workos 5.12.0 → 5.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6852c01440a63d103cd39a4c0aee2eeb5d1215d79a3e8eb2a3053b5aa3f3376e
-  data.tar.gz: 71c5c53d1f8fc5219903cfcfc23cbeb657da1db2c64980fa9d8914bd6ae92b1d
+  metadata.gz: 6183009c18af059a5674bf77c72ec94126a2bafb5f8e4dda14aeaf892f3f8718
+  data.tar.gz: 268cc5ee7e878a4b85100c0e546db98d8a55dbffeb21f993c67265c029c99a4b
 SHA512:
-  metadata.gz: eb001da89bc0cf2866dcfd4d4c5207ddc7c960538ab413c45fcd5d5f80e4c97e205cc0e3fb51bdaaf8af984e9e30ad5c317c30e453c8e6579c1914350dfe3f2c
-  data.tar.gz: 5fe92a1ad40c3bced46b0597430b02ea36b20c82f109614df332695aa7d9f613a025e0f30d3afcaab978c5b3de6882a3a67886e55343de513fb508950664a5d3
+  metadata.gz: dfe47d29f7d33d94ef521e773706e50defed072831386333c10f32b81d60687ffe67519e09c208be7e9c3d5f04cc56e74ef100cc340ea5f653241e636cd32e7e
+  data.tar.gz: '0036088e5ccee84780ce0e223ca64f8da917024322da5969771eaf5c103f2c5a3a3aab4da805f9111041c803bdd7351280edd39bfeb60ac3f2540b29d8eb4696'

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (5.12.0)
+    workos (5.14.0)
       encryptor (~> 3.0)
       jwt (~> 2.8)
 

data/lib/workos/session.rb

@@ -50,6 +50,7 @@ module WorkOS
         organization_id: decoded['org_id'],
         role: decoded['role'],
         permissions: decoded['permissions'],
+        entitlements: decoded['entitlements'],
         user: session[:user],
         impersonator: session[:impersonator],
         reason: nil,

data/lib/workos/types/intent.rb

@@ -7,11 +7,12 @@ module WorkOS
     module Intent
       AUDIT_LOGS = 'audit_logs'
       CERTIFICATE_RENEWAL = 'certificate_renewal'
+      DOMAIN_VERIFICATION = 'domain_verification'
       DSYNC = 'dsync'
       LOG_STREAMS = 'log_streams'
       SSO = 'sso'
 
-      ALL = [AUDIT_LOGS, CERTIFICATE_RENEWAL, DSYNC, LOG_STREAMS, SSO].freeze
+      ALL = [AUDIT_LOGS, CERTIFICATE_RENEWAL, DOMAIN_VERIFICATION, DSYNC, LOG_STREAMS, SSO].freeze
     end
   end
 end

data/lib/workos/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module WorkOS
-  VERSION = '5.12.0'
+  VERSION = '5.14.0'
 end

data/spec/lib/workos/portal_spec.rb

@@ -68,6 +68,21 @@ describe WorkOS::Portal do
       end
     end
 
+    describe 'with the domain_verification intent' do
+      it 'returns an Admin Portal link' do
+        VCR.use_cassette 'portal/generate_link_domain_verification', match_requests_on: %i[path body] do
+          portal_link = described_class.generate_link(
+            intent: 'domain_verification',
+            organization: organization,
+          )
+
+          expect(portal_link).to eq(
+            'https://id.workos.com/portal/launch?secret=secret',
+          )
+        end
+      end
+    end
+
     describe 'with an invalid organization' do
       it 'raises an error' do
         VCR.use_cassette 'portal/generate_link_invalid' do

data/spec/lib/workos/session_spec.rb

@@ -103,24 +103,23 @@ describe WorkOS::Session do
 
   describe '.authenticate' do
     let(:user_management) { instance_double('UserManagement') }
-    let(:valid_access_token) do
-      payload = {
+    let(:payload) do
+      {
         sid: 'session_id',
         org_id: 'org_id',
         role: 'role',
         permissions: ['read'],
         exp: Time.now.to_i + 3600,
       }
-      headers = { kid: jwk[:kid] }
-      JWT.encode(payload, jwk.signing_key, jwk[:alg], headers)
     end
+    let(:valid_access_token) { JWT.encode(payload, jwk.signing_key, jwk[:alg], { kid: jwk[:kid] }) }
     let(:session_data) do
-  WorkOS::Session.seal_data({
-                              access_token: valid_access_token,
-                              user: 'user',
-                              impersonator: 'impersonator',
-                            }, cookie_password,)
-end
+      WorkOS::Session.seal_data({
+                                  access_token: valid_access_token,
+                                  user: 'user',
+                                  impersonator: 'impersonator',
+                                }, cookie_password,)
+    end
 
