whop_sdk 0.0.37 → 0.0.39

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8465f5ce3b0ffbb280bc7f25f778a6500a7534d05aab113245b2778ecdacb995
-  data.tar.gz: badc992950cbd83b175a35381af4e2818d4717e868e85606347d31456392502c
+  metadata.gz: 0d7509c8207433b48cc7855f1b113a5d61a9d435de8cd0007bc849a42791dec4
+  data.tar.gz: 3553946316f1e57d6a6e6b1a0cd33dd67098b2c8e5161002e0f194756d5c16fe
 SHA512:
-  metadata.gz: 462b1ddf6796bed0127bceb52fb663fb80a192add71f329d0ec4af4a64a5560a97e595c27958030e338405c4e5ba286b2151d7b2c278cca168f3620f282731dc
-  data.tar.gz: 7f3e8318bd93c9ffd0d4ff36860b6ae80075a100936e55e01d48b3750dfbffed48f0f36d18599eae0bb9c0ace339cff2320e711f95d6e9d53ac04442534033a1
+  metadata.gz: acf6bcf13b6391ead5b5a24009508ae0c39422ea56635a472d900767e6c9df7d30c0ce6880de442461974c94d5d791030fd1f899679b851b83d7e11b1cfa9904
+  data.tar.gz: f4f7d52cf615dae4d4566d4e9efa4b02abfcb52a97044bdc189833b3a778951aa956ca39eb994765ae28877741160a580a95c7e3f9927a9313996e57c8e9d439

