workos 10.1.0 → 10.2.1

data/test/workos/test_base_client.rb

@@ -82,6 +82,24 @@ class BaseClientTest < Minitest::Test
     end
   end
 
+  # A pooled connection that either returns a canned response or raises when
+  # driven, so execute_request can be exercised without real TCP+TLS.
+  class StubConnection < FakeConnection
+    attr_accessor :read_timeout, :open_timeout
+
+    def initialize(response: nil, error: nil, **kwargs)
+      super(**kwargs)
+      @response = response
+      @error = error
+    end
+
+    def request(_request)
+      raise @error if @error
+
+      @response
+    end
+  end
+
   def setup
     @client = WorkOS::BaseClient.new(api_key: "sk_test_123", max_retries: 1)
   end
@@ -206,6 +224,143 @@ class BaseClientTest < Minitest::Test
     refute keep.finished
   end
 
+  # An exception execute_request's rescue clause doesn't list still leaves the
+  # socket mid-stream, so the connection must not survive in the pool for the
+  # next request on this thread to pick up.
+  def test_unlisted_request_error_evicts_the_pooled_connection
+    conn = StubConnection.new(error: Net::HTTPBadResponse.new("wrong version"))
+    cache = @client.send(:thread_connections)
+    cache["https:api.workos.com:443:30"] = conn
+
+    assert_raises(Net::HTTPBadResponse) do
+      @client.execute_request(request: Net::HTTP::Get.new("/things"))
+    end
+
+    refute cache.key?("https:api.workos.com:443:30"),
+      "a connection whose request did not complete must not stay pooled"
+    assert conn.finished
+  end
+
+  def test_completed_request_keeps_the_connection_pooled
+    conn = StubConnection.new(response: Net::HTTPOK.new("1.1", "200", "OK"))
+    cache = @client.send(:thread_connections)
+    cache["https:api.workos.com:443:30"] = conn
+
+    @client.execute_request(request: Net::HTTP::Get.new("/things"))
+
+    assert cache.key?("https:api.workos.com:443:30")
+    refute conn.finished
+  end
+
+  # Raised asynchronously into the worker thread to stand in for a caller-side
+  # abort: Timeout.timeout, Thread#kill, a signal handler unwinding the stack.
+  # It descends from Exception rather than StandardError so that nothing in
+  # execute_request can catch it — the `ensure` is the only cleanup that runs.
+  class AbortSignal < Exception; end # standard:disable Lint/InheritException
+
+  # End-to-end regression test over a real keep-alive socket, for the failure
+  # the eviction actually prevents: request one is abandoned mid-flight, the
+  # server then writes response one onto that socket, and request two on the
+  # same thread reads those stale bytes as if they were its own response.
+  #
+  # Before the fix, request two sees marker "one" (or a mangled response) off
+  # the pooled socket. After it, the abandoned socket is closed and the server
+  # accepts a fresh connection for request two.
+  def test_aborted_request_does_not_leak_its_response_to_the_next_request
+    WebMock.disable!
+    server = TCPServer.new("127.0.0.1", 0)
+    port = server.addr[1]
+    client = WorkOS::BaseClient.new(
+      api_key: "sk_test_123",
+      base_url: "http://127.0.0.1:#{port}",
+      timeout: 5,
+      max_retries: 0
+    )
+
+    request_one_read = Queue.new
+    release_response_one = Queue.new
+    response_one_written = Queue.new
+    aborted = Queue.new
+    connections = Queue.new
+
+    server_thread = Thread.new do
+      # Connection one: read the request, then hold the response back until
+      # the client has been aborted and has unwound.
+      first = server.accept
+      connections << first
+      read_http_request(first)
+      request_one_read << true
+      release_response_one.pop
+      begin
+        write_http_response(first, {marker: "one"})
+      rescue Errno::EPIPE, Errno::ECONNRESET, IOError
+        # Expected once the fix closes the abandoned socket.
+      end
+      response_one_written << true
+
+      # Connection two: a fresh accept, which only completes because the
+      # client did not reuse the socket above.
+      second = server.accept
+      connections << second
+      read_http_request(second)
+      write_http_response(second, {marker: "two"})
+    end
+
+    worker = Thread.new do
+      begin
+        client.execute_request(request: Net::HTTP::Get.new("/one"))
+      rescue AbortSignal
+        # The caller unwinds but the thread survives and goes on to serve more
+        # work, the way a Puma or Solid Queue worker does. execute_request's
+        # `ensure` has already run by the time this body executes.
+        aborted << true
+        response_one_written.pop
+      end
+      response = client.execute_request(request: Net::HTTP::Get.new("/two"))
+      JSON.parse(response.body)["marker"]
+    end
+
+    marker = Timeout.timeout(15) do
+      request_one_read.pop
+      worker.raise(AbortSignal)
+      aborted.pop
+      release_response_one << true
+      worker.value
+    end
+
+    assert_equal "two", marker,
+      "request two read the abandoned socket's response instead of its own"
+  ensure
+    server_thread&.kill
+    worker&.kill
+    until connections.nil? || connections.empty?
+      socket = connections.pop
+      socket.close unless socket.closed?
+    end
+    server&.close
+    WebMock.enable!
+  end
+
+  def read_http_request(socket)
+    socket.gets # request line
+    loop do
+      line = socket.gets
+      break if line.nil? || line == "\r\n"
+    end
+  end
+
+  def write_http_response(socket, body)
+    payload = JSON.generate(body)
+    socket.write(
+      "HTTP/1.1 200 OK\r\n" \
+      "Content-Type: application/json\r\n" \
+      "Content-Length: #{payload.bytesize}\r\n" \
+      "Connection: keep-alive\r\n" \
+      "\r\n#{payload}"
+    )
+    socket.flush
+  end
+
   # Regression test for https://github.com/workos/workos-ruby/issues/496
   #
   # The connection cache must be isolated per thread. A previous version

