workos 7.1.2 → 9.5.0

data/test/workos/test_authorization_model_round_trip.rb

@@ -0,0 +1,456 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class AuthorizationModelRoundTripTest < Minitest::Test
+  def test_check_authorization_round_trip
+    fixture = {
+      "permission_slug" => "stub",
+      "resource_id" => "stub",
+      "resource_external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::CheckAuthorization.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["permission_slug"], json[:permission_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_group_role_assignment_round_trip
+    fixture = {
+      "role_slug" => "stub",
+      "resource_id" => "stub",
+      "resource_external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::CreateGroupRoleAssignment.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["role_slug"], json[:role_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_replace_group_role_assignment_entry_round_trip
+    fixture = {
+      "role_slug" => "stub",
+      "resource_id" => "stub",
+      "resource_external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::ReplaceGroupRoleAssignmentEntry.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["role_slug"], json[:role_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_replace_group_role_assignments_round_trip
+    fixture = {
+      "role_assignments" => []
+    }
+    model = WorkOS::ReplaceGroupRoleAssignments.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_delete_group_role_assignments_by_criteria_round_trip
+    fixture = {
+      "role_slug" => "stub",
+      "resource_id" => "stub",
+      "resource_external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::DeleteGroupRoleAssignmentsByCriteria.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["role_slug"], json[:role_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_assign_role_round_trip
+    fixture = {
+      "role_slug" => "stub",
+      "resource_id" => "stub",
+      "resource_external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::AssignRole.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["role_slug"], json[:role_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_remove_role_round_trip
+    fixture = {
+      "role_slug" => "stub",
+      "resource_id" => "stub",
+      "resource_external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::RemoveRole.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["role_slug"], json[:role_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_set_role_permissions_round_trip
+    fixture = {
+      "permissions" => []
+    }
+    model = WorkOS::SetRolePermissions.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_add_role_permission_round_trip
+    fixture = {
+      "slug" => "stub"
+    }
+    model = WorkOS::AddRolePermission.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_organization_role_round_trip
+    fixture = {
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::CreateOrganizationRole.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["name"], json[:name]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_update_organization_role_round_trip
+    fixture = {
+      "name" => "stub",
+      "description" => nil
+    }
+    model = WorkOS::UpdateOrganizationRole.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_authorization_permission_round_trip
+    fixture = {
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::CreateAuthorizationPermission.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["name"], json[:name]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_update_authorization_permission_round_trip
+    fixture = {
+      "name" => "stub",
+      "description" => nil
+    }
+    model = WorkOS::UpdateAuthorizationPermission.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_role_round_trip
+    fixture = {
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::CreateRole.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["name"], json[:name]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_update_role_round_trip
+    fixture = {
+      "name" => "stub",
+      "description" => nil
+    }
+    model = WorkOS::UpdateRole.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_update_authorization_resource_round_trip
+    fixture = {
+      "name" => "stub",
+      "description" => nil,
+      "parent_resource_id" => "stub",
+      "parent_resource_external_id" => "stub",
+      "parent_resource_type_slug" => "stub"
+    }
+    model = WorkOS::UpdateAuthorizationResource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_authorization_resource_round_trip
+    fixture = {
+      "external_id" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "resource_type_slug" => "stub",
+      "organization_id" => "stub",
+      "parent_resource_id" => nil,
+      "parent_resource_external_id" => "stub",
+      "parent_resource_type_slug" => "stub"
+    }
+    model = WorkOS::CreateAuthorizationResource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["external_id"], json[:external_id]
+    assert_equal fixture["name"], json[:name]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["organization_id"], json[:organization_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_authorization_check_round_trip
+    fixture = {
+      "authorized" => true
+    }
+    model = WorkOS::AuthorizationCheck.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["authorized"], json[:authorized]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_authorization_resource_round_trip
+    fixture = {
+      "object" => "authorization_resource",
+      "name" => "stub",
+      "description" => nil,
+      "organization_id" => "stub",
+      "parent_resource_id" => nil,
+      "id" => "stub",
+      "external_id" => "stub",
+      "resource_type_slug" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::AuthorizationResource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:description]
+    assert_equal fixture["organization_id"], json[:organization_id]
+    assert_nil json[:parent_resource_id]
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["external_id"], json[:external_id]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_authorization_permission_round_trip
+    fixture = {
+      "object" => "permission",
+      "id" => "stub",
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "system" => true,
+      "resource_type_slug" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::AuthorizationPermission.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:description]
+    assert_equal fixture["system"], json[:system]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_slim_role_round_trip
+    fixture = {
+      "slug" => "stub"
+    }
+    model = WorkOS::SlimRole.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_group_role_assignment_round_trip
+    fixture = {
+      "object" => "group_role_assignment",
+      "id" => "stub",
+      "group_id" => "stub",
+      "role" => {},
+      "resource" => {},
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::GroupRoleAssignment.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["group_id"], json[:group_id]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_user_role_assignment_round_trip
+    fixture = {
+      "object" => "role_assignment",
+      "id" => "stub",
+      "organization_membership_id" => "stub",
+      "role" => {},
+      "resource" => {},
+      "source" => {},
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::UserRoleAssignment.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["organization_membership_id"], json[:organization_membership_id]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_round_trip
+    fixture = {
+      "slug" => "stub",
+      "object" => "role",
+      "id" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "type" => "stub",
+      "resource_type_slug" => "stub",
+      "permissions" => [],
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::Role.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:description]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_list_round_trip
+    fixture = {
+      "object" => "list",
+      "data" => []
+    }
+    model = WorkOS::RoleList.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_user_role_assignment_resource_round_trip
+    fixture = {
+      "id" => "stub",
+      "external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::UserRoleAssignmentResource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["external_id"], json[:external_id]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_user_role_assignment_source_round_trip
+    fixture = {
+      "type" => "stub",
+      "group_role_assignment_id" => nil
+    }
+    model = WorkOS::UserRoleAssignmentSource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_nil json[:group_role_assignment_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_group_role_assignment_resource_round_trip
+    fixture = {
+      "id" => "stub",
+      "external_id" => "stub",
+      "resource_type_slug" => "stub"
+    }
+    model = WorkOS::GroupRoleAssignmentResource.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["external_id"], json[:external_id]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_permission_round_trip
+    fixture = {
+      "object" => "permission",
+      "id" => "stub",
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "system" => true,
+      "resource_type_slug" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::Permission.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:description]
+    assert_equal fixture["system"], json[:system]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_base_client.rb

