workos 7.1.2 → 9.5.0

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "7.1.2"
+  ".": "9.5.0"
 }

data/.ruby-version

@@ -1 +1 @@
-3.3.11
+3.4.9

data/.yardopts

@@ -0,0 +1,6 @@
+--output-dir docs/_site
+--markup markdown
+lib/**/*.rb
+-
+README.md
+CHANGELOG.md

data/CHANGELOG.md

@@ -1,5 +1,336 @@
 # Changelog
 
+## [9.5.0](https://github.com/workos/workos-ruby/compare/v9.4.0...v9.5.0) (2026-07-06)
+
+* [#514](https://github.com/workos/workos-ruby/pull/514) fix(generated): regenerate from spec
+
+  **Features**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `UserRoleAssignmentSource`
+    * Added `source` to `UserRoleAssignment`
+    * Added enum `UserRoleAssignmentSourceType`
+    * Added parameter `UserManagementAuthentication.authorize.max_age`
+    * Added endpoint `GET /user_management/cors_origins`
+    * Added endpoint `GET /user_management/redirect_uris`
+
+  **Fixes**
+  * Restore mistakenly removed CreateMagicAuth logic from previous release
+
+## [9.4.0](https://github.com/workos/workos-ruby/compare/v9.3.0...v9.4.0) (2026-07-02)
+
+* [#508](https://github.com/workos/workos-ruby/pull/508) fix(generated): regenerate from spec
+
+  **Features**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added model `DataIntegrationCredentialsResponse`
+    * Added model `DataIntegrationCredentialsResponseCredential`
+    * Added model `DataIntegrationsUpsertApiKeyRequest`
+    * Added model `DataIntegrationsVendCredentialsRequest`
+    * Added enum `DataIntegrationCredentialsResponseError`
+    * Added endpoint `PUT /data-integrations/{slug}/api-key`
+    * Added endpoint `POST /data-integrations/{slug}/credentials`
+
+* [#510](https://github.com/workos/workos-ruby/pull/510) fix(generated): regenerate from spec
+
+  **⚠️ Breaking**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Removed model `SessionReauthenticated`
+    * Removed model `SessionReauthenticatedData`
+    * Removed model `SessionReauthenticatedDataImpersonator`
+    * Removed enum `SessionReauthenticatedDataAuthMethod`
+    * Removed enum `SessionReauthenticatedDataStatus`
+
+  **Features**
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `agent.registration.created` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.claim.attempt.created` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.claim.completed` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.credential.issued` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.organization.switched` to `CreateWebhookEndpointEvents`
+    * Added `authentication.reauthentication_succeeded` to `CreateWebhookEndpointEvents`
+    * Added `agent.registration.created` to `UpdateWebhookEndpointEvents`
+    * Added `agent.registration.claim.attempt.created` to `UpdateWebhookEndpointEvents`
+    * Added `agent.registration.claim.completed` to `UpdateWebhookEndpointEvents`
+    * Added `agent.registration.credential.issued` to `UpdateWebhookEndpointEvents`
+    * Added `agent.registration.organization.switched` to `UpdateWebhookEndpointEvents`
+    * Added `authentication.reauthentication_succeeded` to `UpdateWebhookEndpointEvents`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `session.reauthenticated` to `CreateWebhookEndpointEvents`
+    * Added `session.reauthenticated` to `UpdateWebhookEndpointEvents`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Added `pipes.connected_account.connection_failed` to `CreateWebhookEndpointEvents`
+    * Added `pipes.connected_account.connection_failed` to `UpdateWebhookEndpointEvents`
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `UserRoleAssignmentSource`
+    * Added `source` to `UserRoleAssignment`
+    * Added enum `UserRoleAssignmentSourceType`
+    * Added parameter `UserManagementAuthentication.authorize.max_age`
+    * Added endpoint `GET /user_management/cors_origins`
+    * Added endpoint `GET /user_management/redirect_uris`
+  * **[audit_logs](https://workos.com/docs/reference/audit-logs)**:
+    * Changed the format of `AuditLogExportCreation.range_start`
+    * Changed the format of `AuditLogExportCreation.range_end`
+  * **[audit_logs](https://workos.com/docs/reference/audit-logs)**:
+    * Added `expired` to `AuditLogExportState`
+
+  **Fixes**
+  * **[admin_portal](https://workos.com/docs/reference/admin-portal)**:
