workos 10.3.0 → 10.4.0

data/test/workos/test_session.rb

@@ -220,6 +220,69 @@ class SessionTest < Minitest::Test
     assert_equal "session_expired", result.session_id
   end
 
+  # --- jwt_issuer -----------------------------------------------------------
+
+  def authenticate_with_issuer(jwt_issuer, iss)
+    rsa, pub = signing_key_pair
+    client = WorkOS::Client.new(api_key: "sk_test_session", client_id: "client_001", jwt_issuer: jwt_issuer)
+    sm = client.session_manager
+    claims = {"sid" => "session_iss", "exp" => Time.now.to_i + 60}
+    claims["iss"] = iss unless iss.nil?
+    access_token = make_jwt(claims, rsa)
+    sealed = sm.seal_data({"access_token" => access_token}, PASSWORD)
+
+    stub_request(:get, "https://api.workos.com/sso/jwks/client_001")
+      .to_return(status: 200, body: jwks_payload(pub).to_json)
+
+    sm.authenticate(seal_data: sealed, cookie_password: PASSWORD)
+  end
+
+  def test_authenticate_ignores_issuer_when_jwt_issuer_is_not_configured
+    result = authenticate_with_issuer(nil, "https://other.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_accepts_matching_jwt_issuer
+    result = authenticate_with_issuer("https://api.workos.com", "https://api.workos.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_rejects_mismatched_jwt_issuer
+    result = authenticate_with_issuer("https://api.workos.com", "https://other.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_authenticate_rejects_missing_iss_when_jwt_issuer_is_configured
+    result = authenticate_with_issuer("https://api.workos.com", nil)
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_authenticate_accepts_any_listed_jwt_issuer
+    issuers = ["https://api.workos.com", "https://auth.example.com"]
+    result = authenticate_with_issuer(issuers, "https://auth.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_rejects_all_tokens_when_jwt_issuer_list_is_empty
+    result = authenticate_with_issuer([], "https://api.workos.com")
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_global_configuration_passes_jwt_issuer_to_client
+    WorkOS.reset_client
+    WorkOS.configure { |config| config.jwt_issuer = "https://api.workos.com" }
+    assert_equal "https://api.workos.com", WorkOS.client.jwt_issuer
+  ensure
+    WorkOS.configuration.jwt_issuer = nil
+    WorkOS.reset_client
+  end
+
   # --- get_logout_url -------------------------------------------------------
 
