kinde_sdk 1.7.1 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c317b417d2fc3da704816894bb6dc06cd7e14c93aa2b1f517f11bd326d80ec18
-  data.tar.gz: a03e51851793bb4df9e87385e0110ca4a39acd9e8ff5bcfffecaf3a6ceeff7fe
+  metadata.gz: 5e745fcc09127b3a90b6b4049d9bc490f268896ab75612681a648600b4bb8033
+  data.tar.gz: 63cdad5a63d19c05b86cff557750ce5b75cdd8f65c99a30eb88ea6cc5032791e
 SHA512:
-  metadata.gz: 26375435c668f53b6de31aee90cb19ff19502798f0dbac74102db2ad25d70bdb6861c5b29875baba8f00c68dd5f47f4076f8c6b046b6761f1cf76b08f3d3fe61
-  data.tar.gz: 6888bc72e8209f4d785c4b9d333b8619ceed14ac8642eb12a78ed7e967aa88b1ac6a56ea00f6ac69e34f771830503e601c2667aed3c5064bdf27de3cc88daca8
+  metadata.gz: 6aada675872e57b16fce0d548f0b02c205a9c2e0aa71a8f6d2160424b4625fb237d84df2c549bbf3112efc5d49f2d0465934a387ec285355e52581e4c2ddd014
+  data.tar.gz: 2dd83d28cbd2fd1211411c84ce578721684e675b072588c97e4422b5f201bad5c623c0e57c49866b04aa8e6948b131a663fd6096896f33b263694a0bc683fef1

data/app/controllers/kinde_sdk/auth_controller.rb

@@ -20,9 +20,17 @@ module KindeSdk
     def auth
       # Generate a secure random nonce for CSRF protection
       nonce = SecureRandom.urlsafe_base64(16)
-      
+
       # Get authorization URL and PKCE code verifier from SDK
-      auth_data = KindeSdk.auth_url(nonce: nonce)
+      auth_params = { nonce: nonce }
+
+      # Check for invitation_code in query parameters
+      # Validate to prevent injection and ensure it's a reasonable length
+      if params[:invitation_code].is_a?(String) && params[:invitation_code].strip.length > 0 && params[:invitation_code].length <= 255
+        auth_params[:invitation_code] = params[:invitation_code].strip
+      end
+
+      auth_data = KindeSdk.auth_url(**auth_params)
       
       # Store PKCE code verifier and nonce in session for validation
       session[:code_verifier] = auth_data[:code_verifier] if auth_data[:code_verifier].present?

data/kinde_api/Gemfile

@@ -3,7 +3,7 @@ source 'https://rubygems.org'
 gemspec
 
 group :development, :test do
-  gem 'rake', '~> 13.0.1'
+  gem 'rake', '~> 13.4.0'
   gem 'pry-byebug'
-  gem 'rubocop', '~> 0.66.0'
+  gem 'rubocop', '~> 1.88.0'
 end

data/kinde_api/docs/ConnectionsApi.md

@@ -293,7 +293,7 @@ end
 ### HTTP request headers
 
 - **Content-Type**: Not defined
-- **Accept**: application/json; charset=utf-8, application/json
+- **Accept**: application/json
 
 
 ## replace_connection

data/kinde_api/lib/kinde_api/api/connections_api.rb

@@ -251,7 +251,7 @@ module KindeApi
       # header parameters
       header_params = opts[:header_params] || {}
       # HTTP header 'Accept' (if needed)
-      header_params['Accept'] = @api_client.select_header_accept(['application/json; charset=utf-8', 'application/json'])
+      header_params['Accept'] = @api_client.select_header_accept(['application/json'])
 
       # form parameters
       form_params = opts[:form_params] || {}

data/kinde_api/lib/kinde_api/api_client.rb

@@ -328,9 +328,15 @@ module KindeApi
     # @return [String] the Accept header (e.g. application/json)
     def select_header_accept(accepts)
       return nil if accepts.nil? || accepts.empty?
+      # Prefer plain application/json; the API rejects charset variants in Accept.
+      plain_json = accepts.find { |s| s.strip.casecmp('application/json').zero? }
+      return plain_json if plain_json
       # use JSON when present, otherwise use all of the provided
       json_accept = accepts.find { |s| json_mime?(s) }
-      json_accept || accepts.join(',')
+      if json_accept
+        return json_accept.strip.casecmp('application/json').zero? ? json_accept : 'application/json'
+      end
+      accepts.join(',')
     end
 
     # Return Content-Type header based on an array of content types provided.

data/kinde_api/lib/kinde_api/models/get_connections_response.rb

@@ -46,7 +46,7 @@ module KindeApi
       {
         :'code' => :'String',
         :'message' => :'String',
-        :'connections' => :'Array<Connection>',
+        :'connections' => :'Array<ConnectionConnection>',
         :'has_more' => :'Boolean'
       }
     end

data/kinde_api/spec/api_client_spec.rb

@@ -187,7 +187,9 @@ describe KindeApi::ApiClient do
       expect(api_client.select_header_accept([])).to be_nil
 
       expect(api_client.select_header_accept(['application/json'])).to eq('application/json')
-      expect(api_client.select_header_accept(['application/xml', 'application/json; charset=UTF8'])).to eq('application/json; charset=UTF8')
+      expect(api_client.select_header_accept(['application/json; charset=utf-8'])).to eq('application/json')
+      expect(api_client.select_header_accept(['application/xml', 'application/json; charset=UTF8'])).to eq('application/json')
+      expect(api_client.select_header_accept(['application/json; charset=utf-8', 'application/json'])).to eq('application/json')
       expect(api_client.select_header_accept(['APPLICATION/JSON', 'text/html'])).to eq('APPLICATION/JSON')
 
       expect(api_client.select_header_accept(['application/xml'])).to eq('application/xml')