+    * Removed `intent_options` from `GenerateLink`
+  * **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    * Removed `session.reauthenticated` from `CreateWebhookEndpointEvents`
+    * Removed `session.reauthenticated` from `UpdateWebhookEndpointEvents`
+
+* [#512](https://github.com/workos/workos-ruby/pull/512) feat(generated): regenerate from spec (1 change)
+
+  **Features**
+  * **[pipes](https://workos.com/docs/reference/pipes)**:
+    * Added model `DataIntegrationCredentialsDto`
+    * Added model `CustomProviderDefinition`
+    * Added model `CreateDataIntegration`
+    * Added model `UpdateCustomProviderDefinition`
+    * Added model `UpdateDataIntegration`
+    * Added model `DataIntegration`
+    * Added model `DataIntegrationList`
+    * Added model `DataIntegrationListListMetadata`
+    * Added model `DataIntegrationCredential`
+    * Added model `DataIntegrationCustomProvider`
+    * Added enum `DataIntegrationCredentialsType`
+    * Added enum `CustomProviderDefinitionAuthenticateVia`
+    * Added enum `UpdateCustomProviderDefinitionAuthenticateVia`
+    * Added enum `DataIntegrationState`
+    * Added enum `DataIntegrationCredentialType`
+    * Added enum `DataIntegrationCustomProviderAuthenticateVia`
+    * Added endpoint `GET /data-integrations`
+    * Added endpoint `POST /data-integrations`
+    * Added endpoint `GET /data-integrations/{slug}`
+    * Added endpoint `PUT /data-integrations/{slug}`
+    * Added endpoint `DELETE /data-integrations/{slug}`
+    * Added endpoint `POST /user_management/users/{user_id}/connected_accounts/{slug}`
+    * Added endpoint `PUT /user_management/users/{user_id}/connected_accounts/{slug}`
+
+* [#513](https://github.com/workos/workos-ruby/pull/513) feat(generated): regenerate from spec (2 changes)
+
+  **Features**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `SendRadarSmsChallenge`
+    * Added model `SendRadarSmsChallengeResponse`
+    * Added model `UrnWorkosOAuthGrantTypeRadarEmailChallengeCodeSessionAuthenticateRequest`
+    * Added model `UrnWorkosOAuthGrantTypeRadarSmsChallengeCodeSessionAuthenticateRequest`
+    * Added model `MagicAuthSendMagicAuthCodeAndReturnResponse`
+    * Added model `UserCreateResponse`
+    * Added `ip_address` to `CreateMagicCodeAndReturn`
+    * Added `user_agent` to `CreateMagicCodeAndReturn`
+    * Added `radar_auth_attempt_id` to `CreateMagicCodeAndReturn`
+    * Added `signals_id` to `CreateMagicCodeAndReturn`
+    * Added `ip_address` to `CreateUser`
+    * Added `user_agent` to `CreateUser`
+    * Added `signals_id` to `CreateUser`
+    * Added `signals_id` to `AuthorizationCodeSessionAuthenticateRequest`
+    * Added `signals_id` to `PasswordSessionAuthenticateRequest`
+    * Added `radar_auth_attempt_id` to `PasswordSessionAuthenticateRequest`
+    * Added `radar_auth_attempt_id` to `UrnWorkosOAuthGrantTypeMagicAuthCodeSessionAuthenticateRequest`
+    * Added endpoint `POST /user_management/radar_challenges`
+  * **[radar](https://workos.com/docs/reference/radar)**:
+    * Added `signals_id` to `RadarStandaloneAssessRequest`
+
+  **Fixes**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Changed request body for `UserManagementAuthentication.authenticate`
+    * Changed response of `UserManagementUsers.create` from `User` to `UserCreateResponse`
+    * Changed response of `UserManagementMagicAuth.sendMagicAuthCodeAndReturn` from `MagicAuth` to `MagicAuthSendMagicAuthCodeAndReturnResponse`
+
+## [9.3.0](https://github.com/workos/workos-ruby/compare/v9.2.0...v9.3.0) (2026-06-30)
+
+* [#504](https://github.com/workos/workos-ruby/pull/504) fix(generated): regenerate from spec
+
+  **Fixes**
+  * **[organization_membership](https://workos.com/docs/reference/authkit/organization-membership)**:
+    * Added `roles` to organization membership models
+
+## [9.2.0](https://github.com/workos/workos-ruby/compare/v9.1.0...v9.2.0) (2026-06-18)
+
+- [#501](https://github.com/workos/workos-ruby/pull/501) feat(generated)!: regenerate from spec (12 changes)
+
+  **Features**
+  - **[authorization](https://workos.com/docs/reference/fga)**:
+    - Added model `ReplaceGroupRoleAssignmentEntry`
+    - Added model `ReplaceGroupRoleAssignments`
+    - Added model `DeleteGroupRoleAssignmentsByCriteria`
