workos 10.3.0 → 10.5.0

data/lib/workos/session_manager.rb

@@ -174,7 +174,10 @@ module WorkOS
     # Verify an access-token JWT against the WorkOS JWKS for this client.
     # Used by Session#authenticate; exposed publicly for advanced cases.
     #
-    # NOTE on iss/aud/required_claims: this method intentionally does not
+    # The `iss` claim is only checked when the client was built with
+    # `jwt_issuer:` (a String or an Array of accepted issuers).
+    #
+    # NOTE on iss/aud/required_claims: by default this method does not
     # enforce iss, aud, or required_claims. workos-node's `jose` call and
     # workos-php's `isset($exp) && $exp < time()` accept exp-less tokens, and
     # cross-SDK parity is required for the planned coordinated hardening of
@@ -182,15 +185,17 @@ module WorkOS
     # required_claims: ['exp'] tightening that was considered here.
     def decode_jwt(access_token, verify_expiration: true)
       jwks = fetch_jwks
-      JWT.decode(
-        access_token,
-        nil,
-        true,
+      options = {
         algorithms: JWK_ALGORITHMS,
         jwks: jwks,
         verify_aud: false,
         verify_expiration: verify_expiration
-      ).first
+      }
+      unless client.jwt_issuer.nil?
+        options[:iss] = client.jwt_issuer
+        options[:verify_iss] = true
+      end
+      JWT.decode(access_token, nil, true, options).first
     end
 
     private

data/lib/workos/shared/account_selection_required_error.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AccountSelectionRequiredError < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      code: :code,
+      message: :message
+    }.freeze
+
+    attr_accessor \
+      :code,
+      :message
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @code = hash[:code]
+      @message = hash[:message]
+    end
+  end
+end

data/lib/workos/shared/agent_blueprint_created_data.rb

@@ -11,6 +11,7 @@ module WorkOS
       description: :description,
       permissions: :permissions,
       invocable_by: :invocable_by,
+      invocable_as: :invocable_as,
       session_settings: :session_settings,
       created_at: :created_at,
       updated_at: :updated_at
@@ -23,6 +24,7 @@ module WorkOS
       :description,
       :permissions,
       :invocable_by,
+      :invocable_as,
       :session_settings,
       :created_at,
       :updated_at
@@ -35,6 +37,7 @@ module WorkOS
       @description = hash[:description]
       @permissions = hash[:permissions] || []
       @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintCreatedDataInvocableBy.new(hash[:invocable_by]) : nil
+      @invocable_as = hash[:invocable_as] ? WorkOS::AgentBlueprintCreatedDataInvocableAs.new(hash[:invocable_as]) : nil
       @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintCreatedDataSessionSetting.new(hash[:session_settings]) : nil
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]

data/lib/workos/shared/agent_blueprint_created_data_invocable_as.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintCreatedDataInvocableAs < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      instance_types: :instance_types
+    }.freeze
+
+    attr_accessor :instance_types
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @instance_types = hash[:instance_types] || []
+    end
+  end
+end

data/lib/workos/shared/agent_blueprint_updated_data.rb

@@ -3,5 +3,44 @@
 # This file is auto-generated by oagen. Do not edit.
 
 module WorkOS
-  AgentBlueprintUpdatedData = AgentBlueprintCreatedData
+  class AgentBlueprintUpdatedData < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      name: :name,
+      description: :description,
+      permissions: :permissions,
+      invocable_by: :invocable_by,
+      invocable_as: :invocable_as,
+      session_settings: :session_settings,
+      created_at: :created_at,
+      updated_at: :updated_at
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :name,
+      :description,
+      :permissions,
+      :invocable_by,
+      :invocable_as,
+      :session_settings,
+      :created_at,
+      :updated_at
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @name = hash[:name]
+      @description = hash[:description]
+      @permissions = hash[:permissions] || []
+      @invocable_by = hash[:invocable_by] ? WorkOS::AgentBlueprintUpdatedDataInvocableBy.new(hash[:invocable_by]) : nil
+      @invocable_as = hash[:invocable_as] ? WorkOS::AgentBlueprintUpdatedDataInvocableAs.new(hash[:invocable_as]) : nil
+      @session_settings = hash[:session_settings] ? WorkOS::AgentBlueprintUpdatedDataSessionSetting.new(hash[:session_settings]) : nil
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+    end
+  end
 end