data/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.0.39 (2026-05-12)
+
+Full Changelog: [v0.0.38...v0.0.39](https://github.com/whopio/whopsdk-ruby/compare/v0.0.38...v0.0.39)
+
+### Features
+
+* **api:** api update ([41f1c48](https://github.com/whopio/whopsdk-ruby/commit/41f1c489c4c3939c5ead8959796206b3f646be0a))
+* **api:** api update ([0a030fb](https://github.com/whopio/whopsdk-ruby/commit/0a030fbcfb624ddae25835b9f4ce9b22914ce965))
+* **api:** api update ([6dee63d](https://github.com/whopio/whopsdk-ruby/commit/6dee63d737eade9121eaa08cc9ba903ff0f0c12e))
+* **api:** api update ([a86b37e](https://github.com/whopio/whopsdk-ruby/commit/a86b37e20f9802ffc244826e26b85e88da193ca7))
+* **api:** api update ([4c48f94](https://github.com/whopio/whopsdk-ruby/commit/4c48f94afcfecede20ff4f68bcab257a52907d05))
+* **api:** api update ([8c8346f](https://github.com/whopio/whopsdk-ruby/commit/8c8346fb790c3e00f6989a2ccfea03bba38e405e))
+* **api:** api update ([cc9da37](https://github.com/whopio/whopsdk-ruby/commit/cc9da3700393b67a2b2a039aafeeba23159f1b2b))
+* **api:** api update ([9a51f78](https://github.com/whopio/whopsdk-ruby/commit/9a51f786894aac2d495c1602cd823292862d094f))
+* **api:** api update ([642732f](https://github.com/whopio/whopsdk-ruby/commit/642732f64a708d22a4bb8f1bfc8a7133e05a1f08))
+* **api:** api update ([e53cc0d](https://github.com/whopio/whopsdk-ruby/commit/e53cc0dc256c0ab781725fef547dad3716eabad5))
+* **api:** api update ([b4aa0af](https://github.com/whopio/whopsdk-ruby/commit/b4aa0af8ac8f678ee722fe23d9c4c2df35426316))
+* **api:** api update ([e923086](https://github.com/whopio/whopsdk-ruby/commit/e9230869b6d1eec823473fb67309ab2ad302ba7b))
+* **api:** api update ([1391fb1](https://github.com/whopio/whopsdk-ruby/commit/1391fb13a1063b8ac483a69795533b7e6bec89f1))
+* **api:** api update ([bca6667](https://github.com/whopio/whopsdk-ruby/commit/bca6667862f9dee69950b47c065787c26236aadb))
+* **api:** api update ([4129022](https://github.com/whopio/whopsdk-ruby/commit/4129022fceee5287f11a5e3858863433effc7ab1))
+* **api:** api update ([b687cb9](https://github.com/whopio/whopsdk-ruby/commit/b687cb9249eb826e3a4d933b292f12ce02d94af0))
+* **api:** api update ([79aae44](https://github.com/whopio/whopsdk-ruby/commit/79aae4416d123e1afa7e27d95749e1fd23ae055f))
+* **api:** api update ([c30e8d4](https://github.com/whopio/whopsdk-ruby/commit/c30e8d4b93c2ea4ece5241af0d122ca30c59bac3))
+* **api:** api update ([327691b](https://github.com/whopio/whopsdk-ruby/commit/327691b54ccbeb7d10a046b4a3938b126aa49500))
+* **api:** api update ([35ba170](https://github.com/whopio/whopsdk-ruby/commit/35ba170f38fabb58908842c2ba39a6a9044812e9))
+* **api:** api update ([7e8b054](https://github.com/whopio/whopsdk-ruby/commit/7e8b054992f97166ef28c10c116a7024c4af6eec))
+* **api:** api update ([d8e52f4](https://github.com/whopio/whopsdk-ruby/commit/d8e52f48055361f0857513f0caac229959506c23))
+* **api:** api update ([f095b42](https://github.com/whopio/whopsdk-ruby/commit/f095b4234574686ed157acf45f3627209ca548f7))
+* **api:** manual updates ([caecf6f](https://github.com/whopio/whopsdk-ruby/commit/caecf6fa4278cf509f247297ab3a0ad5be835a04))
+* **api:** manual updates ([2dbd70c](https://github.com/whopio/whopsdk-ruby/commit/2dbd70cee7fee0252936e15bb8547a4fa0d27501))
+* **api:** manual updates ([02c0e75](https://github.com/whopio/whopsdk-ruby/commit/02c0e7583a78fbc3416f915bd5d80d0a97056323))
+* **api:** manual updates ([9f433de](https://github.com/whopio/whopsdk-ruby/commit/9f433defa7e1a3f56316deff2862a89be69e6c27))
+* **api:** manual updates ([b399216](https://github.com/whopio/whopsdk-ruby/commit/b399216595e3e85b7ec64802017dee810fc268c3))
+* support setting headers via env ([41a50f8](https://github.com/whopio/whopsdk-ruby/commit/41a50f8e339ce87259211c13b135b081ad1141f9))
+
+
+### Chores
+
+* **internal:** codegen related update ([747437e](https://github.com/whopio/whopsdk-ruby/commit/747437e579049c007cc35ddebc1866268b9e9b38))
+* **internal:** more robust bootstrap script ([19ee1dc](https://github.com/whopio/whopsdk-ruby/commit/19ee1dc702fc3a96d2c0c33b25f1dfc9d57eb5cc))
+
+## 0.0.38 (2026-04-21)
+
+Full Changelog: [v0.0.37...v0.0.38](https://github.com/whopio/whopsdk-ruby/compare/v0.0.37...v0.0.38)
+
+### Features
+
+* **api:** api update ([fa1a45f](https://github.com/whopio/whopsdk-ruby/commit/fa1a45f492c238b6ff849440c3c910bc4ea72754))
+* **api:** api update ([f9181a4](https://github.com/whopio/whopsdk-ruby/commit/f9181a4a772ce4828d8332928508109089656648))
+* **api:** api update ([a8e3560](https://github.com/whopio/whopsdk-ruby/commit/a8e35601fcf0ee79bcc2333e5c323682471f3b91))
+* **api:** api update ([516c14b](https://github.com/whopio/whopsdk-ruby/commit/516c14bc5edc25bf46049ea42ae1968f9bf0d782))
+* **api:** api update ([a58e4b0](https://github.com/whopio/whopsdk-ruby/commit/a58e4b0fb68546c017cfa027a6645b906c0acca6))
+* **api:** api update ([2ae4543](https://github.com/whopio/whopsdk-ruby/commit/2ae45431715186177b61e5089136242652cf54a1))
+* **api:** manual updates ([943f900](https://github.com/whopio/whopsdk-ruby/commit/943f9009a1a288e0ac8a139fb090c1dcd7a6440e))
+
+
+### Bug Fixes
+
+* **helpers:** verify_user_token uses remote JWKS with module-level caching ([#44](https://github.com/whopio/whopsdk-ruby/issues/44)) ([107a289](https://github.com/whopio/whopsdk-ruby/commit/107a2898be09866f50e59f402ed08748662c4185))
+
 ## 0.0.37 (2026-04-10)
 