+    - Added endpoint `POST /authorization/groups/{group_id}/role_assignments`
+    - Added endpoint `PUT /authorization/groups/{group_id}/role_assignments`
+    - Added endpoint `DELETE /authorization/groups/{group_id}/role_assignments`
+    - Added endpoint `GET /authorization/groups/{group_id}/role_assignments/{role_assignment_id}`
+    - Added endpoint `DELETE /authorization/groups/{group_id}/role_assignments/{role_assignment_id}`
+  - **[client](https://workos.com/docs/reference)**:
+    - Added model `ClientApiToken`
+    - Added model `ClientApiTokenResponse`
+    - Added service `Client`
+  - **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    - Added `auth_method` to `ConnectedAccount`
+    - Added `api_key_last_4` to `ConnectedAccount`
+    - Added enum `ConnectedAccountAuthMethod`
+  - **[groups](https://workos.com/docs/reference/groups)**:
+    - Added model `CreateGroupRoleAssignment`
+    - Added model `GroupRoleAssignment`
+    - Added model `GroupRoleAssignmentList`
+    - Added model `GroupRoleAssignmentResource`
+  - **[organization_membership](https://workos.com/docs/reference/authkit/organization-membership)**:
+    - Added model `UserOrganizationMembershipList`
+    - Added model `UserOrganizationMembershipListListMetadata`
+  - **[pipes](https://workos.com/docs/reference/pipes)**:
+    - Added model `DataIntegrationCredentials`
+    - Added model `DataIntegrationConfigurationResponse`
+    - Added model `DataIntegrationConfigurationListResponse`
+    - Added model `ConfigureDataIntegrationBody`
+    - Added `auth_methods` to `DataIntegrationsListResponseData`
+    - Added `auth_method` to `DataIntegrationsListResponseDataConnectedAccount`
+    - Added `api_key_last_4` to `DataIntegrationsListResponseDataConnectedAccount`
+    - Added enum `DataIntegrationCredentialsCredentialsType`
+    - Added enum `DataIntegrationsListResponseDataAuthMethods`
+    - Added enum `DataIntegrationsListResponseDataConnectedAccountAuthMethod`
+    - Added service `PipesProvider`
+  - **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    - Added model `UserInviteList`
+    - Added model `UserInviteListListMetadata`
+    - Made `AuthorizationCodeSessionAuthenticateRequest.client_secret` optional
+    - Made `RefreshTokenSessionAuthenticateRequest.client_secret` optional
+  - **[widgets](https://workos.com/docs/reference/widgets)**:
+    - Added `widgets:pipes:manage` to `WidgetSessionTokenScopes`
+
+  **Fixes**
+  - **[organization_membership](https://workos.com/docs/reference/authkit/organization-membership)**:
+    - Changed response of `UserManagementOrganizationMembership.list` from `UserOrganizationMembership` to `UserOrganizationMembershipList`
+  - **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    - Changed response of `UserManagementInvitations.list` from `UserInvite` to `UserInviteList`
+
+## [9.1.0](https://github.com/workos/workos-ruby/compare/v9.0.0...v9.1.0) (2026-06-17)
+
+### Bug Fixes
+
+* **renovate:** explicitly enable minor and patch updates ([#493](https://github.com/workos/workos-ruby/issues/493)) ([c6da3f3](https://github.com/workos/workos-ruby/commit/c6da3f3acdf4dd7a6a65b3ae6463102ff0c024e1))
+* Use Thread.current[] instead of Fiber[] for connection cache ([#499](https://github.com/workos/workos-ruby/issues/499)) ([a44d650](https://github.com/workos/workos-ruby/commit/a44d6500b29d05fe7a5a0ac7449d1a4bee88fd38))
+
+- [#495](https://github.com/workos/workos-ruby/pull/495) feat(generated): regenerate from spec (8 changes)
+
+  **Features**
+  - **[api_keys](https://workos.com/docs/reference/authkit/api-keys)**:
+    - Added model `ExpireApiKey`
+    - Added model `ApiKeyUpdated`
+    - Added model `ApiKeyUpdatedData`
+    - Added model `ApiKeyUpdatedDataOwner`
+    - Added model `UserApiKeyUpdatedDataOwner`
+    - Added model `ApiKeyUpdatedDataPreviousAttribute`
+    - Added endpoint `POST /api_keys/{id}/expire`
+  - **[audit_logs](https://workos.com/docs/reference/audit-logs)**:
+    - Added `Snowflake` to `AuditLogConfigurationLogStreamType`
+  - **[connect](https://workos.com/docs/reference/workos-connect/standalone)**:
+    - Added `name` to `UserObject`
+  - **[directory_sync](https://workos.com/docs/reference/directory-sync)**:
+    - Added model `DsyncTokenCreated`
+    - Added model `DsyncTokenCreatedData`
+    - Added model `DsyncTokenRevoked`
+    - Added model `DsyncTokenRevokedData`
+  - **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    - Added `name` to user management models
+  - **[webhooks](https://workos.com/docs/reference/webhooks)**:
+    - Added `api_key.updated` to `CreateWebhookEndpointEvents`
+    - Added `api_key.updated` to `UpdateWebhookEndpointEvents`
+
+## [9.0.0](https://github.com/workos/workos-ruby/compare/v8.0.1...v9.0.0) (2026-05-26)
+
+### Bug Fixes
+
+* **ci:** extract version from PR title in changelog inline step ([93768a1](https://github.com/workos/workos-ruby/commit/93768a1c00aab7f82c869f38bea5925f6e8cd933))
+
+* [#491](https://github.com/workos/workos-ruby/pull/491) feat(generated)!: regenerate from spec (9 changes)
+
+  **⚠️ Breaking**
+  * **organization_membership:** Migrate organization membership to dedicated service
+    * Moved organization membership methods from `UserManagement` to new `OrganizationMembershipService` class
+    * Methods `create_organization_membership`, `get_organization_membership`, `update_organization_membership`, `delete_organization_membership`, `deactivate_organization_membership`, `reactivate_organization_membership`, `list_organization_memberships`, and `list_organization_membership_groups` now accessed via `client.organization_membership` instead of `client.user_management`
+    * Removed `UserManagement::RoleSingle` and `UserManagement::RoleMultiple` data classes (moved to `OrganizationMembershipService`)
+  * **api_keys:** Add expires_at field to API key models
+    * Added `expires_at` optional field to `ApiKey`, `OrganizationApiKey`, `OrganizationApiKeyWithValue`, `UserApiKey`, and `UserApiKeyWithValue` models
+    * Added `expires_at` field to `CreateOrganizationApiKey` and `CreateUserApiKey` request models
+    * Updated `create_organization_api_key` and `create_user_api_key` methods to accept `expires_at` parameter
+  * **radar:** Remove device_fingerprint and bot_score fields from Radar
+    * Removed `device_fingerprint` and `bot_score` parameters from `Radar.create_attempt` method
+    * Removed `device_fingerprint` and `bot_score` fields from `RadarStandaloneAssessRequest` model
+    * Updated enum values in `RadarStandaloneAssessRequestAction`: removed `LOGIN`, `SIGNUP`, `SIGN_UP_2`, `SIGN_IN_2`, `SIGN_IN_3`, `SIGN_UP_3`; standardized to `SIGN_UP` and `SIGN_IN`
+    * Removed `CREDENTIAL_STUFFING` and `IP_SIGN_UP_RATE_LIMIT` from `RadarStandaloneResponseControl` enum
+  * **audit_logs:** Refactor audit logs models and type names
+    * Merged `AuditLogSchemaJson` fields into `AuditLogSchema`; removed `AuditLogSchemaJson` class
+    * Added new `AuditLogSchemaInput` class (write-side schema without read-only fields)
+    * Renamed `AuditLogSchemaJsonActor` to `AuditLogSchemaActorInput`
+    * Renamed `AuditLogSchemaJsonTarget` to `AuditLogSchemaTargetInput`
+    * Removed `AuditLogActionJson`; `AuditLogAction` now extends `BaseModel`
+    * Renamed `AuditLogExportJson` to `AuditLogExport` (now extends `BaseModel`)
+    * Renamed `AuditLogsRetentionJson` to `AuditLogsRetention` (now extends `BaseModel`)
+    * Removed `AuditLogExportJsonState` type; replaced with `AuditLogExportState`
+    * Updated `list_actions` method return type from `AuditLogActionJson` to `AuditLogAction`
+    * Updated `create_export` and `get_export` method return types from `AuditLogExportJson` to `AuditLogExport`
+  * **webhooks:** Rename WebhookEndpointJson to WebhookEndpoint
+    * Renamed `WebhookEndpointJson` to `WebhookEndpoint`
+    * Updated `list_webhook_endpoints`, `create_webhook_endpoint`, and `update_webhook_endpoint` method return types
+    * `WebhookEndpointStatus` is now an alias for `UpdateWebhookEndpointStatus` (no longer a standalone class); removed `WebhookEndpointJsonStatus` alias
+    * Updated `WebhookEndpoint` to extend `BaseModel` for consistency
+  * **authorization:** Add filtering parameters to authorization list methods
+    * Added `resource_id`, `resource_external_id`, `resource_type_slug` filter parameters to `list_role_assignments` method
+    * Added `role_slug` filter parameter to `list_role_assignments_for_resource_by_external_id` and `list_role_assignments_for_resource` methods
