workos 6.1.0 → 7.0.0

data/lib/workos/radar.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "json"
+
+module WorkOS
+  class Radar
+    def initialize(client)
+      @client = client
+    end
+
+    # Create an attempt
+    # @param ip_address [String] The IP address of the request to assess.
+    # @param user_agent [String] The user agent string of the request to assess.
+    # @param email [String] The email address of the user making the request.
+    # @param auth_method [WorkOS::Types::RadarStandaloneAssessRequestAuthMethod] The authentication method being used.
+    # @param action [WorkOS::Types::RadarStandaloneAssessRequestAction] The action being performed.
+    # @param device_fingerprint [String, nil] An optional device fingerprint for the request.
+    # @param bot_score [String, nil] An optional bot detection score for the request.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::RadarStandaloneResponse]
+    def create_attempt(
+      ip_address:,
+      user_agent:,
+      email:,
+      auth_method:,
+      action:,
+      device_fingerprint: nil,
+      bot_score: nil,
+      request_options: {}
+    )
+      body = {
+        "ip_address" => ip_address,
+        "user_agent" => user_agent,
+        "email" => email,
+        "auth_method" => auth_method,
+        "action" => action,
+        "device_fingerprint" => device_fingerprint,
+        "bot_score" => bot_score
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/radar/attempts",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::RadarStandaloneResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Update a Radar attempt
+    # @param id [String] The unique identifier of the Radar attempt to update.
+    # @param challenge_status [String, nil] Set to `"success"` to mark the challenge as completed.
+    # @param attempt_status [String, nil] Set to `"success"` to mark the authentication attempt as successful.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def update_attempt(
+      id:,
+      challenge_status: nil,
+      attempt_status: nil,
+      request_options: {}
+    )
+      body = {
+        "challenge_status" => challenge_status,
+        "attempt_status" => attempt_status
+      }.compact
+      @client.request(
+        method: :put,
+        path: "/radar/attempts/#{WorkOS::Util.encode_path(id)}",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      nil
+    end
+
+    # Add an entry to a Radar list
+    # @param type [WorkOS::Types::RadarType] The type of the Radar list (e.g. ip_address, domain, email).
+    # @param action [WorkOS::Types::RadarAction] The list action indicating whether to add the entry to the allow or block list.
+    # @param entry [String] The value to add to the list. Must match the format of the list type (e.g. a valid IP address for `ip_address`, a valid email for `email`).
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::RadarListEntryAlreadyPresentResponse]
+    def add_list_entry(
+      type:,
+      action:,
+      entry:,
+      request_options: {}
+    )
+      body = {
+        "entry" => entry
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/radar/lists/#{WorkOS::Util.encode_path(type)}/#{WorkOS::Util.encode_path(action)}",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::RadarListEntryAlreadyPresentResponse.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
+    # Remove an entry from a Radar list
+    # @param type [WorkOS::Types::RadarType] The type of the Radar list (e.g. ip_address, domain, email).
+    # @param action [WorkOS::Types::RadarAction] The list action indicating whether to remove the entry from the allow or block list.
+    # @param entry [String] The value to remove from the list. Must match an existing entry.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [void]
+    def remove_list_entry(
+      type:,
+      action:,
+      entry:,
+      request_options: {}
+    )
+      body = {
+        "entry" => entry
+      }.compact
+      @client.request(
+        method: :delete,
+        path: "/radar/lists/#{WorkOS::Util.encode_path(type)}/#{WorkOS::Util.encode_path(action)}",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      nil
+    end
+  end
+end

data/lib/workos/session.rb

@@ -1,187 +1,135 @@
 # frozen_string_literal: true
 
-require 'jwt'
-require 'uri'
-require 'net/http'
-require 'encryptor'
-require 'securerandom'
-require 'json'
-require 'uri'
+# @oagen-ignore-file
+# Hand-maintained Session object. Constructed by SessionManager#load.
+require "json"
+require "jwt"
+require "openssl"
+require "uri"
 