 Full Changelog: [v0.0.36...v0.0.37](https://github.com/whopio/whopsdk-ruby/compare/v0.0.36...v0.0.37)

data/README.md

@@ -26,7 +26,7 @@ To use this gem, install via Bundler by adding the following to your application
 <!-- x-release-please-start-version -->
 
 ```ruby
-gem "whop_sdk", "~> 0.0.37"
+gem "whop_sdk", "~> 0.0.39"
 ```
 
 <!-- x-release-please-end -->

data/lib/whop_sdk/client.rb

@@ -29,6 +29,18 @@ module WhopSDK
     # @return [String, nil]
     attr_reader :app_id
 
+    # Static public key (PEM or JWK JSON) used by {#verify_user_token} to
+    # verify user tokens. When set, the SDK skips remote JWKS fetching.
+    # Prefer {#user_token_jwks_url} (or the default) so key rotation is
+    # handled automatically.
+    # @return [String, nil]
+    attr_reader :user_token_public_key
+
+    # Override for the JWKS endpoint used by {#verify_user_token}. Defaults
+    # to the canonical Whop endpoint when unset.
+    # @return [String, nil]
+    attr_reader :user_token_jwks_url
+
     # Apps
     # @return [WhopSDK::Resources::Apps]
     attr_reader :apps
@@ -241,6 +253,30 @@ module WhopSDK
     # @return [WhopSDK::Resources::Affiliates]
     attr_reader :affiliates
 
+    # Bounties
+    # @return [WhopSDK::Resources::Bounties]
+    attr_reader :bounties
+
+    # Ad campaigns
+    # @return [WhopSDK::Resources::AdCampaigns]
+    attr_reader :ad_campaigns
+
+    # Ad groups
+    # @return [WhopSDK::Resources::AdGroups]
+    attr_reader :ad_groups
+
+    # Ads
+    # @return [WhopSDK::Resources::Ads]
+    attr_reader :ads
+
+    # Conversions
+    # @return [WhopSDK::Resources::Conversions]
+    attr_reader :conversions
+
+    # Ad reports
+    # @return [WhopSDK::Resources::AdReports]
+    attr_reader :ad_reports
+
     # @api private
     #
     # @return [Hash{String=>String}]
@@ -261,6 +297,13 @@ module WhopSDK
     # @param app_id [String, nil] When using the SDK in app mode pass this parameter to allow verifying user
     # tokens Defaults to `ENV["WHOP_APP_ID"]`
     #
+    # @param user_token_public_key [String, nil] Static public key (PEM or JWK JSON) used to verify
+    # user tokens. When set, {#verify_user_token} skips remote JWKS fetching.
+    # Defaults to `ENV["WHOP_USER_TOKEN_PUBLIC_KEY"]`
+    #
+    # @param user_token_jwks_url [String, nil] Override the JWKS URL used by {#verify_user_token}.
+    # Defaults to `ENV["WHOP_USER_TOKEN_JWKS_URL"]`, then to the canonical Whop endpoint.
+    #
     # @param base_url [String, nil] Override the default base URL for the API, e.g.,
     # `"https://api.example.com/v2/"`. Defaults to `ENV["WHOP_BASE_URL"]`
     #
@@ -275,6 +318,8 @@ module WhopSDK
       api_key: ENV["WHOP_API_KEY"],
       webhook_key: ENV["WHOP_WEBHOOK_SECRET"],
       app_id: ENV["WHOP_APP_ID"],
+      user_token_public_key: ENV["WHOP_USER_TOKEN_PUBLIC_KEY"],
+      user_token_jwks_url: ENV["WHOP_USER_TOKEN_JWKS_URL"],
       base_url: ENV["WHOP_BASE_URL"],
       max_retries: self.class::DEFAULT_MAX_RETRIES,
       timeout: self.class::DEFAULT_TIMEOUT_IN_SECONDS,
@@ -290,9 +335,22 @@ module WhopSDK
       headers = {
         "x-whop-app-id" => (@app_id = app_id&.to_s)
       }
+      custom_headers_env = ENV["WHOP_CUSTOM_HEADERS"]
+      unless custom_headers_env.nil?
+        parsed = {}
+        custom_headers_env.split("\n").each do |line|
+          colon = line.index(":")
+          unless colon.nil?
+            parsed[line[0...colon].strip] = line[(colon + 1)..].strip
+          end
+        end
+        headers = parsed.merge(headers)
+      end
 