+    * Removed `search` parameter from `list_resources` method
+
+  **Features**
+  * **vault:** Add new Vault service with key-value operations
+    * Added new `Vault` service class with methods: `create_data_key`, `create_decrypt`, `create_rekey`, `list_kv`, `create_kv`, `get_name`, `get_kv`, `update_kv`, `delete_kv`, `list_kv_metadata`, `list_kv_versions`
+    * Added vault model classes: `Actor`, `CreateDataKeyRequest`, `CreateDataKeyResponse`, `CreateObjectRequest`, `DecryptRequest`, `DecryptResponse`, `DeleteObjectResponse`, `ObjectModel`, `ObjectMetadata`, `ObjectSummary`, `ObjectVersion`, `ObjectWithoutValue`, `RekeyRequest`, `UpdateObjectRequest`
+    * Added `VaultOrder` enum for sorting operations
+    * Added `client.vault` accessor to access the new service
+  * **pipes:** Add Pipes connected account event models
+    * Added `PipeConnectedAccount` model for representing connected accounts
+    * Added three new event models: `PipesConnectedAccountConnected`, `PipesConnectedAccountDisconnected`, `PipesConnectedAccountReauthorizationNeeded`
+    * Added `PipeConnectedAccountState` enum with `CONNECTED` and `NEEDS_REAUTHORIZATION` values
+    * Added new webhook event types to `CreateWebhookEndpointEvents` and `UpdateWebhookEndpointEvents`
+  * **generated:** Add Error and Actor shared models
+    * Added `Error` model in shared module for error responses
+    * Added `Actor` model in vault module representing user/actor information
+    * Updated inflections to map 'object' to 'ObjectModel' to avoid conflicts
+
+## [8.0.1](https://github.com/workos/workos-ruby/compare/v8.0.0...v8.0.1) (2026-05-12)
+
+
+### Bug Fixes
+
+* harden session sealing, log redaction, and webhook tolerance checks ([#482](https://github.com/workos/workos-ruby/issues/482)) ([347fe1e](https://github.com/workos/workos-ruby/commit/347fe1edf296778d7ea331e666a7957870074b9f))
+
+## [8.0.0](https://github.com/workos/workos-ruby/compare/v7.1.2...v8.0.0) (2026-05-06)
+
+
+### ⚠ BREAKING CHANGES
+
+* **authorization:** Consolidate order enums to PaginationOrder
+* **api_keys:** Separate organization and user API key types
+* **user_management:** Consolidate order enums to PaginationOrder
+* **vault:** Add BYOK key deleted event and consolidate key provider enum
+* **types:** Consolidate pagination order enums
+* **authorization:** Rename RoleAssignment to UserRoleAssignment
+
+### Features
+
+* **api_keys:** Separate organization and user API key types ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **authorization:** Add new role assignment listing endpoints ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **authorization:** Consolidate order enums to PaginationOrder ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **authorization:** Rename RoleAssignment to UserRoleAssignment ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **directory_sync:** Add name field to directory users ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **docs:** publish YARD API docs + llms.txt to GitHub Pages ([#480](https://github.com/workos/workos-ruby/issues/480)) ([117eeac](https://github.com/workos/workos-ruby/commit/117eeac5d25c896c7a9b989592f3525f51e52a3d))
+* **events:** Add admin_portal source to event context actor ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **sso:** Add name field to SSO profile ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **types:** Consolidate pagination order enums ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **user_management:** Add get JWT template endpoint ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **user_management:** Add user API key management ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **user_management:** Add user field to membership and organization membership ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **user_management:** Consolidate order enums to PaginationOrder ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+* **vault:** Add BYOK key deleted event and consolidate key provider enum ([956386a](https://github.com/workos/workos-ruby/commit/956386a27cb0f8a8707442fa98b74a317f3f9920))
+
 ## [7.1.2](https://github.com/workos/workos-ruby/compare/v7.1.1...v7.1.2) (2026-05-06)
 