data/test/workos/test_events.rb

@@ -14,13 +14,13 @@ class EventsTest < Minitest::Test
   def test_list_events_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/events(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
-    result = @client.events.list_events
+    result = @client.events.list_events(events: ["stub"])
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
   # Parameterized authentication error tests (one per endpoint).
   [
-    {name: :list_events, verb: :get, url: %r{\Ahttps://api\.workos\.com/events(\?|\z)}}
+    {name: :list_events, verb: :get, url: %r{\Ahttps://api\.workos\.com/events(\?|\z)}, args: {events: ["stub"]}}
   ].each do |spec|
     define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
       stub_request(spec[:verb], spec[:url])

data/test/workos/test_pipes.rb

@@ -60,6 +60,13 @@ class PipesTest < Minitest::Test
     refute_nil result
   end
 
+  def test_update_data_integration_client_credentials_returns_expected_result
+    stub_request(:put, %r{\Ahttps://api\.workos\.com/data-integrations/stub/client-credentials(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.pipes.update_data_integration_client_credentials(slug: "stub", user_id: "stub", client_id: "stub", client_secret: "stub")
+    refute_nil result
+  end
+
   def test_create_data_integration_credential_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/data-integrations/stub/credentials(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -118,6 +125,7 @@ class PipesTest < Minitest::Test
     {name: :delete_data_integration, verb: :delete, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub(\?|\z)}, args: {slug: "stub"}},
     {name: :update_data_integration_api_key, verb: :put, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/api-key(\?|\z)}, args: {slug: "stub", user_id: "stub", secret: "stub"}},
     {name: :authorize_data_integration, verb: :post, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/authorize(\?|\z)}, args: {slug: "stub", user_id: "stub"}},
+    {name: :update_data_integration_client_credentials, verb: :put, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/client-credentials(\?|\z)}, args: {slug: "stub", user_id: "stub", client_id: "stub", client_secret: "stub"}},
     {name: :create_data_integration_credential, verb: :post, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/credentials(\?|\z)}, args: {slug: "stub", user_id: "stub"}},
     {name: :get_access_token, verb: :post, url: %r{\Ahttps://api\.workos\.com/data-integrations/stub/token(\?|\z)}, args: {provider: "stub", user_id: "stub"}},
     {name: :get_user_connected_account, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/connected_accounts/stub(\?|\z)}, args: {user_id: "stub", slug: "stub"}},

