workos 8.0.0 → 9.0.0

data/lib/workos/radar.rb

@@ -16,8 +16,6 @@ module WorkOS
     # @param email [String] The email address of the user making the request.
     # @param auth_method [WorkOS::Types::RadarStandaloneAssessRequestAuthMethod] The authentication method being used.
     # @param action [WorkOS::Types::RadarStandaloneAssessRequestAction] The action being performed.
-    # @param device_fingerprint [String, nil] An optional device fingerprint for the request.
-    # @param bot_score [String, nil] An optional bot detection score for the request.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::RadarStandaloneResponse]
     def create_attempt(
@@ -26,8 +24,6 @@ module WorkOS
       email:,
       auth_method:,
       action:,
-      device_fingerprint: nil,
-      bot_score: nil,
       request_options: {}
     )
       body = {
@@ -35,10 +31,8 @@ module WorkOS
         "user_agent" => user_agent,
         "email" => email,
         "auth_method" => auth_method,
-        "action" => action,
-        "device_fingerprint" => device_fingerprint,
-        "bot_score" => bot_score
-      }.compact
+        "action" => action
+      }
       response = @client.request(
         method: :post,
         path: "/radar/attempts",
@@ -78,8 +72,8 @@ module WorkOS
     end
 
     # Add an entry to a Radar list
-    # @param type [WorkOS::Types::RadarType] The type of the Radar list (e.g. ip_address, domain, email).
-    # @param action [WorkOS::Types::RadarAction] The list action indicating whether to add the entry to the allow or block list.
+    # @param type [WorkOS::Types::RadarListType] The type of the Radar list (e.g. ip_address, domain, email).
+    # @param action [WorkOS::Types::RadarListAction] The list action indicating whether to add the entry to the allow or block list.
     # @param entry [String] The value to add to the list. Must match the format of the list type (e.g. a valid IP address for `ip_address`, a valid email for `email`).
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::RadarListEntryAlreadyPresentResponse]
@@ -105,8 +99,8 @@ module WorkOS
     end
 
     # Remove an entry from a Radar list
-    # @param type [WorkOS::Types::RadarType] The type of the Radar list (e.g. ip_address, domain, email).
-    # @param action [WorkOS::Types::RadarAction] The list action indicating whether to remove the entry from the allow or block list.
+    # @param type [WorkOS::Types::RadarListType] The type of the Radar list (e.g. ip_address, domain, email).
+    # @param action [WorkOS::Types::RadarListAction] The list action indicating whether to remove the entry from the allow or block list.
     # @param entry [String] The value to remove from the list. Must match an existing entry.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [void]

data/lib/workos/session.rb

@@ -21,8 +21,16 @@ module WorkOS
   # @example Build a logout URL
   #   url = session.get_logout_url(return_to: "https://app.example.com")
   class Session
+    # Minimum cookie_password byte length. AES-256-GCM derives a 32-byte
+    # key from the password via SHA-256; a passphrase shorter than the
+    # output it derives to provides less than the full keyspace and makes
+    # offline brute-force feasible. Require callers to supply at least 32
+    # bytes of high-entropy secret. See README + V7_MIGRATION_GUIDE.md.
+    MIN_COOKIE_PASSWORD_BYTES = 32
+
     def initialize(manager, seal_data:, cookie_password:)
       raise ArgumentError, "cookie_password is required" if cookie_password.nil? || cookie_password.empty?
+      raise ArgumentError, "cookie_password must be at least #{MIN_COOKIE_PASSWORD_BYTES} bytes" if cookie_password.bytesize < MIN_COOKIE_PASSWORD_BYTES
       @manager = manager
       @client = manager.client
       @seal_data = seal_data
@@ -57,7 +65,7 @@ module WorkOS
         return SessionManager::AuthError.new(authenticated: false, reason: SessionManager::INVALID_JWT)
       end
 
-      is_expired = decoded["exp"] && decoded["exp"] < Time.now.to_i
+      is_expired = decoded["exp"].nil? || decoded["exp"] < Time.now.to_i
 