       @api_key = api_key.to_s
       @webhook_key = webhook_key&.to_s
+      @user_token_public_key = user_token_public_key&.to_s
+      @user_token_jwks_url = user_token_jwks_url&.to_s
 
       super(
         base_url: base_url,
@@ -356,31 +414,39 @@ module WhopSDK
       @resolution_center_cases = WhopSDK::Resources::ResolutionCenterCases.new(client: self)
       @payout_accounts = WhopSDK::Resources::PayoutAccounts.new(client: self)
       @affiliates = WhopSDK::Resources::Affiliates.new(client: self)
+      @bounties = WhopSDK::Resources::Bounties.new(client: self)
+      @ad_campaigns = WhopSDK::Resources::AdCampaigns.new(client: self)
+      @ad_groups = WhopSDK::Resources::AdGroups.new(client: self)
+      @ads = WhopSDK::Resources::Ads.new(client: self)
+      @conversions = WhopSDK::Resources::Conversions.new(client: self)
+      @ad_reports = WhopSDK::Resources::AdReports.new(client: self)
     end
 
-    # Verifies a Whop user token
+    # Verifies a Whop user token.
     #
     # @param token_or_headers [String, Hash, nil] The token string or headers hash
     # @param app_id [String, nil] The app id to verify against
-    # @param public_key [String, nil] Optional custom public key (PEM format)
-    # @param header_name [String, nil] The header name to use (defaults to x-whop-user-token)
-    # @return [UserTokenPayload] The verified token payload
+    # @param public_key [String, nil] Static public key (PEM or JWK JSON). When set, the
+    #   SDK skips remote JWKS fetching. Defaults to the client's `user_token_public_key`.
+    # @param jwks_url [String, nil] Override the JWKS URL. Defaults to the client's
+    #   `user_token_jwks_url`, then to the canonical Whop endpoint.
+    # @param header_name [String, nil] The header name to read the token from
+    # @return [Helpers::VerifyUserToken::UserTokenPayload]
     # @raise [StandardError] If verification fails
     def verify_user_token!(token_or_headers, **opts)
       opts[:app_id] ||= app_id
+      opts[:public_key] = user_token_public_key if opts[:public_key].nil? && user_token_public_key && !user_token_public_key.empty?
+      opts[:jwks_url] = user_token_jwks_url if opts[:jwks_url].nil? && user_token_jwks_url && !user_token_jwks_url.empty?
       unless opts[:app_id]
         raise StandardError, "You must set app_id in the Whop client if you want to verify user tokens"
       end
       Helpers::VerifyUserToken.verify_user_token!(token_or_headers, **opts)
     end
 
-    # Verifies a Whop user token
+    # Verifies a Whop user token. Same signature as {#verify_user_token!}
+    # but returns `nil` on any validation failure instead of raising.
     #
-    # @param token_or_headers [String, Hash, nil] The token string or headers hash
-    # @param app_id [String, nil] The app id to verify against
-    # @param public_key [String, nil] Optional custom public key (PEM format)
-    # @param header_name [String, nil] The header name to use (defaults to x-whop-user-token)
-    # @return [UserTokenPayload, nil] The verified token payload or nil if the verification failed
+    # @return [Helpers::VerifyUserToken::UserTokenPayload, nil]
     def verify_user_token(token_or_headers, **opts)
       verify_user_token!(token_or_headers, **opts)
     rescue StandardError

data/lib/whop_sdk/helpers/verify_user_token.rb

@@ -1,18 +1,29 @@
 # frozen_string_literal: true
 
 require "jwt"
+require "json"
+require "net/http"
 require "openssl"
+require "uri"
 