data/kinde_api/spec/models/get_connections_response_spec.rb

@@ -38,8 +38,24 @@ describe KindeApi::GetConnectionsResponse do
   end
 
   describe 'test attribute "connections"' do
-    it 'should work' do
-      # assertion here. ref: https://www.relishapp.com/rspec/rspec-expectations/docs/built-in-matchers
+    it 'deserializes flat connection objects from the list endpoint' do
+      response = described_class.build_from_hash(
+        'connections' => [
+          {
+            'id' => 'conn_123',
+            'name' => 'google',
+            'display_name' => 'Google',
+            'strategy' => 'oauth2'
+          }
+        ]
+      )
+
+      connection = response.connections.first
+      expect(connection).to be_a(KindeApi::ConnectionConnection)
+      expect(connection.id).to eq('conn_123')
+      expect(connection.name).to eq('google')
+      expect(connection.display_name).to eq('Google')
+      expect(connection.strategy).to eq('oauth2')
     end
   end
 

data/lib/kinde_sdk/client/entitlements.rb

@@ -1,6 +1,7 @@
 module KindeSdk
     class Client
       module Entitlements
+        include KindeSdk::Logging
         # Get all entitlements for the authenticated user
         # Matches the JavaScript SDK API: getEntitlements(options?)
         #
@@ -66,21 +67,6 @@ module KindeSdk
         # JavaScript SDK compatible aliases
         alias_method :hasBillingEntitlements, :has_billing_entitlements?
         alias_method :hasEntitlements, :has_entitlements?
-  
-        private
-  
-        # Configurable logging that works with or without Rails
-        def log_error(message)
-          if defined?(Rails) && Rails.logger
-            Rails.logger.error(message)
-          elsif @logger
-            @logger.error(message)
-          elsif respond_to?(:logger) && logger
-            logger.error(message)
-          else
-            $stderr.puts "[KindeSdk] ERROR: #{message}"
-          end
-        end
       end
     end
-  end
+  end

data/lib/kinde_sdk/client/feature_flags.rb

@@ -1,6 +1,7 @@
 module KindeSdk
   class Client
     module FeatureFlags
+      include KindeSdk::Logging
       # Get all feature flags for the authenticated user
       # Matches the JavaScript SDK API: getFlags(options?)
       #
@@ -137,27 +138,30 @@ module KindeSdk
       end
 
       # Extract the key from a flag object (handles both symbol and string keys)
+      # Uses key? to properly handle falsy values
       #
       # @param flag [Hash] Flag object
       # @return [String] The flag key
       def get_flag_key(flag)
-        flag[:key] || flag['key']
+        flag.key?(:key) ? flag[:key] : flag['key']
       end
 
       # Extract the value from a flag object (handles both symbol and string keys)
+      # Uses key? to properly handle boolean false values (critical fix)
       #
       # @param flag [Hash] Flag object
       # @return [Object] The flag value
       def get_flag_value(flag)
-        flag[:value] || flag['value']
+        flag.key?(:value) ? flag[:value] : flag['value']
       end
 
       # Extract the type from a flag object (handles both symbol and string keys)
+      # Uses key? to properly handle falsy values
       #
       # @param flag [Hash] Flag object
       # @return [String] The flag type
       def get_flag_type(flag)
-        flag[:type] || flag['type']
+        flag.key?(:type) ? flag[:type] : flag['type']
       end
 
       # Legacy get_flag implementation for backward compatibility
@@ -282,19 +286,6 @@ module KindeSdk
       def check_type(value, type)
         type == "s" && value.is_a?(String) || type == "b" && (value == false || value == true) || type == "i" && value.is_a?(Integer)
       end
-
-      # Configurable logging that works with or without Rails
-      def log_error(message)
-        if defined?(Rails) && Rails.logger
-          Rails.logger.error(message)
-        elsif @logger
-          @logger.error(message)
-        elsif respond_to?(:logger) && logger
-          logger.error(message)
-        else
-          $stderr.puts "[KindeSdk] ERROR: #{message}"
-        end
-      end
     end
   end
 end

data/lib/kinde_sdk/client/permissions.rb

@@ -1,6 +1,7 @@
 module KindeSdk
   class Client
     module Permissions
+      include KindeSdk::Logging
       # Get all permissions for the authenticated user
       # Matches the JavaScript SDK API: getPermissions(options?)
       #
@@ -178,34 +179,6 @@ module KindeSdk
           get_permissions_from_token
         end
       end
-
-      # Configurable logging that works with or without Rails
-      #
-      # @param message [String] The error message to log
-      def log_error(message)
-        if defined?(Rails) && Rails.logger
-          Rails.logger.error(message)
-        elsif @logger
-          @logger.error(message)
-        elsif respond_to?(:logger) && logger
-          logger.error(message)
-        else
-          # Fallback to STDERR if no logger available
-          $stderr.puts "[KindeSdk] ERROR: #{message}"
-        end
-      end
-
-      def log_warning(message)
-        if defined?(Rails) && Rails.logger
-          Rails.logger.warn(message)
-        elsif @logger
-          @logger.warn(message)
-        elsif respond_to?(:logger) && logger
-          logger.warn(message)
-        else
-          $stderr.puts "[KindeSdk] WARNING: #{message}"
-        end
-      end
     end
   end
 end

data/lib/kinde_sdk/client/roles.rb

@@ -1,6 +1,7 @@
 module KindeSdk
   class Client
     module Roles
+      include KindeSdk::Logging
       # Get all roles for the authenticated user
       # Matches the JavaScript SDK API: getRoles(options?)
       # Implements smart fallback: uses API automatically if token claims are empty
@@ -166,53 +167,20 @@ module KindeSdk
       end
 
       # Helper to extract field from hash or object
+      # Checks Hash first to avoid issues with Hash#key requiring an argument
+      #
+      # @param item [Hash, Object] The item to extract from
+      # @param field [Symbol] The field name to extract
+      # @return [Object, nil] The field value or nil
       def extract_field(item, field)
-        if item.respond_to?(field)
+        if item.is_a?(Hash)
+          item.key?(field) ? item[field] : item[field.to_s]
+        elsif item.respond_to?(field)
           item.public_send(field)
-        elsif item.is_a?(Hash)
-          item[field] || item[field.to_s]
         else
           nil
         end
       end
-
-      # Configurable logging that works with or without Rails
-      # Supports multiple log levels for better debugging
-      def log_error(message)
-        write_log(:error, message)
-      end
-
-      def log_warning(message)
-        write_log(:warn, message)
-      end
-
-      def log_info(message)
-        write_log(:info, message)
-      end
-
-      def log_debug(message)
-        write_log(:debug, message)
-      end
-
-      def write_log(level, message)
-        formatted_message = "[KindeSdk::Roles] #{message}"
-        
-        if defined?(Rails) && Rails.logger
-          Rails.logger.public_send(level, formatted_message)
-        elsif @logger && @logger.respond_to?(level)
-          @logger.public_send(level, formatted_message)
-        elsif respond_to?(:logger) && logger && logger.respond_to?(level)
-          logger.public_send(level, formatted_message)
-        else
-          # Fallback based on level
-          case level
-          when :error, :warn
-            $stderr.puts formatted_message
-          when :info, :debug
-            $stdout.puts formatted_message if ENV['KINDE_DEBUG']
-          end
-        end
-      end
     end
   end
-end
+end

