 'app1',
+          name: 'test',
+          description: 'awesome app',
+          logo: 'https://logo.com',
+          login_page_url: 'https://dummy.com/login'
+        )
+      end.not_to raise_error
+    end
+  end
+
+  context('.patch_application') do
+    it 'should respond to .patch_application' do
+      expect(@instance).to respond_to :patch_application
+    end
+
+    it 'is expected to patch a third party application' do
+      expect(@instance).to receive(:mgmt_post).with(
+        THIRD_PARTY_APP_PATCH_PATH, {
+          id: 'app1',
+          name: 'test'
+        }
+      )
+      expect do
+        @instance.patch_application(
+          id: 'app1',
+          name: 'test'
+        )
+      end.not_to raise_error
+    end
+  end
+
+  it 'is expected to delete a third party application' do
+    expect(@instance).to receive(:mgmt_post).with(
+      THIRD_PARTY_APP_DELETE_PATH, { id: 'app1' }
+    )
+    expect { @instance.delete_application('app1') }.not_to raise_error
+  end
+
+  it 'is expected to load a third party application' do
+    expect(@instance).to receive(:mgmt_get).with(
+      THIRD_PARTY_APP_LOAD_PATH, { id: 'app1' }
+    )
+    expect { @instance.load_application('app1') }.not_to raise_error
+  end
+
+  it 'is expected to load all third party applications' do
+    expect(@instance).to receive(:mgmt_get).with(
+      THIRD_PARTY_APP_LOAD_ALL_PATH, {}
+    )
+    expect { @instance.load_all_applications }.not_to raise_error
+  end
+
+  it 'is expected to get a third party application secret' do
+    expect(@instance).to receive(:mgmt_get).with(
+      THIRD_PARTY_APP_SECRET_PATH, { id: 'app1' }
+    )
+    expect { @instance.get_application_secret('app1') }.not_to raise_error
+  end
+
+  it 'is expected to rotate a third party application secret' do
+    expect(@instance).to receive(:mgmt_post).with(
+      THIRD_PARTY_APP_ROTATE_PATH, { id: 'app1' }
+    )
+    expect { @instance.rotate_application_secret('app1') }.not_to raise_error
+  end
+
+  it 'is expected to delete consents' do
+    expect(@instance).to receive(:mgmt_post).with(
+      THIRD_PARTY_APP_DELETE_CONSENTS_PATH, {
+        consentIds: %w[consent1 consent2],
+        appId: 'app1',
+        userIds: %w[user1 user2],
+        tenantId: 'tenant1'
+      }
+    )
+    expect do
+      @instance.delete_consents(
+        app_id: 'app1',
+        consent_ids: %w[consent1 consent2],
+        user_ids: %w[user1 user2],
+        tenant_id: 'tenant1'
+      )
+    end.not_to raise_error
+  end
+
+  it 'is expected to delete tenant consents' do
+    expect(@instance).to receive(:mgmt_post).with(
+      THIRD_PARTY_APP_DELETE_TENANT_CONSENTS_PATH, {
+        consentIds: %w[consent1 consent2],
+        appId: 'app1',
+        tenantId: 'tenant1'
+      }
+    )
+    expect do
+      @instance.delete_tenant_consents(
+        app_id: 'app1',
+        consent_ids: %w[consent1 consent2],
+        tenant_id: 'tenant1'
+      )
+    end.not_to raise_error
+  end
+end

data/spec/lib.descope/api/v1/management/user_spec.rb

@@ -58,7 +58,7 @@ describe Descope::Api::V1::Management::User do
     }
 
     it 'is expected to create a user with user data' do
-      expect(@instance).to receive(:post).with(USER_CREATE_PATH, params)
+      expect(@instance).to receive(:mgmt_post).with(USER_CREATE_PATH, params)
 
       expect do
         @instance.create_user(**args)
@@ -67,7 +67,7 @@ describe Descope::Api::V1::Management::User do
 
     it 'is expected to create a test user with user data' do
       params[:test] = true
-      expect(@instance).to receive(:post).with(TEST_USER_CREATE_PATH, params)
+      expect(@instance).to receive(:mgmt_post).with(TEST_USER_CREATE_PATH, params)
 
       expect do
         args[:test] = true
@@ -101,7 +101,7 @@ describe Descope::Api::V1::Management::User do
           }
         ]
       }
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_CREATE_BATCH_PATH, users_params
       )
 
