keycloak-admin 2.0.0 → 2.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0c198fd53c7034b75c805c4479b73eec2dec2159da57e6cebd8056742ad40cd6
-  data.tar.gz: f2532b1773d60f633644bb5dd9c0c361933037db228ec871ac92aea73f4baf0b
+  metadata.gz: 4a9c09a6765355416960bbc5c4564ad5dd5f526f65093b43d46ac10fc39d0ae7
+  data.tar.gz: b2dd1762448fad5a096b94adc3d18b30640235fe02efa1e77269797bfa3f9464
 SHA512:
-  metadata.gz: 553e781914529764e787e455918d878e7ce49902e4f75b679f66a6559d59a70684058f655e81f7de23bd3f83e9f884a26c3bad3a9d2c962600de66249176409a
-  data.tar.gz: 626a03f798614205ffe9218b76f31d8fd625810980c33f49d12ce322e79e5e47977104873863ea36b955b79efb68aa995af3f63efa4aad2beef77b38dba85527
+  metadata.gz: 3274b863ef8b7d295b82d5dd87a6d3340ac96ac08c1f38c822ad531b204f4fd5755704a905ccc308821e199d17cc8c73959c3dc1d39a5a13079ce133f1ed4854
+  data.tar.gz: 7c8d7b5f54eb523f27eaaa83893d8b5190d4647ed6d7424a6ac1b55168ffa02fb426171b424330db86d976e00c84e1644d3bab3cf4fd398d1eb9cf4deff2e679

data/.github/workflows/release.yml

@@ -0,0 +1,112 @@
+name: Release
+
+# Publishing is triggered by pushing a version tag, e.g.:
+#   git tag -a v1.2.0 -m "Version 1.2.0" && git push origin v1.2.0
+#
+# No RubyGems API key is stored in this repository: the gem is pushed through
+# RubyGems' Trusted Publishing, which exchanges a short-lived GitHub OIDC token
+# for a scoped RubyGems credential. This requires a trusted publisher declared on
+# https://rubygems.org/gems/keycloak-admin pointing to this repository, this
+# workflow file name and the 'release' environment.
+on:
+  push:
+    tags: [ "v*" ]
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Push gem to RubyGems.org
+    # Pinned rather than 'ubuntu-latest', for the same reason as in ci.yml.
+    runs-on: ubuntu-24.04
+
+    environment: release
+
+    permissions:
+      contents: write # 'rake release' pushes the version tag when it does not exist yet
+      id-token: write # mandatory to request the OIDC token used by trusted publishing
+
+    steps:
+    # The test suite includes an integration spec that talks to a real Keycloak
+    # (spec/integration/client_authorization_spec.rb, gated on ENV["GITHUB_ACTIONS"],
+    # which GitHub Actions sets on every run regardless of workflow). Keycloak is
+    # provisioned here the same way ci.yml does it, so 'bundle exec rspec' below is a
+    # real, complete gate rather than skipping that spec for lack of a server.
+    - name: Start Keycloak
+      run: |
+        docker run -d --name keycloak -p 8080:8080 \
+          -e KC_BOOTSTRAP_ADMIN_USERNAME=admin \
+          -e KC_BOOTSTRAP_ADMIN_PASSWORD=admin \
+          -e KC_HOSTNAME=http://localhost:8080 \
+          -e KC_HOSTNAME_ADMIN=http://localhost:8080 \
+          -e KC_HTTP_ENABLED=true \
+          -e KC_DB=dev-file \
+          quay.io/keycloak/keycloak:26.7.0 \
+          start-dev
+
+    - name: Wait for Keycloak to be ready
+      run: |
+        for i in $(seq 1 30); do
+          if curl --silent --fail http://localhost:8080/realms/master > /dev/null; then
+            echo "Keycloak is ready"
+            exit 0
+          fi
+          sleep 5
+        done
+        echo "Keycloak did not become ready in time"
+        docker logs keycloak
+        exit 1
+
+    - name: create realm
+      run: |
+         TOKEN=$(curl --silent --location --request POST "http://localhost:8080/realms/master/protocol/openid-connect/token" \
+            --header 'Content-Type: application/x-www-form-urlencoded' \
+            --data-urlencode 'grant_type=password' \
+            --data-urlencode 'username=admin' \
+            --data-urlencode 'password=admin' \
+            --data-urlencode 'client_id=admin-cli' | jq -r '.access_token')
+
+         curl --silent --show-error -L -X POST "http://localhost:8080/admin/realms" \
+            --header "Content-Type: application/json" \
+            --header "Authorization: Bearer ${TOKEN}" \
+            --data '{"realm":"dummy","enabled":true}'
+
+         curl --silent --show-error --request POST 'http://localhost:8080/admin/realms/dummy/clients' \
+           --header 'Authorization: Bearer '$TOKEN \
+           --header 'Content-Type: application/json' \
+           --data-raw '{
+             "clientId":"dummy-client",
+             "enabled":true,
+             "consentRequired": false,
+             "attributes":{},
+             "serviceAccountsEnabled": true,
+             "protocol":"openid-connect",
+             "publicClient":false,
+             "authorizationServicesEnabled": true,
+             "clientAuthenticatorType":"client-secret",
+             "redirectUris":["http://localhost:8180/demo"]
+           }'
+
+    - uses: actions/checkout@v4
+
+    - name: Set up Ruby
+      uses: ruby/setup-ruby@v1
+      with:
+        ruby-version: '3.4'
+        bundler-cache: true
+
+    - name: Check that the tag matches KeycloakAdmin::VERSION
+      run: |
+        tag="${GITHUB_REF_NAME#v}"
+        version="$(ruby -Ilib -r keycloak-admin/version -e 'print KeycloakAdmin::VERSION')"
+        if [ "$tag" != "$version" ]; then
+          echo "::error::Tag '${GITHUB_REF_NAME}' does not match KeycloakAdmin::VERSION '${version}'"
+          exit 1
+        fi
+
+    - name: Run tests
+      run: bundle exec rspec
+
+    # Builds the gem, pushes it to RubyGems.org and waits for it to be available.