       SessionManager::AuthSuccess.new(
         authenticated: !is_expired,
@@ -77,6 +85,11 @@ module WorkOS
 
     def refresh(organization_id: nil, cookie_password: nil)
       effective_password = cookie_password || @cookie_password
+      # Validate up front so a caller-supplied short password raises ArgumentError
+      # (matching Session#initialize) instead of being swallowed by the
+      # unseal_data rescue and surfacing as INVALID_SESSION_COOKIE.
+      raise ArgumentError, "cookie_password is required" if effective_password.nil? || effective_password.empty?
+      raise ArgumentError, "cookie_password must be at least #{MIN_COOKIE_PASSWORD_BYTES} bytes" if effective_password.bytesize < MIN_COOKIE_PASSWORD_BYTES
 
       session = begin
         @manager.unseal_data(@seal_data, effective_password)
@@ -105,17 +118,20 @@ module WorkOS
         impersonator: auth_response["impersonator"]
       )
 
-      # Decode before mutating session state so a malformed access_token
-      # doesn't leave the Session half-updated.
-      decoded = @manager.decode_jwt(auth_response["access_token"])
-
+      # Persist the new seal/password BEFORE decoding the JWT, so a transient
+      # JWKS fetch error (or any decode failure on the freshly-minted token)
+      # leaves the Session with a usable sealed cookie that the caller can
+      # re-#authenticate against, rather than half-updated state.
       @seal_data = sealed
       @cookie_password = effective_password
+
+      decoded = @manager.decode_jwt(auth_response["access_token"])
+
       SessionManager::RefreshSuccess.new(
         authenticated: true,
         sealed_session: sealed,
         session_id: decoded["sid"],
-        organization_id: decoded["org_id"],
+        organization_id: auth_response["organization_id"] || decoded["org_id"],
         role: decoded["role"],
         roles: decoded["roles"],
         permissions: decoded["permissions"],
@@ -127,7 +143,12 @@ module WorkOS
     rescue WorkOS::AuthenticationError, WorkOS::InvalidRequestError => e
       SessionManager::RefreshError.new(authenticated: false, reason: e.message)
     rescue JWT::DecodeError => e
-      SessionManager::RefreshError.new(authenticated: false, reason: e.message)
+      # The refresh token was already rotated server-side before decode failed,
+      # so @seal_data holds the freshly-minted cookie. Surface it on the error
+      # struct so the caller can write the rotated cookie back to the browser
+      # and recover on a subsequent #authenticate, rather than re-sending the
+      # now-revoked refresh token.
+      SessionManager::RefreshError.new(authenticated: false, reason: e.message, sealed_session: @seal_data)
     end
 
     # Build the WorkOS session-logout URL for the currently authenticated session.

data/lib/workos/session_manager.rb

@@ -107,7 +107,7 @@ module WorkOS
       :roles, :permissions, :entitlements, :user, :impersonator, :feature_flags,
       keyword_init: true
     )
-    RefreshError = Struct.new(:authenticated, :reason, keyword_init: true)
+    RefreshError = Struct.new(:authenticated, :reason, :sealed_session, keyword_init: true)
 
     # Failure reason constants
     NO_SESSION_COOKIE_PROVIDED = "no_session_cookie_provided"
@@ -150,12 +150,14 @@ module WorkOS
     # H06 — Raw seal: encrypt arbitrary data with a key string.
     # Delegates to the configured encryptor (default: AES-256-GCM).
     def seal_data(data, key)
+      validate_cookie_password!(key)
       @encryptor.seal(data, key)
     end
 
     # H06 — Raw unseal: returns parsed JSON (Hash) or raw string if not JSON.
     # Delegates to the configured encryptor (default: AES-256-GCM).
     def unseal_data(sealed, key)
+      validate_cookie_password!(key)
       @encryptor.unseal(sealed, key)
     end
 