data/lib/kinde_sdk/client.rb

@@ -21,6 +21,7 @@ module KindeSdk
   end
 
   class Client
+    include Logging
     include FeatureFlags
     include Permissions
     include Roles
@@ -120,7 +121,7 @@ module KindeSdk
       begin
         { url: URI.parse(result['url']) }
       rescue URI::InvalidURIError => e
-        Rails.logger.error(e)
+        log_error(e.message)
         raise StandardError, "Invalid URL format received from API: #{result['url']}"
       end
     end
@@ -176,7 +177,7 @@ module KindeSdk
     def entitlements(page_size: 10, starting_after: nil)
       frontend.get_entitlements(page_size: page_size, starting_after: starting_after)
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch entitlements: #{e.message}")
+      log_error("Failed to fetch entitlements: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch entitlements: #{e.message}"
     end
 
@@ -191,7 +192,7 @@ module KindeSdk
 
       paginate_all_results('entitlements') { |starting_after| entitlements(page_size: 100, starting_after: starting_after) }
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch all entitlements: #{e.message}")
+      log_error("Failed to fetch all entitlements: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch all entitlements: #{e.message}"
     end
 
@@ -206,7 +207,7 @@ module KindeSdk
     def entitlement(key)
       frontend.get_entitlement(key)
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch entitlement for #{key}: #{e.message}")
+      log_error("Failed to fetch entitlement for #{key}: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch entitlement: #{e.message}"
     end
 
@@ -221,7 +222,7 @@ module KindeSdk
       
       entitlements.find { |entitlement| entitlement.feature_key == key }
     rescue StandardError => e
-      Rails.logger.error("Failed to get entitlement for #{key}: #{e.message}")
+      log_error("Failed to get entitlement for #{key}: #{e.message}")
       raise KindeSdk::APIError, "Unable to get entitlement: #{e.message}"
     end
 
@@ -231,9 +232,9 @@ module KindeSdk
     # @return [Boolean] True if the user has the entitlement, false otherwise
     def has_entitlement?(feature_key)
       entitlement_response = entitlement(feature_key)
-      entitlement_response&.data&.entitlement.present?
+      !entitlement_response&.data&.entitlement.nil?
     rescue StandardError => e
-      Rails.logger.error("Error checking entitlement for #{feature_key}: #{e.message}")
+      log_error("Error checking entitlement for #{feature_key}: #{e.message}")
       false
     end
 
@@ -244,7 +245,7 @@ module KindeSdk
     def hasEntitlement(key)
       getEntitlement(key) != nil
     rescue StandardError => e
-      Rails.logger.error("Error checking entitlement for #{key}: #{e.message}")
+      log_error("Error checking entitlement for #{key}: #{e.message}")
       false
     end
 
@@ -257,7 +258,7 @@ module KindeSdk
       entitlement = getEntitlement(key)
       entitlement ? entitlement.entitlement_limit_max : nil
     rescue StandardError => e
-      Rails.logger.error("Error getting entitlement limit for #{key}: #{e.message}")
+      log_error("Error getting entitlement limit for #{key}: #{e.message}")
       nil
     end
 
@@ -273,7 +274,7 @@ module KindeSdk
     def user_feature_flags(page_size: 10, starting_after: nil)
       frontend.get_feature_flags(page_size: page_size, starting_after: starting_after)
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch feature flags: #{e.message}")
+      log_error("Failed to fetch feature flags: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch feature flags: #{e.message}"
     end
 
@@ -286,7 +287,7 @@ module KindeSdk
     def user_permissions(page_size: 10, starting_after: nil)
       frontend.get_user_permissions(page_size: page_size, starting_after: starting_after)
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch permissions: #{e.message}")
+      log_error("Failed to fetch permissions: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch permissions: #{e.message}"
     end
 
@@ -299,7 +300,7 @@ module KindeSdk
     def user_properties(page_size: 10, starting_after: nil)
       frontend.get_user_properties(page_size: page_size, starting_after: starting_after)
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch properties: #{e.message}")
+      log_error("Failed to fetch properties: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch properties: #{e.message}"
     end
 
@@ -312,7 +313,7 @@ module KindeSdk
     def user_roles(page_size: 10, starting_after: nil)
       frontend.get_user_roles(page_size: page_size, starting_after: starting_after)
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch roles: #{e.message}")
+      log_error("Failed to fetch roles: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch roles: #{e.message}"
     end
 
@@ -325,7 +326,7 @@ module KindeSdk
     def portal_link(return_url:, page: PortalPage::PROFILE)
       frontend.get_portal_link(subnav: page, return_url: return_url)
     rescue StandardError => e
-      Rails.logger.error("Failed to get portal link: #{e.message}")
+      log_error("Failed to get portal link: #{e.message}")
       raise KindeSdk::APIError, "Unable to get portal link: #{e.message}"
     end
 
@@ -347,7 +348,7 @@ module KindeSdk
 
       frontend.get_portal_link(subnav: sub_nav, return_url: return_url)
     rescue StandardError => e
-      Rails.logger.error("Failed to generate portal URL: #{e.message}")
+      log_error("Failed to generate portal URL: #{e.message}")
       raise KindeSdk::APIError, "Unable to generate portal URL: #{e.message}"
     end
 