data/lib/workos/shared/agent_blueprint_updated_data_invocable_as.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintUpdatedDataInvocableAs < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      instance_types: :instance_types
+    }.freeze
+
+    attr_accessor :instance_types
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @instance_types = hash[:instance_types] || []
+    end
+  end
+end

data/lib/workos/shared/pipe_connected_account.rb

@@ -7,12 +7,19 @@ module WorkOS
     HASH_ATTRS = {
       object: :object,
       id: :id,
+      connection_role: :connection_role,
+      account_identifier: :account_identifier,
+      account_display_name: :account_display_name,
       data_integration_id: :data_integration_id,
       provider_slug: :provider_slug,
       user_id: :user_id,
       organization_id: :organization_id,
       scopes: :scopes,
+      auth_method: :auth_method,
+      api_key_last_4: :api_key_last_4,
       state: :state,
+      established_by_user_id: :established_by_user_id,
+      state_reason: :state_reason,
       created_at: :created_at,
       updated_at: :updated_at
     }.freeze
@@ -20,12 +27,19 @@ module WorkOS
     attr_accessor \
       :object,
       :id,
+      :connection_role,
+      :account_identifier,
+      :account_display_name,
       :data_integration_id,
       :provider_slug,
       :user_id,
       :organization_id,
       :scopes,
+      :auth_method,
+      :api_key_last_4,
       :state,
+      :established_by_user_id,
+      :state_reason,
       :created_at,
       :updated_at
 
@@ -33,12 +47,19 @@ module WorkOS
       hash = self.class.normalize(json)
       @object = hash[:object]
       @id = hash[:id]
+      @connection_role = hash[:connection_role]
+      @account_identifier = hash[:account_identifier]
+      @account_display_name = hash[:account_display_name]
       @data_integration_id = hash[:data_integration_id]
       @provider_slug = hash[:provider_slug]
       @user_id = hash[:user_id]
       @organization_id = hash[:organization_id]
       @scopes = hash[:scopes] || []
+      @auth_method = hash[:auth_method]
+      @api_key_last_4 = hash[:api_key_last_4]
       @state = hash[:state]
+      @established_by_user_id = hash[:established_by_user_id]
+      @state_reason = hash[:state_reason]
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]
     end

data/lib/workos/shared/pipes_account_connection_add_failed.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesAccountConnectionAddFailed < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipesAccountConnectionAddFailedData.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/shared/pipes_account_connection_add_failed_data.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesAccountConnectionAddFailedData < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      data_integration_id: :data_integration_id,
+      provider_slug: :provider_slug,
+      user_id: :user_id,
+      organization_id: :organization_id,
+      account_identifier: :account_identifier,
+      error_code: :error_code,
+      error_reason: :error_reason,
+      provider_error: :provider_error,
+      provider_error_description: :provider_error_description,
+      created_at: :created_at
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :data_integration_id,
+      :provider_slug,
+      :user_id,
+      :organization_id,
+      :account_identifier,
+      :error_code,
+      :error_reason,
+      :provider_error,
+      :provider_error_description,
+      :created_at
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @data_integration_id = hash[:data_integration_id]
+      @provider_slug = hash[:provider_slug]
+      @user_id = hash[:user_id]
+      @organization_id = hash[:organization_id]
+      @account_identifier = hash[:account_identifier]
+      @error_code = hash[:error_code]
+      @error_reason = hash[:error_reason]
+      @provider_error = hash[:provider_error]
+      @provider_error_description = hash[:provider_error_description]
+      @created_at = hash[:created_at]
+    end
+  end
+end