   def test_get_logout_url_includes_session_id_from_authenticate

data/test/workos/test_shared_model_round_trip.rb

@@ -152,11 +152,16 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture = {
       "object" => "connected_account",
       "id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
       "data_integration_id" => "stub",
       "provider_slug" => "stub",
       "user_id" => nil,
       "organization_id" => nil,
       "scopes" => [],
+      "auth_method" => "stub",
+      "api_key_last_4" => nil,
       "state" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub"
@@ -1006,6 +1011,149 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_pipes_account_connection_add_failed_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "pipes.account_connection.add_failed",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PipesAccountConnectionAddFailed.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_pipes_account_connection_add_failed_data_round_trip
+    fixture = {
+      "object" => "connection_failed",
+      "data_integration_id" => "stub",
+      "provider_slug" => "stub",
+      "user_id" => nil,
+      "organization_id" => nil,
+      "account_identifier" => nil,
+      "error_code" => "stub",
+      "error_reason" => nil,
+      "provider_error" => nil,
+      "provider_error_description" => nil,
+      "created_at" => "stub"
+    }
+    model = WorkOS::PipesAccountConnectionAddFailedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["data_integration_id"], json[:data_integration_id]
+    assert_equal fixture["provider_slug"], json[:provider_slug]
+    assert_nil json[:user_id]
+    assert_nil json[:organization_id]
+    assert_equal fixture["error_code"], json[:error_code]
+    assert_nil json[:error_reason]
+    assert_nil json[:provider_error]
+    assert_nil json[:provider_error_description]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_pipes_account_connection_connected_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "pipes.account_connection.connected",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PipesAccountConnectionConnected.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_pipes_account_connection_connection_failed_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "pipes.account_connection.connection_failed",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PipesAccountConnectionConnectionFailed.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_pipes_account_connection_connection_failed_data_round_trip
+    fixture = {
+      "object" => "connection_failed",
+      "data_integration_id" => "stub",
+      "provider_slug" => "stub",
+      "user_id" => nil,
+      "organization_id" => nil,
+      "account_identifier" => nil,
+      "error_code" => "stub",
+      "error_reason" => nil,
+      "provider_error" => nil,
+      "provider_error_description" => nil,
+      "created_at" => "stub"
+    }
+    model = WorkOS::PipesAccountConnectionConnectionFailedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["data_integration_id"], json[:data_integration_id]
+    assert_equal fixture["provider_slug"], json[:provider_slug]
+    assert_nil json[:user_id]
+    assert_nil json[:organization_id]
+    assert_equal fixture["error_code"], json[:error_code]
+    assert_nil json[:error_reason]
+    assert_nil json[:provider_error]
+    assert_nil json[:provider_error_description]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_pipes_account_connection_disconnected_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "pipes.account_connection.disconnected",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PipesAccountConnectionDisconnected.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_pipes_account_connection_reauthorization_needed_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "pipes.account_connection.reauthorization_needed",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PipesAccountConnectionReauthorizationNeeded.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_pipes_connected_account_connected_round_trip
     fixture = {
       "object" => "event",
@@ -1047,6 +1195,7 @@ class SharedModelRoundTripTest < Minitest::Test
       "provider_slug" => "stub",
       "user_id" => nil,
       "organization_id" => nil,
+      "account_identifier" => nil,
       "error_code" => "stub",
       "error_reason" => nil,
       "provider_error" => nil,
@@ -1302,6 +1451,18 @@ class SharedModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_account_selection_required_error_round_trip
+    fixture = {
+      "code" => "account_selection_required",
+      "message" => "stub"
+    }
+    model = WorkOS::AccountSelectionRequiredError.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["message"], json[:message]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_auth_method_mismatch_error_round_trip
     fixture = {
       "code" => "auth_method_mismatch",

data/test/workos/test_user_management.rb

@@ -203,6 +203,27 @@ class UserManagementTest < Minitest::Test
     assert_nil result
   end
 
+  def test_list_authkit_oauth_resources_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/authkit_oauth_resources(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.user_management.list_authkit_oauth_resources
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
+  def test_create_authkit_oauth_resource_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authkit_oauth_resources(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.create_authkit_oauth_resource(uri: "stub")
+    refute_nil result
+  end
+
+  def test_delete_authkit_oauth_resource_returns_expected_result
+    stub_request(:delete, %r{\Ahttps://api\.workos\.com/user_management/authkit_oauth_resources/stub(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.delete_authkit_oauth_resource(id: "stub")
+    assert_nil result
+  end
+
   def test_list_cors_origins_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/user_management/cors_origins(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
@@ -530,6 +551,9 @@ class UserManagementTest < Minitest::Test
     {name: :create_radar_challenge, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/radar_challenges(\?|\z)}, args: {user_id: "stub", pending_authentication_token: "stub", phone_number: "stub"}},
     {name: :get_radar_challenge, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/radar_challenges/stub(\?|\z)}, args: {id: "stub"}},
     {name: :revoke_session, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/sessions/revoke(\?|\z)}, args: {session_id: "stub"}},
+    {name: :list_authkit_oauth_resources, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/authkit_oauth_resources(\?|\z)}},
+    {name: :create_authkit_oauth_resource, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/authkit_oauth_resources(\?|\z)}, args: {uri: "stub"}},
+    {name: :delete_authkit_oauth_resource, verb: :delete, url: %r{\Ahttps://api\.workos\.com/user_management/authkit_oauth_resources/stub(\?|\z)}, args: {id: "stub"}},
     {name: :list_cors_origins, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/cors_origins(\?|\z)}},
     {name: :create_cors_origin, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/cors_origins(\?|\z)}, args: {origin: "stub"}},
     {name: :get_email_verification, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/email_verification/stub(\?|\z)}, args: {id: "stub"}},