+    - uses: rubygems/release-gem@v1

data/CHANGELOG.md

@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2.0.1] - 2026-07-31
+
+* [Feature] Requests are now logged through `config.logger` (method, URL, and response status) via Faraday's `:logger` middleware.
+* [Feature] The access token is now cached and reused (tracking `expires_in`) instead of being fetched before nearly every call. Previously, caching lived on the `Client` instance, but a fresh `Client` subclass is created for almost every call (e.g. `KeycloakAdmin.realm(x).users` builds a new `UserClient`), so the cache was rarely hit in practice; it now lives on the shared `Configuration`.
+* Publish the gem to RubyGems from Github Actions when a `v*` tag is pushed, using RubyGems' Trusted Publishing
+
 ## [2.0.0] - 2026-07-31
 
 * [Breaking] Replaced `rest-client` with `Faraday` as the underlying HTTP library. This should be transparent for callers of this gem's own API, but `config.rest_client_options` is renamed to `config.faraday_options` and its shape changes from rest-client's flat hash to Faraday's connection options (e.g. `{ timeout: 5 }` becomes `{ request: { timeout: 5 } }`, `{ verify_ssl: false }` becomes `{ ssl: { verify: false } }`). See the `Configuration` section of the README.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    keycloak-admin (2.0.0)
+    keycloak-admin (2.0.1)
       base64
       faraday (~> 2.0)
       http-cookie (~> 1.0, >= 1.0.3)
@@ -25,6 +25,7 @@ GEM
     logger (1.7.0)
     net-http (0.9.1)
       uri (>= 0.11.1)
+    rake (13.4.2)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -46,6 +47,7 @@ PLATFORMS
 DEPENDENCIES
   byebug (= 12.0.0)
   keycloak-admin!
+  rake (>= 13.0)
   rspec (= 3.13.2)
 
 BUNDLED WITH

data/README.md

@@ -16,7 +16,7 @@ This gem *does not* require Rails.
 For example, using `bundle`, add this line to your Gemfile.
 
 ```ruby
-gem "keycloak-admin", "2.0.0"
+gem "keycloak-admin", "2.0.1"
 ```
 
 ## Login
@@ -885,3 +885,19 @@ From the `keycloak-admin-api` directory:
   $ docker build . -t keycloak-admin:test
   $ docker run -v `pwd`:/usr/src/app/ keycloak-admin:test rspec spec
 ```
+
+## How to release a new version
+
+Releases are published to [RubyGems](https://rubygems.org/gems/keycloak-admin) by GitHub Actions
+(`.github/workflows/release.yml`), through [Trusted Publishing](https://guides.rubygems.org/trusted-publishing/):
+no API key is stored in this repository, the workflow exchanges a short-lived GitHub OIDC token for a
+scoped RubyGems credential.
+
+1. Update `KeycloakAdmin::VERSION` in `lib/keycloak-admin/version.rb` and the `CHANGELOG.md`
+2. Commit and push these changes to `main`
+3. Tag the commit and push the tag:
+
+```
+  $ git tag -a v2.0.1 -m "Version 2.0.1"
+  $ git push origin v2.0.1
+```

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task default: :spec

data/keycloak-admin.gemspec

@@ -22,4 +22,5 @@ Gem::Specification.new do |spec|
   spec.add_dependency "base64"
   spec.add_development_dependency "rspec",  "3.13.2"
   spec.add_development_dependency "byebug", "12.0.0"
+  spec.add_development_dependency "rake",   ">= 13.0"
 end

data/lib/keycloak-admin/client/client.rb

@@ -9,8 +9,11 @@ module KeycloakAdmin
       @configuration.server_url&.sub(/\/+\z/, "")
     end
 
+    # Cached on @configuration, not on this instance, since a new Client subclass is
+    # created for nearly every call (e.g. KeycloakAdmin.realm(x).users creates a fresh
+    # UserClient) - caching here alone would fetch a new token on almost every request.
     def current_token
-      @current_token ||= KeycloakAdmin.create_client(@configuration, @configuration.client_realm_name).token.get
+      @configuration.cached_token || @configuration.cache_token(fetch_token)
     end
 
     def headers
@@ -49,8 +52,12 @@ module KeycloakAdmin
 
     private
 
+    def fetch_token
+      KeycloakAdmin.create_client(@configuration, @configuration.client_realm_name).token.get
+    end
+
     def resource(url)
-      Resource.new(url, @configuration.faraday_options)
+      Resource.new(url, @configuration.faraday_options, @configuration.logger)
     end
 
     def http_error(response)

data/lib/keycloak-admin/client/configurable_token_client.rb

@@ -25,7 +25,8 @@ module KeycloakAdmin
               Authorization: "Bearer #{user_access_token}",
               content_type: :json,
               accept: :json
-            }
+            },
+            logger: @configuration.logger
           )
         )
       end

data/lib/keycloak-admin/client/group_client.rb

@@ -118,7 +118,8 @@ module KeycloakAdmin
             url: url,
             method: :delete,
             payload: create_payload([role_representation]),
-            headers: headers
+            headers: headers,
+            logger: @configuration.logger
           )
         )
       end

data/lib/keycloak-admin/client/resource.rb

@@ -0,0 +1,98 @@
+require "faraday"
+require "uri"
+
+module KeycloakAdmin
+  # Thin facade over Faraday that mirrors RestClient::Resource/RestClient::Request's call
+  # shape, so every client class can build/send requests without depending on Faraday's API
+  # directly.