@@ -358,7 +359,7 @@ module KindeSdk
     def enhanced_user_profile
       frontend.get_user_profile_v2
     rescue StandardError => e
-      Rails.logger.error("Failed to fetch enhanced profile: #{e.message}")
+      log_error("Failed to fetch enhanced profile: #{e.message}")
       raise KindeSdk::APIError, "Unable to fetch enhanced profile: #{e.message}"
     end
 

data/lib/kinde_sdk/logging.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+module KindeSdk
+  # Shared logging module for consistent logging across all SDK components.
+  # Supports Rails logger, custom logger, or falls back to stdout/stderr.
+  #
+  # Can be used as:
+  # - Instance methods via `include KindeSdk::Logging`
+  # - Class methods via `include KindeSdk::Logging` inside `class << self`
+  # - Direct calls via `KindeSdk::Logging.log_error("message")`
+  #
+  # @example Using in a class (instance methods)
+  #   class MyClass
+  #     include KindeSdk::Logging
+  #
+  #     def my_method
+  #       log_info("Starting operation")
+  #       log_error("Something went wrong")
+  #     end
+  #   end
+  #
+  # @example Using for class methods
+  #   class MyClass
+  #     class << self
+  #       include KindeSdk::Logging
+  #
+  #       def my_class_method
+  #         log_error("Class-level error")
+  #       end
+  #     end
+  #   end
+  module Logging
+    # Log an error message
+    #
+    # @param message [String] The message to log
+    def log_error(message)
+      Logging.write_log(:error, message)
+    end
+
+    # Log a warning message
+    #
+    # @param message [String] The message to log
+    def log_warning(message)
+      Logging.write_log(:warn, message)
+    end
+
+    # Log an info message
+    #
+    # @param message [String] The message to log
+    def log_info(message)
+      Logging.write_log(:info, message)
+    end
+
+    # Log a debug message
+    #
+    # @param message [String] The message to log
+    def log_debug(message)
+      Logging.write_log(:debug, message)
+    end
+
+    class << self
+      # Write a log message at the specified level
+      # Tries multiple logger sources in order of preference:
+      # 1. Rails.logger (if Rails is defined)
+      # 2. Fallback to $stderr/$stdout based on level
+      #
+      # @param level [Symbol] The log level (:error, :warn, :info, :debug)
+      # @param message [String] The message to log
+      def write_log(level, message)
+        formatted_message = "[KindeSdk] #{message}"
+
+        logger_instance = resolve_logger
+        if logger_instance&.respond_to?(level)
+          logger_instance.public_send(level, formatted_message)
+        else
+          # Fallback based on level
+          case level
+          when :error, :warn
+            $stderr.puts formatted_message
+          when :info, :debug
+            $stdout.puts formatted_message if ENV['KINDE_DEBUG']
+          end
+        end
+      end
+
+      # Resolve the appropriate logger instance
+      #
+      # @return [Logger, nil] The logger to use, or nil if none available
+      def resolve_logger
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger
+        end
+      end
+    end
+  end
+end
+
+

data/lib/kinde_sdk/token_hash.rb

@@ -0,0 +1,58 @@
+module KindeSdk
+  # Normalizes token hash key types for oauth2 round-trips and SDK consumers.
+  # Accepts string or symbol keys on input; internal storage uses symbol keys.
+  module TokenHash
+    PUBLIC_KEYS = %i[
+      access_token refresh_token expires_at id_token scope token_type expires_in
+    ].freeze
+
+    module_function
+
+    # Symbolize keys while preserving the full oauth2 hash contract.
+    def normalize(raw)
+      return {} if raw.nil?
+      return {} if raw.respond_to?(:empty?) && raw.empty?
+
+      raw.each_with_object({}) do |(key, value), memo|
+        memo[key.to_sym] = value
+      end.tap do |hash|
+        hash[:access_token] = hash[:access_token].to_s if hash[:access_token]
+      end
+    end
+
+    def access_token(raw)
+      normalize(raw)[:access_token]
+    end
+
+    # Reduced shape for documented public SDK responses (e.g. fetch_tokens).
+    def public_tokens(raw)
+      normalize(raw).slice(*PUBLIC_KEYS).compact
+    end
+
+    def from_access_token(token)
+      public_tokens(
+        access_token: token.token,
+        refresh_token: token.refresh_token,
+        expires_at: token.expires_at,
+        id_token: token_param(token, "id_token"),
+        scope: token_param(token, "scope"),
+        token_type: token_param(token, "token_type"),
+        expires_in: token_param(token, "expires_in")
+      )
+    end
+
+    # String keys for session storage and documented public API responses.
+    def for_session(raw)
+      public_tokens(raw).transform_keys(&:to_s)
+    end
+
+    # Full oauth2 hash with string keys for refresh_token responses.
+    def for_refresh_response(raw)
+      normalize(raw).transform_keys(&:to_s)
+    end
+
+    def token_param(token, key)
+      token.params[key] || token.params[key.to_sym]
+    end
+  end
+end

data/lib/kinde_sdk/token_manager.rb

@@ -1,5 +1,7 @@
 module KindeSdk
   class TokenManager
+    include Logging
+
     attr_reader :tokens, :bearer_token, :expires_at
 
     def initialize(tokens = nil)
@@ -7,19 +9,19 @@ module KindeSdk
     end
 
     def set_tokens(tokens)
-      @tokens = tokens.transform_keys(&:to_sym).freeze
+      @tokens = TokenHash.normalize(tokens).freeze
       @bearer_token = @tokens[:access_token]
       @expires_at = @tokens[:expires_at]
       @tokens
     end
 
     def token_expired?
-      return true unless @tokens.present?
+      return true if @tokens.nil? || @tokens.empty?
       begin
         KindeSdk.validate_jwt_token(@tokens)
         @expires_at.to_i > 0 && (@expires_at <= Time.now.to_i)
-      rescue Exception => e
-        Rails.logger.error("Error checking token expiration: #{e.message}")
+      rescue StandardError => e
+        log_error("Error checking token expiration: #{e.message}")
         true
       end
     end
@@ -31,6 +33,8 @@ module KindeSdk
     end
 
     class << self
+      extend KindeSdk::Logging
+
       def create_store(tokens = nil)
         TokenStore.new(tokens)
       end
@@ -71,7 +75,7 @@ module KindeSdk
       def safe_refresh(tokens)
         KindeSdk.refresh_token(tokens)
       rescue StandardError => e
-        Rails.logger.error("Token refresh failed: #{e.message}")
+        log_error("Token refresh failed: #{e.message}")
         nil
       end
 