 

data/Gemfile

@@ -3,3 +3,9 @@
 source "https://rubygems.org"
 
 gemspec
+
+group :docs do
+  gem "yard"
+  gem "yard-markdown"
+  gem "webrick"
+end

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (7.1.2)
+    workos (9.5.0)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -17,10 +17,13 @@ GEM
     crack (1.0.1)
       bigdecimal
       rexml
+    csv (3.3.5)
+    date (3.5.1)
     drb (2.2.3)
+    erb (6.0.4)
     hashdiff (1.2.1)
     json (2.19.4)
-    jwt (3.1.2)
+    jwt (3.2.0)
       base64
     language_server-protocol (3.17.0.5)
     lint_roller (1.1.0)
@@ -33,10 +36,17 @@ GEM
       ast (~> 2.4.1)
       racc
     prism (1.9.0)
+    psych (5.3.1)
+      date
+      stringio
     public_suffix (7.0.5)
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
+    rdoc (7.2.0)
+      erb
+      psych (>= 4.0.0)
+      tsort
     regexp_parser (2.12.0)
     rexml (3.4.4)
     rubocop (1.84.2)
@@ -70,6 +80,8 @@ GEM
     standard-performance (1.9.0)
       lint_roller (~> 1.1)
       rubocop-performance (~> 1.26.0)
+    stringio (3.2.0)
+    tsort (0.2.0)
     unicode-display_width (3.2.0)
       unicode-emoji (~> 4.1)
     unicode-emoji (4.2.0)
@@ -77,6 +89,12 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
+    webrick (1.9.2)
+    yard (0.9.44)
+    yard-markdown (0.7.1)
+      csv
+      rdoc
+      yard
     zeitwerk (2.7.5)
 
 PLATFORMS
@@ -89,7 +107,10 @@ DEPENDENCIES
   rake
   standard (~> 1.49)
   webmock (~> 3.26)
+  webrick
   workos!
+  yard
+  yard-markdown
 
 CHECKSUMS
   addressable (2.9.0) sha256=7fdf6ac3660f7f4e867a0838be3f6cf722ace541dd97767fa42bc6cfa980c7af
@@ -97,10 +118,13 @@ CHECKSUMS
   base64 (0.3.0) sha256=27337aeabad6ffae05c265c450490628ef3ebd4b67be58257393227588f5a97b
   bigdecimal (4.1.2) sha256=53d217666027eab4280346fba98e7d5b66baaae1b9c3c1c0ffe89d48188a3fbd
   crack (1.0.1) sha256=ff4a10390cd31d66440b7524eb1841874db86201d5b70032028553130b6d4c7e
+  csv (3.3.5) sha256=6e5134ac3383ef728b7f02725d9872934f523cb40b961479f69cf3afa6c8e73f
+  date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0
   drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
+  erb (6.0.4) sha256=38e3803694be357fe2bfe312487c74beaf9fb4e5beb3e22498952fe1645b95d9
   hashdiff (1.2.1) sha256=9c079dbc513dfc8833ab59c0c2d8f230fa28499cc5efb4b8dd276cf931457cd1
   json (2.19.4) sha256=670a7d333fb3b18ca5b29cb255eb7bef099e40d88c02c80bd42a3f30fe5239ac
-  jwt (3.1.2) sha256=af6991f19a6bb4060d618d9add7a66f0eeb005ac0bc017cd01f63b42e122d535
+  jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
   language_server-protocol (3.17.0.5) sha256=fd1e39a51a28bf3eec959379985a72e296e9f9acfce46f6a79d31ca8760803cc
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
   logger (1.7.0) sha256=196edec7cc44b66cfb40f9755ce11b392f21f7967696af15d274dde7edff0203
@@ -108,10 +132,12 @@ CHECKSUMS
   parallel (1.28.0) sha256=33e6de1484baf2524792d178b0913fc8eb94c628d6cfe45599ad4458c638c970
   parser (3.3.11.1) sha256=d17ace7aabe3e72c3cc94043714be27cc6f852f104d81aa284c2281aecc65d54
   prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
+  psych (5.3.1) sha256=eb7a57cef10c9d70173ff74e739d843ac3b2c019a003de48447b2963d81b1974
   public_suffix (7.0.5) sha256=1a8bb08f1bbea19228d3bed6e5ed908d1cb4f7c2726d18bd9cadf60bc676f623
   racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
   rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
   rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
+  rdoc (7.2.0) sha256=8650f76cd4009c3b54955eb5d7e3a075c60a57276766ebf36f9085e8c9f23192
   regexp_parser (2.12.0) sha256=35a916a1d63190ab5c9009457136ae5f3c0c7512d60291d0d1378ba18ce08ebb
   rexml (3.4.4) sha256=19e0a2c3425dfbf2d4fc1189747bdb2f849b6c5e74180401b15734bc97b5d142
   rubocop (1.84.2) sha256=5692cea54168f3dc8cb79a6fe95c5424b7ea893c707ad7a4307b0585e88dbf5f
@@ -121,10 +147,15 @@ CHECKSUMS
   standard (1.54.0) sha256=7a4b08f83d9893083c8f03bc486f0feeb6a84d48233b40829c03ef4767ea0100
   standard-custom (1.0.2) sha256=424adc84179a074f1a2a309bb9cf7cd6bfdb2b6541f20c6bf9436c0ba22a652b
   standard-performance (1.9.0) sha256=49483d31be448292951d80e5e67cdcb576c2502103c7b40aec6f1b6e9c88e3f2
+  stringio (3.2.0) sha256=c37cb2e58b4ffbd33fe5cd948c05934af997b36e0b6ca6fdf43afa234cf222e1
+  tsort (0.2.0) sha256=9650a793f6859a43b6641671278f79cfead60ac714148aabe4e3f0060480089f
   unicode-display_width (3.2.0) sha256=0cdd96b5681a5949cdbc2c55e7b420facae74c4aaf9a9815eee1087cb1853c42
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
-  workos (7.1.2)
+  webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
+  workos (9.5.0)
+  yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28
+  yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd
 
