oktakit 0.3.3 → 1.1.0

data/lib/oktakit/client/factors.rb

@@ -15,7 +15,7 @@ module Oktakit
       # @example
       #   Oktakit.get_factor('user_id', 'factor_id')
       def get_factor(user_id, factor_id, options = {})
-        get("/users/#{user_id}/factors/#{factor_id}", options)
+        get("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}", options)
       end
 
       # List Enrolled Factors
@@ -31,7 +31,7 @@ module Oktakit
       # @example
       #   Oktakit.list_enrolled_factors('user_id')
       def list_enrolled_factors(user_id, options = {})
-        get("/users/#{user_id}/factors", options)
+        get("/users/#{path_segment(user_id)}/factors", options)
       end
 
       # List Factors to Enroll
@@ -47,7 +47,7 @@ module Oktakit
       # @example
       #   Oktakit.list_factors_to_enroll('user_id')
       def list_factors_to_enroll(user_id, options = {})
-        get("/users/#{user_id}/factors/catalog", options)
+        get("/users/#{path_segment(user_id)}/factors/catalog", options)
       end
 
       # List Security Questions
@@ -63,7 +63,7 @@ module Oktakit
       # @example
       #   Oktakit.list_security_questions('user_id')
       def list_security_questions(user_id, options = {})
-        get("/users/#{user_id}/factors/questions", options)
+        get("/users/#{path_segment(user_id)}/factors/questions", options)
       end
 
       # Enroll Factor
@@ -79,7 +79,7 @@ module Oktakit
       # @example
       #   Oktakit.enroll_factor('id')
       def enroll_factor(user_id, options = {})
-        post("/users/#{user_id}/factors", options)
+        post("/users/#{path_segment(user_id)}/factors", options)
       end
 
       # Activate Factor
@@ -96,7 +96,7 @@ module Oktakit
       # @example
       #   Oktakit.activate_factor('user_id', 'factor_id')
       def activate_factor(user_id, factor_id, options = {})
-        post("/users/#{user_id}/factors/#{factor_id}/lifecycle/activate", options)
+        post("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}/lifecycle/activate", options)
       end
 
       # Reset Factor
@@ -113,7 +113,7 @@ module Oktakit
       # @example
       #   Oktakit.reset_factor('user_id', 'factor_id')
       def reset_factor(user_id, factor_id, options = {})
-        delete("/users/#{user_id}/factors/#{factor_id}", options)
+        delete("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}", options)
       end
 
       # Verify Security Question Factor
@@ -130,7 +130,7 @@ module Oktakit
       # @example
       #   Oktakit.verify_security_question_factor('user_id', 'factor_id')
       def verify_security_question_factor(user_id, factor_id, options = {})
-        post("/users/#{user_id}/factors/#{factor_id}/verify", options)
+        post("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}/verify", options)
       end
 
       # Verify SMS Factor
@@ -147,7 +147,7 @@ module Oktakit
       # @example
       #   Oktakit.verify_sms_factor('user_id', 'factor_id')
       def verify_sms_factor(user_id, factor_id, options = {})
-        post("/users/#{user_id}/factors/#{factor_id}/verify", options)
+        post("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}/verify", options)
       end
 
       # Verify TOTP Factor
@@ -164,7 +164,7 @@ module Oktakit
       # @example
       #   Oktakit.verify_totp_factor('user_id', 'factor_id')
       def verify_totp_factor(user_id, factor_id, options = {})
-        post("/users/#{user_id}/factors/#{factor_id}/verify", options)
+        post("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}/verify", options)
       end
 
       # Verify Push Factor
@@ -181,7 +181,7 @@ module Oktakit
       # @example
       #   Oktakit.verify_push_factor('user_id', 'factor_id')
       def verify_push_factor(user_id, factor_id, options = {})
-        post("/users/#{user_id}/factors/#{factor_id}/verify", options)
+        post("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}/verify", options)
       end
 
       # Poll for Verify Transaction Completion
@@ -199,7 +199,8 @@ module Oktakit
       # @example
       #   Oktakit.poll_for_verify_transaction_completion('user_id', 'factor_id', 'transaction_id')
       def poll_for_verify_transaction_completion(user_id, factor_id, transaction_id, options = {})
-        get("/users/#{user_id}/factors/#{factor_id}/transactions/#{transaction_id}", options)
+        factor = "/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}"
+        get("#{factor}/transactions/#{path_segment(transaction_id)}", options)
       end
 
       # Verify Token Factor
@@ -216,7 +217,7 @@ module Oktakit
       # @example
       #   Oktakit.verify_token_factor('user_id', 'factor_id')
       def verify_token_factor(user_id, factor_id, options = {})
-        post("/users/#{user_id}/factors/#{factor_id}/verify", options)
+        post("/users/#{path_segment(user_id)}/factors/#{path_segment(factor_id)}/verify", options)
       end
     end
   end

data/lib/oktakit/client/group_rules.rb

@@ -29,7 +29,7 @@ module Oktakit
       # @example
       #   Oktakit.get_group_rule('id')
       def get_group_rule(id, options = {})
-        get("/groups/rules/#{id}", options)
+        get("/groups/rules/#{path_segment(id)}", options)
       end
 
       # List Group Rules
@@ -60,7 +60,7 @@ module Oktakit
       # @example
       #   Oktakit.update_group_rule('id')
       def update_group_rule(id, options = {})
-        put("/groups/rules/#{id}", options)
+        put("/groups/rules/#{path_segment(id)}", options)
       end
 
       # Remove Group Rule
@@ -76,7 +76,7 @@ module Oktakit
       # @example
       #   Oktakit.remove_group_rule('id')
       def remove_group_rule(id, options = {})
-        delete("/groups/rules/#{id}", options)
+        delete("/groups/rules/#{path_segment(id)}", options)
       end
 
       # Activate Group Rule
@@ -92,7 +92,7 @@ module Oktakit
       # @example
       #   Oktakit.activate_group_rule('id')
       def activate_group_rule(id, options = {})
-        post("/groups/rules/#{id}/lifecycle/activate", options)
+        post("/groups/rules/#{path_segment(id)}/lifecycle/activate", options)
       end
 
       # Deactivate Group Rule
@@ -108,7 +108,7 @@ module Oktakit
       # @example
       #   Oktakit.deactivate_group_rule('id')
       def deactivate_group_rule(id, options = {})
-        post("/groups/rules/#{id}/lifecycle/deactivate", options)
+        post("/groups/rules/#{path_segment(id)}/lifecycle/deactivate", options)
       end
     end
   end

data/lib/oktakit/client/groups.rb

@@ -29,7 +29,7 @@ module Oktakit
       # @example
       #   Oktakit.get_group('id')
       def get_group(id, options = {})
-        get("/groups/#{id}", options)
+        get("/groups/#{path_segment(id)}", options)
       end
 
       # List Groups
@@ -60,7 +60,7 @@ module Oktakit
       # @example
       #   Oktakit.update_group('id')
       def update_group(id, options = {})
-        put("/groups/#{id}", options)
+        put("/groups/#{path_segment(id)}", options)
       end
 
       # Remove Group
@@ -76,7 +76,7 @@ module Oktakit
       # @example
       #   Oktakit.remove_group('id')
       def remove_group(id, options = {})
-        delete("/groups/#{id}", options)
+        delete("/groups/#{path_segment(id)}", options)
       end
 
       # List Group Members
@@ -92,7 +92,7 @@ module Oktakit
       # @example
       #   Oktakit.list_group_members('id')
       def list_group_members(id, options = {})
-        get("/groups/#{id}/users", options)
+        get("/groups/#{path_segment(id)}/users", options)
       end
 
       # Add User to Group
@@ -109,7 +109,7 @@ module Oktakit
       # @example
       #   Oktakit.add_user_to_group('group_id', 'user_id')
       def add_user_to_group(group_id, user_id, options = {})
-        put("/groups/#{group_id}/users/#{user_id}", options)
+        put("/groups/#{path_segment(group_id)}/users/#{path_segment(user_id)}", options)
       end
 
       # Remove User from Group
@@ -126,7 +126,7 @@ module Oktakit
       # @example
       #   Oktakit.remove_user_from_group('group_id', 'user_id')
       def remove_user_from_group(group_id, user_id, options = {})
-        delete("/groups/#{group_id}/users/#{user_id}", options)
+        delete("/groups/#{path_segment(group_id)}/users/#{path_segment(user_id)}", options)
       end
 
       # List Assigned Applications
@@ -142,7 +142,7 @@ module Oktakit
       # @example
       #   Oktakit.list_assigned_applications('id')
       def list_assigned_applications(id, options = {})
-        get("/groups/#{id}/apps", options)
+        get("/groups/#{path_segment(id)}/apps", options)
       end
     end
   end

data/lib/oktakit/client/identity_providers.rb

@@ -29,7 +29,7 @@ module Oktakit
       # @example
       #   Oktakit.get_identity_provider('id')
       def get_identity_provider(id, options = {})
-        get("/idps/#{id}", options)
+        get("/idps/#{path_segment(id)}", options)
       end
 
       # List Identity Providers
@@ -60,7 +60,7 @@ module Oktakit
       # @example
       #   Oktakit.update_identity_provider('id')
       def update_identity_provider(id, options = {})
-        put("/idps/#{id}", options)
+        put("/idps/#{path_segment(id)}", options)
       end
 
       # Delete Identity Provider
@@ -76,7 +76,7 @@ module Oktakit
       # @example
       #   Oktakit.delete_identity_provider('id')
       def delete_identity_provider(id, options = {})
-        delete("/idps/#{id}", options)
+        delete("/idps/#{path_segment(id)}", options)
       end
 
       # Activate Identity Provider
@@ -92,7 +92,7 @@ module Oktakit
       # @example
       #   Oktakit.activate_identity_provider('id')
       def activate_identity_provider(id, options = {})
-        post("/idps/#{id}/lifecycle/activate", options)
+        post("/idps/#{path_segment(id)}/lifecycle/activate", options)
       end
 
       # Deactivate Identity Provider
@@ -108,7 +108,7 @@ module Oktakit
       # @example
       #   Oktakit.deactivate_identity_provider('id')
       def deactivate_identity_provider(id, options = {})
-        post("/idps/#{id}/lifecycle/deactivate", options)
+        post("/idps/#{path_segment(id)}/lifecycle/deactivate", options)
       end
 
       # Get Identity Provider Transaction
@@ -124,7 +124,7 @@ module Oktakit
       # @example
       #   Oktakit.get_identity_provider_transaction('transaction_id')
       def get_identity_provider_transaction(transaction_id, options = {})
-        get("/idps/tx/#{transaction_id}", options)
+        get("/idps/tx/#{path_segment(transaction_id)}", options)
       end
 
       # Get Source IdP User for IdP Transaction
@@ -140,7 +140,7 @@ module Oktakit
       # @example
       #   Oktakit.get_source_idp_user_for_idp_transaction('transaction_id')
       def get_source_idp_user_for_idp_transaction(transaction_id, options = {})
-        get("/idps/tx/#{transaction_id}/source", options)
+        get("/idps/tx/#{path_segment(transaction_id)}/source", options)
       end
 
       # Get Target User for IdP Provision Transaction
@@ -156,7 +156,7 @@ module Oktakit
       # @example
       #   Oktakit.get_target_user_for_idp_provision_transaction('transaction_id')
       def get_target_user_for_idp_provision_transaction(transaction_id, options = {})
-        get("/idps/tx/#{transaction_id}/target", options)
+        get("/idps/tx/#{path_segment(transaction_id)}/target", options)
       end
 
       # List Users for IdP Link Transaction
@@ -172,7 +172,7 @@ module Oktakit
       # @example
       #   Oktakit.list_users_for_idp_link_transaction('transaction_id')
       def list_users_for_idp_link_transaction(transaction_id, options = {})
-        get("/idps/tx/#{transaction_id}/users", options)
+        get("/idps/tx/#{path_segment(transaction_id)}/users", options)
       end
 
       # Provision IdP User
@@ -188,7 +188,7 @@ module Oktakit
       # @example
       #   Oktakit.provision_idp_user('transaction_id')
       def provision_idp_user(transaction_id, options = {})
-        post("/idps/tx/#{transaction_id}/lifecycle/provision", options)
+        post("/idps/tx/#{path_segment(transaction_id)}/lifecycle/provision", options)
       end
 
       # Link IdP User
@@ -205,7 +205,7 @@ module Oktakit
       # @example
       #   Oktakit.link_idp_user('user_id', 'transaction_id')
       def link_idp_user(transaction_id, user_id, options = {})
-        post("/idps/tx/#{transaction_id}/lifecycle/confirm/#{user_id}", options)
+        post("/idps/tx/#{path_segment(transaction_id)}/lifecycle/confirm/#{path_segment(user_id)}", options)
       end
 
       # Add X.509 Certificate Public Key
@@ -236,7 +236,7 @@ module Oktakit
       # @example
       #   Oktakit.get_key('key_id')
       def get_key(key_id, options = {})
-        get("/idps/credentials/keys/#{key_id}", options)
+        get("/idps/credentials/keys/#{path_segment(key_id)}", options)
       end
 
       # List Keys
@@ -267,7 +267,7 @@ module Oktakit
       # @example
       #   Oktakit.delete_key('key_id')
       def delete_key(key_id, options = {})
-        delete("/idps/credentials/keys/#{key_id}", options)
+        delete("/idps/credentials/keys/#{path_segment(key_id)}", options)
       end
     end
   end

data/lib/oktakit/client/schemas.rb

@@ -74,7 +74,7 @@ module Oktakit
       # @example
       #   Oktakit.get_app_user_schema('id')
       def get_app_user_schema(id, options = {})
-        get("/meta/schemas/apps/#{id}/default", options)
+        get("/meta/schemas/apps/#{path_segment(id)}/default", options)
       end
 
       # Add Property to App User Profile Schema
@@ -90,7 +90,7 @@ module Oktakit
       # @example
       #   Oktakit.add_property_to_app_user_profile_schema('id')
       def add_property_to_app_user_profile_schema(id, options = {})
-        post("/meta/schemas/apps/#{id}/default", options)
+        post("/meta/schemas/apps/#{path_segment(id)}/default", options)
       end
 
       # Update App User Profile Schema property
@@ -106,7 +106,7 @@ module Oktakit
       # @example
       #   Oktakit.update_app_user_profile_schema_property('id')
       def update_app_user_profile_schema_property(id, options = {})
-        post("/meta/schemas/apps/#{id}/default", options)
+        post("/meta/schemas/apps/#{path_segment(id)}/default", options)
       end
 
       # Remove property from App User Profile Schema
@@ -122,7 +122,7 @@ module Oktakit
       # @example
       #   Oktakit.remove_property_from_app_user_profile_schema('id')
       def remove_property_from_app_user_profile_schema(id, options = {})
-        post("/meta/schemas/apps/#{id}/default", options)
+        post("/meta/schemas/apps/#{path_segment(id)}/default", options)
       end
     end
   end

data/lib/oktakit/client/templates.rb

@@ -29,7 +29,7 @@ module Oktakit
       # @example
       #   Oktakit.get_sms_template('id')
       def get_sms_template(id, options = {})
-        get("/templates/sms/#{id}", options)
+        get("/templates/sms/#{path_segment(id)}", options)
       end
 
       # List SMS Templates
@@ -60,7 +60,7 @@ module Oktakit
       # @example
       #   Oktakit.update_sms_template('id')
       def update_sms_template(id, options = {})
-        put("/templates/sms/#{id}", options)
+        put("/templates/sms/#{path_segment(id)}", options)
       end
 
       # Partial SMS Template Update
@@ -76,7 +76,7 @@ module Oktakit
       # @example
       #   Oktakit.partial_sms_template_update('id')
       def partial_sms_template_update(id, options = {})
-        post("/templates/sms/#{id}", options)
+        post("/templates/sms/#{path_segment(id)}", options)
       end
 
       # Remove SMS Template
@@ -92,7 +92,7 @@ module Oktakit
       # @example
       #   Oktakit.remove_sms_template('id')
       def remove_sms_template(id, options = {})
-        delete("/templates/sms/#{id}", options)
+        delete("/templates/sms/#{path_segment(id)}", options)
       end
     end
   end

data/lib/oktakit/client/users.rb

@@ -29,7 +29,7 @@ module Oktakit
       # @example
       #   Oktakit.get_user('id')
       def get_user(id, options = {})
-        get("/users/#{id}", options)
+        get("/users/#{path_segment(id)}", options)
       end
 
       # List Users
@@ -62,9 +62,9 @@ module Oktakit
       #   Oktakit.update_user('id')
       def update_user(id, options = {})
         if options.delete(:partial)
-          post("/users/#{id}", options)
+          post("/users/#{path_segment(id)}", options)
         else
-          put("/users/#{id}", options)
+          put("/users/#{path_segment(id)}", options)
         end
       end
 
@@ -81,7 +81,7 @@ module Oktakit
       # @example
       #   Oktakit.update_profile('id')
       def update_profile(id, options = {})
-        post("/users/#{id}", options)
+        post("/users/#{path_segment(id)}", options)
       end
 
       # Get Assigned App Links
@@ -96,7 +96,7 @@ module Oktakit
       # @example
       #   Oktakit.get_assigned_app_links('id')
       def get_assigned_app_links(id, options = {})
-        get("/users/#{id}/appLinks", options)
+        get("/users/#{path_segment(id)}/appLinks", options)
       end
 
       # Get Member Groups
@@ -112,7 +112,7 @@ module Oktakit
       # @example
       #   Oktakit.get_member_groups('id')
       def get_member_groups(id, options = {})
-        get("/users/#{id}/groups", options)
+        get("/users/#{path_segment(id)}/groups", options)
       end
 
       # Activate User
@@ -128,7 +128,7 @@ module Oktakit
       # @example
       #   Oktakit.activate_user('id')
       def activate_user(id, options = {})
-        post("/users/#{id}/lifecycle/activate", options)
+        post("/users/#{path_segment(id)}/lifecycle/activate", options)
       end
 
       # Reactivate User
@@ -146,7 +146,7 @@ module Oktakit
       #   Oktakit.reactivate_user('id')
 
       def reactivate_user(id, options = {})
-        post("/users/#{id}/lifecycle/reactivate", options)
+        post("/users/#{path_segment(id)}/lifecycle/reactivate", options)
       end
 
       # Deactivate User
@@ -162,7 +162,7 @@ module Oktakit
       # @example
       #   Oktakit.deactivate_user('id')
       def deactivate_user(id, options = {})
-        post("/users/#{id}/lifecycle/deactivate", options)
+        post("/users/#{path_segment(id)}/lifecycle/deactivate", options)
       end
 
       # Delete User
@@ -180,7 +180,7 @@ module Oktakit
       # @example
       #   Oktakit.delete_user('id')
       def delete_user(id, options = {})
-        delete("/users/#{id}", options)
+        delete("/users/#{path_segment(id)}", options)
       end
 
       # Suspend User
@@ -196,7 +196,7 @@ module Oktakit
       # @example
       #   Oktakit.suspend_user('id')
       def suspend_user(id, options = {})
-        post("/users/#{id}/lifecycle/suspend", options)
+        post("/users/#{path_segment(id)}/lifecycle/suspend", options)
       end
 
       # Unsuspend User
@@ -212,7 +212,7 @@ module Oktakit
       # @example
       #   Oktakit.unsuspend_user('id')
       def unsuspend_user(id, options = {})
-        post("/users/#{id}/lifecycle/unsuspend", options)
+        post("/users/#{path_segment(id)}/lifecycle/unsuspend", options)
       end
 
       # Unlock User
@@ -228,7 +228,7 @@ module Oktakit
       # @example
       #   Oktakit.unlock_user('id')
       def unlock_user(id, options = {})
-        post("/users/#{id}/lifecycle/unlock", options)
+        post("/users/#{path_segment(id)}/lifecycle/unlock", options)
       end
 
       # Reset Password
@@ -244,7 +244,7 @@ module Oktakit
       # @example
       #   Oktakit.reset_password('id')
       def reset_password(id, options = {})
-        post("/users/#{id}/lifecycle/reset_password", options)
+        post("/users/#{path_segment(id)}/lifecycle/reset_password", options)
       end
 
       # Expire Password
@@ -260,7 +260,7 @@ module Oktakit
       # @example
       #   Oktakit.expire_password('id')
       def expire_password(id, options = {})
-        post("/users/#{id}/lifecycle/expire_password", options)
+        post("/users/#{path_segment(id)}/lifecycle/expire_password", options)
       end
 
       # Reset Factors
@@ -276,7 +276,7 @@ module Oktakit
       # @example
       #   Oktakit.reset_factors('id')
       def reset_factors(id, options = {})
-        post("/users/#{id}/lifecycle/reset_factors", options)
+        post("/users/#{path_segment(id)}/lifecycle/reset_factors", options)
       end
 
       # Forgot Password
@@ -292,7 +292,7 @@ module Oktakit
       # @example
       #   Oktakit.forgot_password('id')
       def forgot_password(id, options = {})
-        post("/users/#{id}/credentials/forgot_password", options)
+        post("/users/#{path_segment(id)}/credentials/forgot_password", options)
       end
 
       # Change Password
@@ -308,7 +308,7 @@ module Oktakit
       # @example
       #   Oktakit.change_password('id')
       def change_password(id, options = {})
-        post("/users/#{id}/credentials/change_password", options)
+        post("/users/#{path_segment(id)}/credentials/change_password", options)
       end
 
       # Change Recovery Question
@@ -324,7 +324,7 @@ module Oktakit
       # @example
       #   Oktakit.change_recovery_question('id')
       def change_recovery_question(id, options = {})
-        post("/users/#{id}/credentials/change_recovery_question", options)
+        post("/users/#{path_segment(id)}/credentials/change_recovery_question", options)
       end
 
       # Clear user sessions
@@ -339,7 +339,7 @@ module Oktakit
       # @see https://developer.okta.com/docs/api/resources/users#user-sessions
       #   Oktakit.clear_user_sessions('id')
       def clear_user_sessions(id, options = {})
-        delete("/users/#{id}/sessions", options)
+        delete("/users/#{path_segment(id)}/sessions", options)
       end
     end
   end

data/lib/oktakit/client.rb

@@ -1,3 +1,4 @@
+require "json"
 require 'sawyer'
 require 'oktakit/response/raise_error'
 require 'oktakit/client/admin_roles'
@@ -24,13 +25,22 @@ module Oktakit
     include Templates
     include Users
 
-    # In Faraday 0.9, Faraday::Builder was renamed to Faraday::RackBuilder
-    RACK_BUILDER_CLASS = defined?(Faraday::RackBuilder) ? Faraday::RackBuilder : Faraday::Builder
+    # Bytes that path_segment percent-encodes: everything except RFC 3986 unreserved characters.
+    PATH_SEGMENT_UNSAFE = /[^A-Za-z0-9\-._~]/n
+
+    # Bytes that request percent-encodes in a full path: everything outside the RFC 2396
+    # unreserved and reserved sets, plus any "%" that does not start a valid escape sequence.
+    # Existing escapes are preserved so already-encoded segments are not encoded twice.
+    REQUEST_PATH_UNSAFE = %r{[^\-_.!~*'()a-zA-Z\d;/?:@&=+$,\[\]%]|%(?![0-9A-Fa-f]{2})}n
+    # A single DNS label: letters, digits and inner hyphens, at most 63 characters.
+    ORGANIZATION_FORMAT = /\A[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\z/i
+
+    private_constant :PATH_SEGMENT_UNSAFE, :REQUEST_PATH_UNSAFE, :ORGANIZATION_FORMAT
 
     # Default Faraday middleware stack
-    MIDDLEWARE = RACK_BUILDER_CLASS.new do |builder|
+    MIDDLEWARE = Faraday::RackBuilder.new do |builder|
       builder.use(Oktakit::Response::RaiseError)
-      builder.adapter(Faraday.default_adapter)
+      builder.adapter(:net_http)
     end
 
     def initialize(token: nil, access_token: nil, organization: nil, api_endpoint: nil)
@@ -42,6 +52,12 @@ module Oktakit
         raise ArgumentError, "Please provide either the token or the access_token argument"
       end
 
+      # The organization becomes the hostname the token is sent to, so it must be a single DNS label.
+      if !api_endpoint && !ORGANIZATION_FORMAT.match?(organization.to_s)
+        raise ArgumentError, "Invalid organization: #{organization.inspect}. Use the Okta subdomain, " \
+          "e.g. \"my-org\" for my-org.okta.com, or pass api_endpoint instead."
+      end
+
       @token = token
       @access_token = access_token
       @organization = organization
@@ -176,7 +192,7 @@ module Oktakit
       options[:headers][:accept] = accept if accept
       options[:headers][:content_type] = content_type if content_type
 
-      uri = URI::DEFAULT_PARSER.escape("/api/v1" + path.to_s)
+      uri = escape_request_path("/api/v1" + path.to_s)
       @last_response = resp = sawyer_agent.call(method, uri, data, options)
 
       response = [resp.data, resp.status]
@@ -184,6 +200,37 @@ module Oktakit
       response
     end
 
+    # Percent-encode a single value for use as one URL path segment.
+    #
+    # Everything outside the RFC 3986 unreserved set is percent-encoded, including "?", "#"
+    # and "%". Some values cannot be made safe by encoding and are rejected instead:
+    #
+    # - empty values, "." and "..", which resolve to a different resource;
+    # - values containing "/", because Okta decodes "%2F" back into a path separator;
+    # - values containing ";", because Okta ignores everything from ";" (or "%3B") onward.
+    #
+    # Okta only supports fetching logins that contain "/" by user ID.
+    #
+    # @param value [#to_s] Resource identifier, e.g. an Okta ID or a user login
+    # @return [String] The encoded segment
+    # @raise [ArgumentError] If the value is empty, ".", "..", or contains "/" or ";"
+    def path_segment(value)
+      segment = value.to_s
+      if segment.empty? || segment == "." || segment == ".." || segment.include?("/") || segment.include?(";")
+        raise ArgumentError, "Invalid path segment: #{value.inspect}"
+      end
+
+      percent_encode(segment, PATH_SEGMENT_UNSAFE)
+    end
+
+    def escape_request_path(path)
+      percent_encode(path, REQUEST_PATH_UNSAFE)
+    end
+
+    def percent_encode(string, unsafe)
+      string.b.gsub(unsafe) { |byte| format("%%%02X", byte.ord) }.force_encoding(Encoding::US_ASCII)
+    end
+
     def sawyer_agent
       @sawyer_agent ||= Sawyer::Agent.new(api_endpoint, sawyer_options) do |http|
         http.headers[:accept] = 'application/json'

data/lib/oktakit/response/raise_error.rb

@@ -6,7 +6,7 @@ module Oktakit
   module Response
     # This class raises an Oktakit-flavored exception based
     # HTTP status codes returned by the API
-    class RaiseError < Faraday::Response::Middleware
+    class RaiseError < Faraday::Middleware
       private
 
       def on_complete(response)