@@ -86,6 +86,14 @@ class BaseClientTest < Minitest::Test
     @client = WorkOS::BaseClient.new(api_key: "sk_test_123", max_retries: 1)
   end
 
+  def teardown
+    super
+    # Close any open connections and clear the thread-local cache to avoid
+    # leaking sockets between tests.
+    @client.shutdown
+    Thread.current[:workos_connections] = nil
+  end
+
   def test_request_dispatches_known_methods
     client = RecordingClient.new(api_key: "sk_test_123")
 
@@ -170,4 +178,104 @@ class BaseClientTest < Minitest::Test
     assert evict.finished
     refute keep.finished
   end
+
+  # Regression test for https://github.com/workos/workos-ruby/issues/496
+  #
+  # The connection cache must be isolated per thread. A previous version
+  # keyed it on Fiber[] (inheritable fiber storage), which is inherited *by
+  # reference* by child threads — so a Net::HTTP socket warmed in a parent
+  # thread leaked into every worker thread spawned afterward (Solid Queue,
+  # Puma, etc.) and got driven concurrently, corrupting the stream.
+  def test_connection_cache_is_not_shared_with_threads_spawned_after_warming
+    # Warm a connection in the "parent" thread before spawning workers.
+    parent_cache = @client.send(:thread_connections)
+    warm = FakeConnection.new
+    parent_cache["https:api.workos.com:443:30"] = warm
+
+    results = Array.new(4) do
+      Thread.new do
+        cache = @client.send(:thread_connections)
+        {cache_id: cache.object_id, leaked: cache.value?(warm), size: cache.size}
+      end
+    end.map(&:value)
+
+    results.each do |r|
+      refute_equal parent_cache.object_id, r[:cache_id],
+        "worker thread must not share the parent thread's connection cache"
+      refute r[:leaked],
+        "parent thread's warmed connection leaked into a worker thread"
+      assert_equal 0, r[:size],
+        "worker thread should start with an empty, isolated cache"
+    end
+
+    # The parent's own cache is left intact.
+    assert_same warm, parent_cache["https:api.workos.com:443:30"]
+  end
+
+  # Exercises the connection_for path (not just the storage helper):
+  # each thread must open and cache its *own* Net::HTTP connection rather
+  # than reusing one established on another thread.
+  #
+  # Net::HTTP#start is stubbed to avoid real TCP+TLS connections.
+  def test_connection_for_opens_a_distinct_connection_per_thread
+    original_start = Net::HTTP.instance_method(:start)
+    Net::HTTP.define_method(:start) { self }
+
+    parent_conn = @client.send(:connection_for, "https://api.workos.com", 30)
+
+    worker_conns = Array.new(4) do
+      Thread.new { @client.send(:connection_for, "https://api.workos.com", 30).object_id }
+    end.map(&:value)
+
+    refute_includes worker_conns, parent_conn.object_id,
+      "a worker thread reused a connection opened on another thread"
+    assert_equal worker_conns.length, worker_conns.uniq.length,
+      "worker threads must each get a distinct connection"
+  ensure
+    Net::HTTP.define_method(:start, original_start)
+  end
+
+  def test_redact_path_strips_invitation_token_segment
+    redacted = @client.send(:redact_path, "/user_management/invitations/by_token/invtoken_secret123")
+    assert_equal "/user_management/invitations/by_token/[REDACTED]", redacted
+  end
+
+  def test_redact_path_strips_magic_auth_token_segment
+    redacted = @client.send(:redact_path, "/user_management/magic_auth/magic_secret/extra")
+    assert_equal "/user_management/magic_auth/[REDACTED]/[REDACTED]", redacted
+  end
+
+  def test_redact_path_preserves_non_token_paths
+    assert_equal "/organizations/org_123", @client.send(:redact_path, "/organizations/org_123")
+  end
+
+  def test_redact_path_preserves_query_string
+    redacted = @client.send(:redact_path, "/user_management/invitations/by_token/secret?foo=bar")
+    assert_equal "/user_management/invitations/by_token/[REDACTED]?foo=bar", redacted
+  end
+
+  def test_redact_path_handles_nil_and_empty
+    assert_nil @client.send(:redact_path, nil)
+    assert_equal "", @client.send(:redact_path, "")
+  end
+
+  def test_redact_path_scrubs_sensitive_query_params
+    redacted = @client.send(:redact_path, "/user_management/sessions/logout?session_id=ses_abc123&return_to=https://app.example.com")
+    assert_equal "/user_management/sessions/logout?session_id=[REDACTED]&return_to=https://app.example.com", redacted
+  end
+
+  def test_redact_path_scrubs_authorize_code_query_param
+    redacted = @client.send(:redact_path, "/user_management/authorize?client_id=client_1&code=auth_code_secret&state=xyz")
+    assert_equal "/user_management/authorize?client_id=client_1&code=[REDACTED]&state=xyz", redacted
+  end
+
+  def test_redact_path_leaves_non_sensitive_query_params_untouched
+    redacted = @client.send(:redact_path, "/user_management/users?limit=10&order=desc")
+    assert_equal "/user_management/users?limit=10&order=desc", redacted
+  end
+
+  def test_redact_path_scrubs_query_alongside_path_segment_redaction
+    redacted = @client.send(:redact_path, "/user_management/magic_auth/magic_secret?token=qs_token")
+    assert_equal "/user_management/magic_auth/[REDACTED]?token=[REDACTED]", redacted
+  end
 end