+  class Resource
+    MIME_TYPES = { json: "application/json" }.freeze
+
+    def self.execute(options)
+      options = options.dup
+      method  = options.delete(:method)
+      url     = options.delete(:url)
+      payload = options.delete(:payload)
+      headers = options.delete(:headers) || {}
+      logger  = options.delete(:logger)
+      new(url, options, logger).send(:request, method, payload, headers)
+    end
+
+    def self.put(url, payload, headers = {}, logger = nil)
+      new(url, {}, logger).put(payload, headers)
+    end
+
+    def initialize(url, options = {}, logger = nil)
+      @url     = url
+      @options = options || {}
+      @logger  = logger
+    end
+
+    def get(headers = {})
+      request(:get, nil, headers)
+    end
+
+    def delete(headers = {})
+      request(:delete, nil, headers)
+    end
+
+    def post(payload, headers = {})
+      request(:post, payload, headers)
+    end
+
+    def put(payload, headers = {})
+      request(:put, payload, headers)
+    end
+
+    private
+
+    def request(method, payload, headers)
+      headers      = headers || {}
+      query        = headers[:params]
+      send_headers = build_headers(headers.reject { |key, _| key == :params })
+      body         = encode_payload(payload)
+
+      # RestClient::Payload::UrlEncoded always stamped this Content-Type for Hash payloads,
+      # regardless of what the caller's headers said; token retrieval relies on it and never
+      # sets content_type itself.
+      if payload.is_a?(Hash) && !send_headers.key?("Content-Type")
+        send_headers["Content-Type"] = "application/x-www-form-urlencoded"
+      end
+
+      faraday_response = connection.public_send(method) do |req|
+        req.params.update(query) if query
+        send_headers.each { |name, value| req.headers[name] = value }
+        req.body = body unless body.nil?
+      end
+      Response.new(faraday_response)
+    end
+
+    def connection
+      Faraday.new(url: @url, **@options) do |f|
+        f.response :raise_error
+        # Added after :raise_error so it logs the raw response (status/duration) before
+        # :raise_error can raise, including on failures. Faraday's logger middleware logs
+        # headers by default, which would print the bearer token on every call; headers: false
+        # keeps this to method/url/status only. Bodies are already off by Faraday's own default.
+        f.response :logger, @logger, headers: false if @logger
+        f.adapter Faraday.default_adapter
+      end
+    end
+
+    def encode_payload(payload)
+      return nil if payload.nil?
+      payload.is_a?(Hash) ? URI.encode_www_form(payload) : payload.to_s
+    end
+
+    def build_headers(headers)
+      headers.each_with_object({}) do |(key, value), result|
+        name         = key.is_a?(Symbol) ? humanize(key) : key.to_s
+        result[name] = value.is_a?(Symbol) ? MIME_TYPES.fetch(value, value.to_s) : value
+      end
+    end
+
+    def humanize(key)
+      key.to_s.split("_").map { |word| word.capitalize }.join("-")
+    end
+  end
+end

data/lib/keycloak-admin/client/response.rb

@@ -0,0 +1,36 @@
+module KeycloakAdmin
+  # Wraps a Faraday::Response the way RestClient::Response used to: as the body string
+  # itself (RestClient::Response < String), so existing call sites that do JSON.parse(response)
+  # or response.to_i keep working, while .body/.headers/.status/.code/.reason_phrase stay
+  # available for call sites that need response metadata.
+  class Response < String
+    attr_reader :status, :reason_phrase, :headers
+
+    def initialize(faraday_response)
+      super(faraday_response.body.to_s)
+      @status        = faraday_response.status
+      @reason_phrase = faraday_response.reason_phrase
+      @headers       = symbolize_headers(faraday_response.headers)
+    end
+
+    alias_method :code, :status
+    alias_method :body, :to_s
+
+    private
+
+    def symbolize_headers(faraday_headers)
+      faraday_headers.each_with_object({}) do |(key, value), result|
+        symbol_key         = key.downcase.tr("-", "_").to_sym
+        result[symbol_key] = symbol_key == :set_cookie ? split_set_cookie(value) : value
+      end
+    end
+
+    # Net::HTTP (used by Faraday's default adapter) joins repeated Set-Cookie header lines with
+    # ", " (see Net::HTTPHeader#each_header), losing the one-header-per-cookie structure RestClient
+    # exposed as an Array. Re-split on cookie boundaries rather than on every comma, since a comma
+    # can also appear inside a cookie's own "Expires=Wed, 09 Jun 2027 ..." attribute.
+    def split_set_cookie(value)
+      value.split(/,(?=\s*[^;\s]+=)/).map(&:strip)
+    end
+  end
+end

data/lib/keycloak-admin/client/role_mapper_client.rb

@@ -27,7 +27,8 @@ module KeycloakAdmin
             method: :delete,
             url: realm_level_url,
             payload: create_payload(role_representation_list),
-            headers: headers
+            headers: headers,
+            logger: @configuration.logger
           )
         )
       end

data/lib/keycloak-admin/client/user_client.rb

@@ -28,7 +28,8 @@ module KeycloakAdmin
           method: :put,
           url: users_url(user_id),
           payload: create_payload(user_representation_body),
-          headers: headers
+          headers: headers,
+          logger: @configuration.logger
         )
       )
     end
@@ -39,7 +40,8 @@ module KeycloakAdmin
           method: :put,
           url: "#{users_url(user_id)}/groups/#{group_id}",
           payload: create_payload({}),
-          headers: headers
+          headers: headers,
+          logger: @configuration.logger
         )
       )
     end
@@ -49,7 +51,8 @@ module KeycloakAdmin
         @configuration.faraday_options.merge(
           method: :delete,
           url: "#{users_url(user_id)}/groups/#{group_id}",
-          headers: headers
+          headers: headers,
+          logger: @configuration.logger
         )
       )
     end
@@ -116,7 +119,8 @@ module KeycloakAdmin
             method: :put,
             url: reset_password_url(user_id),
             payload: { type: "password", value: new_password, temporary: false }.to_json,
-            headers: headers
+            headers: headers,
+            logger: @configuration.logger
           )
         )
       end
@@ -140,7 +144,7 @@ module KeycloakAdmin
         lifespan_param = lifespan.nil? ? "" : "&lifespan=#{lifespan.seconds}"
         redirect_uri_param = redirect_uri.nil? ? "" : "&redirect_uri=#{redirect_uri}"
         client_id_param = client_id.nil? ? "" : "client_id=#{client_id}"
-        Resource.put("#{execute_actions_email_url(user_id)}?#{client_id_param}#{redirect_uri_param}#{lifespan_param}", create_payload(actions), headers)
+        Resource.put("#{execute_actions_email_url(user_id)}?#{client_id_param}#{redirect_uri_param}#{lifespan_param}", create_payload(actions), headers, @configuration.logger)
       end
       user_id
     end
@@ -153,7 +157,8 @@ module KeycloakAdmin
             method: :post,
             url: impersonation.impersonation_url,
             payload: impersonation.body.to_json,
-            headers: impersonation.headers
+            headers: impersonation.headers,
+            logger: @configuration.logger
           )
         )
       end
@@ -177,7 +182,8 @@ module KeycloakAdmin
           @configuration.faraday_options.merge(
             method: :post,
             url: logout_url(user_id),
-            headers: headers
+            headers: headers,
+            logger: @configuration.logger
           )
         )
       end
@@ -200,7 +206,8 @@ module KeycloakAdmin
             method: :post,
             url: federated_identity_url(user_id, idp_id),
             payload: fed_id_rep.to_json,
-            headers: headers
+            headers: headers,
+            logger: @configuration.logger
           )
         )
       end

data/lib/keycloak-admin/configuration.rb

@@ -4,6 +4,28 @@ module KeycloakAdmin
   class Configuration
     attr_accessor :server_url, :server_domain, :client_id, :client_secret, :client_realm_name, :use_service_account, :username, :password, :logger, :faraday_options
 
+    # Treat a cached token as expired this many seconds before its real expiry, so it
+    # cannot go stale between the check below and the request that relies on it.