 BUNDLED WITH

data/README.md

@@ -139,6 +139,25 @@ user = WorkOS.client.user_management.create_user(
 puts user.id
 ```
 
+### Sealed sessions (cookie_password requirements)
+
+When you use `client.session_manager` to seal session cookies, the
+`cookie_password` you supply must be **at least 32 bytes** of high-entropy
+secret material (typically 32 random bytes encoded as base64 or a 64-char
+hex string). The SDK derives the AES-256-GCM key from this password via
+SHA-256, and a passphrase shorter than 32 bytes makes the resulting key
+materially easier to brute-force offline.
+
+Generate a suitable secret once and store it as an environment variable:
+
+```sh
+ruby -rsecurerandom -e 'puts SecureRandom.base64(32)'
+```
+
+Anything shorter than 32 bytes (including `nil` or `""`) raises
+`ArgumentError` at SDK init time — sealing or unsealing will not silently
+proceed with a weakened key.
+
 ### Verify a webhook
 
 ```ruby

data/docs/V7_MIGRATION_GUIDE.md

@@ -501,6 +501,27 @@ Session management was one of the largest refactors in v7. The old `WorkOS::Sess
 
 If your application seals session cookies, refreshes access tokens, or decodes the access-token JWT, every one of these call sites needs to be updated.
 
+#### `cookie_password` minimum length (32 bytes)
+
+v7 enforces a **minimum 32-byte length** on every `cookie_password` you supply
+to the session manager (`load`, `seal_data`, `unseal_data`,
+`seal_session_from_auth_response`, and the underlying `Encryptors::AesGcm`).
+
+Anything shorter — including `nil` or `""` — now raises `ArgumentError` at the
+moment the SDK is asked to seal or unseal. Older deployments that used a
+short passphrase (e.g. a 16-character secret) will start erroring at app
+boot or the next sealed-session request.
+
+Pick a 32+ byte secret once and store it as an environment variable:
+
+```sh
+ruby -rsecurerandom -e 'puts SecureRandom.base64(32)'
+```
+
+The KDF itself (single-pass SHA-256) is unchanged in this release, so
+existing sealed cookies continue to round-trip as long as the same
+(now-length-validated) password is in use.
+
 #### Sealing a cookie from an authentication response
 