data/test/workos/test_client_api.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class ClientApiTest < Minitest::Test
+  include FixtureHelper
+
+  def setup
+    @client = WorkOS::Client.new(api_key: "sk_test_123")
+  end
+
+  def test_create_token_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/client/token(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.client_api.create_token(organization_id: "stub", user_id: "stub")
+    refute_nil result
+  end
+
+  # Parameterized authentication error tests (one per endpoint).
+  [
+    {name: :create_token, verb: :post, url: %r{\Ahttps://api\.workos\.com/client/token(\?|\z)}, args: {organization_id: "stub", user_id: "stub"}}
+  ].each do |spec|
+    define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
+      stub_request(spec[:verb], spec[:url])
+        .to_return(body: '{"message": "Unauthorized"}', status: 401)
+      assert_raises(WorkOS::AuthenticationError) do
+        @client.client_api.send(spec[:name], **(spec[:args] || {}))
+      end
+    end
+  end
+end

data/test/workos/test_connect_model_round_trip.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class ConnectModelRoundTripTest < Minitest::Test
+  def test_connect_application_round_trip
+    fixture = {
+      "object" => "connect_application",
+      "id" => "stub",
+      "client_id" => "stub",
+      "description" => nil,
+      "name" => "stub",
+      "scopes" => [],
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::ConnectApplication.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["client_id"], json[:client_id]
+    assert_nil json[:description]
+    assert_equal fixture["name"], json[:name]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_encryptors_aes_gcm.rb

@@ -28,11 +28,26 @@ class EncryptorsAesGcmTest < Minitest::Test
 
   def test_unseal_with_wrong_key_raises
     sealed = @enc.seal({"x" => 1}, PASSWORD)
+    # Wrong key is the same length (>= 32 bytes) so the length guard doesn't
+    # short-circuit; we want to assert the underlying cipher rejection.
     assert_raises(OpenSSL::Cipher::CipherError) do
-      @enc.unseal(sealed, "wrong-password")
+      @enc.unseal(sealed, "wrong-cookie-password-32-bytes--")
     end
   end
 
+  def test_unseal_rejects_short_key
+    sealed = @enc.seal({"x" => 1}, PASSWORD)
+    assert_raises(ArgumentError) do
+      @enc.unseal(sealed, "too-short")
+    end
+  end
+
+  def test_seal_rejects_short_key
+    assert_raises(ArgumentError) { @enc.seal({"x" => 1}, "too-short") }
+    assert_raises(ArgumentError) { @enc.seal({"x" => 1}, nil) }
+    assert_raises(ArgumentError) { @enc.seal({"x" => 1}, "") }
+  end
+
   def test_unseal_rejects_short_payload
     assert_raises(ArgumentError) do
       @enc.unseal(Base64.strict_encode64("short"), PASSWORD)