+    TOKEN_EXPIRY_SAFETY_MARGIN_SECONDS = 10
+
+    # Returns the cached TokenRepresentation, or nil if there is none or it is (about to be) expired.
+    def cached_token
+      return nil if @token_expires_at.nil? || Time.now >= @token_expires_at
+      @cached_token
+    end
+
+    def cache_token(token_representation)
+      return token_representation unless token_representation.expires_in.is_a?(Numeric)
+      @cached_token     = token_representation
+      @token_expires_at = Time.now + token_representation.expires_in - TOKEN_EXPIRY_SAFETY_MARGIN_SECONDS
+      token_representation
+    end
+
+    def clear_cached_token!
+      @cached_token     = nil
+      @token_expires_at = nil
+    end
+
     def body_for_token_retrieval
       if use_service_account
         body_for_service_account

data/lib/keycloak-admin/version.rb

@@ -1,3 +1,3 @@
 module KeycloakAdmin
-  VERSION = "2.0.0"
+  VERSION = "2.0.1"
 end

data/spec/client/client_client_spec.rb

@@ -86,7 +86,7 @@ RSpec.describe KeycloakAdmin::ClientClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/clients", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/clients", faraday_options, anything).and_call_original
 
       clients = @client_client.list
       expect(clients.length).to eq 1
@@ -126,7 +126,7 @@ RSpec.describe KeycloakAdmin::ClientClient do
       faraday_options = {timeout: 10}
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/clients/95b45037-3980-404c-ba12-784fa1baf2c2", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/clients/95b45037-3980-404c-ba12-784fa1baf2c2", faraday_options, anything).and_call_original
       @client_client.delete("95b45037-3980-404c-ba12-784fa1baf2c2")
     end
   end

data/spec/client/client_role_mappings_client_spec.rb

@@ -37,7 +37,8 @@ RSpec.describe KeycloakAdmin::ClientRoleMappingsClient do
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
         "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user/role-mappings/clients/test_client/available",
-        faraday_options
+        faraday_options,
+        anything
       ).and_call_original
 
       roles = @client_role_mappings_client.list_available
@@ -74,7 +75,7 @@ RSpec.describe KeycloakAdmin::ClientRoleMappingsClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user/role-mappings/clients/test_client", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user/role-mappings/clients/test_client", faraday_options, anything).and_call_original
 
       @client_role_mappings_client.save(role_list)
     end

data/spec/client/client_spec.rb

@@ -23,6 +23,59 @@ RSpec.describe KeycloakAdmin::Client do
     end
   end
 
+  describe "#current_token" do
+    def token(expires_in)
+      KeycloakAdmin::TokenRepresentation.new(
+        "access_token", "bearer", expires_in, "refresh_token",
+        "refresh_expires_in", "id_token", "not_before_policy", "session_state"
+      )
+    end
+
+    it "fetches once and reuses the cached token across Client instances sharing the same configuration" do
+      configuration = KeycloakAdmin.config
+      configuration.clear_cached_token!
+      allow_any_instance_of(KeycloakAdmin::TokenClient).to receive(:get).and_return(token(3600))
+
+      first  = KeycloakAdmin::Client.new(configuration).current_token
+      second = KeycloakAdmin::Client.new(configuration).current_token
+
+      expect(first).to be second
+      expect(second).to be second
+    end
+
+    it "fetches a new token once the cached one has expired" do
+      configuration = KeycloakAdmin.config
+      configuration.clear_cached_token!
+      # allow_any_instance_of's sequential and_return(a, b) tracks call count per instance,
+      # and a fresh TokenClient is built on every fetch, so a plain external counter is used
+      # instead to force the first fetch to be pre-expired and the second one not to be.
