workos 10.2.1 → 10.4.0

data/test/workos/test_pipes_model_round_trip.rb

@@ -55,6 +55,7 @@ class PipesModelRoundTripTest < Minitest::Test
   def test_create_data_integration_round_trip
     fixture = {
       "provider" => "stub",
+      "ownership" => "stub",
       "description" => nil,
       "enabled" => true,
       "scopes" => nil,
@@ -126,6 +127,7 @@ class PipesModelRoundTripTest < Minitest::Test
       "id" => "stub",
       "slug" => "stub",
       "integration_type" => "stub",
+      "ownership" => "stub",
       "description" => nil,
       "enabled" => true,
       "state" => "stub",
@@ -192,6 +194,9 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "object" => "connected_account",
       "id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
       "user_id" => nil,
       "organization_id" => nil,
       "scopes" => [],
@@ -208,6 +213,8 @@ class PipesModelRoundTripTest < Minitest::Test
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["id"], json[:id]
+    assert_nil json[:account_identifier]
+    assert_nil json[:account_display_name]
     assert_nil json[:user_id]
     assert_nil json[:organization_id]
     assert_equal fixture["created_at"], json[:created_at]
@@ -237,10 +244,12 @@ class PipesModelRoundTripTest < Minitest::Test
       "credentials_type" => "stub",
       "scopes" => nil,
       "auth_methods" => [],
+      "connection_owner" => "stub",
       "ownership" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub",
-      "connected_account" => nil
+      "connected_account" => nil,
+      "connected_accounts" => []
     }
     model = WorkOS::DataIntegrationsListResponseData.new(fixture.to_json)
     json = model.to_h
@@ -306,7 +315,10 @@ class PipesModelRoundTripTest < Minitest::Test
   def test_data_integration_installation_round_trip
     fixture = {
       "id" => "stub",
-      "user_id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
+      "user_id" => nil,
       "organization_id" => nil,
       "api_key_last_4" => nil
     }
@@ -314,7 +326,9 @@ class PipesModelRoundTripTest < Minitest::Test
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["id"], json[:id]
-    assert_equal fixture["user_id"], json[:user_id]
+    assert_nil json[:account_identifier]
+    assert_nil json[:account_display_name]
+    assert_nil json[:user_id]
     assert_nil json[:organization_id]
     assert_nil json[:api_key_last_4]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
@@ -353,6 +367,8 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "user_id" => "stub",
       "organization_id" => "stub",
+      "connected_account_id" => "stub",
+      "connection_owner" => "stub",
       "secret" => "stub"
     }
     model = WorkOS::DataIntegrationsUpsertApiKeyRequest.new(fixture.to_json)
@@ -367,6 +383,7 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "user_id" => "stub",
       "organization_id" => "stub",
+      "connection_owner" => "stub",
       "return_to" => "stub",
       "config" => {}
     }
@@ -381,6 +398,8 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "user_id" => "stub",
       "organization_id" => "stub",
+      "connected_account_id" => "stub",
+      "connection_owner" => "stub",
       "client_id" => "stub",
       "client_secret" => "stub",
       "config" => {}
@@ -397,7 +416,10 @@ class PipesModelRoundTripTest < Minitest::Test
   def test_data_integrations_vend_credentials_request_round_trip
     fixture = {
       "user_id" => "stub",
-      "organization_id" => "stub"
+      "organization_id" => "stub",
+      "connected_account_id" => "stub",
+      "connection_owner" => "stub",
+      "supports_multiple_connections" => true
     }
     model = WorkOS::DataIntegrationsVendCredentialsRequest.new(fixture.to_json)
     json = model.to_h
@@ -409,7 +431,10 @@ class PipesModelRoundTripTest < Minitest::Test
   def test_data_integrations_get_user_token_request_round_trip
     fixture = {
       "user_id" => "stub",
-      "organization_id" => nil
+      "organization_id" => nil,
+      "connected_account_id" => "stub",
+      "connection_owner" => "stub",
+      "supports_multiple_connections" => true
     }
     model = WorkOS::DataIntegrationsGetUserTokenRequest.new(fixture.to_json)
     json = model.to_h
@@ -422,6 +447,9 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "object" => "connected_account",
       "id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
       "user_id" => nil,
       "organization_id" => nil,
       "scopes" => [],
@@ -439,6 +467,8 @@ class PipesModelRoundTripTest < Minitest::Test
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["id"], json[:id]
+    assert_nil json[:account_identifier]
+    assert_nil json[:account_display_name]
     assert_nil json[:user_id]
     assert_nil json[:organization_id]
     assert_equal fixture["created_at"], json[:created_at]

