workos 10.3.0 → 10.5.0

data/test/workos/test_pipes_model_round_trip.rb

@@ -55,6 +55,7 @@ class PipesModelRoundTripTest < Minitest::Test
   def test_create_data_integration_round_trip
     fixture = {
       "provider" => "stub",
+      "ownership" => "stub",
       "description" => nil,
       "enabled" => true,
       "scopes" => nil,
@@ -106,8 +107,64 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_create_organization_connected_account_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "access_token" => "stub",
+      "refresh_token" => "stub",
+      "expires_at" => "stub",
+      "scopes" => [],
+      "state" => "stub",
+      "user_id" => "stub",
+      "connection_intent" => "add"
+    }
+    model = WorkOS::CreateOrganizationConnectedAccount.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_organization_connected_account_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "access_token" => "stub",
+      "refresh_token" => "stub",
+      "expires_at" => "stub",
+      "scopes" => [],
+      "state" => "stub",
+      "user_id" => "stub"
+    }
+    model = WorkOS::OrganizationConnectedAccount.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_connected_account_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "access_token" => "stub",
+      "refresh_token" => "stub",
+      "expires_at" => "stub",
+      "scopes" => [],
+      "state" => "stub",
+      "connection_intent" => "add"
+    }
+    model = WorkOS::CreateConnectedAccount.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_connected_account_input_round_trip
     fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
       "access_token" => "stub",
       "refresh_token" => "stub",
       "expires_at" => "stub",
@@ -126,6 +183,7 @@ class PipesModelRoundTripTest < Minitest::Test
       "id" => "stub",
       "slug" => "stub",
       "integration_type" => "stub",
+      "ownership" => "stub",
       "description" => nil,
       "enabled" => true,
       "state" => "stub",
@@ -176,6 +234,23 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_data_integration_vended_credential_round_trip
+    fixture = {
+      "object" => "credential",
+      "auth_method" => "oauth",
+      "value" => "stub",
+      "expires_at" => nil,
+      "scopes" => [],
+      "missing_scopes" => [],
+      "config" => {},
+      "metadata" => {}
+    }
+    model = WorkOS::DataIntegrationVendedCredential.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integration_credentials_response_round_trip
     fixture = {
       "active" => true,
@@ -188,10 +263,13 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
-  def test_connected_account_round_trip
+  def test_connected_account_write_response_round_trip
     fixture = {
       "object" => "connected_account",
       "id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
       "user_id" => nil,
       "organization_id" => nil,
       "scopes" => [],
@@ -201,13 +279,18 @@ class PipesModelRoundTripTest < Minitest::Test
       "client_secret_last_4" => nil,
       "config" => {},
       "state" => "stub",
+      "established_by_user_id" => nil,
+      "state_reason" => nil,
       "created_at" => "stub",
-      "updated_at" => "stub"
+      "updated_at" => "stub",
+      "warnings" => []
     }
-    model = WorkOS::ConnectedAccount.new(fixture.to_json)
+    model = WorkOS::ConnectedAccountWriteResponse.new(fixture.to_json)
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["id"], json[:id]
+    assert_nil json[:account_identifier]
+    assert_nil json[:account_display_name]
     assert_nil json[:user_id]
     assert_nil json[:organization_id]
     assert_equal fixture["created_at"], json[:created_at]
@@ -226,6 +309,40 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_connected_account_round_trip
+    fixture = {
+      "object" => "connected_account",
+      "id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
+      "user_id" => nil,
+      "organization_id" => nil,
+      "scopes" => [],
+      "auth_method" => "stub",
+      "api_key_last_4" => nil,
+      "client_id" => nil,
+      "client_secret_last_4" => nil,
+      "config" => {},
+      "state" => "stub",
+      "established_by_user_id" => nil,
+      "state_reason" => nil,
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::ConnectedAccount.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_nil json[:account_identifier]
+    assert_nil json[:account_display_name]
+    assert_nil json[:user_id]
+    assert_nil json[:organization_id]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integrations_list_response_data_round_trip
     fixture = {
       "object" => "data_provider",
@@ -237,10 +354,12 @@ class PipesModelRoundTripTest < Minitest::Test
       "credentials_type" => "stub",
       "scopes" => nil,
       "auth_methods" => [],
+      "connection_owner" => "stub",
       "ownership" => "stub",
       "created_at" => "stub",
       "updated_at" => "stub",
-      "connected_account" => nil
+      "connected_account" => nil,
+      "connected_accounts" => []
     }
     model = WorkOS::DataIntegrationsListResponseData.new(fixture.to_json)
     json = model.to_h
@@ -256,20 +375,15 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
-  def test_data_integration_credentials_response_credential_round_trip
+  def test_connected_account_write_response_warning_round_trip
     fixture = {
-      "object" => "credential",
-      "auth_method" => "oauth",
-      "value" => "stub",
-      "expires_at" => nil,
-      "scopes" => [],
-      "missing_scopes" => []
+      "code" => "duplicate_account_display_name",
+      "message" => "stub"
     }
-    model = WorkOS::DataIntegrationCredentialsResponseCredential.new(fixture.to_json)
+    model = WorkOS::ConnectedAccountWriteResponseWarning.new(fixture.to_json)
     json = model.to_h
     assert_kind_of Hash, json
-    assert_equal fixture["value"], json[:value]
-    assert_nil json[:expires_at]
+    assert_equal fixture["message"], json[:message]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
@@ -306,7 +420,10 @@ class PipesModelRoundTripTest < Minitest::Test
   def test_data_integration_installation_round_trip
     fixture = {
       "id" => "stub",
-      "user_id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
+      "user_id" => nil,
       "organization_id" => nil,
       "api_key_last_4" => nil
     }
@@ -314,7 +431,9 @@ class PipesModelRoundTripTest < Minitest::Test
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["id"], json[:id]
-    assert_equal fixture["user_id"], json[:user_id]
+    assert_nil json[:account_identifier]
+    assert_nil json[:account_display_name]
+    assert_nil json[:user_id]
     assert_nil json[:organization_id]
     assert_nil json[:api_key_last_4]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