+      call_count = 0
+      allow_any_instance_of(KeycloakAdmin::TokenClient).to receive(:get) do
+        call_count += 1
+        call_count == 1 ? token(5) : token(3600)
+      end
+
+      expired_immediately = KeycloakAdmin::Client.new(configuration).current_token
+      refreshed            = KeycloakAdmin::Client.new(configuration).current_token
+
+      expect(expired_immediately).to_not be refreshed
+      expect(call_count).to eq 2
+    end
+  end
+
+  describe "#resource" do
+    it "builds a Resource with the configuration's faraday_options and logger" do
+      configuration = KeycloakAdmin::Configuration.new
+      configuration.faraday_options = { timeout: 5 }
+      configuration.logger          = Logger.new(IO::NULL)
+      client = KeycloakAdmin::Client.new(configuration)
+
+      expect(KeycloakAdmin::Resource).to receive(:new).with("http://x", { timeout: 5 }, configuration.logger)
+
+      client.send(:resource, "http://x")
+    end
+  end
+
   describe "#execute_http" do
     let(:realm_name) { "valid-realm" }
     before(:each) do

data/spec/client/group_client_spec.rb

@@ -43,7 +43,7 @@ RSpec.describe KeycloakAdmin::GroupClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/groups/test_group_id", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/groups/test_group_id", faraday_options, anything).and_call_original
 
       group = @group_client.get("test_group_id")
       expect(group.id).to eq "test_group_id"
@@ -72,7 +72,7 @@ RSpec.describe KeycloakAdmin::GroupClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/groups", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/groups", faraday_options, anything).and_call_original
 
       groups = @group_client.list
       expect(groups.length).to eq 1
@@ -102,7 +102,7 @@ RSpec.describe KeycloakAdmin::GroupClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/groups/parent_group_id/children", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/groups/parent_group_id/children", faraday_options, anything).and_call_original
 
       groups = @group_client.children("parent_group_id")
       expect(groups.length).to eq 1
@@ -142,7 +142,7 @@ RSpec.describe KeycloakAdmin::GroupClient do
         allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
         expect(KeycloakAdmin::Resource).to receive(:new).with(
-          "http://auth.service.io/auth/admin/realms/valid-realm/groups", faraday_options).and_call_original
+          "http://auth.service.io/auth/admin/realms/valid-realm/groups", faraday_options, anything).and_call_original
 
         @group_client.save(group)
       end
@@ -172,7 +172,7 @@ RSpec.describe KeycloakAdmin::GroupClient do
         allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
         expect(KeycloakAdmin::Resource).to receive(:new).with(
-          "http://auth.service.io/auth/admin/realms/valid-realm/groups/test_group_id", faraday_options).and_call_original
+          "http://auth.service.io/auth/admin/realms/valid-realm/groups/test_group_id", faraday_options, anything).and_call_original
 
         @group_client.save(group)
       end
@@ -250,7 +250,7 @@ RSpec.describe KeycloakAdmin::GroupClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/groups/test_group_id", faraday_options).and_raise("error")
+        "http://auth.service.io/auth/admin/realms/valid-realm/groups/test_group_id", faraday_options, anything).and_raise("error")
 
       expect { @group_client.delete("test_group_id") }.to raise_error("error")
     end

data/spec/client/identity_provider_client_spec.rb

@@ -82,7 +82,7 @@ RSpec.describe KeycloakAdmin::IdentityProviderClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/identity-provider/instances", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/identity-provider/instances", faraday_options, anything).and_call_original
 
       identity_providers = @identity_provider_client.list
       expect(identity_providers.length).to eq 1

data/spec/client/organization_client_spec.rb

@@ -57,7 +57,7 @@ RSpec.describe KeycloakAdmin::OrganizationClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/organizations?briefRepresentation=true", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/organizations?briefRepresentation=true", faraday_options, anything).and_call_original
 
       organizations = @organization_client.list
       expect(organizations.length).to eq 1
@@ -193,7 +193,7 @@ RSpec.describe KeycloakAdmin::OrganizationClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/organizations/2904e1a1-e5f4-4143-8725-003e54cc8b58", faraday_options).and_raise("error")
+        "http://auth.service.io/auth/admin/realms/valid-realm/organizations/2904e1a1-e5f4-4143-8725-003e54cc8b58", faraday_options, anything).and_raise("error")
 
       expect { @organization_client.delete("2904e1a1-e5f4-4143-8725-003e54cc8b58") }.to raise_error("error")
     end
@@ -336,7 +336,7 @@ RSpec.describe KeycloakAdmin::OrganizationClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/organizations/8f6e474e-e688-4bec-99ba-5dc862594f4b", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/organizations/8f6e474e-e688-4bec-99ba-5dc862594f4b", faraday_options, anything).and_call_original
 
       organization = @organization_client.get("8f6e474e-e688-4bec-99ba-5dc862594f4b")
       expect(organization).to be

data/spec/client/realm_client_spec.rb

@@ -64,7 +64,7 @@ RSpec.describe KeycloakAdmin::RealmClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms", faraday_options, anything).and_call_original
 
       realms = @realm_client.list
       expect(realms.length).to eq 1
@@ -91,7 +91,7 @@ RSpec.describe KeycloakAdmin::RealmClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm", faraday_options, anything).and_call_original
 
       expect(@realm_client.delete).to be_truthy
     end
@@ -121,7 +121,7 @@ RSpec.describe KeycloakAdmin::RealmClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms", faraday_options, anything).and_call_original
 
       @realm_client.save(realm)
     end
@@ -147,7 +147,7 @@ RSpec.describe KeycloakAdmin::RealmClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm", faraday_options, anything).and_call_original
 
       @realm_client.update(realm_json)
     end

data/spec/client/resource_spec.rb

@@ -0,0 +1,223 @@
+RSpec.describe KeycloakAdmin::Resource do
+  # A real, mutable stand-in for the Faraday::Request builder yielded by
+  # connection.get/post/put/delete { |req| ... }.