@@ -164,11 +166,20 @@ module WorkOS
       payload = {"access_token" => access_token, "refresh_token" => refresh_token}
       payload["user"] = user if user
       payload["impersonator"] = impersonator if impersonator
+      # Delegates to seal_data, which calls validate_cookie_password!; no need
+      # to validate here too.
       seal_data(payload, cookie_password)
     end
 
     # Verify an access-token JWT against the WorkOS JWKS for this client.
     # Used by Session#authenticate; exposed publicly for advanced cases.
+    #
+    # NOTE on iss/aud/required_claims: this method intentionally does not
+    # enforce iss, aud, or required_claims. workos-node's `jose` call and
+    # workos-php's `isset($exp) && $exp < time()` accept exp-less tokens, and
+    # cross-SDK parity is required for the planned coordinated hardening of
+    # these claims. See commit 9ce069f for the rationale behind dropping the
+    # required_claims: ['exp'] tightening that was considered here.
     def decode_jwt(access_token, verify_expiration: true)
       jwks = fetch_jwks
       JWT.decode(
@@ -182,6 +193,18 @@ module WorkOS
       ).first
     end
 
+    private
+
+    # Validate a cookie_password is non-empty and at least the minimum
+    # byte length required by Session::MIN_COOKIE_PASSWORD_BYTES (32).
+    # Defense-in-depth — Session#initialize enforces the same invariant
+    # on the load path; this guards the inline #seal_data / #unseal_data
+    # entry points.
+    def validate_cookie_password!(key)
+      raise ArgumentError, "cookie_password is required" if key.nil? || key.empty?
+      raise ArgumentError, "cookie_password must be at least #{Session::MIN_COOKIE_PASSWORD_BYTES} bytes" if key.bytesize < Session::MIN_COOKIE_PASSWORD_BYTES
+    end
+
     # Cached JWKS fetch (5-minute TTL, thread-safe).
     def fetch_jwks(now: Time.now)
       @jwks_mutex.synchronize do

data/lib/workos/shared/connect_application_m2m.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ConnectApplicationM2M < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      client_id: :client_id,
+      description: :description,
+      name: :name,
+      scopes: :scopes,
+      created_at: :created_at,
+      updated_at: :updated_at,
+      application_type: :application_type,
+      organization_id: :organization_id
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :client_id,
+      :description,
+      :name,
+      :scopes,
+      :created_at,
+      :updated_at,
+      :application_type,
+      :organization_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @client_id = hash[:client_id]
+      @description = hash[:description]
+      @name = hash[:name]
+      @scopes = hash[:scopes] || []
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+      @application_type = hash[:application_type]
+      @organization_id = hash[:organization_id]
+    end
+  end
+end

data/lib/workos/shared/connect_application_oauth.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ConnectApplicationOAuth < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      client_id: :client_id,
+      description: :description,
+      name: :name,
+      scopes: :scopes,
+      created_at: :created_at,
+      updated_at: :updated_at,
+      application_type: :application_type,
+      redirect_uris: :redirect_uris,
+      uses_pkce: :uses_pkce,
+      is_first_party: :is_first_party,
+      was_dynamically_registered: :was_dynamically_registered,
+      organization_id: :organization_id
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :client_id,
+      :description,
+      :name,
+      :scopes,
+      :created_at,
+      :updated_at,
+      :application_type,
+      :redirect_uris,
+      :uses_pkce,
+      :is_first_party,
+      :was_dynamically_registered,
+      :organization_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @client_id = hash[:client_id]
+      @description = hash[:description]
+      @name = hash[:name]
+      @scopes = hash[:scopes] || []
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+      @application_type = hash[:application_type]
+      @redirect_uris = (hash[:redirect_uris] || []).map { |item| item ? WorkOS::ConnectApplicationOAuthRedirectUris.new(item) : nil }
+      @uses_pkce = hash[:uses_pkce]
+      @is_first_party = hash[:is_first_party]
+      @was_dynamically_registered = hash[:was_dynamically_registered]
+      @organization_id = hash[:organization_id]
+    end
+  end
+end