data/test/workos/test_platform_teams.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class PlatformTeamsTest < Minitest::Test
+  include FixtureHelper
+
+  def setup
+    @client = WorkOS::Client.new(api_key: "sk_test_123")
+  end
+
+  def test_create_team_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/platform/teams(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.platform_teams.create_team(admin_email: "stub", name: "stub")
+    refute_nil result
+  end
+
+  def test_get_team_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/platform/teams/stub(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.platform_teams.get_team(team_id: "stub")
+    refute_nil result
+  end
+
+  # Parameterized authentication error tests (one per endpoint).
+  [
+    {name: :create_team, verb: :post, url: %r{\Ahttps://api\.workos\.com/platform/teams(\?|\z)}, args: {admin_email: "stub", name: "stub"}},
+    {name: :get_team, verb: :get, url: %r{\Ahttps://api\.workos\.com/platform/teams/stub(\?|\z)}, args: {team_id: "stub"}}
+  ].each do |spec|
+    define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
+      stub_request(spec[:verb], spec[:url])
+        .to_return(body: '{"message": "Unauthorized"}', status: 401)
+      assert_raises(WorkOS::AuthenticationError) do
+        @client.platform_teams.send(spec[:name], **(spec[:args] || {}))
+      end
+    end
+  end
+end

data/test/workos/test_platform_teams_model_round_trip.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class PlatformTeamsModelRoundTripTest < Minitest::Test
+  def test_create_team_round_trip
+    fixture = {
+      "admin_email" => "stub",
+      "name" => "stub"
+    }
+    model = WorkOS::CreateTeam.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["admin_email"], json[:admin_email]
+    assert_equal fixture["name"], json[:name]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_team_round_trip
+    fixture = {
+      "object" => "team",
+      "id" => "stub",
+      "name" => "stub",
+      "production_state" => "stub",
+      "production_enabled_at" => nil,
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::Team.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:production_enabled_at]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_session.rb

@@ -220,6 +220,69 @@ class SessionTest < Minitest::Test
     assert_equal "session_expired", result.session_id
   end
 
+  # --- jwt_issuer -----------------------------------------------------------
+
+  def authenticate_with_issuer(jwt_issuer, iss)
+    rsa, pub = signing_key_pair
+    client = WorkOS::Client.new(api_key: "sk_test_session", client_id: "client_001", jwt_issuer: jwt_issuer)
+    sm = client.session_manager
+    claims = {"sid" => "session_iss", "exp" => Time.now.to_i + 60}
+    claims["iss"] = iss unless iss.nil?
+    access_token = make_jwt(claims, rsa)
+    sealed = sm.seal_data({"access_token" => access_token}, PASSWORD)
+
+    stub_request(:get, "https://api.workos.com/sso/jwks/client_001")
+      .to_return(status: 200, body: jwks_payload(pub).to_json)
+
+    sm.authenticate(seal_data: sealed, cookie_password: PASSWORD)
+  end
+
+  def test_authenticate_ignores_issuer_when_jwt_issuer_is_not_configured
+    result = authenticate_with_issuer(nil, "https://other.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_accepts_matching_jwt_issuer
+    result = authenticate_with_issuer("https://api.workos.com", "https://api.workos.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_rejects_mismatched_jwt_issuer
+    result = authenticate_with_issuer("https://api.workos.com", "https://other.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_authenticate_rejects_missing_iss_when_jwt_issuer_is_configured
+    result = authenticate_with_issuer("https://api.workos.com", nil)
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_authenticate_accepts_any_listed_jwt_issuer
+    issuers = ["https://api.workos.com", "https://auth.example.com"]
+    result = authenticate_with_issuer(issuers, "https://auth.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_rejects_all_tokens_when_jwt_issuer_list_is_empty
+    result = authenticate_with_issuer([], "https://api.workos.com")
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_global_configuration_passes_jwt_issuer_to_client
+    WorkOS.reset_client
+    WorkOS.configure { |config| config.jwt_issuer = "https://api.workos.com" }
+    assert_equal "https://api.workos.com", WorkOS.client.jwt_issuer
+  ensure
+    WorkOS.configuration.jwt_issuer = nil
+    WorkOS.reset_client
+  end
+
   # --- get_logout_url -------------------------------------------------------
 
   def test_get_logout_url_includes_session_id_from_authenticate