 module WorkOS
-  # The Session class provides helper methods for working with WorkOS sessions
-  # This class is not meant to be instantiated in a user space, and is instantiated internally but exposed.
+  # Wraps a sealed session cookie for authentication, refresh, and logout.
+  # Constructed by {SessionManager#load}; not intended for direct instantiation.
+  #
+  # @example Authenticate and refresh
+  #   session = client.session_manager.load(seal_data: cookie, cookie_password: pw)
+  #   result = session.authenticate
+  #   if result.is_a?(SessionManager::AuthError) && result.reason == SessionManager::EXPIRED_JWT
+  #     refresh = session.refresh
+  #   end
+  #
+  # @example Build a logout URL
+  #   url = session.get_logout_url(return_to: "https://app.example.com")
   class Session
-    attr_accessor :jwks, :jwks_algorithms, :user_management, :cookie_password, :session_data, :client_id, :encryptor
-
-    def initialize(user_management:, client_id:, session_data:, cookie_password:, encryptor: nil)
-      raise ArgumentError, 'cookiePassword is required' if cookie_password.nil? || cookie_password.empty?
-
-      @encryptor = encryptor || WorkOS::Encryptors::AesGcm.new
-      validate_encryptor!(@encryptor)
-
-      @user_management = user_management
+    def initialize(manager, seal_data:, cookie_password:)
+      raise ArgumentError, "cookie_password is required" if cookie_password.nil? || cookie_password.empty?
+      @manager = manager
+      @client = manager.client
+      @seal_data = seal_data
       @cookie_password = cookie_password
-      @session_data = session_data
-      @client_id = client_id
-
-      @jwks = Cache.fetch("jwks_#{client_id}", expires_in: 5 * 60) do
-        create_remote_jwk_set(URI(@user_management.get_jwks_url(client_id)))
-      end
-      @jwks_algorithms = @jwks.map { |key| key[:alg] }.compact.uniq
     end
 
+    attr_reader :seal_data, :cookie_password
+
     # Authenticates the user based on the session data
     # @param include_expired [Boolean] If true, returns decoded token data even when expired (default: false)
     # @param block [Proc] Optional block to call to extract additional claims from the decoded JWT
     # @return [Hash] A hash containing the authentication response and a reason if the authentication failed
-    # rubocop:disable Metrics/AbcSize, Metrics/PerceivedComplexity
     def authenticate(include_expired: false, &claim_extractor)
-      return { authenticated: false, reason: 'NO_SESSION_COOKIE_PROVIDED' } if @session_data.nil?
+      return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::NO_SESSION_COOKIE_PROVIDED) if @seal_data.nil? || @seal_data.empty?
 
-      begin
-        session = Session.unseal_data(@session_data, @cookie_password, encryptor: @encryptor)
-      rescue StandardError
-        return { authenticated: false, reason: 'INVALID_SESSION_COOKIE' }
+      session = begin
+        @manager.unseal_data(@seal_data, @cookie_password)
+      rescue ArgumentError, OpenSSL::Cipher::CipherError
+        return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::INVALID_SESSION_COOKIE)
       end
-
-      return { authenticated: false, reason: 'INVALID_SESSION_COOKIE' } unless session[:access_token]
-
-      begin
-        decoded = JWT.decode(
-          session[:access_token],
-          nil,
-          true,
-          algorithms: @jwks_algorithms,
-          jwks: @jwks,
-          verify_expiration: false,
-        ).first
-
-        expired = decoded['exp'] && decoded['exp'] < Time.now.to_i
-
-        # Early return for expired tokens when not including expired data (backward compatible)
-        return { authenticated: false, reason: 'INVALID_JWT' } if expired && !include_expired
-
-        # Return full data for valid tokens or when include_expired is true
-        result = {
-          authenticated: !expired,
-          session_id: decoded['sid'],
-          organization_id: decoded['org_id'],
-          role: decoded['role'],
-          roles: decoded['roles'],
-          permissions: decoded['permissions'],
-          entitlements: decoded['entitlements'],
-          feature_flags: decoded['feature_flags'],
-          user: session[:user],
-          impersonator: session[:impersonator],
-          reason: expired ? 'INVALID_JWT' : nil,
-        }
-        result.merge!(claim_extractor.call(decoded)) if block_given?
-        result
+      return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::INVALID_SESSION_COOKIE) unless session.is_a?(Hash) && session["access_token"]
+
+      decoded = begin
+        @manager.decode_jwt(session["access_token"], verify_expiration: !include_expired)
+      rescue JWT::ExpiredSignature
+        return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::EXPIRED_JWT)
+      rescue JWT::IncorrectAlgorithm
+        return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::INVALID_JWT_ALGORITHM)
+      rescue JWT::VerificationError
+        return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::INVALID_JWT_SIGNATURE)
       rescue JWT::DecodeError
-        { authenticated: false, reason: 'INVALID_JWT' }
-      rescue StandardError => e
-        { authenticated: false, reason: e.message }
-      end
-    end
-
-    # Refreshes the session data using the refresh token stored in the session data
-    # @param options [Hash] Options for refreshing the session
-    # @option options [String] :cookie_password The password to use for unsealing the session data
-    # @option options [String] :organization_id The organization ID to use for refreshing the session
-    # @return [Hash] A hash containing a new sealed session, the authentication response,
-    # and a reason if the refresh failed
-    def refresh(options = nil)
-      cookie_password = options.nil? || options[:cookie_password].nil? ? @cookie_password : options[:cookie_password]
-
-      begin
-        session = Session.unseal_data(@session_data, cookie_password, encryptor: @encryptor)
-      rescue StandardError
-        return { authenticated: false, reason: 'INVALID_SESSION_COOKIE' }
+        return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::INVALID_JWT)
       end
 