data/test/workos/test_pipes_model_round_trip.rb

@@ -49,8 +49,6 @@ class PipesModelRoundTripTest < Minitest::Test
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["name"], json[:name]
-    assert_equal fixture["authorization_url"], json[:authorization_url]
-    assert_equal fixture["token_url"], json[:token_url]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
@@ -134,7 +132,7 @@ class PipesModelRoundTripTest < Minitest::Test
       "scopes" => nil,
       "redirect_uri" => "stub",
       "auth_methods" => [],
-      "credentials" => {},
+      "credentials" => nil,
       "installation" => nil,
       "config" => {},
       "custom_provider" => nil,
@@ -199,6 +197,9 @@ class PipesModelRoundTripTest < Minitest::Test
       "scopes" => [],
       "auth_method" => "stub",
       "api_key_last_4" => nil,
+      "client_id" => nil,
+      "client_secret_last_4" => nil,
+      "config" => {},
       "state" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub"
@@ -376,6 +377,23 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_data_integrations_upsert_client_credentials_request_round_trip
+    fixture = {
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "client_id" => "stub",
+      "client_secret" => "stub",
+      "config" => {}
+    }
+    model = WorkOS::DataIntegrationsUpsertClientCredentialsRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_equal fixture["client_secret"], json[:client_secret]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integrations_vend_credentials_request_round_trip
     fixture = {
       "user_id" => "stub",
@@ -409,6 +427,9 @@ class PipesModelRoundTripTest < Minitest::Test
       "scopes" => [],
       "auth_method" => "stub",
       "api_key_last_4" => nil,
+      "client_id" => nil,
+      "client_secret_last_4" => nil,
+      "config" => {},
       "state" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub",

data/test/workos/test_shared_model_round_trip.rb

@@ -16,6 +16,39 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_object_summary_round_trip
+    fixture = {
+      "id" => "stub",
+      "name" => "stub",
+      "updated_at" => nil
+    }
+    model = WorkOS::ObjectSummary.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["name"], json[:name]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_object_version_round_trip
+    fixture = {
+      "created_at" => "stub",
+      "current_version" => true,
+      "etag" => "stub",
+      "id" => "stub",
+      "size" => 1
+    }
+    model = WorkOS::ObjectVersion.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["current_version"], json[:current_version]
+    assert_equal fixture["etag"], json[:etag]
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["size"], json[:size]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_connect_application_oauth_round_trip
     fixture = {
       "object" => "connect_application",
@@ -148,6 +181,7 @@ class SharedModelRoundTripTest < Minitest::Test
       "email" => "stub",
       "state" => "stub",
       "approved_at" => nil,
+      "waitlist_id" => nil,
       "created_at" => "stub",
       "updated_at" => "stub"
     }
@@ -162,6 +196,24 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_event_schema_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "stub",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::EventSchema.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["event"], json[:event]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_agent_registration_claim_attempt_created_round_trip
     fixture = {
       "object" => "event",
@@ -456,6 +508,34 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_agent_registration_refreshed_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "agent.registration.refreshed",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::AgentRegistrationRefreshed.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_agent_registration_refreshed_data_round_trip
+    fixture = {
+      "agent_registration_id" => "stub"
+    }
+    model = WorkOS::AgentRegistrationRefreshedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["agent_registration_id"], json[:agent_registration_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_agent_registration_revoked_round_trip
     fixture = {
       "object" => "event",
@@ -787,6 +867,17 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_event_list_list_metadata_round_trip
+    fixture = {
+      "after" => nil
+    }
+    model = WorkOS::EventListListMetadata.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_nil json[:after]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_event_context_google_analytics_session_round_trip
     fixture = {
       "containerId" => "stub",

data/test/workos/test_user_management.rb

@@ -163,7 +163,7 @@ class UserManagementTest < Minitest::Test
   def test_authenticate_with_radar_sms_challenge_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    result = @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", pending_authentication_token: "stub")
     refute_nil result
   end
 
@@ -171,7 +171,7 @@ class UserManagementTest < Minitest::Test
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
       .to_return(body: '{"message": "Unauthorized"}', status: 401)
     assert_raises(WorkOS::AuthenticationError) do
-      @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+      @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", pending_authentication_token: "stub")
     end
   end
 
@@ -262,9 +262,9 @@ class UserManagementTest < Minitest::Test
 
   def test_create_user_with_password_hashed_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/users(\?|\z)})
-      .with(body: hash_including("email" => "stub", "password_hash" => "stub", "password_hash_type" => "stub"))
+      .with(body: hash_including("email" => "stub", "password_hash" => "stub", "password_hash_type" => "stub", "password_salt_position" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.create_user(email: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub"))
+    result = @client.user_management.create_user(email: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub", password_salt_position: "stub"))
     refute_nil result
   end
 