@@ -349,10 +468,31 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_data_integrations_create_api_key_connection_request_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "secret" => "stub",
+      "connection_intent" => "add"
+    }
+    model = WorkOS::DataIntegrationsCreateApiKeyConnectionRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["secret"], json[:secret]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integrations_upsert_api_key_request_round_trip
     fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
       "user_id" => "stub",
       "organization_id" => "stub",
+      "connection_owner" => "stub",
       "secret" => "stub"
     }
     model = WorkOS::DataIntegrationsUpsertApiKeyRequest.new(fixture.to_json)
@@ -363,10 +503,51 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_reauthorize_data_integrations_upsert_api_key_request_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "secret" => "stub",
+      "connection_intent" => "reauthorize",
+      "connected_account_id" => "stub"
+    }
+    model = WorkOS::ReauthorizeDataIntegrationsUpsertApiKeyRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["secret"], json[:secret]
+    assert_equal fixture["connected_account_id"], json[:connected_account_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_data_integrations_upsert_api_key_request_2_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "secret" => "stub",
+      "connected_account_id" => "stub"
+    }
+    model = WorkOS::DataIntegrationsUpsertApiKeyRequest2.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["secret"], json[:secret]
+    assert_equal fixture["connected_account_id"], json[:connected_account_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integrations_get_data_integration_authorize_url_request_round_trip
     fixture = {
+      "account_display_name" => nil,
       "user_id" => "stub",
       "organization_id" => "stub",
+      "connection_owner" => "stub",
       "return_to" => "stub",
       "config" => {}
     }
@@ -377,10 +558,70 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_add_data_integrations_get_data_integration_authorize_url_request_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "return_to" => "stub",
+      "config" => {},
+      "connection_intent" => "add"
+    }
+    model = WorkOS::AddDataIntegrationsGetDataIntegrationAuthorizeUrlRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_reauthorize_data_integrations_get_data_integration_authorize_url_request_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "return_to" => "stub",
+      "config" => {},
+      "connection_intent" => "reauthorize",
+      "connected_account_id" => "stub"
+    }
+    model = WorkOS::ReauthorizeDataIntegrationsGetDataIntegrationAuthorizeUrlRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["connected_account_id"], json[:connected_account_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_data_integrations_create_client_credentials_connection_request_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "client_id" => "stub",
+      "client_secret" => "stub",
+      "config" => {},
+      "connection_intent" => "add"
+    }
+    model = WorkOS::DataIntegrationsCreateClientCredentialsConnectionRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_equal fixture["client_secret"], json[:client_secret]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integrations_upsert_client_credentials_request_round_trip
     fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
       "user_id" => "stub",
       "organization_id" => "stub",
+      "connection_owner" => "stub",
       "client_id" => "stub",
       "client_secret" => "stub",
       "config" => {}
@@ -394,10 +635,58 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_reauthorize_data_integrations_upsert_client_credentials_request_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "client_id" => "stub",
+      "client_secret" => "stub",
+      "config" => {},
+      "connection_intent" => "reauthorize",
+      "connected_account_id" => "stub"
+    }
+    model = WorkOS::ReauthorizeDataIntegrationsUpsertClientCredentialsRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_equal fixture["client_secret"], json[:client_secret]
+    assert_equal fixture["connected_account_id"], json[:connected_account_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_data_integrations_upsert_client_credentials_request_2_round_trip
+    fixture = {
+      "account_display_name" => nil,
+      "account_identifier" => nil,
+      "user_id" => "stub",
+      "organization_id" => "stub",
+      "connection_owner" => "stub",
+      "client_id" => "stub",
+      "client_secret" => "stub",
+      "config" => {},
+      "connected_account_id" => "stub"
+    }
+    model = WorkOS::DataIntegrationsUpsertClientCredentialsRequest2.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_equal fixture["client_secret"], json[:client_secret]
+    assert_equal fixture["connected_account_id"], json[:connected_account_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_data_integrations_vend_credentials_request_round_trip
     fixture = {
       "user_id" => "stub",
-      "organization_id" => "stub"
+      "organization_id" => "stub",
+      "connected_account_id" => "stub",
+      "connection_owner" => "stub",
+      "supports_multiple_connections" => true
     }
     model = WorkOS::DataIntegrationsVendCredentialsRequest.new(fixture.to_json)
     json = model.to_h
@@ -409,7 +698,10 @@ class PipesModelRoundTripTest < Minitest::Test
   def test_data_integrations_get_user_token_request_round_trip
     fixture = {
       "user_id" => "stub",
-      "organization_id" => nil
+      "organization_id" => nil,
+      "connected_account_id" => "stub",
+      "connection_owner" => "stub",
+      "supports_multiple_connections" => true
     }
     model = WorkOS::DataIntegrationsGetUserTokenRequest.new(fixture.to_json)
     json = model.to_h
@@ -422,6 +714,9 @@ class PipesModelRoundTripTest < Minitest::Test
     fixture = {
       "object" => "connected_account",
       "id" => "stub",
+      "connection_role" => "stub",
+      "account_identifier" => nil,
+      "account_display_name" => nil,
       "user_id" => nil,
       "organization_id" => nil,
       "scopes" => [],
@@ -431,6 +726,8 @@ class PipesModelRoundTripTest < Minitest::Test
       "client_secret_last_4" => nil,
       "config" => {},
       "state" => "stub",
+      "established_by_user_id" => nil,
+      "state_reason" => nil,
       "created_at" => "stub",
       "updated_at" => "stub",
       "userlandUserId" => nil
@@ -439,6 +736,8 @@ class PipesModelRoundTripTest < Minitest::Test
     json = model.to_h
     assert_kind_of Hash, json
     assert_equal fixture["id"], json[:id]
+    assert_nil json[:account_identifier]
+    assert_nil json[:account_display_name]
     assert_nil json[:user_id]
     assert_nil json[:organization_id]
     assert_equal fixture["created_at"], json[:created_at]