@@ -117,7 +117,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it "is expected to post #{USER_CREATE_PATH} with invite true" do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_CREATE_PATH, {
           loginId: 'name@mail.com',
           email: 'name@mail.com',
@@ -143,7 +143,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a user update method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_PATH, {
           loginId: 'name@mail.com',
           email: 'name@mail.com',
@@ -171,7 +171,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a user delete method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_DELETE_PATH, { loginId: 'name@mail.com' }
       )
 
@@ -183,7 +183,7 @@ describe Descope::Api::V1::Management::User do
 
   context '.delete_all_user' do
     it 'is expected to respond to a user delete method' do
-      expect(@instance).to receive(:delete).with(USER_DELETE_ALL_TEST_USERS_PATH)
+      expect(@instance).to receive(:mgmt_delete).with(USER_DELETE_ALL_TEST_USERS_PATH)
 
       expect do
         @instance.delete_all_test_users
@@ -197,7 +197,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it "is expected to get #{USER_LOAD_PATH} with login_id" do
-      expect(@instance).to receive(:get).with(
+      expect(@instance).to receive(:mgmt_get).with(
         USER_LOAD_PATH, { loginId: 'someone' }
       )
       expect { @instance.load_user('someone') }.not_to raise_error
@@ -206,7 +206,7 @@ describe Descope::Api::V1::Management::User do
 
   context '.load_by_user_id' do
     it "is expected to get #{USER_LOAD_PATH} with user_id" do
-      allow(@instance).to receive(:get).with(
+      allow(@instance).to receive(:mgmt_get).with(
         USER_LOAD_PATH, { userId: 'ABCD' }
       )
       expect { @instance.load_by_user_id('ABCD') }.not_to raise_error
@@ -215,7 +215,7 @@ describe Descope::Api::V1::Management::User do
 
   context '.logout_user' do
     it 'is expected to respond to a logout user method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_LOGOUT_PATH, { loginId: 'name@mail.com' }
       )
 
@@ -225,7 +225,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a logout user by id method' do
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_LOGOUT_PATH, { userId: 'U2ZpARjKAJJmq0fzU2lXNNCGnF4j' }
       )
 
@@ -241,7 +241,7 @@ describe Descope::Api::V1::Management::User do
 
       tenant_role_ids = { 'tenant1' => ['roleA', 'roleB'] }
       tenant_role_names = { 'tenant1' => ['roleName1', 'roleName2'] }
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USERS_SEARCH_PATH, {
           loginId: 'someone@example.com',
           tenantIds: [],
@@ -284,7 +284,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a get_provider_token method' do
       expect(@instance).to respond_to(:get_provider_token)
 
-      expect(@instance).to receive(:get).with(
+      expect(@instance).to receive(:mgmt_get).with(
         USER_GET_PROVIDER_TOKEN, {
           loginId: 'someone@example.com',
           provider: 'google-oauth2'
@@ -304,7 +304,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a activate method' do
       expect(@instance).to respond_to(:activate)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_STATUS_PATH, {
           loginId: 'someone@example.com',
           status: 'enabled'
@@ -321,7 +321,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a activate method' do
       expect(@instance).to respond_to(:activate)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_STATUS_PATH, {
           loginId: 'someone@example.com',
           status: 'disabled'
@@ -338,7 +338,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_email method' do
       expect(@instance).to respond_to(:update_email)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_EMAIL_PATH, {
           loginId: 'someone@example.com',
           email: 'tester@test.com',
@@ -360,7 +360,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_phone method' do
       expect(@instance).to respond_to(:update_phone)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_PHONE_PATH, {
           loginId: 'someone@example.com',
           phone: '1234567890',
@@ -382,7 +382,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_display_name method' do
       expect(@instance).to respond_to(:update_display_name)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_NAME_PATH, {
           loginId: 'someone@example.com',
           name: 'some guy',
@@ -408,7 +408,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_picture method' do
       expect(@instance).to respond_to(:update_picture)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_PICTURE_PATH, {
           loginId: 'someone@example.com',
           picture: 'https://www.example.com/picture.png'
@@ -428,7 +428,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_custom_attribute method' do
       expect(@instance).to respond_to(:update_custom_attribute)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_UPDATE_CUSTOM_ATTRIBUTE_PATH, {
           loginId: 'someone@example.com',
           attributeKey: 'OU',
@@ -450,7 +450,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a add_roles method' do
       expect(@instance).to respond_to(:user_add_roles)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_ADD_ROLE_PATH, {
           loginId: 'someone@example.com',
           roleNames: %w[role1 role2],
@@ -472,7 +472,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a user_remove_roles method' do
       expect(@instance).to respond_to(:user_remove_roles)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_REMOVE_ROLE_PATH, {
           loginId: 'someone@example.com',
           roleNames: %w[role1 role2],
@@ -494,7 +494,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a add_tenant method' do
       expect(@instance).to respond_to(:user_add_tenant)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_ADD_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1'
@@ -514,7 +514,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a remove_tenant method' do
       expect(@instance).to respond_to(:user_remove_tenant)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_REMOVE_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1'
@@ -534,7 +534,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a add_tenant_role method' do
       expect(@instance).to respond_to(:add_tenant_role)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_ADD_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1',
@@ -556,7 +556,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a remove_tenant_role method' do
       expect(@instance).to respond_to(:user_remove_tenant_roles)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_REMOVE_TENANT_PATH, {
           loginId: 'someone@example.com',
           tenantId: 'tenant1',
@@ -578,7 +578,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a set_temporary_password method' do
       expect(@instance).to respond_to(:set_temporary_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_SET_TEMPORARY_PASSWORD_PATH, {
           loginId: 'someone@example.com',
           password: 's3cr3t'
@@ -598,7 +598,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a set_active_password method' do
       expect(@instance).to respond_to(:set_active_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_SET_ACTIVE_PASSWORD_PATH, {
           loginId: 'someone@example.com',
           password: 's3cr3t'
@@ -618,7 +618,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a set_password method' do
       expect(@instance).to respond_to(:set_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_SET_PASSWORD_PATH, {
           loginId: 'someone@example.com',
           password: 's3cr3t'
@@ -638,7 +638,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a expire_password method' do
       expect(@instance).to respond_to(:expire_password)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_EXPIRE_PASSWORD_PATH, { loginId: 'someone@example.com' }
       )
 