data/lib/workos/shared/pipes_account_connection_connected.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesAccountConnectionConnected < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipeConnectedAccount.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/shared/pipes_account_connection_connection_failed.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesAccountConnectionConnectionFailed < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipesAccountConnectionConnectionFailedData.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/shared/pipes_account_connection_connection_failed_data.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  PipesAccountConnectionConnectionFailedData = PipesAccountConnectionAddFailedData
+end

data/lib/workos/shared/pipes_account_connection_disconnected.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesAccountConnectionDisconnected < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipeConnectedAccount.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/shared/pipes_account_connection_reauthorization_needed.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesAccountConnectionReauthorizationNeeded < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipeConnectedAccount.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/shared/pipes_connected_account_connection_failed_data.rb

@@ -3,44 +3,5 @@
 # This file is auto-generated by oagen. Do not edit.
 
 module WorkOS
-  class PipesConnectedAccountConnectionFailedData < WorkOS::Types::BaseModel
-    HASH_ATTRS = {
-      object: :object,
-      data_integration_id: :data_integration_id,
-      provider_slug: :provider_slug,
-      user_id: :user_id,
-      organization_id: :organization_id,
-      error_code: :error_code,
-      error_reason: :error_reason,
-      provider_error: :provider_error,
-      provider_error_description: :provider_error_description,
-      created_at: :created_at
-    }.freeze
-
-    attr_accessor \
-      :object,
-      :data_integration_id,
-      :provider_slug,
-      :user_id,
-      :organization_id,
-      :error_code,
-      :error_reason,
-      :provider_error,
-      :provider_error_description,
-      :created_at
-
-    def initialize(json)
-      hash = self.class.normalize(json)
-      @object = hash[:object]
-      @data_integration_id = hash[:data_integration_id]
-      @provider_slug = hash[:provider_slug]
-      @user_id = hash[:user_id]
-      @organization_id = hash[:organization_id]
-      @error_code = hash[:error_code]
-      @error_reason = hash[:error_reason]
-      @provider_error = hash[:provider_error]
-      @provider_error_description = hash[:provider_error_description]
-      @created_at = hash[:created_at]
-    end
-  end
+  PipesConnectedAccountConnectionFailedData = PipesAccountConnectionAddFailedData
 end

data/lib/workos/sso/token_query.rb

@@ -9,6 +9,7 @@ module WorkOS
       client_secret: :client_secret,
       code: :code,
       grant_type: :grant_type,
+      code_verifier: :code_verifier,
       subject_token: :subject_token,
       subject_token_type: :subject_token_type,
       organization_id: :organization_id
@@ -19,6 +20,7 @@ module WorkOS
       :client_secret,
       :code,
       :grant_type,
+      :code_verifier,
       :subject_token,
       :subject_token_type,
       :organization_id
@@ -29,6 +31,7 @@ module WorkOS
       @client_secret = hash[:client_secret]
       @code = hash[:code]
       @grant_type = hash[:grant_type]
+      @code_verifier = hash[:code_verifier]
       @subject_token = hash[:subject_token]
       @subject_token_type = hash[:subject_token_type]
       @organization_id = hash[:organization_id]