-      return { authenticated: false, reason: 'INVALID_SESSION_COOKIE' } unless session[:refresh_token] && session[:user]
-
-      begin
-        auth_response = @user_management.authenticate_with_refresh_token(
-          client_id: @client_id,
-          refresh_token: session[:refresh_token],
-          organization_id: options.nil? || options[:organization_id].nil? ? nil : options[:organization_id],
-          session: { seal_session: true, cookie_password: cookie_password, encryptor: @encryptor },
-        )
-
-        @session_data = auth_response.sealed_session
-        @cookie_password = cookie_password
-
-        {
-          authenticated: true,
-          sealed_session: auth_response.sealed_session,
-          session: auth_response,
-          reason: nil,
-        }
-      rescue StandardError => e
-        { authenticated: false, reason: e.message }
-      end
+      is_expired = decoded["exp"] && decoded["exp"] < Time.now.to_i
+
+      SessionManager::AuthSuccess.new(
+        authenticated: !is_expired,
+        reason: is_expired ? SessionManager::EXPIRED_JWT : nil,
+        session_id: decoded["sid"],
+        organization_id: decoded["org_id"],
+        role: decoded["role"],
+        roles: decoded["roles"],
+        permissions: decoded["permissions"],
+        entitlements: decoded["entitlements"],
+        user: session["user"],
+        impersonator: session["impersonator"],
+        feature_flags: decoded["feature_flags"],
+        custom_claims: claim_extractor&.call(decoded)
+      )
     end
-    # rubocop:enable Metrics/AbcSize
-    # rubocop:enable Metrics/CyclomaticComplexity
-    # rubocop:enable Metrics/PerceivedComplexity
 
-    # Returns a URL to redirect the user to for logging out
-    # @param return_to [String] The URL to redirect the user to after logging out
-    # @return [String] The URL to redirect the user to for logging out
-    def get_logout_url(return_to: nil)
-      auth_response = authenticate
+    def refresh(organization_id: nil, cookie_password: nil)
+      effective_password = cookie_password || @cookie_password
 