@@ -82,4 +86,4 @@ module KindeSdk
       end
     end
   end
-end 
+end

data/lib/kinde_sdk/token_store.rb

@@ -7,7 +7,7 @@ module KindeSdk
     end
 
     def set_tokens(tokens)
-      @tokens = (tokens || {}).transform_keys(&:to_sym)
+      @tokens = TokenHash.normalize(tokens)
       @bearer_token = @tokens[:access_token]
       @expires_at = @tokens[:expires_at]
       @tokens

data/lib/kinde_sdk/version.rb

@@ -1,3 +1,3 @@
 module KindeSdk
-  VERSION = "1.7.1"
+  VERSION = "1.8.0"
 end

data/lib/kinde_sdk.rb

@@ -1,7 +1,16 @@
 require "logger"
-require "rails"
+
+# Rails is optional - SDK works in non-Rails Ruby applications
+begin
+  require "rails"
+rescue LoadError
+  # Rails not available, that's fine
+end
+
 require "kinde_sdk/version"
 require "kinde_sdk/configuration"
+require "kinde_sdk/logging"
+require "kinde_sdk/token_hash"
 require "kinde_sdk/client/feature_flags"
 require "kinde_sdk/client/permissions"
 require "kinde_sdk/client"
@@ -24,6 +33,8 @@ module KindeSdk
 
   
   class << self
+    include Logging
+    
     attr_accessor :config
 
     if defined?(Rails)
@@ -55,6 +66,13 @@ module KindeSdk
         scope: @config.scope,
         supports_reauth: "true"
       }.merge(**kwargs)
+
+      if params[:invitation_code].is_a?(String) && !params[:invitation_code].strip.empty?
+        params[:invitation_code] = params[:invitation_code].strip
+        params[:is_invitation] = "true"
+      else
+        params.delete(:invitation_code)
+      end
       return { url: @config.oauth_client(
         client_id: client_id,
         client_secret: client_secret,
@@ -98,14 +116,7 @@ module KindeSdk
         authorize_url: "#{domain}/oauth2/auth",
         token_url: "#{domain}/oauth2/token").auth_code.get_token(code.to_s, params)
 
-      {
-        access_token: token.token,           # The access token
-        id_token: token.params['id_token'],  # The ID token from params
-        expires_at: token.expires_at,        # Optional: expiration time
-        refresh_token: token.refresh_token,   # Optional: if present
-        scope: token.params['scope'],        # The scopes requested
-        token_type: token.params['token_type'] # The token type
-      }.compact
+      TokenHash.from_access_token(token)
     end
 
     # tokens_hash #=>
@@ -118,14 +129,46 @@ module KindeSdk
     #
     # @return [KindeSdk::Client]
     def client(tokens_hash, auto_refresh_tokens = @config.auto_refresh_tokens, force_api = @config.force_api)
-      sdk_api_client = api_client(tokens_hash[:access_token] || tokens_hash["access_token"])
-      KindeSdk::Client.new(sdk_api_client, tokens_hash, auto_refresh_tokens, force_api)
+      normalized_tokens = TokenHash.normalize(tokens_hash)
+      bearer_token = normalized_tokens[:access_token]
+      if bearer_token.nil? || bearer_token.empty?
+        raise AuthenticationError, "Missing access_token in token hash"
+      end
+
+      sdk_api_client = api_client(bearer_token)
+      KindeSdk::Client.new(sdk_api_client, normalized_tokens, auto_refresh_tokens, force_api)
     end
 
     def logout_url(logout_url: @config.logout_url, domain: @config.domain)
+      raise ArgumentError, "domain is required for logout_url" if domain.nil? || domain.to_s.strip.empty?
+      
       query = logout_url ? URI.encode_www_form(redirect: logout_url) : nil
-      host = URI::parse(domain).host
-      URI::HTTP.build(host: host, path: '/logout', query: query).to_s
+      normalized_domain = domain.to_s.strip
+      
+      # Only allow http/https schemes; prepend https:// if no scheme present
+      if normalized_domain.match?(%r{\Ahttps?://}i)
+        # Valid http/https scheme - use as-is
+      elsif normalized_domain.match?(%r{\A\w+://})
+        # Invalid scheme (ftp://, file://, etc.)
+        raise ArgumentError, "invalid scheme in domain: #{domain} (only http/https allowed)"
+      else
+        # No scheme - default to https
+        normalized_domain = "https://#{normalized_domain}"
+      end
+      
+      begin
+        parsed = URI.parse(normalized_domain)
+      rescue URI::InvalidURIError
+        raise ArgumentError, "invalid domain format: #{domain}"
+      end
+      raise ArgumentError, "invalid domain format: #{domain}" if parsed.host.nil? || parsed.host.empty?
+      
+      scheme = parsed.scheme || 'https'
+      # Only omit port if it matches the default for the scheme
+      default_port = scheme == 'https' ? 443 : 80
+      host_with_port = parsed.port && parsed.port != default_port ? "#{parsed.host}:#{parsed.port}" : parsed.host
+      
+      "#{scheme}://#{host_with_port}/logout#{query ? "?#{query}" : ''}"
     end
 
     def client_credentials_access(
@@ -154,13 +197,13 @@ module KindeSdk
       begin
         validate_jwt_token(hash)
         OAuth2::AccessToken.from_hash(@config.oauth_client(
-          client_id: client_id, 
+          client_id: client_id,
           client_secret: client_secret,
           domain: domain,
           authorize_url: "#{domain}/oauth2/auth",
-          token_url: "#{domain}/oauth2/token"), hash).expired?
+          token_url: "#{domain}/oauth2/token"), TokenHash.normalize(hash)).expired?
       rescue JWT::DecodeError, OAuth2::Error => e
-        Rails.logger.error("Error checking token expiration: #{e.message}")
+        log_error("Error checking token expiration: #{e.message}")
         true
       end
     end
@@ -172,12 +215,14 @@ module KindeSdk
       audience: "#{@config.domain}/api",
       domain: @config.domain
     )
-      OAuth2::AccessToken.from_hash(@config.oauth_client(
-        client_id: client_id, 
+      oauth_client = @config.oauth_client(
+        client_id: client_id,
         client_secret: client_secret,
         domain: domain,
         authorize_url: "#{domain}/oauth2/auth",
-        token_url: "#{domain}/oauth2/token"), hash).refresh.to_hash
+        token_url: "#{domain}/oauth2/token")
+      refreshed = OAuth2::AccessToken.from_hash(oauth_client, TokenHash.normalize(hash)).refresh
+      TokenHash.for_refresh_response(refreshed.to_hash)
     end
 