data/lib/workos/shared/connect_application_oauth_redirect_uris.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ConnectApplicationOAuthRedirectUris < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      uri: :uri,
+      default: :default
+    }.freeze
+
+    attr_accessor \
+      :uri,
+      :default
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @uri = hash[:uri]
+      @default = hash[:default]
+    end
+  end
+end

data/lib/workos/shared/error_response.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class ErrorResponse < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      error: :error
+    }.freeze
+
+    attr_accessor :error
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @error = hash[:error]
+    end
+  end
+end

data/lib/workos/shared/group_created.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class GroupCreated < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::Group.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/shared/group_deleted.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class GroupDeleted < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::Group.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/shared/group_member_added.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class GroupMemberAdded < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::GroupMemberAddedData.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/shared/group_member_removed.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class GroupMemberRemoved < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::GroupMemberRemovedData.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/shared/group_updated.rb

@@ -5,30 +5,30 @@
 module WorkOS
   class GroupUpdated < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
       id: :id,
       event: :event,
       data: :data,
       created_at: :created_at,
-      context: :context,
-      object: :object
+      context: :context
     }.freeze
 
     attr_accessor \
+      :object,
       :id,
       :event,
       :data,
       :created_at,
-      :context,
-      :object
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
       @id = hash[:id]
       @event = hash[:event]
       @data = hash[:data] ? WorkOS::Group.new(hash[:data]) : nil
       @created_at = hash[:created_at]
       @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
-      @object = hash[:object]
     end
   end
 end

data/lib/workos/shared/pipe_connected_account.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipeConnectedAccount < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      data_integration_id: :data_integration_id,
+      provider_slug: :provider_slug,
+      user_id: :user_id,
+      organization_id: :organization_id,
+      scopes: :scopes,
+      state: :state,
+      created_at: :created_at,
+      updated_at: :updated_at
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :data_integration_id,
+      :provider_slug,
+      :user_id,
+      :organization_id,
+      :scopes,
+      :state,
+      :created_at,
+      :updated_at
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @data_integration_id = hash[:data_integration_id]
+      @provider_slug = hash[:provider_slug]
+      @user_id = hash[:user_id]
+      @organization_id = hash[:organization_id]
+      @scopes = hash[:scopes] || []
+      @state = hash[:state]
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+    end
+  end
+end

data/lib/workos/{audit_logs/audit_log_export_json.rb → shared/pipes_connected_account_connected.rb}

@@ -3,32 +3,32 @@
 # This file is auto-generated by oagen. Do not edit.
 
 module WorkOS
-  class AuditLogExportJson < WorkOS::Types::BaseModel
+  class PipesConnectedAccountConnected < WorkOS::Types::BaseModel
     HASH_ATTRS = {
       object: :object,
       id: :id,
-      state: :state,
-      url: :url,
+      event: :event,
+      data: :data,
       created_at: :created_at,
-      updated_at: :updated_at
+      context: :context
     }.freeze
 
     attr_accessor \
       :object,
       :id,
-      :state,
-      :url,
+      :event,
+      :data,
       :created_at,
-      :updated_at
+      :context
 
     def initialize(json)
       hash = self.class.normalize(json)
       @object = hash[:object]
       @id = hash[:id]
-      @state = hash[:state]
-      @url = hash[:url]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipeConnectedAccount.new(hash[:data]) : nil
       @created_at = hash[:created_at]
-      @updated_at = hash[:updated_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
     end
   end
 end

data/lib/workos/shared/pipes_connected_account_disconnected.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesConnectedAccountDisconnected < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipeConnectedAccount.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end

data/lib/workos/shared/pipes_connected_account_reauthorization_needed.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class PipesConnectedAccountReauthorizationNeeded < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      event: :event,
+      data: :data,
+      created_at: :created_at,
+      context: :context
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :event,
+      :data,
+      :created_at,
+      :context
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @event = hash[:event]
+      @data = hash[:data] ? WorkOS::PipeConnectedAccount.new(hash[:data]) : nil
+      @created_at = hash[:created_at]
+      @context = hash[:context] ? WorkOS::EventContext.new(hash[:context]) : nil
+    end
+  end
+end