data/test/workos/test_session.rb

@@ -220,6 +220,69 @@ class SessionTest < Minitest::Test
     assert_equal "session_expired", result.session_id
   end
 
+  # --- jwt_issuer -----------------------------------------------------------
+
+  def authenticate_with_issuer(jwt_issuer, iss)
+    rsa, pub = signing_key_pair
+    client = WorkOS::Client.new(api_key: "sk_test_session", client_id: "client_001", jwt_issuer: jwt_issuer)
+    sm = client.session_manager
+    claims = {"sid" => "session_iss", "exp" => Time.now.to_i + 60}
+    claims["iss"] = iss unless iss.nil?
+    access_token = make_jwt(claims, rsa)
+    sealed = sm.seal_data({"access_token" => access_token}, PASSWORD)
+
+    stub_request(:get, "https://api.workos.com/sso/jwks/client_001")
+      .to_return(status: 200, body: jwks_payload(pub).to_json)
+
+    sm.authenticate(seal_data: sealed, cookie_password: PASSWORD)
+  end
+
+  def test_authenticate_ignores_issuer_when_jwt_issuer_is_not_configured
+    result = authenticate_with_issuer(nil, "https://other.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_accepts_matching_jwt_issuer
+    result = authenticate_with_issuer("https://api.workos.com", "https://api.workos.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_rejects_mismatched_jwt_issuer
+    result = authenticate_with_issuer("https://api.workos.com", "https://other.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_authenticate_rejects_missing_iss_when_jwt_issuer_is_configured
+    result = authenticate_with_issuer("https://api.workos.com", nil)
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_authenticate_accepts_any_listed_jwt_issuer
+    issuers = ["https://api.workos.com", "https://auth.example.com"]
+    result = authenticate_with_issuer(issuers, "https://auth.example.com")
+    assert_kind_of WorkOS::SessionManager::AuthSuccess, result
+    assert result.authenticated
+  end
+
+  def test_authenticate_rejects_all_tokens_when_jwt_issuer_list_is_empty
+    result = authenticate_with_issuer([], "https://api.workos.com")
+    assert_kind_of WorkOS::SessionManager::AuthError, result
+    assert_equal WorkOS::SessionManager::INVALID_JWT, result.reason
+  end
+
+  def test_global_configuration_passes_jwt_issuer_to_client
+    WorkOS.reset_client
+    WorkOS.configure { |config| config.jwt_issuer = "https://api.workos.com" }
+    assert_equal "https://api.workos.com", WorkOS.client.jwt_issuer
+  ensure
+    WorkOS.configuration.jwt_issuer = nil
+    WorkOS.reset_client
+  end
+
   # --- get_logout_url -------------------------------------------------------
 
   def test_get_logout_url_includes_session_id_from_authenticate