     # init sdk api client by bearer token
@@ -205,7 +250,7 @@ module KindeSdk
         begin
           jwt_validation(token, "#{@config.domain}#{@config.jwks_url}", @config.expected_issuer, @config.expected_audience)
         rescue JWT::DecodeError
-          Rails.logger.error("Invalid JWT token: #{key}")
+          log_error("Invalid JWT token: #{key}")
           raise JWT::DecodeError, "Invalid #{key.to_s.capitalize.gsub('_', ' ')}"
         end
       end
@@ -253,12 +298,13 @@ module KindeSdk
       payload, _header = JWT.decode(jwt_token, nil, true, algorithms: algorithms, jwks: jwks)
       { valid: true, payload: payload }
     rescue JWT::DecodeError => e
-      Rails.logger.error("Token validation failed: #{e.message}")
+      log_error("Token validation failed: #{e.message}")
       raise JWT::DecodeError, "Token validation failed: #{e.message}"
     rescue StandardError => e
-      Rails.logger.error("Unexpected error: #{e.message}")
+      log_error("Unexpected error: #{e.message}")
       raise StandardError, "Unexpected error: #{e.message}"
     end
 
   end
 end
+

data/spec/examples.txt

@@ -1,29 +1,45 @@
 example_id                            | status | run_time        |
 ------------------------------------- | ------ | --------------- |
-./spec/kinde_sdk_spec.rb[1:1:1]       | passed | 0.01547 seconds |
-./spec/kinde_sdk_spec.rb[1:1:2]       | passed | 0.01147 seconds |
-./spec/kinde_sdk_spec.rb[1:2:1]       | passed | 0.01382 seconds |
-./spec/kinde_sdk_spec.rb[1:2:2:1]     | passed | 0.02244 seconds |
-./spec/kinde_sdk_spec.rb[1:3:1]       | passed | 0.00956 seconds |
-./spec/kinde_sdk_spec.rb[1:4:1]       | passed | 0.06429 seconds |
-./spec/kinde_sdk_spec.rb[1:4:2:1]     | passed | 0.01294 seconds |
-./spec/kinde_sdk_spec.rb[1:5:1]       | passed | 0.05019 seconds |
-./spec/kinde_sdk_spec.rb[1:5:2:1]     | passed | 0.02212 seconds |
-./spec/kinde_sdk_spec.rb[1:6:1:1]     | passed | 0.05796 seconds |
-./spec/kinde_sdk_spec.rb[1:6:1:2]     | passed | 0.01345 seconds |
-./spec/kinde_sdk_spec.rb[1:6:1:3]     | passed | 0.0155 seconds  |
-./spec/kinde_sdk_spec.rb[1:6:2:1]     | passed | 0.01915 seconds |
-./spec/kinde_sdk_spec.rb[1:6:2:2:1:1] | passed | 0.02559 seconds |
-./spec/kinde_sdk_spec.rb[1:6:2:2:2:1] | passed | 0.01714 seconds |
-./spec/kinde_sdk_spec.rb[1:6:3:1]     | passed | 0.02433 seconds |
-./spec/kinde_sdk_spec.rb[1:6:3:2]     | passed | 0.01565 seconds |
-./spec/kinde_sdk_spec.rb[1:6:3:3]     | passed | 0.01722 seconds |
-./spec/kinde_sdk_spec.rb[1:6:3:4]     | passed | 0.07104 seconds |
-./spec/kinde_sdk_spec.rb[1:6:3:5]     | passed | 0.02051 seconds |
-./spec/kinde_sdk_spec.rb[1:6:3:6]     | passed | 0.0496 seconds  |
-./spec/kinde_sdk_spec.rb[1:6:4:1:1]   | passed | 0.02547 seconds |
-./spec/kinde_sdk_spec.rb[1:7]         | passed | 0.06144 seconds |
-./spec/kinde_sdk_spec.rb[1:8:1]       | passed | 0.03108 seconds |
-./spec/kinde_sdk_spec.rb[1:8:2]       | passed | 0.051 seconds   |
-./spec/kinde_sdk_spec.rb[1:8:3]       | passed | 0.014 seconds   |
-./spec/kinde_sdk_spec.rb[1:8:4]       | passed | 0.0682 seconds  |
+./spec/kinde_sdk_spec.rb[1:1:1]       | passed | 0.05436 seconds |
+./spec/kinde_sdk_spec.rb[1:1:2]       | passed | 0.05822 seconds |
+./spec/kinde_sdk_spec.rb[1:1:3]       | passed | 0.03791 seconds |
+./spec/kinde_sdk_spec.rb[1:1:4]       | passed | 0.02654 seconds |
+./spec/kinde_sdk_spec.rb[1:1:5]       | passed | 0.02896 seconds |
+./spec/kinde_sdk_spec.rb[1:1:6]       | passed | 0.07656 seconds |
+./spec/kinde_sdk_spec.rb[1:1:7]       | passed | 0.06324 seconds |
+./spec/kinde_sdk_spec.rb[1:2:1]       | passed | 0.03315 seconds |
+./spec/kinde_sdk_spec.rb[1:2:2:1]     | passed | 0.03904 seconds |
+./spec/kinde_sdk_spec.rb[1:3:1]       | passed | 0.02823 seconds |
+./spec/kinde_sdk_spec.rb[1:4:1]       | passed | 0.06163 seconds |
+./spec/kinde_sdk_spec.rb[1:4:2:1]     | passed | 0.17631 seconds |
+./spec/kinde_sdk_spec.rb[1:5:1]       | passed | 0.07435 seconds |
+./spec/kinde_sdk_spec.rb[1:5:2:1]     | passed | 0.05682 seconds |
+./spec/kinde_sdk_spec.rb[1:6:1]       | passed | 0.04508 seconds |
+./spec/kinde_sdk_spec.rb[1:7:1:1]     | passed | 0.04243 seconds |
+./spec/kinde_sdk_spec.rb[1:7:1:2]     | passed | 0.14146 seconds |
+./spec/kinde_sdk_spec.rb[1:7:2:1]     | passed | 0.05834 seconds |
+./spec/kinde_sdk_spec.rb[1:7:2:2]     | passed | 0.04263 seconds |
+./spec/kinde_sdk_spec.rb[1:7:2:3]     | passed | 0.04012 seconds |
+./spec/kinde_sdk_spec.rb[1:7:3:1]     | passed | 0.08297 seconds |
+./spec/kinde_sdk_spec.rb[1:7:3:2:1:1] | passed | 0.11155 seconds |
+./spec/kinde_sdk_spec.rb[1:7:3:2:2:1] | passed | 0.04904 seconds |
+./spec/kinde_sdk_spec.rb[1:7:4:1]     | passed | 0.06419 seconds |
+./spec/kinde_sdk_spec.rb[1:7:4:2]     | passed | 0.09575 seconds |
+./spec/kinde_sdk_spec.rb[1:7:4:3]     | passed | 0.04359 seconds |
+./spec/kinde_sdk_spec.rb[1:7:4:4]     | passed | 0.04235 seconds |
+./spec/kinde_sdk_spec.rb[1:7:4:5]     | passed | 0.11869 seconds |
+./spec/kinde_sdk_spec.rb[1:7:4:6]     | passed | 0.07644 seconds |
+./spec/kinde_sdk_spec.rb[1:7:5:1:1]   | passed | 0.06087 seconds |
+./spec/kinde_sdk_spec.rb[1:8]         | passed | 0.07786 seconds |
+./spec/kinde_sdk_spec.rb[1:9:1]       | passed | 0.05067 seconds |
+./spec/kinde_sdk_spec.rb[1:9:2]       | passed | 0.08124 seconds |
+./spec/kinde_sdk_spec.rb[1:9:3]       | passed | 0.0672 seconds  |
+./spec/kinde_sdk_spec.rb[1:9:4]       | passed | 0.07944 seconds |
+./spec/kinde_sdk_spec.rb[2:1:1]       | passed | 0.00005 seconds |
+./spec/kinde_sdk_spec.rb[2:1:2]       | passed | 0.00005 seconds |
+./spec/kinde_sdk_spec.rb[2:1:3]       | passed | 0.00005 seconds |
+./spec/kinde_sdk_spec.rb[2:1:4]       | passed | 0.00008 seconds |
+./spec/kinde_sdk_spec.rb[2:2:1]       | passed | 0.00005 seconds |
+./spec/kinde_sdk_spec.rb[2:3:1]       | passed | 0.00465 seconds |
+./spec/kinde_sdk_spec.rb[2:4:1]       | passed | 0.00006 seconds |
+./spec/kinde_sdk_spec.rb[2:5:1]       | passed | 0.00059 seconds |