+  FakeRequest = Struct.new(:params, :headers) do
+    attr_accessor :body
+  end
+
+  let(:fake_request)  { FakeRequest.new({}, {}) }
+  let(:fake_response) { double(status: 200, body: "ok", headers: {}, reason_phrase: "OK") }
+
+  def stub_connection(resource, verb)
+    connection = double
+    allow(connection).to receive(verb) do |&block|
+      block.call(fake_request) if block
+      fake_response
+    end
+    allow(resource).to receive(:connection).and_return(connection)
+    connection
+  end
+
+  describe "#connection (the real Faraday connection, not stubbed)" do
+    def middleware_classes(resource)
+      resource.send(:connection).builder.handlers
+    end
+
+    it "does not register the logger middleware when no logger is configured" do
+      resource = KeycloakAdmin::Resource.new("http://example.com")
+      expect(middleware_classes(resource)).to_not include(Faraday::Response::Logger)
+    end
+
+    it "registers the logger middleware when a logger is configured" do
+      resource = KeycloakAdmin::Resource.new("http://example.com", {}, Logger.new(IO::NULL))
+      expect(middleware_classes(resource)).to include(Faraday::Response::Logger)
+    end
+
+    it "orders :raise_error before :logger, so a response is logged even when it raises" do
+      resource = KeycloakAdmin::Resource.new("http://example.com", {}, Logger.new(IO::NULL))
+      handlers = middleware_classes(resource)
+      expect(handlers.index(Faraday::Response::RaiseError)).to be < handlers.index(Faraday::Response::Logger)
+    end
+
+    it "logs method/url/status but never headers, since Faraday logs headers by default and one of them is the bearer token" do
+      log_output = StringIO.new
+      logger     = Logger.new(log_output)
+      stubs      = Faraday::Adapter::Test::Stubs.new
+      stubs.get(//) { [200, {}, "ok"] }
+
+      resource = KeycloakAdmin::Resource.new("http://example.com/x", {}, logger)
+      allow(resource).to receive(:connection) do
+        Faraday.new(url: "http://example.com/x") do |f|
+          f.response :raise_error
+          f.response :logger, logger, headers: false
+          f.adapter :test, stubs
+        end
+      end
+
+      resource.get(Authorization: "Bearer super-secret-token")
+
+      expect(log_output.string).to include("request: GET")
+      expect(log_output.string).to include("response: Status 200")
+      expect(log_output.string).to_not include("super-secret-token")
+      expect(log_output.string).to_not include("Authorization")
+    end
+  end
+
+  describe "#get" do
+    it "humanizes symbol header keys into HTTP header names" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :get)
+
+      resource.get(Authorization: "Bearer token", content_type: :json, accept: :json)
+
+      expect(fake_request.headers).to eq(
+        "Authorization" => "Bearer token",
+        "Content-Type"  => "application/json",
+        "Accept"        => "application/json"
+      )
+    end
+
+    it "extracts :params into the query string instead of sending it as a header" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :get)
+
+      resource.get(Authorization: "Bearer token", params: { search: "jean" })
+
+      expect(fake_request.params).to eq(search: "jean")
+      expect(fake_request.headers).to eq("Authorization" => "Bearer token")
+    end
+
+    it "passes a string content_type through unchanged" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :get)
+
+      resource.get(content_type: "application/x-www-form-urlencoded")
+
+      expect(fake_request.headers["Content-Type"]).to eq "application/x-www-form-urlencoded"
+    end
+
+    it "does not set a body" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :get)
+
+      resource.get({})
+
+      expect(fake_request.body).to be_nil
+    end
+
+    it "wraps the Faraday response in a KeycloakAdmin::Response" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :get)
+
+      expect(resource.get({})).to be_a KeycloakAdmin::Response
+    end
+  end
+
+  describe "#post" do
+    it "sends a pre-serialized string payload as the body unchanged" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :post)
+
+      resource.post('{"username":"jean"}', content_type: :json)
+
+      expect(fake_request.body).to eq '{"username":"jean"}'
+      expect(fake_request.headers["Content-Type"]).to eq "application/json"
+    end
+
+    it "form-encodes a Hash payload" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :post)
+
+      resource.post({ email: "a@b.com", firstName: "Jean Yves" }, {})
+
+      expect(fake_request.body).to eq "email=a%40b.com&firstName=Jean+Yves"
+    end
+
+    it "stamps Content-Type: application/x-www-form-urlencoded for a Hash payload when none was set" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :post)
+
+      resource.post({ id: "42" }, {})
+
+      expect(fake_request.headers["Content-Type"]).to eq "application/x-www-form-urlencoded"
+    end
+
+    it "does not override an explicit Content-Type for a Hash payload" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users")
+      stub_connection(resource, :post)
+
+      resource.post({ id: "42" }, content_type: "application/vnd.custom+form")
+
+      expect(fake_request.headers["Content-Type"]).to eq "application/vnd.custom+form"
+    end
+  end
+
+  describe "#delete" do
+    it "sends no body and only the given headers" do
+      resource = KeycloakAdmin::Resource.new("http://example.com/users/1")
+      stub_connection(resource, :delete)
+
+      resource.delete(Authorization: "Bearer token")
+
+      expect(fake_request.body).to be_nil
+      expect(fake_request.headers).to eq("Authorization" => "Bearer token")
+    end
+  end
+
+  describe ".execute (RestClient::Request.execute equivalent)" do
+    it "dispatches an arbitrary method with a payload, including DELETE with a body" do
+      resource_instance = KeycloakAdmin::Resource.new("http://example.com/mappings")
+      allow(KeycloakAdmin::Resource).to receive(:new).and_return(resource_instance)
+      stub_connection(resource_instance, :delete)
+
+      KeycloakAdmin::Resource.execute(
+        method: :delete,
+        url: "http://example.com/mappings",
+        payload: '[{"id":"1"}]',
+        headers: { content_type: :json }
+      )
+