data/test/workos/test_user_management_model_round_trip.rb

@@ -44,6 +44,18 @@ class UserManagementModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_create_authkit_oauth_resource_round_trip
+    fixture = {
+      "uri" => "stub",
+      "default" => true
+    }
+    model = WorkOS::CreateAuthkitOAuthResource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["uri"], json[:uri]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_create_redirect_uri_round_trip
     fixture = {
       "uri" => "stub"
@@ -1805,6 +1817,26 @@ class UserManagementModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_authkit_oauth_resource_round_trip
+    fixture = {
+      "object" => "authkit_oauth_resource",
+      "id" => "stub",
+      "uri" => "stub",
+      "default" => true,
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::AuthkitOAuthResource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["uri"], json[:uri]
+    assert_equal fixture["default"], json[:default]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_redirect_uri_round_trip
     fixture = {
       "object" => "redirect_uri",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 10.3.0
+  version: 10.4.0
 platform: ruby
 authors:
 - WorkOS
@@ -485,6 +485,7 @@ files:
 - lib/workos/session.rb
 - lib/workos/session_manager.rb
 - lib/workos/shared/access_token_agent_registration_credential_issued_data_detail.rb
+- lib/workos/shared/account_selection_required_error.rb
 - lib/workos/shared/agent_blueprint_created.rb
 - lib/workos/shared/agent_blueprint_created_data.rb
 - lib/workos/shared/agent_blueprint_created_data_invocable_by.rb
@@ -540,6 +541,13 @@ files:
 - lib/workos/shared/group_member_removed_data.rb
 - lib/workos/shared/group_updated.rb
 - lib/workos/shared/pipe_connected_account.rb
+- lib/workos/shared/pipes_account_connection_add_failed.rb
+- lib/workos/shared/pipes_account_connection_add_failed_data.rb
+- lib/workos/shared/pipes_account_connection_connected.rb
+- lib/workos/shared/pipes_account_connection_connection_failed.rb
+- lib/workos/shared/pipes_account_connection_connection_failed_data.rb
+- lib/workos/shared/pipes_account_connection_disconnected.rb
+- lib/workos/shared/pipes_account_connection_reauthorization_needed.rb
 - lib/workos/shared/pipes_connected_account_connected.rb
 - lib/workos/shared/pipes_connected_account_connection_failed.rb
 - lib/workos/shared/pipes_connected_account_connection_failed_data.rb
@@ -628,6 +636,7 @@ files:
 - lib/workos/types/base_model.rb
 - lib/workos/types/claim_view_response_status.rb
 - lib/workos/types/connected_account_auth_method.rb
+- lib/workos/types/connected_account_connection_role.rb
 - lib/workos/types/connected_account_input_state.rb
 - lib/workos/types/connected_account_state.rb
 - lib/workos/types/connection_activated_data_connection_type.rb
@@ -647,6 +656,7 @@ files:
 - lib/workos/types/create_connection_oidc_options_id_token_signature_algorithm.rb
 - lib/workos/types/create_connection_oidc_options_token_authentication_method.rb
 - lib/workos/types/create_data_integration_auth_methods.rb
+- lib/workos/types/create_data_integration_ownership.rb
 - lib/workos/types/create_user_invite_options_locale.rb
 - lib/workos/types/create_user_password_hash_type.rb
 - lib/workos/types/create_user_password_salt_position.rb
@@ -659,11 +669,20 @@ files:
 - lib/workos/types/data_integration_credentials_input_type.rb
 - lib/workos/types/data_integration_credentials_response_error.rb
 - lib/workos/types/data_integration_custom_provider_authenticate_via.rb
+- lib/workos/types/data_integration_installation_connection_role.rb
+- lib/workos/types/data_integration_ownership.rb
 - lib/workos/types/data_integration_state.rb
+- lib/workos/types/data_integrations_get_data_integration_authorize_url_request_connection_owner.rb
+- lib/workos/types/data_integrations_get_user_token_request_connection_owner.rb
 - lib/workos/types/data_integrations_list_response_data_auth_methods.rb