 module WhopSDK
   module Helpers
+    # Verifies Whop-issued x-whop-user-token JWTs. By default, fetches the
+    # public signing keys from Whop's canonical JWKS endpoint and caches
+    # them at module scope (TTL-bounded with a cooldown on refetch). The
+    # behavior mirrors the TypeScript SDK's `createRemoteJWKSet` path so
+    # that upgrading to a key rotation doesn't require a gem release.
     module VerifyUserToken
       USER_TOKEN_HEADER_NAME = "x-whop-user-token"
-      USER_TOKEN_VERIFICATION_KEY = <<~PEM
-        -----BEGIN PUBLIC KEY-----
-        MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAErz8a8vxvexHC0TLT91g7llOdDOsN
-        uYiGEfic4Qhni+HMfRBuUphOh7F3k8QgwZc9UlL0AHmyYqtbhL9NuJes6w==
-        -----END PUBLIC KEY-----
-      PEM
+      DEFAULT_JWKS_URL = "https://api.whop.com/.well-known/jwks.json"
+      TOKEN_ISSUER = "urn:whopcom:exp-proxy"
+      TOKEN_ALGORITHM = "ES256"
+
+      # 12h freshness window before a proactive refresh; 30s cooldown
+      # between refetches when a kid lookup misses. Matches the TS SDK
+      # (`cacheMaxAge: 12 * 60 * 60 * 1000, cooldownDuration: 30_000`).
+      JWKS_CACHE_MAX_AGE_SECONDS = 12 * 60 * 60
+      JWKS_COOLDOWN_SECONDS = 30
 
       # User token payload structure
       class UserTokenPayload
@@ -28,11 +39,84 @@ module WhopSDK
         end
       end
 
-      # Extracts the user token from various input types
+      # Thread-safe, TTL-bounded remote JWKS cache with cooldown-gated
+      # refresh on kid miss.
+      class RemoteJwks
+        def initialize(url, cache_max_age_seconds:, cooldown_seconds:)
+          @url = url
+          @cache_max_age_seconds = cache_max_age_seconds
+          @cooldown_seconds = cooldown_seconds
+          @mutex = Mutex.new
+          @jwk_set = nil
+          @fetched_at = nil
+          @last_refresh_attempt_at = nil
+        end
+
+        # Returns the current JWK::Set, fetching or refreshing as needed.
+        # When `force_refresh` is true, bypass the freshness window but
+        # still honor the refetch cooldown.
+        def jwk_set(force_refresh: false)
+          @mutex.synchronize do
+            now = monotonic_now
+            cache_stale = @jwk_set.nil? || @fetched_at.nil? ||
+                          (now - @fetched_at) > @cache_max_age_seconds
+            cooldown_elapsed = @last_refresh_attempt_at.nil? ||
+                               (now - @last_refresh_attempt_at) > @cooldown_seconds
+
+            refresh_now = @jwk_set.nil? || cache_stale ||
+                          (force_refresh && cooldown_elapsed)
+
+            fetch! if refresh_now
+            @jwk_set
+          end
+        end
+
+        private
+
+        def fetch!
+          @last_refresh_attempt_at = monotonic_now
+          response = Net::HTTP.get_response(URI(@url))
+
+          unless response.is_a?(Net::HTTPSuccess)
+            raise StandardError, "Failed to fetch JWKS from #{@url} (HTTP #{response.code})"
+          end
+
+          parsed = JSON.parse(response.body)
+          @jwk_set = JWT::JWK::Set.new(parsed)
+          @fetched_at = monotonic_now
+        end
+
+        def monotonic_now
+          Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        end
+      end
+
+      # Module-level cache keyed by JWKS URL. One RemoteJwks instance per
+      # distinct URL survives for the process lifetime.
+      @jwks_cache = {}
+      @jwks_cache_mutex = Mutex.new
+
+      # @api private
+      def self.remote_jwks_for(url)
+        @jwks_cache_mutex.synchronize do
+          @jwks_cache[url] ||= RemoteJwks.new(
+            url,
+            cache_max_age_seconds: JWKS_CACHE_MAX_AGE_SECONDS,
+            cooldown_seconds: JWKS_COOLDOWN_SECONDS
+          )
+        end
+      end
+
+      # @api private — test-only hook to clear the module-level cache.
+      def self.reset_jwks_cache!
+        @jwks_cache_mutex.synchronize { @jwks_cache.clear }
+      end
+
+      # Extracts the user token from various input types.
       #
-      # @param token_or_headers [String, Hash, nil] The token string or headers hash
-      # @param header_name [String, nil] The header name to use (defaults to x-whop-user-token)
-      # @return [String, nil] The extracted token or nil
+      # @param token_or_headers [String, Hash, nil] token string or headers hash
+      # @param header_name [String, nil] header name (defaults to x-whop-user-token)
+      # @return [String, nil]
       def self.get_user_token(token_or_headers, header_name: nil)
         header_name ||= USER_TOKEN_HEADER_NAME
 