     before do
       allow(user_management).to receive(:get_jwks_url).with(client_id).and_return(jwks_url)
@@ -167,14 +166,7 @@ end
         session_data: session_data,
         cookie_password: cookie_password,
       )
-      allow(session).to receive(:is_valid_jwt).and_return(true)
-      allow(JWT).to receive(:decode).and_return([{
-                                                  'sid' => 'session_id',
-                                                  'org_id' => 'org_id',
-                                                  'role' => 'role',
-                                                  'permissions' => ['read'],
-                                                }])
-
+      allow_any_instance_of(JWT::Decode).to receive(:verify_signature).and_return(true)
       result = session.authenticate
       expect(result).to eq({
                              authenticated: true,
@@ -182,11 +174,47 @@ end
                              organization_id: 'org_id',
                              role: 'role',
                              permissions: ['read'],
+                             entitlements: nil,
                              user: 'user',
                              impersonator: 'impersonator',
                              reason: nil,
                            })
     end
+
+    describe 'with entitlements' do
+      let(:payload) do
+        {
+          sid: 'session_id',
+          org_id: 'org_id',
+          role: 'role',
+          permissions: ['read'],
+          entitlements: ['billing'],
+          exp: Time.now.to_i + 3600,
+        }
+      end
+
+      it 'includes entitlements in the result' do
+        session = WorkOS::Session.new(
+          user_management: user_management,
+          client_id: client_id,
+          session_data: session_data,
+          cookie_password: cookie_password,
+        )
+        allow_any_instance_of(JWT::Decode).to receive(:verify_signature).and_return(true)
+        result = session.authenticate
+        expect(result).to eq({
+                               authenticated: true,
+                               session_id: 'session_id',
+                               organization_id: 'org_id',
+                               role: 'role',
+                               permissions: ['read'],
+                               entitlements: ['billing'],
+                               user: 'user',
+                               impersonator: 'impersonator',
+                               reason: nil,
+                             })
+      end
+    end
   end
 
   describe '.refresh' do

data/spec/support/fixtures/vcr_cassettes/portal/generate_link_domain_verification.yml

@@ -0,0 +1,72 @@
+---
+http_interactions:
+- request:
+    method: post
+    uri: https://api.workos.com/portal/generate_link
+    body:
+      encoding: UTF-8
+      string: '{"intent":"domain_verification","organization":"org_01EHQMYV6MBK39QC5PZXHY59C3","return_url":null,"success_url":null}'
+    headers:
+      Content-Type:
+      - application/json
+      Accept-Encoding:
+      - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+      Accept:
+      - "*/*"
+      User-Agent:
+      - WorkOS; ruby/2.7.1; x86_64-darwin19; v0.5.0
+      Authorization:
+      - Bearer <API_KEY>
+  response:
+    status:
+      code: 201
+      message: Created
+    headers:
+      Server:
+      - Cowboy
+      Connection:
+      - keep-alive
+      Vary:
+      - Origin, Accept-Encoding
+      Access-Control-Allow-Credentials:
+      - 'true'
+      Content-Security-Policy:
+      - 'default-src ''self'';base-uri ''self'';block-all-mixed-content;font-src ''self''
+        https: data:;frame-ancestors ''self'';img-src ''self'' data:;object-src ''none'';script-src
+        ''self'';script-src-attr ''none'';style-src ''self'' https: ''unsafe-inline'';upgrade-insecure-requests'
+      X-Dns-Prefetch-Control:
+      - 'off'
+      Expect-Ct:
+      - max-age=0
+      X-Frame-Options:
+      - SAMEORIGIN
+      Strict-Transport-Security:
+      - max-age=15552000; includeSubDomains
+      X-Download-Options:
+      - noopen
+      X-Content-Type-Options:
+      - nosniff
+      X-Permitted-Cross-Domain-Policies:
+      - none
+      Referrer-Policy:
+      - no-referrer
+      X-Xss-Protection:
+      - '0'
+      X-Request-Id:
+      - cb9ad5cf-243a-4084-a4f6-2d7d2b097b8b
+      Content-Type:
+      - application/json; charset=utf-8
+      Content-Length:
+      - '79'
+      Etag:
+      - W/"4f-NN86NUZRu/GQgPAYTexTS6/9DnM"
+      Date:
+      - Wed, 09 Sep 2020 23:43:07 GMT
+      Via:
+      - 1.1 vegur
+    body:
+      encoding: UTF-8
+      string: '{"link":"https://id.workos.com/portal/launch?secret=secret"}'
+    http_version:
+  recorded_at: Wed, 09 Sep 2020 23:43:07 GMT
+recorded_with: VCR 5.0.0

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 5.12.0
+  version: 5.14.0
 platform: ruby
 authors:
 - WorkOS
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-23 00:00:00.000000000 Z
+date: 2025-02-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: encryptor
@@ -281,6 +281,7 @@ files:
 - spec/support/fixtures/vcr_cassettes/passwordless/send_session_invalid.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_audit_logs.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_certificate_renewal.yml
+- spec/support/fixtures/vcr_cassettes/portal/generate_link_domain_verification.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_dsync.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_invalid.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_sso.yml
@@ -502,6 +503,7 @@ test_files:
 - spec/support/fixtures/vcr_cassettes/passwordless/send_session_invalid.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_audit_logs.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_certificate_renewal.yml
+- spec/support/fixtures/vcr_cassettes/portal/generate_link_domain_verification.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_dsync.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_invalid.yml
 - spec/support/fixtures/vcr_cassettes/portal/generate_link_sso.yml