-      unless auth_response[:authenticated]
-        raise "Failed to extract session ID for logout URL: #{auth_response[:reason]}"
+      session = begin
+        @manager.unseal_data(@seal_data, effective_password)
+      rescue ArgumentError, OpenSSL::Cipher::CipherError
+        return SessionManager::RefreshError.new(authenticated: false, reason: SessionManager::INVALID_SESSION_COOKIE)
       end
-
-      @user_management.get_logout_url(session_id: auth_response[:session_id], return_to: return_to)
-    end
-
-    # Encrypts and seals data using the provided encryptor (defaults to AES-256-GCM)
-    # @param data [Hash] The data to seal
-    # @param key [String] The key to use for encryption
-    # @param encryptor [Object] Optional encryptor that responds to #seal(data, key)
-    # @return [String] The sealed data
-    def self.seal_data(data, key, encryptor: nil)
-      enc = encryptor || WorkOS::Encryptors::AesGcm.new
-      enc.seal(data, key)
-    end
-
-    # Decrypts and unseals data using the provided encryptor (defaults to AES-256-GCM)
-    # @param sealed_data [String] The sealed data to unseal
-    # @param key [String] The key to use for decryption
-    # @param encryptor [Object] Optional encryptor that responds to #unseal(sealed_data, key)
-    # @return [Hash] The unsealed data
-    def self.unseal_data(sealed_data, key, encryptor: nil)
-      enc = encryptor || WorkOS::Encryptors::AesGcm.new
-      enc.unseal(sealed_data, key)
+      return SessionManager::RefreshError.new(authenticated: false, reason: SessionManager::INVALID_SESSION_COOKIE) unless session.is_a?(Hash) && session["refresh_token"]
+
+      # Uses auth: true (Bearer token) to match authenticate_with_refresh_token.
+      # client_id is included in the body as required by the OAuth2 token exchange.
+      body = {
+        "grant_type" => "refresh_token",
+        "client_id" => @client.client_id,
+        "refresh_token" => session["refresh_token"],
+        "session" => {"seal_session" => true, "cookie_password" => effective_password}
+      }
+      body["organization_id"] = organization_id if organization_id
+
+      response = @client.request(method: :post, path: "/user_management/authenticate", auth: true, body: body)
+      auth_response = JSON.parse(response.body)
+      sealed = auth_response["sealed_session"].to_s
+      @seal_data = sealed
+      @cookie_password = effective_password
+
+      decoded = @manager.decode_jwt(auth_response["access_token"])
+      SessionManager::RefreshSuccess.new(
+        authenticated: true,
+        sealed_session: sealed,
+        session_id: decoded["sid"],
+        organization_id: decoded["org_id"],
+        role: decoded["role"],
+        roles: decoded["roles"],
+        permissions: decoded["permissions"],
+        entitlements: decoded["entitlements"],
+        user: auth_response["user"],
+        impersonator: auth_response["impersonator"],
+        feature_flags: decoded["feature_flags"]
+      )
+    rescue WorkOS::AuthenticationError, WorkOS::InvalidRequestError => e
+      SessionManager::RefreshError.new(authenticated: false, reason: e.message)
     end
 
-    private
-
-    def validate_encryptor!(enc)
-      return if enc.respond_to?(:seal) && enc.respond_to?(:unseal)
-
-      raise ArgumentError, 'encryptor must respond to #seal(data, key) and #unseal(sealed_data, key)'
-    end
-
-    # Creates a JWKS set from a remote JWKS URL
-    # @param uri [URI] The URI of the JWKS
-    # @return [JWT::JWK::Set] The JWKS set
-    def create_remote_jwk_set(uri)
-      # Fetch the JWKS from the remote URL
-      response = Net::HTTP.get(uri)
-
-      jwks_hash = JSON.parse(response)
-      jwks = JWT::JWK::Set.new(jwks_hash)
-
-      # filter jwks so it only returns the keys where 'use' is equal to 'sig'
-      jwks.keys.select! { |key| key[:use] == 'sig' }
-
-      jwks
+    # Build the WorkOS session-logout URL for the currently authenticated session.
+    # Requires #authenticate to succeed (so we have the session_id).
+    def get_logout_url(return_to: nil)
+      result = authenticate
+      raise WorkOS::Error.new(message: "Failed to extract session ID for logout URL: #{result.reason}") if result.is_a?(SessionManager::AuthError)
+      base = @client.base_url
+      params = {"session_id" => result.session_id}
+      params["return_to"] = return_to if return_to
+      uri = URI.join(base, "/user_management/sessions/logout")
+      uri.query = URI.encode_www_form(params)
+      uri.to_s
     end
   end
 end