@@ -650,7 +650,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a generate_otp_for_test method' do
       expect(@instance).to respond_to(:generate_otp_for_test_user)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_GENERATE_OTP_FOR_TEST_PATH, {
           loginId: 'someone@example.com',
           deliveryMethod: 'email'
@@ -670,7 +670,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a generate_enchanted_link_for_test method' do
       expect(@instance).to respond_to(:generate_enchanted_link_for_test_user)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_GENERATE_ENCHANTED_LINK_FOR_TEST_PATH, {
           loginId: 'someone@example.com',
           URI: 'https://www.example.com'
@@ -690,7 +690,7 @@ describe Descope::Api::V1::Management::User do
     it 'is expected to respond to a update_jwt method' do
       expect(@instance).to respond_to(:update_jwt)
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         UPDATE_JWT_PATH, {
           jwt: 'eyJ3abcde12345',
           customClaims: { 'claim1' => 'value1', 'claim2' => 'value2' }
@@ -717,7 +717,7 @@ describe Descope::Api::V1::Management::User do
         customClaims: { 'abc': '123' }
       }
 
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         USER_GENERATE_EMBEDDED_LINK_PATH,
         request_params
       )
@@ -737,7 +737,7 @@ describe Descope::Api::V1::Management::User do
     end
 
     it 'is expected to respond to a user patch method' do
-      expect(@instance).to receive(:patch).with(
+      expect(@instance).to receive(:mgmt_patch).with(
         USER_PATCH_PATH, {
           loginId: 'name@mail.com',
           email: 'name@mail.com',
@@ -765,7 +765,7 @@ describe Descope::Api::V1::Management::User do
 
       tenant_role_ids = { 'tenant1' => ['roleA', 'roleB'] }
       tenant_role_names = { 'tenant1' => ['roleName1', 'roleName2'] }
-      expect(@instance).to receive(:post).with(
+      expect(@instance).to receive(:mgmt_post).with(
         TEST_USERS_SEARCH_PATH, {
           tenantIds: %w[t1 t2],
           roleNames: %w[r1 r2],