 - lib/workos/types/data_integrations_list_response_data_connected_account_auth_method.rb
+- lib/workos/types/data_integrations_list_response_data_connected_account_connection_role.rb
 - lib/workos/types/data_integrations_list_response_data_connected_account_state.rb
+- lib/workos/types/data_integrations_list_response_data_connection_owner.rb
 - lib/workos/types/data_integrations_list_response_data_ownership.rb
+- lib/workos/types/data_integrations_upsert_api_key_request_connection_owner.rb
+- lib/workos/types/data_integrations_upsert_client_credentials_request_connection_owner.rb
+- lib/workos/types/data_integrations_vend_credentials_request_connection_owner.rb
 - lib/workos/types/directory_state.rb
 - lib/workos/types/directory_type.rb
 - lib/workos/types/directory_user_state.rb
@@ -715,7 +734,10 @@ files:
 - lib/workos/types/pagination_order.rb
 - lib/workos/types/patch_connection_oidc_options_id_token_signature_algorithm.rb
 - lib/workos/types/patch_connection_oidc_options_token_authentication_method.rb
+- lib/workos/types/pipe_connected_account_auth_method.rb
+- lib/workos/types/pipe_connected_account_connection_role.rb
 - lib/workos/types/pipe_connected_account_state.rb
+- lib/workos/types/pipes_ownership.rb
 - lib/workos/types/profile_connection_type.rb
 - lib/workos/types/radar_list_action.rb
 - lib/workos/types/radar_list_type.rb
@@ -828,10 +850,12 @@ files:
 - lib/workos/user_management/authentication_sso_timed_out_data.rb
 - lib/workos/user_management/authentication_sso_timed_out_data_error.rb
 - lib/workos/user_management/authentication_sso_timed_out_data_sso.rb
+- lib/workos/user_management/authkit_oauth_resource.rb
 - lib/workos/user_management/authorization_code_session_authenticate_request.rb
 - lib/workos/user_management/authorized_connect_application_list_data.rb
 - lib/workos/user_management/confirm_email_change.rb
 - lib/workos/user_management/cors_origin_response.rb
+- lib/workos/user_management/create_authkit_oauth_resource.rb
 - lib/workos/user_management/create_cors_origin.rb
 - lib/workos/user_management/create_magic_code_and_return.rb
 - lib/workos/user_management/create_password_reset.rb
@@ -969,6 +993,7 @@ files:
 - lib/workos/widgets/widget_session_token.rb
 - lib/workos/widgets/widget_session_token_response.rb
 - rbi/workos/access_token_agent_registration_credential_issued_data_detail.rbi
+- rbi/workos/account_selection_required_error.rbi
 - rbi/workos/action_authentication_denied.rbi
 - rbi/workos/action_authentication_denied_data.rbi
 - rbi/workos/action_user_registration_denied.rbi
@@ -1137,6 +1162,7 @@ files:
 - rbi/workos/authentication_sso_timed_out_data.rbi
 - rbi/workos/authentication_sso_timed_out_data_error.rbi
 - rbi/workos/authentication_sso_timed_out_data_sso.rbi
+- rbi/workos/authkit_oauth_resource.rbi
 - rbi/workos/authorization.rbi
 - rbi/workos/authorization_check.rbi
 - rbi/workos/authorization_code_session_authenticate_request.rbi
@@ -1180,6 +1206,7 @@ files:
 - rbi/workos/connection_saml_certificate_renewed_data_connection.rbi
 - rbi/workos/cors_origin_response.rbi
 - rbi/workos/create_application_secret.rbi
+- rbi/workos/create_authkit_oauth_resource.rbi
 - rbi/workos/create_authorization_permission.rbi
 - rbi/workos/create_authorization_resource.rbi
 - rbi/workos/create_connection.rbi
@@ -1432,6 +1459,13 @@ files:
 - rbi/workos/permission_updated_data.rbi
 - rbi/workos/pipe_connected_account.rbi
 - rbi/workos/pipes.rbi
+- rbi/workos/pipes_account_connection_add_failed.rbi
+- rbi/workos/pipes_account_connection_add_failed_data.rbi
+- rbi/workos/pipes_account_connection_connected.rbi
+- rbi/workos/pipes_account_connection_connection_failed.rbi
+- rbi/workos/pipes_account_connection_connection_failed_data.rbi
+- rbi/workos/pipes_account_connection_disconnected.rbi
+- rbi/workos/pipes_account_connection_reauthorization_needed.rbi
 - rbi/workos/pipes_connected_account_connected.rbi
 - rbi/workos/pipes_connected_account_connection_failed.rbi
 - rbi/workos/pipes_connected_account_connection_failed_data.rbi