@@ -292,9 +292,9 @@ class UserManagementTest < Minitest::Test
 
   def test_update_user_with_password_hashed_returns_expected_result
     stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)})
-      .with(body: hash_including("password_hash" => "stub", "password_hash_type" => "stub"))
+      .with(body: hash_including("password_hash" => "stub", "password_hash_type" => "stub", "password_salt_position" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.update_user(id: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub"))
+    result = @client.user_management.update_user(id: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub", password_salt_position: "stub"))
     refute_nil result
   end
 

data/test/workos/test_user_management_model_round_trip.rb

@@ -126,7 +126,8 @@ class UserManagementModelRoundTripTest < Minitest::Test
       "signals_id" => "stub",
       "password" => nil,
       "password_hash" => "stub",
-      "password_hash_type" => "stub"
+      "password_hash_type" => "stub",
+      "password_salt_position" => "stub"
     }
     model = WorkOS::CreateUser.new(fixture.to_json)
     json = model.to_h
@@ -147,7 +148,8 @@ class UserManagementModelRoundTripTest < Minitest::Test
       "locale" => nil,
       "password" => "stub",
       "password_hash" => "stub",
-      "password_hash_type" => "stub"
+      "password_hash_type" => "stub",
+      "password_salt_position" => "stub"
     }
     model = WorkOS::UpdateUser.new(fixture.to_json)
     json = model.to_h
@@ -2356,8 +2358,6 @@ class UserManagementModelRoundTripTest < Minitest::Test
     assert_equal fixture["client_id"], json[:client_id]
     assert_equal fixture["client_secret"], json[:client_secret]
     assert_equal fixture["code"], json[:code]
-    assert_equal fixture["verification_id"], json[:verification_id]
-    assert_equal fixture["phone_number"], json[:phone_number]
     assert_equal fixture["pending_authentication_token"], json[:pending_authentication_token]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 10.1.0
+  version: 10.2.1
 platform: ruby
 authors:
 - WorkOS
@@ -442,6 +442,7 @@ files:
 - lib/workos/pipes/data_integrations_list_response_data.rb
 - lib/workos/pipes/data_integrations_list_response_data_connected_account.rb
 - lib/workos/pipes/data_integrations_upsert_api_key_request.rb
+- lib/workos/pipes/data_integrations_upsert_client_credentials_request.rb
 - lib/workos/pipes/data_integrations_vend_credentials_request.rb
 - lib/workos/pipes/update_custom_provider_definition.rb
 - lib/workos/pipes/update_data_integration.rb
@@ -479,6 +480,8 @@ files:
 - lib/workos/shared/agent_registration_expired_data.rb
 - lib/workos/shared/agent_registration_organization_switched.rb
 - lib/workos/shared/agent_registration_organization_switched_data.rb
+- lib/workos/shared/agent_registration_refreshed.rb
+- lib/workos/shared/agent_registration_refreshed_data.rb
 - lib/workos/shared/agent_registration_revoked.rb
 - lib/workos/shared/agent_registration_revoked_data.rb
 - lib/workos/shared/auth_method_mismatch_error.rb
@@ -574,6 +577,7 @@ files:
 - lib/workos/types/create_data_integration_auth_methods.rb
 - lib/workos/types/create_user_invite_options_locale.rb
 - lib/workos/types/create_user_password_hash_type.rb
+- lib/workos/types/create_user_password_salt_position.rb
 - lib/workos/types/create_webhook_endpoint_events.rb
 - lib/workos/types/custom_provider_definition_authenticate_via.rb
 - lib/workos/types/data_integration_access_token_response_error.rb
@@ -655,6 +659,7 @@ files:
 - lib/workos/types/sso_provider.rb
 - lib/workos/types/update_custom_provider_definition_authenticate_via.rb
 - lib/workos/types/update_user_password_hash_type.rb
+- lib/workos/types/update_user_password_salt_position.rb
 - lib/workos/types/update_webhook_endpoint_events.rb
 - lib/workos/types/update_webhook_endpoint_status.rb
 - lib/workos/types/user_identities_get_item_provider.rb
@@ -907,6 +912,8 @@ files:
 - rbi/workos/agent_registration_expired_data.rbi
 - rbi/workos/agent_registration_organization_switched.rbi
 - rbi/workos/agent_registration_organization_switched_data.rbi
+- rbi/workos/agent_registration_refreshed.rbi
+- rbi/workos/agent_registration_refreshed_data.rbi
 - rbi/workos/agent_registration_revoked.rbi
 - rbi/workos/agent_registration_revoked_data.rbi
 - rbi/workos/agents.rbi
@@ -1096,6 +1103,7 @@ files:
 - rbi/workos/data_integrations_list_response_data.rbi
 - rbi/workos/data_integrations_list_response_data_connected_account.rbi
 - rbi/workos/data_integrations_upsert_api_key_request.rbi
+- rbi/workos/data_integrations_upsert_client_credentials_request.rbi
 - rbi/workos/data_integrations_vend_credentials_request.rbi
 - rbi/workos/decrypt_request.rbi
 - rbi/workos/decrypt_response.rbi