data/lib/workos/sso.rb

@@ -507,6 +507,7 @@ module WorkOS
 
     # Get a Profile and Token
     # @param code [String, nil] The authorization code received from the authorization callback. Required when `grant_type` is `authorization_code`.
+    # @param code_verifier [String, nil] The PKCE code verifier matching the `code_challenge` sent with the authorization request. Required when the authorization request included a `code_challenge`. Must be sent in the request body.
     # @param subject_token [String, nil] The OIDC ID token to exchange. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body.
     # @param subject_token_type [String, nil] The type of the subject token. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body.
     # @param organization_id [String, nil] The ID of the organization whose connection the subject token is validated against. Required when `grant_type` is `urn:ietf:params:oauth:grant-type:token-exchange`. Must be sent in the request body.
@@ -514,6 +515,7 @@ module WorkOS
     # @return [WorkOS::SSOTokenResponse]
     def get_profile_and_token(
       code: nil,
+      code_verifier: nil,
       subject_token: nil,
       subject_token_type: nil,
       organization_id: nil,
@@ -524,6 +526,7 @@ module WorkOS
         "client_id" => request_options[:client_id] || @client.client_id,
         "client_secret" => request_options[:api_key] || @client.api_key,
         "code" => code,
+        "code_verifier" => code_verifier,
         "subject_token" => subject_token,
         "subject_token_type" => subject_token_type,
         "organization_id" => organization_id

data/lib/workos/types/add_data_integrations_get_data_integration_authorize_url_request_connection_owner.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AddDataIntegrationsGetDataIntegrationAuthorizeUrlRequestConnectionOwner
+      USER = "user"
+      ORGANIZATION = "organization"
+      ALL = [USER, ORGANIZATION].freeze
+    end
+  end
+end

data/lib/workos/types/agent_blueprint_created_data_invocable_as_instance_types.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class AgentBlueprintCreatedDataInvocableAsInstanceTypes
+      DELEGATED = "delegated"
+      AUTONOMOUS = "autonomous"
+      ALL = [DELEGATED, AUTONOMOUS].freeze
+    end
+  end
+end

data/lib/workos/types/agent_blueprint_invocable_as_instance_types.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    AgentBlueprintInvocableAsInstanceTypes = AgentBlueprintCreatedDataInvocableAsInstanceTypes
+  end
+end

data/lib/workos/types/agent_blueprint_updated_data_invocable_as_instance_types.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    AgentBlueprintUpdatedDataInvocableAsInstanceTypes = AgentBlueprintCreatedDataInvocableAsInstanceTypes
+  end
+end

data/lib/workos/types/agent_blueprints_create_request_invocable_as_instance_types.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    AgentBlueprintsCreateRequestInvocableAsInstanceTypes = AgentBlueprintCreatedDataInvocableAsInstanceTypes
+  end
+end

data/lib/workos/types/agent_blueprints_update_request_invocable_as_instance_types.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    AgentBlueprintsUpdateRequestInvocableAsInstanceTypes = AgentBlueprintCreatedDataInvocableAsInstanceTypes
+  end
+end

data/lib/workos/types/agent_instance_created_data_type.rb

@@ -4,10 +4,6 @@
 
 module WorkOS
   module Types
-    class AgentInstanceCreatedDataType
-      DELEGATED = "delegated"
-      AUTONOMOUS = "autonomous"
-      ALL = [DELEGATED, AUTONOMOUS].freeze
-    end
+    AgentInstanceCreatedDataType = AgentBlueprintCreatedDataInvocableAsInstanceTypes
   end
 end

data/lib/workos/types/agent_instance_deleted_data_type.rb

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    AgentInstanceDeletedDataType = AgentInstanceCreatedDataType
+    AgentInstanceDeletedDataType = AgentBlueprintCreatedDataInvocableAsInstanceTypes
   end
 end

data/lib/workos/types/agent_instance_type.rb

@@ -4,6 +4,6 @@
 
 module WorkOS
   module Types
-    AgentInstanceType = AgentInstanceCreatedDataType
+    AgentInstanceType = AgentBlueprintCreatedDataInvocableAsInstanceTypes
   end
 end

data/lib/workos/types/connected_account_connection_role.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  module Types
+    class ConnectedAccountConnectionRole
+      COMPATIBILITY = "compatibility"
+      STANDARD = "standard"
+      ALL = [COMPATIBILITY, STANDARD].freeze
+    end
+  end
+end