+      expect(fake_request.body).to eq '[{"id":"1"}]'
+      expect(fake_request.headers["Content-Type"]).to eq "application/json"
+    end
+
+    it "forwards non-method/url/payload/headers keys as connection options" do
+      resource_instance  = KeycloakAdmin::Resource.new("http://example.com/x")
+      expected_options   = { timeout: 5 }
+      stub_connection(resource_instance, :get)
+      expect(KeycloakAdmin::Resource).to receive(:new).with("http://example.com/x", expected_options, nil).and_return(resource_instance)
+
+      KeycloakAdmin::Resource.execute(method: :get, url: "http://example.com/x", headers: {}, timeout: 5)
+    end
+
+    it "extracts :logger and passes it positionally instead of leaving it in connection options" do
+      resource_instance = KeycloakAdmin::Resource.new("http://example.com/x")
+      logger             = Logger.new(IO::NULL)
+      stub_connection(resource_instance, :get)
+      expect(KeycloakAdmin::Resource).to receive(:new).with("http://example.com/x", {}, logger).and_return(resource_instance)
+
+      KeycloakAdmin::Resource.execute(method: :get, url: "http://example.com/x", headers: {}, logger: logger)
+    end
+  end
+
+  describe ".put (RestClient.put shorthand)" do
+    it "posts without requiring any connection options" do
+      resource_instance = KeycloakAdmin::Resource.new("http://example.com/x")
+      allow(KeycloakAdmin::Resource).to receive(:new).and_return(resource_instance)
+      stub_connection(resource_instance, :put)
+
+      KeycloakAdmin::Resource.put("http://example.com/x", "body", {})
+
+      expect(fake_request.body).to eq "body"
+    end
+
+    it "forwards the given logger to the underlying Resource" do
+      resource_instance = KeycloakAdmin::Resource.new("http://example.com/x")
+      logger             = Logger.new(IO::NULL)
+      stub_connection(resource_instance, :put)
+      expect(KeycloakAdmin::Resource).to receive(:new).with("http://example.com/x", {}, logger).and_return(resource_instance)
+
+      KeycloakAdmin::Resource.put("http://example.com/x", "body", {}, logger)
+    end
+  end
+end

data/spec/client/response_spec.rb

@@ -0,0 +1,68 @@
+RSpec.describe KeycloakAdmin::Response do
+  def fake_faraday_response(status: 200, body: "", headers: {}, reason_phrase: "OK")
+    double(status: status, body: body, headers: headers, reason_phrase: reason_phrase)
+  end
+
+  describe "body-as-string behavior (RestClient::Response was a String subclass)" do
+    it "behaves like the raw body string" do
+      response = KeycloakAdmin::Response.new(fake_faraday_response(body: '{"a":1}'))
+      expect(response).to eq '{"a":1}'
+      expect(JSON.parse(response)).to eq({ "a" => 1 })
+    end
+
+    it "supports String methods relied on by callers, e.g. #to_i" do
+      response = KeycloakAdmin::Response.new(fake_faraday_response(body: "42"))
+      expect(response.to_i).to eq 42
+    end
+
+    it "exposes #body returning the same content" do
+      response = KeycloakAdmin::Response.new(fake_faraday_response(body: "hello"))
+      expect(response.body).to eq "hello"
+    end
+  end
+
+  describe "#status / #code / #reason_phrase" do
+    it "exposes the HTTP status" do
+      response = KeycloakAdmin::Response.new(fake_faraday_response(status: 201))
+      expect(response.status).to eq 201
+      expect(response.code).to eq 201
+    end
+
+    it "exposes the reason phrase" do
+      response = KeycloakAdmin::Response.new(fake_faraday_response(reason_phrase: "Created"))
+      expect(response.reason_phrase).to eq "Created"
+    end
+  end
+
+  describe "#headers" do
+    it "symbolizes header names the way RestClient did (downcased, dash to underscore)" do
+      response = KeycloakAdmin::Response.new(fake_faraday_response(headers: { "Location" => "/users/42", "Content-Type" => "application/json" }))
+      expect(response.headers[:location]).to eq "/users/42"
+      expect(response.headers[:content_type]).to eq "application/json"
+    end
+
+    it "splits a single Set-Cookie header into a one-element array" do
+      response = KeycloakAdmin::Response.new(fake_faraday_response(headers: { "Set-Cookie" => "a=1; Path=/" }))
+      expect(response.headers[:set_cookie]).to eq ["a=1; Path=/"]
+    end
+
+    it "splits multiple Set-Cookie headers joined by Faraday's net_http adapter" do
+      joined = "KEYCLOAK_SESSION=abc; Path=/, KEYCLOAK_IDENTITY=def; Path=/, AUTH_SESSION_ID=ghi; Path=/"
+      response = KeycloakAdmin::Response.new(fake_faraday_response(headers: { "Set-Cookie" => joined }))
+      expect(response.headers[:set_cookie]).to eq [
+        "KEYCLOAK_SESSION=abc; Path=/",
+        "KEYCLOAK_IDENTITY=def; Path=/",
+        "AUTH_SESSION_ID=ghi; Path=/"
+      ]
+    end
+
+    it "does not split on a comma embedded in a cookie's own Expires attribute" do
+      joined = "a=1; Expires=Wed, 09 Jun 2027 10:18:14 GMT; Path=/, b=2; Path=/"
+      response = KeycloakAdmin::Response.new(fake_faraday_response(headers: { "Set-Cookie" => joined }))
+      expect(response.headers[:set_cookie]).to eq [
+        "a=1; Expires=Wed, 09 Jun 2027 10:18:14 GMT; Path=/",
+        "b=2; Path=/"
+      ]
+    end
+  end
+end

data/spec/client/role_client_spec.rb

@@ -39,7 +39,7 @@ RSpec.describe KeycloakAdmin::RoleClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/roles", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/roles", faraday_options, anything).and_call_original
 
       roles = @role_client.list
       expect(roles.length).to eq 1
@@ -71,7 +71,7 @@ RSpec.describe KeycloakAdmin::RoleClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/roles", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/roles", faraday_options, anything).and_call_original
 
       @role_client.save(role)
     end

data/spec/client/role_mapper_client_spec.rb

@@ -60,7 +60,7 @@ RSpec.describe KeycloakAdmin::RoleMapperClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user/role-mappings/realm", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user/role-mappings/realm", faraday_options, anything).and_call_original
 
       @role_mapper_client.save_realm_level(role_list)
     end

data/spec/client/token_client_spec.rb

@@ -54,7 +54,7 @@ RSpec.describe KeycloakAdmin::TokenClient do
       stub_post