data/spec/lib.descope/auth_management_key_spec.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+# Covers the Authorization header the SDK actually sends. The auth management key rides along with
+# every authentication request so that methods whose public access has been disabled can still be
+# used, and it is never sent on management requests - those carry the management key instead.
+describe 'auth management key' do
+  let(:project_id) { 'P2abcde12345' }
+  let(:management_key) { 'mgmt-key' }
+  let(:auth_management_key) { 'auth-key' }
+  let(:refresh_token) { 'refresh-token' }
+
+  # Stubs the RestClient boundary on both of the client's HTTP clients and hands back the
+  # Authorization header of whichever one ends up being used.
+  def authorization_for(client)
+    captured = nil
+    [client.auth_http, client.mgmt_http].each do |http|
+      allow(http).to receive(:call) do |_method, _url, _timeout, headers, _body|
+        captured = headers['Authorization']
+        double('response', code: 200, body: '{}', cookies: {}, headers: {})
+      end
+    end
+    yield
+    captured
+  end
+
+  def build_client(**options)
+    Descope::Client.new({ project_id: project_id, log_level: 'fatal' }.merge(options))
+  end
+
+  # An authentication request that presents no token of its own.
+  def sign_up(client)
+    client.otp_sign_up(method: Descope::Mixins::Common::DeliveryMethod::EMAIL, login_id: 'someone@example.com')
+  end
+
+  around do |example|
+    keys = %w[DESCOPE_MANAGEMENT_KEY DESCOPE_AUTH_MANAGEMENT_KEY]
+    saved = keys.to_h { |var| [var, ENV[var]] }
+    keys.each { |var| ENV.delete(var) }
+    example.run
+  ensure
+    saved.each { |var, value| ENV[var] = value }
+  end
+
+  context 'on authentication requests' do
+    it 'sends only the project ID when no auth management key is configured' do
+      client = build_client
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}")
+    end
+
+    it 'appends the auth management key when one is configured' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+
+    it 'appends the auth management key after a refresh token' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.me(refresh_token) }
+      expect(header).to eq("Bearer #{project_id}:#{refresh_token}:#{auth_management_key}")
+    end
+
+    it 'never sends the management key' do
+      client = build_client(management_key: management_key, auth_management_key: auth_management_key)
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+      expect(header).to_not include(management_key)
+    end
+
+    # DummyClass swallows extra_headers, so only a real client exercises this argument.
+    it 'tolerates a nil extra_headers from the caller' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.post(SIGN_IN_PASSWORD_PATH, {}, nil, refresh_token) }
+      expect(header).to eq("Bearer #{project_id}:#{refresh_token}:#{auth_management_key}")
+    end
+
+    it 'signs in with an enchanted link' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) do
+        client.enchanted_link_sign_in(login_id: 'someone@example.com', uri: 'https://example.com')
+      end
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+
+    it 'does not substitute a key for an empty refresh token' do
+      client = build_client(management_key: management_key, auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.sign_out('') }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+  end
+
+  context 'on management requests' do
+    it 'appends the management key' do
+      client = build_client(management_key: management_key)
+      header = authorization_for(client) { client.load_all_tenants }
+      expect(header).to eq("Bearer #{project_id}:#{management_key}")
+    end
+
+    it 'never sends the auth management key' do
+      client = build_client(management_key: management_key, auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.load_all_tenants }
+      expect(header).to eq("Bearer #{project_id}:#{management_key}")
+      expect(header).to_not include(auth_management_key)
+    end
+
+    it 'sends only the project ID when no management key is configured' do
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { client.load_all_tenants }
+      expect(header).to eq("Bearer #{project_id}")
+    end
+  end
+
+  context 'configuration' do
+    it 'falls back to the DESCOPE_AUTH_MANAGEMENT_KEY env var' do
+      ENV['DESCOPE_AUTH_MANAGEMENT_KEY'] = 'env-auth-key'
+      client = build_client
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:env-auth-key")
+    end
+
+    it 'prefers the configured key over the env var' do
+      ENV['DESCOPE_AUTH_MANAGEMENT_KEY'] = 'env-auth-key'
+      client = build_client(auth_management_key: auth_management_key)
+      header = authorization_for(client) { sign_up(client) }
+      expect(header).to eq("Bearer #{project_id}:#{auth_management_key}")
+    end
+
+    it 'keeps the two keys distinct' do
+      ENV['DESCOPE_MANAGEMENT_KEY'] = management_key
+      ENV['DESCOPE_AUTH_MANAGEMENT_KEY'] = auth_management_key
+      client = build_client
+      expect(client.auth_http.authorization_header).to eq(
+        { 'Authorization' => "Bearer #{project_id}:#{auth_management_key}" }
+      )
+      expect(client.mgmt_http.authorization_header).to eq(
+        { 'Authorization' => "Bearer #{project_id}:#{management_key}" }
+      )
+    end
+  end
+
+  describe 'debug logging' do
+    it 'masks everything after the project ID' do
+      client = build_client(auth_management_key: auth_management_key)
+      masked = client.auth_http.mask_authorization(client.auth_http.authorization_header)
+      expect(masked['Authorization']).to eq("Bearer #{project_id}:***")
+      expect(masked['Authorization']).to_not include(auth_management_key)
+    end
+  end
+end