data/spec/kinde_sdk_spec.rb

@@ -88,6 +88,36 @@ RSpec.describe KindeSdk do
       auth_obj = described_class.auth_url(redirect_uri: "localhost:5000/another_callback")
       expect(auth_obj[:url]).to match(/localhost%3A5000%2Fanother_callback/)
     end
+
+    it "includes invitation_code and is_invitation when invitation_code is provided" do
+      auth_obj = described_class.auth_url(invitation_code: "test_invitation_123")
+      expect(auth_obj[:url]).to include("invitation_code=test_invitation_123")
+      expect(auth_obj[:url]).to include("is_invitation=true")
+    end
+
+    it "does not include is_invitation when invitation_code is not provided" do
+      auth_obj = described_class.auth_url
+      expect(auth_obj[:url]).not_to include("is_invitation")
+      expect(auth_obj[:url]).not_to include("invitation_code")
+    end
+
+    it "does not include is_invitation for empty invitation_code" do
+      auth_obj = described_class.auth_url(invitation_code: "")
+      expect(auth_obj[:url]).not_to include("is_invitation")
+      expect(auth_obj[:url]).not_to include("invitation_code")
+    end
+
+    it "does not include is_invitation for whitespace-only invitation_code" do
+      auth_obj = described_class.auth_url(invitation_code: "   ")
+      expect(auth_obj[:url]).not_to include("is_invitation")
+      expect(auth_obj[:url]).not_to include("invitation_code")
+    end
+
+    it "includes invitation_code and is_invitation for valid invitation_code with whitespace" do
+      auth_obj = described_class.auth_url(invitation_code: "  abc123  ")
+      expect(auth_obj[:url]).to include("invitation_code=abc123")
+      expect(auth_obj[:url]).to include("is_invitation=true")
+    end
   end
 
   describe "#logout_url" do
@@ -190,6 +220,51 @@ RSpec.describe KindeSdk do
     end
   end
 
+  describe "#refresh_token" do
+    it "returns string-keyed tokens with the full oauth2 hash contract" do
+      refreshed = double(
+        "OAuth2::AccessToken",
+        token: token,
+        refresh_token: refresh_token,
+        expires_at: Time.now.to_i + 7200,
+        params: {}
+      )
+      allow(refreshed).to receive(:to_hash).and_return(
+        access_token: token,
+        refresh_token: refresh_token,
+        expires_at: Time.now.to_i + 7200,
+        mode: :header,
+        header_format: "Bearer %s"
+      )
+
+      access_token_object = double(refresh: refreshed)
+      allow(OAuth2::AccessToken).to receive(:from_hash).and_return(access_token_object)
+
+      stored_tokens = {
+        "access_token" => token,
+        "refresh_token" => refresh_token,
+        "expires_at" => Time.now.to_i + 3600,
+        "mode" => :query,
+        "param_name" => "access_token"
+      }
+
+      expect(OAuth2::AccessToken).to receive(:from_hash) do |_client, normalized|
+        expect(normalized[:access_token]).to eq(token)
+        expect(normalized[:mode]).to eq(:query)
+        expect(normalized[:param_name]).to eq("access_token")
+        access_token_object
+      end
+
+      result = described_class.refresh_token(stored_tokens)
+
+      expect(result["access_token"]).to eq(token)
+      expect(result["refresh_token"]).to eq(refresh_token)
+      expect(result["mode"]).to eq(:header)
+      expect(result["header_format"]).to eq("Bearer %s")
+      expect(result[:access_token]).to be_nil
+    end
+  end
+
   describe "client" do
     let(:hash_to_encode) do
       { "aud" => [],
@@ -213,6 +288,24 @@ RSpec.describe KindeSdk do
     let(:tokens_hash) { { access_token: token, expires_at: expires_at, refresh_token: refresh_token } }
     let(:client) { described_class.client(tokens_hash, auto_refresh_tokens) }
 