data/lib/workos/session_manager.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+
+# @oagen-ignore-file
+# Hand-maintained session-cookie helpers (H04-H07, H13):
+#   - SessionManager#load(seal_data:, cookie_password:)  -> Session (H04)
+#   - SessionManager#authenticate / #refresh             -> inline convenience (H05)
+#   - SessionManager#seal_data / #unseal_data            -> raw seal/unseal (H06)
+#   - SessionManager#seal_session_from_auth_response     -> H07
+#   - Session#authenticate / #refresh / #get_logout_url
+#
+# Symmetric encryption: AES-256-GCM by default. Users may supply a custom
+# encryptor (any object responding to `seal(data, key)` and `unseal(sealed, key)`)
+# for compatibility with other sealing formats (e.g. Iron/Next.js).
+
+require "json"
+require "jwt"
+
+module WorkOS
+  # Manages sealed-session lifecycle: loading, authenticating, refreshing,
+  # and sealing sessions from authentication responses.
+  #
+  # @example Load and authenticate a session
+  #   session = client.session_manager.load(
+  #     seal_data: cookies["wos-session"],
+  #     cookie_password: ENV["COOKIE_PASSWORD"]
+  #   )
+  #   result = session.authenticate
+  #
+  # @example Seal a session from an auth response
+  #   sealed = client.session_manager.seal_session_from_auth_response(
+  #     access_token: response.access_token,
+  #     refresh_token: response.refresh_token,
+  #     cookie_password: ENV["COOKIE_PASSWORD"]
+  #   )
+  class SessionManager
+    JWK_ALGORITHMS = ["RS256"].freeze
+
+    # H04 success / failure shapes — kept minimal & frozen.
+    class AuthSuccess
+      RESERVED_KEYS = [
+        :authenticated, :reason, :session_id, :organization_id, :role, :roles,
+        :permissions, :entitlements, :user, :impersonator, :feature_flags
+      ].freeze
+
+      attr_reader(*RESERVED_KEYS)
+
+      def initialize(
+        authenticated:,
+        session_id:, organization_id:, role:, roles:, permissions:, entitlements:, user:, impersonator:, feature_flags:, reason: nil,
+        custom_claims: nil
+      )
+        @authenticated = authenticated
+        @reason = reason
+        @session_id = session_id
+        @organization_id = organization_id
+        @role = role
+        @roles = roles
+        @permissions = permissions
+        @entitlements = entitlements
+        @user = user
+        @impersonator = impersonator
+        @feature_flags = feature_flags
+        @custom_claims = normalize_custom_claims(custom_claims)
+        define_custom_claim_readers(@custom_claims)
+      end
+
+      def [](key)
+        sym_key = key.to_sym
+        return public_send(sym_key) if RESERVED_KEYS.include?(sym_key)
+
+        @custom_claims[sym_key]
+      end
+
+      def to_h
+        RESERVED_KEYS.to_h { |key| [key, public_send(key)] }.merge(@custom_claims)
+      end
+
+      private
+
+      def define_custom_claim_readers(claims)
+        claims.each_key do |key|
+          next if respond_to?(key)
+
+          define_singleton_method(key) { @custom_claims[key] }
+        end
+      end
+
+      def normalize_custom_claims(custom_claims)
+        return {} if custom_claims.nil?
+        raise ArgumentError, "claim_extractor must return a Hash" unless custom_claims.is_a?(Hash)
+
+        claims = custom_claims.each_with_object({}) do |(key, value), memo|
+          sym_key = key.to_sym
+          if RESERVED_KEYS.include?(sym_key)
+            raise ArgumentError, "claim_extractor cannot overwrite reserved key #{sym_key.inspect}"
+          end
+
+          memo[sym_key] = value
+        end
+        claims.freeze
+      end
+    end
+    AuthError = Struct.new(:authenticated, :reason, keyword_init: true)
+
+    RefreshSuccess = Struct.new(
+      :authenticated, :sealed_session, :session_id, :organization_id, :role,
+      :roles, :permissions, :entitlements, :user, :impersonator, :feature_flags,
+      keyword_init: true
+    )
+    RefreshError = Struct.new(:authenticated, :reason, keyword_init: true)
+
+    # Failure reason constants
+    NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided"
+    INVALID_SESSION_COOKIE = "invalid_session_cookie"
+    INVALID_JWT = "invalid_jwt"
+    INVALID_JWT_ALGORITHM = "invalid_jwt_algorithm"
+    INVALID_JWT_SIGNATURE = "invalid_jwt_signature"