@@ -46,18 +130,27 @@ module WhopSDK
         end
       end
 
-      # Verifies a Whop user token
+      # Verifies a Whop user token.
       #
-      # @param token_or_headers [String, Hash, nil] The token string or headers hash
-      # @param app_id [String, nil] The app id to verify against
-      # @param public_key [String, nil] Optional custom public key (PEM format)
-      # @param header_name [String, nil] The header name to use (defaults to x-whop-user-token)
-      # @return [UserTokenPayload] The verified token payload
-      # @raise [StandardError] If verification fails
+      # By default fetches the public signing keys from `jwks_url` (or the
+      # canonical Whop endpoint) and caches them at module scope. Pass
+      # `public_key` to verify against a static key instead — useful for
+      # self-hosted / test setups where you know the exact key.
+      #
+      # @param token_or_headers [String, Hash, nil]
+      # @param app_id [String, nil] Required; when set, the aud claim must match.
+      # @param public_key [String, nil] PEM-encoded EC public key or JWK JSON.
+      #   When set, skips remote JWKS fetching entirely.
+      # @param jwks_url [String, nil] Override the JWKS endpoint URL. Defaults
+      #   to {DEFAULT_JWKS_URL}.
+      # @param header_name [String, nil] Header to read the token from.
+      # @return [UserTokenPayload]
+      # @raise [StandardError] on validation failure.
       def self.verify_user_token!(
         token_or_headers,
         app_id: nil,
         public_key: nil,
+        jwks_url: nil,
         header_name: nil
       )
         token_string = get_user_token(token_or_headers, header_name: header_name)
@@ -69,33 +162,72 @@ module WhopSDK
           ERROR
         end
 
-        pem_string = public_key || USER_TOKEN_VERIFICATION_KEY
-        key = OpenSSL::PKey::EC.new(pem_string)
-
-        # Verify the JWT
-        payload, _header = JWT.decode(
-          token_string,
-          key,
-          true,
-          algorithm: "ES256",
-          iss: "urn:whopcom:exp-proxy",
-          verify_iss: true
-        )
+        payload = if public_key
+          verify_with_static_key(token_string, public_key: public_key)
+        else
+          verify_with_remote_jwks(token_string, jwks_url: jwks_url || DEFAULT_JWKS_URL)
+        end
 
-        # Validate required fields
         unless payload["sub"] && payload["aud"] && !payload["aud"].is_a?(Array)
           raise StandardError, "Invalid user token provided to verifyUserToken"
         end
 
-        # Validate app_id if provided
         if app_id && payload["aud"] != app_id
           raise StandardError, "Invalid app id provided to verifyUserToken"
         end
 
-        UserTokenPayload.new(
-          user_id: payload["sub"],
-          app_id: payload["aud"]
+        UserTokenPayload.new(user_id: payload["sub"], app_id: payload["aud"])
+      end
+
+      # @api private
+      def self.verify_with_static_key(token_string, public_key:)
+        key = import_static_key(public_key)
+        decoded_payload, = JWT.decode(
+          token_string,
+          key,
+          true,
+          algorithm: TOKEN_ALGORITHM,
+          iss: TOKEN_ISSUER,
+          verify_iss: true
+        )
+        decoded_payload
+      end
+
+      # @api private
+      def self.verify_with_remote_jwks(token_string, jwks_url:)
+        remote = remote_jwks_for(jwks_url)
+
+        # ruby-jwt calls the loader twice when the token's kid isn't found
+        # in the current set — once normally, then again with
+        # invalidate: true. The loader uses that signal to force a
+        # cooldown-guarded refresh, mirroring jose's remote JWKS behavior.
+        jwks_loader = ->(opts) { remote.jwk_set(force_refresh: opts[:invalidate]) }
+
+        decoded_payload, = JWT.decode(
+          token_string,
+          nil,
+          true,
+          algorithms: [TOKEN_ALGORITHM],
+          iss: TOKEN_ISSUER,
+          verify_iss: true,
+          jwks: jwks_loader,
+          # Legacy tokens (pre-kid rollout) have no kid header. Let
+          # ruby-jwt fall back to the first key in the set for those.
+          allow_nil_kid: true
         )
+        decoded_payload
+      end
+
+      # @api private
+      def self.import_static_key(public_key)
+        stripped = public_key.to_s.strip
+        if stripped.start_with?("-----BEGIN")
+          OpenSSL::PKey::EC.new(stripped)
+        else
+          JWT::JWK.new(JSON.parse(stripped)).verify_key
+        end
+      rescue JSON::ParserError, OpenSSL::PKey::ECError => e
+        raise StandardError, "Invalid public key provided to verifyUserToken: #{e.message}"
       end
     end
   end