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/realms/valid-realm/protocol/openid-connect/token", faraday_options).and_call_original
+        "http://auth.service.io/auth/realms/valid-realm/protocol/openid-connect/token", faraday_options, anything).and_call_original
 
       @token_client.get
     end

data/spec/client/user_client_spec.rb

@@ -145,7 +145,7 @@ RSpec.describe KeycloakAdmin::TokenClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/users", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/users", faraday_options, anything).and_call_original
 
       expect(@user_client.save(user)).to eq user
     end
@@ -171,7 +171,7 @@ RSpec.describe KeycloakAdmin::TokenClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user_id", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user_id", faraday_options, anything).and_call_original
 
       user = @user_client.get('test_user_id')
       expect(user.username).to eq 'test_username'
@@ -217,7 +217,7 @@ RSpec.describe KeycloakAdmin::TokenClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/users", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/users", faraday_options, anything).and_call_original
 
       users = @user_client.search("test_username")
       expect(users.length).to eq 1
@@ -250,7 +250,7 @@ RSpec.describe KeycloakAdmin::TokenClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/users", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/users", faraday_options, anything).and_call_original
 
       users = @user_client.list
       expect(users.length).to eq 1
@@ -277,7 +277,7 @@ RSpec.describe KeycloakAdmin::TokenClient do
       allow_any_instance_of(KeycloakAdmin::Configuration).to receive(:faraday_options).and_return faraday_options
 
       expect(KeycloakAdmin::Resource).to receive(:new).with(
-        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user_id", faraday_options).and_call_original
+        "http://auth.service.io/auth/admin/realms/valid-realm/users/test_user_id", faraday_options, anything).and_call_original
 
       @user_client.delete('test_user_id')
     end

data/spec/configuration_spec.rb

@@ -68,6 +68,43 @@ RSpec.describe KeycloakAdmin::RealmClient do
     end
   end
 
+  describe "#cached_token / #cache_token / #clear_cached_token!" do
+    def token(expires_in)
+      KeycloakAdmin::TokenRepresentation.new(
+        "access_token", "bearer", expires_in, "refresh_token",
+        "refresh_expires_in", "id_token", "not_before_policy", "session_state"
+      )
+    end
+
+    it "has no cached token initially" do
+      expect(@configuration.cached_token).to be_nil
+    end
+
+    it "returns the token it was given, while it is still within its expiry" do
+      cached = @configuration.cache_token(token(3600))
+      expect(cached.access_token).to eq "access_token"
+      expect(@configuration.cached_token).to eq cached
+    end
+
+    it "treats a token as expired a bit before its real expiry, not just after" do
+      # expires_in: 5, minus the 10s safety margin, is already in the past the moment it is cached.
+      @configuration.cache_token(token(5))
+      expect(@configuration.cached_token).to be_nil
+    end
+
+    it "does not cache a token with a non-numeric expires_in, but still returns it" do
+      returned = @configuration.cache_token(token("not-a-number"))
+      expect(returned.access_token).to eq "access_token"
+      expect(@configuration.cached_token).to be_nil
+    end
+
+    it "clears the cache" do
+      @configuration.cache_token(token(3600))
+      @configuration.clear_cached_token!
+      expect(@configuration.cached_token).to be_nil
+    end
+  end
+
   describe "#body_for_token_retrieval" do
     before(:each) do
       @body = @configuration.body_for_token_retrieval

data/spec/spec_helper.rb

@@ -19,11 +19,18 @@ RSpec.configure do |config|
   end
 
   configure
+
+  # KeycloakAdmin.config is a global set up once for the whole suite (see 'configure'
+  # above), not per example, so a token cached in one example would otherwise leak into
+  # the next one and silently skip its stub_token_client expectations.
+  config.before(:each) do
+    KeycloakAdmin.config.clear_cached_token!
+  end
 end
 
 def stub_token_client
   allow_any_instance_of(KeycloakAdmin::TokenClient).to receive(:get).and_return KeycloakAdmin::TokenRepresentation.new(
-    "test_access_token", "token_type", "expires_in", "refresh_token",
+    "test_access_token", "token_type", 3600, "refresh_token",
     "refresh_expires_in", "id_token", "not_before_policy", "session_state"
   )
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: keycloak-admin
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.0.1
 platform: ruby
 authors:
 - Lorent Lempereur
@@ -85,6 +85,20 @@ dependencies:
     - - '='
       - !ruby/object:Gem::Version
         version: 12.0.0
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '13.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '13.0'
 description: Keycloak Admin REST API client written in Ruby
 email:
 - lorent.lempereur.dev@gmail.com
@@ -94,6 +108,7 @@ extra_rdoc_files: []
 files:
 - ".github/workflows/Dockerfile"
 - ".github/workflows/ci.yml"
+- ".github/workflows/release.yml"
 - ".gitignore"
 - ".rspec"
 - CHANGELOG.md
@@ -102,6 +117,7 @@ files:
 - Gemfile.lock
 - MIT-LICENSE
 - README.md
+- Rakefile
 - bin/console
 - keycloak-admin.gemspec
 - lib/keycloak-admin.rb
@@ -121,6 +137,8 @@ files:
 - lib/keycloak-admin/client/identity_provider_client.rb
 - lib/keycloak-admin/client/organization_client.rb
 - lib/keycloak-admin/client/realm_client.rb
+- lib/keycloak-admin/client/resource.rb
+- lib/keycloak-admin/client/response.rb
 - lib/keycloak-admin/client/role_client.rb
 - lib/keycloak-admin/client/role_mapper_client.rb
 - lib/keycloak-admin/client/token_client.rb
@@ -171,6 +189,8 @@ files:
 - spec/client/identity_provider_client_spec.rb
 - spec/client/organization_client_spec.rb
 - spec/client/realm_client_spec.rb
+- spec/client/resource_spec.rb
+- spec/client/response_spec.rb
 - spec/client/role_client_spec.rb
 - spec/client/role_mapper_client_spec.rb
 - spec/client/token_client_spec.rb
@@ -216,7 +236,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.17
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Keycloak Admin REST API client written in Ruby
 test_files: []