+    EXPIRED_JWT = "expired_jwt"
+
+    # @param client [WorkOS::Client]
+    # @param encryptor [#seal, #unseal] Optional custom encryptor. Defaults to
+    #   {WorkOS::Encryptors::AesGcm}. A custom encryptor must respond to
+    #   `seal(data, key) -> String` and `unseal(sealed_string, key) -> Hash`.
+    def initialize(client, encryptor: nil)
+      @client = client
+      @encryptor = encryptor || Encryptors::AesGcm.new
+      @jwks_cache = nil
+      @jwks_cache_at = nil
+      @jwks_mutex = Mutex.new
+    end
+
+    attr_reader :client
+
+    # H04 — Load a Session object from a sealed cookie.
+    def load(seal_data:, cookie_password:)
+      Session.new(self, seal_data: seal_data, cookie_password: cookie_password)
+    end
+
+    # H05 — Inline convenience: authenticate without manual Session construction.
+    def authenticate(seal_data:, cookie_password:, include_expired: false, &claim_extractor)
+      load(seal_data: seal_data, cookie_password: cookie_password).authenticate(include_expired: include_expired, &claim_extractor)
+    end
+
+    # H05 — Inline convenience: refresh without manual Session construction.
+    def refresh(seal_data:, cookie_password:, organization_id: nil)
+      load(seal_data: seal_data, cookie_password: cookie_password)
+        .refresh(organization_id: organization_id)
+    end
+
+    # H06 — Raw seal: encrypt arbitrary data with a key string.
+    # Delegates to the configured encryptor (default: AES-256-GCM).
+    def seal_data(data, key)
+      @encryptor.seal(data, key)
+    end
+
+    # H06 — Raw unseal: returns parsed JSON (Hash) or raw string if not JSON.
+    # Delegates to the configured encryptor (default: AES-256-GCM).
+    def unseal_data(sealed, key)
+      @encryptor.unseal(sealed, key)
+    end
+
+    # H07 — Build a sealed session string directly from auth-response fields.
+    def seal_session_from_auth_response(access_token:, refresh_token:, cookie_password:, user: nil, impersonator: nil)
+      payload = {"access_token" => access_token, "refresh_token" => refresh_token}
+      payload["user"] = user if user
+      payload["impersonator"] = impersonator if impersonator
+      seal_data(payload, cookie_password)
+    end
+
+    # Verify an access-token JWT against the WorkOS JWKS for this client.
+    # Used by Session#authenticate; exposed publicly for advanced cases.
+    def decode_jwt(access_token, verify_expiration: true)
+      jwks = fetch_jwks
+      JWT.decode(
+        access_token,
+        nil,
+        true,
+        algorithms: JWK_ALGORITHMS,
+        jwks: jwks,
+        verify_aud: false,
+        verify_expiration: verify_expiration
+      ).first
+    end
+
+    # Cached JWKS fetch (5-minute TTL, thread-safe).
+    def fetch_jwks(now: Time.now)
+      @jwks_mutex.synchronize do
+        return @jwks_cache if @jwks_cache && @jwks_cache_at && (now - @jwks_cache_at) < 300
+        response = @client.user_management.get_jwks(client_id: @client.client_id)
+        @jwks_cache = {"keys" => response.keys.map(&:to_h)}
+        @jwks_cache_at = now
+        @jwks_cache
+      end
+    end
+  end
+end

data/lib/workos/shared/event_context.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class EventContext < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      google_analytics_client_id: :google_analytics_client_id,
+      google_analytics_sessions: :google_analytics_sessions,
+      ajs_anonymous_id: :ajs_anonymous_id,
+      client_id: :client_id,
+      actor: :actor,
+      previous_attributes: :previous_attributes
+    }.freeze
+
+    attr_accessor \
+      :google_analytics_client_id,
+      :google_analytics_sessions,
+      :ajs_anonymous_id,
+      :client_id,
+      :actor,
+      :previous_attributes
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @google_analytics_client_id = hash[:google_analytics_client_id]
+      @google_analytics_sessions = (hash[:google_analytics_sessions] || []).map { |item| item ? WorkOS::EventContextGoogleAnalyticsSession.new(item) : nil }
+      @ajs_anonymous_id = hash[:ajs_anonymous_id]
+      @client_id = hash[:client_id]
+      @actor = hash[:actor] ? WorkOS::EventContextActor.new(hash[:actor]) : nil
+      @previous_attributes = hash[:previous_attributes] || {}
+    end
+  end
+end