data/lib/whop_sdk/models/ad_campaign_list_params.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module WhopSDK
+  module Models
+    # @see WhopSDK::Resources::AdCampaigns#list
+    class AdCampaignListParams < WhopSDK::Internal::Type::BaseModel
+      extend WhopSDK::Internal::Type::RequestParameters::Converter
+      include WhopSDK::Internal::Type::RequestParameters
+
+      # @!attribute company_id
+      #   The unique identifier of the company to list ad campaigns for.
+      #
+      #   @return [String]
+      required :company_id, String
+
+      # @!attribute after
+      #   Returns the elements in the list that come after the specified cursor.
+      #
+      #   @return [String, nil]
+      optional :after, String, nil?: true
+
+      # @!attribute before
+      #   Returns the elements in the list that come before the specified cursor.
+      #
+      #   @return [String, nil]
+      optional :before, String, nil?: true
+
+      # @!attribute created_after
+      #   Only return ad campaigns created after this timestamp.
+      #
+      #   @return [Time, nil]
+      optional :created_after, Time, nil?: true
+
+      # @!attribute created_before
+      #   Only return ad campaigns created before this timestamp.
+      #
+      #   @return [Time, nil]
+      optional :created_before, Time, nil?: true
+
+      # @!attribute first
+      #   Returns the first _n_ elements from the list.
+      #
+      #   @return [Integer, nil]
+      optional :first, Integer, nil?: true
+
+      # @!attribute last
+      #   Returns the last _n_ elements from the list.
+      #
+      #   @return [Integer, nil]
+      optional :last, Integer, nil?: true
+
+      # @!attribute query
+      #   Case-insensitive substring match against the campaign title.
+      #
+      #   @return [String, nil]
+      optional :query, String, nil?: true
+
+      # @!attribute status
+      #   The status of an ad campaign.
+      #
+      #   @return [Symbol, WhopSDK::Models::AdCampaignListParams::Status, nil]
+      optional :status, enum: -> { WhopSDK::AdCampaignListParams::Status }, nil?: true
+
+      # @!method initialize(company_id:, after: nil, before: nil, created_after: nil, created_before: nil, first: nil, last: nil, query: nil, status: nil, request_options: {})
+      #   @param company_id [String] The unique identifier of the company to list ad campaigns for.
+      #
+      #   @param after [String, nil] Returns the elements in the list that come after the specified cursor.
+      #
+      #   @param before [String, nil] Returns the elements in the list that come before the specified cursor.
+      #
+      #   @param created_after [Time, nil] Only return ad campaigns created after this timestamp.
+      #
+      #   @param created_before [Time, nil] Only return ad campaigns created before this timestamp.
+      #
+      #   @param first [Integer, nil] Returns the first _n_ elements from the list.
+      #
+      #   @param last [Integer, nil] Returns the last _n_ elements from the list.
+      #
+      #   @param query [String, nil] Case-insensitive substring match against the campaign title.
+      #
+      #   @param status [Symbol, WhopSDK::Models::AdCampaignListParams::Status, nil] The status of an ad campaign.
+      #
+      #   @param request_options [WhopSDK::RequestOptions, Hash{Symbol=>Object}]
+
+      # The status of an ad campaign.
+      module Status
+        extend WhopSDK::Internal::Type::Enum
+
+        ACTIVE = :active
+        PAUSED = :paused
+        PAYMENT_FAILED = :payment_failed
+        DRAFT = :draft
+        IN_REVIEW = :in_review
+        FLAGGED = :flagged
+
+        # @!method self.values
+        #   @return [Array<Symbol>]
+      end
+    end
+  end
+end