 In v6, you asked `authenticate_with_*` to seal the cookie for you:

data/lib/workos/actions.rb

@@ -35,7 +35,7 @@ module WorkOS
     def verify_header(payload:, sig_header:, secret:, tolerance: DEFAULT_TOLERANCE_SECONDS)
       timestamp_ms, signature_hash = parse_signature_header(sig_header)
       issued_at = timestamp_ms.to_i / 1000.0
-      if (Time.now.to_f - issued_at) > tolerance
+      if (Time.now.to_f - issued_at).abs > tolerance
         raise WorkOS::SignatureVerificationError.new(
           message: "Timestamp outside the tolerance zone",
           http_status: nil

data/lib/workos/admin_portal/generate_link.rb

@@ -9,7 +9,6 @@ module WorkOS
       success_url: :success_url,
       organization: :organization,
       intent: :intent,
-      intent_options: :intent_options,
       it_contact_emails: :it_contact_emails
     }.freeze
 
@@ -18,7 +17,6 @@ module WorkOS
       :success_url,
       :organization,
       :intent,
-      :intent_options,
       :it_contact_emails
 
     def initialize(json)
@@ -27,7 +25,6 @@ module WorkOS
       @success_url = hash[:success_url]
       @organization = hash[:organization]
       @intent = hash[:intent]
-      @intent_options = hash[:intent_options] ? WorkOS::IntentOptions.new(hash[:intent_options]) : nil
       @it_contact_emails = hash[:it_contact_emails] || []
     end
   end

data/lib/workos/admin_portal.rb

@@ -15,7 +15,6 @@ module WorkOS
     # @param success_url [String, nil] The URL to redirect the admin to when they finish setup. If not specified, the success URL configured on the [Redirects](https://dashboard.workos.com/redirects) page will be used.
     # @param organization [String] An [Organization](https://workos.com/docs/reference/organization) identifier.
     # @param intent [WorkOS::Types::GenerateLinkIntent, nil] The intent of the Admin Portal. - `sso` - Launch Admin Portal for creating SSO connections - `dsync` - Launch Admin Portal for creating Directory Sync connections - `audit_logs` - Launch Admin Portal for viewing Audit Logs - `log_streams` - Launch Admin Portal for creating Log Streams - `domain_verification` - Launch Admin Portal for Domain Verification - `certificate_renewal` - Launch Admin Portal for renewing SAML Certificates - `bring_your_own_key` - Launch Admin Portal for configuring Bring Your Own Key
-    # @param intent_options [WorkOS::IntentOptions, nil] Options to configure the Admin Portal based on the intent.
     # @param it_contact_emails [Array<String>, nil] The email addresses of the IT contacts to grant access to the Admin Portal for the given organization. Accepts up to 20 emails.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::PortalLinkResponse]
@@ -24,7 +23,6 @@ module WorkOS
       return_url: nil,
       success_url: nil,
       intent: nil,
-      intent_options: nil,
       it_contact_emails: nil,
       request_options: {}
     )
@@ -33,7 +31,6 @@ module WorkOS
         "success_url" => success_url,
         "organization" => organization,
         "intent" => intent,
-        "intent_options" => intent_options,
         "it_contact_emails" => it_contact_emails
       }.compact
       response = @client.request(

data/lib/workos/api_keys/api_key.rb

@@ -11,6 +11,7 @@ module WorkOS
       name: :name,
       obfuscated_value: :obfuscated_value,
       last_used_at: :last_used_at,
+      expires_at: :expires_at,
       permissions: :permissions,
       created_at: :created_at,
       updated_at: :updated_at
@@ -23,6 +24,7 @@ module WorkOS
       :name,
       :obfuscated_value,
       :last_used_at,
+      :expires_at,
       :permissions,
       :created_at,
       :updated_at
@@ -31,10 +33,11 @@ module WorkOS
       hash = self.class.normalize(json)
       @object = hash[:object]
       @id = hash[:id]
-      @owner = hash[:owner] ? WorkOS::ApiKeyOwner.new(hash[:owner]) : nil
+      @owner = hash[:owner] ? (case hash[:owner][:type] when "organization" then WorkOS::ApiKeyOwner.new(hash[:owner]) when "user" then WorkOS::UserApiKeyOwner.new(hash[:owner]) else hash[:owner] end) : nil
       @name = hash[:name]
       @obfuscated_value = hash[:obfuscated_value]
       @last_used_at = hash[:last_used_at]
+      @expires_at = hash[:expires_at]
       @permissions = hash[:permissions] || []
       @created_at = hash[:created_at]
       @updated_at = hash[:updated_at]