+    context "with string-key session tokens" do
+      it "accepts string keys" do
+        session_tokens = {
+          "access_token" => token,
+          "refresh_token" => refresh_token,
+          "expires_at" => expires_at
+        }
+
+        expect(described_class.client(session_tokens, false).bearer_token).to eq(token)
+      end
+
+      it "raises when access_token is missing" do
+        expect {
+          described_class.client({ "refresh_token" => refresh_token }, false)
+        }.to raise_error(KindeSdk::AuthenticationError, /Missing access_token/)
+      end
+    end
+
     context "with session integration" do
       before do
         KindeSdk::Current.set_session(mock_session)
@@ -447,4 +540,136 @@ RSpec.describe KindeSdk do
   end
 end
 
+RSpec.describe KindeSdk::TokenHash do
+  describe ".normalize" do
+    it "accepts string keys" do
+      hash = described_class.normalize(
+        "access_token" => "abc",
+        "refresh_token" => "def",
+        "expires_at" => 123
+      )
+
+      expect(hash).to eq(
+        access_token: "abc",
+        refresh_token: "def",
+        expires_at: 123
+      )
+    end
+
+    it "accepts symbol keys" do
+      hash = described_class.normalize(
+        access_token: "abc",
+        refresh_token: "def",
+        expires_at: 123
+      )
+
+      expect(hash[:access_token]).to eq("abc")
+    end
+
+    it "returns an empty hash for nil" do
+      expect(described_class.normalize(nil)).to eq({})
+    end
+
+    it "preserves oauth2 reconstruction fields" do
+      hash = described_class.normalize(
+        "access_token" => "abc",
+        "mode" => :header,
+        header_format: "Bearer %s",
+        "token_name" => :access_token,
+        "expires_latency" => 5,
+        "expires" => 3600
+      )
+
+      expect(hash).to eq(
+        access_token: "abc",
+        mode: :header,
+        header_format: "Bearer %s",
+        token_name: :access_token,
+        expires_latency: 5,
+        expires: 3600
+      )
+    end
+  end
+
+  describe ".public_tokens" do
+    it "returns only the documented public SDK token fields" do
+      hash = described_class.public_tokens(
+        access_token: "abc",
+        refresh_token: "def",
+        expires_at: 123,
+        mode: :header,
+        header_format: "Bearer %s"
+      )
+
+      expect(hash).to eq(
+        access_token: "abc",
+        refresh_token: "def",
+        expires_at: 123
+      )
+    end
+  end
+
+  describe ".from_access_token" do
+    let(:oauth_token) do
+      double(
+        "OAuth2::AccessToken",
+        token: "access-token-value",
+        refresh_token: "refresh-token-value",
+        expires_at: 1_700_000_000,
+        params: {
+          "id_token" => "id-token",
+          "scope" => "openid profile",
+          "token_type" => "bearer"
+        }
+      )
+    end
+
+    it "builds a normalized hash without calling oauth2 #to_hash" do
+      expect(oauth_token).not_to receive(:to_hash)
+
+      hash = described_class.from_access_token(oauth_token)
+
+      expect(hash).to eq(
+        access_token: "access-token-value",
+        refresh_token: "refresh-token-value",
+        expires_at: 1_700_000_000,
+        id_token: "id-token",
+        scope: "openid profile",
+        token_type: "bearer"
+      )
+    end
+  end
+
+  describe ".for_refresh_response" do
+    it "returns string keys while preserving the full oauth2 hash contract" do
+      response = described_class.for_refresh_response(
+        access_token: "abc",
+        refresh_token: "def",
+        expires_at: 123,
+        mode: :header,
+        param_name: "access_token"
+      )
+
+      expect(response).to eq(
+        "access_token" => "abc",
+        "refresh_token" => "def",
+        "expires_at" => 123,
+        "mode" => :header,
+        "param_name" => "access_token"
+      )
+    end
+  end
+
+  describe ".for_session" do
+    it "returns string keys for documented session/API compatibility" do
+      session_hash = described_class.for_session(access_token: "abc", expires_at: 123)
+
+      expect(session_hash).to eq(
+        "access_token" => "abc",
+        "expires_at" => 123
+      )
+      expect(session_hash["access_token"]).to eq("abc")
+    end
+  end
+end
 

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kinde_sdk
 version: !ruby/object:Gem::Version
-  version: 1.7.1
+  version: 1.8.0
 platform: ruby
 authors:
 - Kinde Australia Pty Ltd
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-01-08 00:00:00.000000000 Z
+date: 2026-07-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: typhoeus
@@ -105,34 +106,34 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '3.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.6'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.6.0
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.6'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '3.6'
     - - ">="
       - !ruby/object:Gem::Version
         version: 3.6.0
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.6'
 description: Integrate the Kinde API into any ruby-based applications, Rails or non-Rails
 email:
 - support@kinde.com
@@ -935,7 +936,9 @@ files:
 - lib/kinde_sdk/engine.rb
 - lib/kinde_sdk/errors.rb
 - lib/kinde_sdk/internal/frontend_client.rb
+- lib/kinde_sdk/logging.rb
 - lib/kinde_sdk/middleware.rb
+- lib/kinde_sdk/token_hash.rb
 - lib/kinde_sdk/token_manager.rb
 - lib/kinde_sdk/token_store.rb
 - lib/kinde_sdk/version.rb
@@ -946,6 +949,7 @@ homepage: https://kinde.com/
 licenses:
 - MIT
 metadata: {}
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -961,7 +965,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.0.3.1
+signing_key: 
 specification_version: 4
 summary: Kinde Management API Ruby Gem
 test_files: