onelogin 1.8.0 → 1.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 341fedcf1ef3faf8e076b127ad2b7379c48fe04957396d850d3468a01a27b369
-  data.tar.gz: ca91b881e24411ff62d8d91b37e6226d5f879c8f245eaced58c44d84194ff892
+  metadata.gz: '0887ddcbf97b6c873d5547842d27822f35b7e4eeefa4c78285ed2828c0cf546b'
+  data.tar.gz: 5a59b6e4c2ff4605775a8473931ed82183d9f434d455a559214828cd612c1988
 SHA512:
-  metadata.gz: 6d0a9ac12d1bb6fc17434ff5503f0fe311ad9b48603f430244423c19c6b9e130e434e2892f4d3308dcfa4c1dc966a5557ba6537d7a733567dd5f42e3a6db8b49
-  data.tar.gz: c95b20d2915d751098950bc1bda5b0356bbc1d9bb4fad76f3c94bf4a8134705bbb3c745b1b4518e849cb0c1994ca2c3a0a3f7584c8eab051dd1344f4dee995c4
+  metadata.gz: 01b0e196b7f431a2d6e04a1b64757a4b0224b0a5b34e3b17ee6c829f642e6b321305d6ebe15dee6dae44fd15b92f64555927522994c469f7f8ba2a1964ccfb10
+  data.tar.gz: 2595a8b6f36f9a446e991baa18b66e37c9f2ac21687a43d7ca6f0c1dfa1b5c515a7edf8c9d57f3e64874d7690d79d807af31c3f689842fc21fda936bd8fd2b52

data/README.md

@@ -59,6 +59,7 @@ If you don't have an account you can [sign up for a free developer account here]
 |max_results| Optional: Defaults to 1000  |
 |timeout| Optional: Defaults to 60 (requires httparty > 0.16.2) |
 |token_expiration_buffer| Optional: Non-negative number of seconds before token expiration to trigger a refresh. Set to `0` to disable. Defaults to 30 |
+|api_version| Optional: `1` or `2`. Calls that API version from every method that supports it. See [API versions](#api-versions) |
 
 ```ruby
 require 'onelogin'
@@ -158,6 +159,34 @@ client = OneLogin::Api::Client.new(
 client.get_events.map {|event| event.id}
 ```
 
+### API versions
+
+Each method calls one version of the OneLogin API by default, and that default
+doesn't change. Pass `api_version: 2` to move the methods below to API v2:
+
+```ruby
+client = OneLogin::Api::Client.new(
+    client_id: '',
+    client_secret:'',
+    api_version: 2
+)
+```
+
+`get_users`, `get_user`, `get_user_apps`, `create_user`, `update_user`,
+`delete_user`, `get_roles` and `get_role` support both versions. Every other method
+keeps its default version, whatever `api_version` says.
+`OneLogin::Api::Client::API_VERSIONS` lists the versions each method supports.
+
+Under v2 they return the same models, filled from v2's responses. Two differences
+show through:
+
+- v2 lists fewer fields per user than v1. Under v2, `get_users` leaves `role_ids`
+  and `custom_attributes` empty, for example. `get_user` fills them.
+- `App#login_id` from `get_user_apps` is the login's numeric id in v2, where v1
+  gives the username used to sign in. v2 fills the `provisioning_enabled`,
+  `provisioning_state` and `provisioning_status` fields rather than `provisioned`
+  and `personal`.
+
 
 
 ### Available Methods

data/lib/onelogin/api/client.rb

@@ -21,6 +21,7 @@ module OneLogin
 
       attr_accessor :client_id, :client_secret, :region
       attr_accessor :user_agent, :error, :error_description, :error_attribute
+      attr_reader :api_version
 
       NOKOGIRI_OPTIONS = Nokogiri::XML::ParseOptions::STRICT |
                          Nokogiri::XML::ParseOptions::NONET
@@ -32,6 +33,9 @@ module OneLogin
       #
       # @param config [Hash] Client Id, Client Secret and Region
       #
+      # Pass api_version to call that API version from every method that
+      # supports it (see API_VERSIONS). Other methods keep their default.
+      #
       def initialize(config)
         options = Hash[config.map { |(k, v)| [k.to_sym, v] }]
 
@@ -40,6 +44,7 @@ module OneLogin
         @region = options[:region] || 'us'
         @max_results = options[:max_results] || 1000
         @token_expiration_buffer = normalize_expiration_buffer(options[:token_expiration_buffer])
+        @api_version = normalize_api_version(options[:api_version])
 
         if options[:timeout] and defined? self.class.default_timeout
           self.class.default_timeout options[:timeout]
@@ -105,6 +110,40 @@ module OneLogin
       end
       private :normalize_expiration_buffer
 
+      # Coerce the configured API version into one the SDK can call.
+      #
+      # nil leaves every method on its default version. Anything else must be a
+      # version at least one method supports, so a typo fails here instead of
+      # quietly calling the defaults. Only Integers and Strings convert:
+      # Integer() would truncate 1.9 to 1.
+      #
+      def normalize_api_version(value)
+        return nil if value.nil?
+
+        version = begin
+          Integer(value) if value.is_a?(Integer) || value.is_a?(String)
+        rescue ArgumentError
+          nil
+        end
+
+        supported = API_VERSIONS.values.flatten.uniq.sort
+        unless supported.include?(version)
+          raise ArgumentError, "api_version must be one of #{supported.join(', ')}, got #{value.inspect}"
+        end
+
+        version
+      end
+      private :normalize_api_version
+
+      # The API version a method calls: the configured api_version when the
+      # method supports it, otherwise the method's default.
+      #
+      def api_version_for(method)
+        versions = API_VERSIONS.fetch(method)
+        versions.include?(@api_version) ? @api_version : versions.first
+      end
+      private :api_version_for
+
       # Clean any previous error registered at the client.
       #
       def clean_error
@@ -395,14 +434,16 @@ module OneLogin
         prepare_token
 
         begin
+          version = api_version_for(:get_users)
           options = {
             model: OneLogin::Api::Models::User,
             headers: authorized_headers,
             max_results: @max_results,
-            params: params
+            params: params,
+            api_version: version
           }
 
-          return Cursor.new(self, url_for(GET_USERS_URL), options)
+          return Cursor.new(self, url_for(GET_USERS_URL, version: version), options)
 
         rescue Exception => e
           @error = '500'
@@ -431,7 +472,8 @@ module OneLogin
             return
           end
 
-          url = url_for(GET_USER_URL, user_id)
+          version = api_version_for(:get_user)
+          url = url_for(GET_USER_URL, user_id, version: version)
 
           response = self.class.get(
             url,
@@ -440,7 +482,9 @@ module OneLogin
 
           if response.code == 200
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::User.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::User.new(json_data['data'][0])
             end
           else
@@ -474,13 +518,15 @@ module OneLogin
             return
           end
 
+          version = api_version_for(:get_user_apps)
           options = {
             model: OneLogin::Api::Models::App,
             headers: authorized_headers,
-            max_results: @max_results
+            max_results: @max_results,
+            api_version: version
           }
 
-          return Cursor.new(self, url_for(GET_APPS_FOR_USER_URL, user_id), options)
+          return Cursor.new(self, url_for(GET_APPS_FOR_USER_URL, user_id, version: version), options)
 
         rescue Exception => e
           @error = '500'
@@ -588,7 +634,8 @@ module OneLogin
         prepare_token
 
         begin
-          url = url_for(CREATE_USER_URL)
+          version = api_version_for(:create_user)
+          url = url_for(CREATE_USER_URL, version: version)
 
           response = self.class.post(
             url,
@@ -596,9 +643,12 @@ module OneLogin
             body: user_params.to_json
           )
 
-          if response.code == 200
+          # v1 answers a create with 200, v2 with 201 Created.
+          if response.code == (version == 2 ? 201 : 200)
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::User.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::User.new(json_data['data'][0])
             end
           else
@@ -639,7 +689,8 @@ module OneLogin
             return
           end
 
-          url = url_for(UPDATE_USER_URL, user_id)
+          version = api_version_for(:update_user)
+          url = url_for(UPDATE_USER_URL, user_id, version: version)
 
           response = self.class.put(
             url,
@@ -649,7 +700,9 @@ module OneLogin
 
           if response.code == 200
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::User.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::User.new(json_data['data'][0])
             end
           else
@@ -1069,14 +1122,18 @@ module OneLogin
             return
           end
 
-          url = url_for(DELETE_USER_URL, user_id)
+          version = api_version_for(:delete_user)
+          url = url_for(DELETE_USER_URL, user_id, version: version)
 
           response = self.class.delete(
             url,
             headers: authorized_headers
           )
 
-          if response.code == 200
+          # v2 confirms a delete with an empty 204 rather than a status body.
+          if version == 2 && response.code == 204
+            return true
+          elsif version == 1 && response.code == 200
             return handle_operation_response(response)
           else
             @error = response.code.to_s
@@ -1621,14 +1678,16 @@ module OneLogin
         prepare_token
 
         begin
+          version = api_version_for(:get_roles)
           options = {
             model: OneLogin::Api::Models::Role,
             headers: authorized_headers,
             max_results: @max_results,
-            params: params
+            params: params,
+            api_version: version
           }
 
-          return Cursor.new(self, url_for(GET_ROLES_URL), options)
+          return Cursor.new(self, url_for(GET_ROLES_URL, version: version), options)
 
         rescue Exception => e
           @error = '500'
@@ -1657,7 +1716,8 @@ module OneLogin
             return
           end
 
-          url = url_for(GET_ROLE_URL, role_id)
+          version = api_version_for(:get_role)
+          url = url_for(GET_ROLE_URL, role_id, version: version)
 
           response = self.class.get(
             url,
@@ -1666,7 +1726,9 @@ module OneLogin
 
           if response.code == 200
             json_data = JSON.parse(response.body)
-            if json_data && json_data['data']
+            if version == 2
+              return OneLogin::Api::Models::Role.new(json_data) if json_data.is_a?(Hash)
+            elsif json_data && json_data['data']
               return OneLogin::Api::Models::Role.new(json_data['data'][0])
             end
           else

data/lib/onelogin/api/cursor.rb

@@ -25,6 +25,7 @@ class Cursor
     @params = options[:params] || {}
     @max_results = options[:max_results]
     @container = options[:container] || 'data'
+    @api_version = options[:api_version]
 
     @collection = []
     @after_cursor = options.fetch(:after_cursor, nil)
@@ -53,12 +54,14 @@ class Cursor
   private
 
   def fetch_next_page
+    return fetch_next_v2_page if @api_version == 2
+
     @params = @params.merge(after_cursor: @after_cursor) if @after_cursor
     @client.prepare_token
 
     response = @client.class.get(
       @url,
-      headers: @headers,
+      headers: request_headers,
       query: @params
     )
 
@@ -91,6 +94,43 @@ class Cursor
     end
   end
 
+  # v2 returns a bare array and puts the next page's cursor in the After-Cursor
+  # header, which is absent on the last page. The cursor already encodes the
+  # filters and page size, and the API rejects a cursor sent alongside limit or
+  # page, so follow-up requests send the cursor alone.
+  def fetch_next_v2_page
+    @client.prepare_token
+
+    response = @client.class.get(
+      @url,
+      headers: request_headers,
+      query: @after_cursor ? { cursor: @after_cursor } : @params
+    )
+
+    results = response.parsed_response
+
+    unless response.code == 200 && results.is_a?(Array)
+      message = results.is_a?(Hash) ? extract_error_message_from_response(response) : "Response could not be parsed"
+      raise OneLogin::Api::ApiException.new(message, response.code)
+    end
+
+    @collection += if results_remaining < results.size
+      results.slice(0, results_remaining)
+    else
+      results
+    end
+
+    @after_cursor = response.headers['after-cursor']
+    @last_cursor_empty = @after_cursor.nil? || @after_cursor.empty?
+  end
+
+  # The headers were built when the cursor was, and prepare_token may have
+  # refreshed the token since: a cursor enumerated later, or one whose pages
+  # outlive the token. Take the current token from the client.
+  def request_headers
+    @headers.merge(@client.authorized_headers)
+  end
+
   def after_cursor(json)
     value = nil
     if json.has_key?('pagination')

data/lib/onelogin/api/models/app.rb

@@ -6,15 +6,22 @@ module OneLogin
 
         attr_accessor :id, :name, :icon, :provisioned
         attr_accessor :extension, :login_id, :personal
+        attr_accessor :provisioning_enabled, :provisioning_state, :provisioning_status
 
+        # v2 renames icon to icon_url and replaces provisioned and personal with
+        # the provisioning_* fields. Its login_id is the numeric id of the
+        # user's login, where v1 gives the username used to sign in.
         def initialize(data)
           @id = data['id']
           @name = data['name']
-          @icon = data['icon']
+          @icon = data['icon'] || data['icon_url']
           @provisioned = data['provisioned']
           @extension = data['extension']
           @login_id = data['login_id']
           @personal = data['personal']
+          @provisioning_enabled = data['provisioning_enabled']
+          @provisioning_state = data['provisioning_state']
+          @provisioning_status = data['provisioning_status']
         end
       end
     end

data/lib/onelogin/api/models/user.rb

@@ -28,7 +28,8 @@ module OneLogin
           @samaccountname = data['samaccountname'].to_s
           @userprincipalname = data['userprincipalname'].to_s
           @group_id = data['group_id']? data['group_id'].to_i : nil
-          @role_ids = data['role_id']? data['role_id'] : []
+          # v1 calls it role_id, v2 role_ids.
+          @role_ids = data['role_id'] || data['role_ids'] || []
           @custom_attributes = data['custom_attributes'] ? data['custom_attributes'] : []
           @openid_name = data['openid_name'].to_s
           @locale_code = data['locale_code'].to_s

data/lib/onelogin/api/util/constants.rb

@@ -98,6 +98,24 @@ module OneLogin
         GET_USERS_ASSIGNED_TO_PRIVILEGE_URL = "https://api.%s.onelogin.com/api/1/privileges/%s/users"
         ASSIGN_USERS_TO_PRIVILEGE_URL = "https://api.%s.onelogin.com/api/1/privileges/%s/users"
         REMOVE_USER_FROM_PRIVILEGE_URL = "https://api.%s.onelogin.com/api/1/privileges/%s/users/%s"
+
+        # API versions each client method can call, keyed by method name.
+        #
+        # The first version is the default and matches the version in the
+        # method's URL constant. A method that isn't listed only calls the
+        # version in its URL constant. List a version here only once the method
+        # can parse that version's response: v1 and v2 use different envelopes.
+        API_VERSIONS = {
+          get_users: [1, 2],
+          get_user: [1, 2],
+          get_user_apps: [1, 2],
+          create_user: [1, 2],
+          update_user: [1, 2],
+          delete_user: [1, 2],
+          get_roles: [1, 2],
+          get_role: [1, 2]
+        }.transform_values(&:freeze).freeze
+
         VALID_ACTIONS = [
           "apps:List",
           "apps:Get",

data/lib/onelogin/api/util/parser.rb

@@ -6,7 +6,9 @@ module OneLogin
           message = ''
           content = JSON.parse(response.body)
           if content
-            if content.has_key?('status')
+            # v1 nests the error under a status object. Some v2 endpoints send
+            # status as the bare HTTP code, with the text in description.
+            if content['status'].is_a?(Hash)
               status = content['status']
               if status.has_key?('message')
                 if status['message'].instance_of?(Hash)
@@ -21,6 +23,8 @@ module OneLogin
               end
             elsif content.has_key?('message')
               message = content['message']
+            elsif content.has_key?('description')
+              message = content['description']
             elsif content.has_key?('name')
               message = content['name']
             end
@@ -31,7 +35,7 @@ module OneLogin
         def extract_error_attribute_from_response(response)
           attribute = nil
           content = JSON.parse(response.body)
-          if content && content.has_key?('status')
+          if content && content['status'].is_a?(Hash)
             status = content['status']
             if status.has_key?('message') && status['message'].instance_of?(Hash)
               if status['message'].has_key?('attribute')

data/lib/onelogin/api/util/url_builder.rb

@@ -3,13 +3,20 @@ module OneLogin
     module Util
       module UrlBuilder
 
+        # The version segment of a versioned endpoint, e.g. "/api/1/"
+        API_VERSION_SEGMENT = %r{/api/\d+/}
+
         # Build the URL of the API endpoint
         #
         # @param base [String] Base of the endpoint
         # @param obj_id [String, nil] Id of the referenced object
         # @param extra_id [String, nil] Id of the secundary referenced object
+        # @param version [Integer, nil] API version to call. Defaults to the
+        #   version already in the base.
         #
-        def url_for(base, obj_id=nil, extra_id=nil)
+        def url_for(base, obj_id=nil, extra_id=nil, version: nil)
+          base = with_api_version(base, version) unless version.nil?
+
           if obj_id.nil? || obj_id.to_s.empty?
             base % [@region]
           elsif extra_id.nil? || extra_id.to_s.empty?
@@ -18,6 +25,23 @@ module OneLogin
             base % [@region, obj_id, extra_id]
           end
         end
+
+        private
+
+        # Swap the version segment of an endpoint, so the URL constants keep
+        # their current values and stay the default.
+        #
+        # Raises rather than calling a version nobody asked for. The client
+        # still rescues this into error '500', but error_description then names
+        # the endpoint.
+        #
+        def with_api_version(base, version)
+          unless base.scan(API_VERSION_SEGMENT).size == 1
+            raise ArgumentError, "#{base} has no single API version segment to replace"
+          end
+
+          base.sub(API_VERSION_SEGMENT, "/api/#{version}/")
+        end
       end
     end
   end

data/lib/onelogin/version.rb

@@ -1,3 +1,3 @@
 module OneLogin
-  VERSION = "1.8.0"
+  VERSION = "1.9.0"
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: onelogin
 version: !ruby/object:Gem::Version
-  version: 1.8.0
+  version: 1.9.0
 platform: ruby
 authors:
 - OneLogin
-autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-04 00:00:00.000000000 Z
+date: 2026-10-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: httparty
@@ -167,7 +166,6 @@ licenses:
 - MIT
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -182,8 +180,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.33
-signing_key:
+rubygems_version: 3.6.2
 specification_version: 4
 summary: OneLogin's Ruby SDK.
 test_files: []