workos 8.0.1 → 9.1.0

data/rbi/workos/vault_names_listed.rbi

@@ -9,6 +9,12 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
     sig { returns(String) }
     def id; end
 
@@ -39,12 +45,6 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::EventContext)).returns(T.nilable(WorkOS::EventContext)) }
     def context=(value); end
 
-    sig { returns(String) }
-    def object; end
-
-    sig { params(value: String).returns(String) }
-    def object=(value); end
-
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/vault_object.rbi

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+# typed: strong
+
+module WorkOS
+  class VaultObject
+    sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
+    def initialize(json); end
+
+    sig { returns(String) }
+    def id; end
+
+    sig { params(value: String).returns(String) }
+    def id=(value); end
+
+    sig { returns(WorkOS::ObjectMetadata) }
+    def metadata; end
+
+    sig { params(value: WorkOS::ObjectMetadata).returns(WorkOS::ObjectMetadata) }
+    def metadata=(value); end
+
+    sig { returns(String) }
+    def name; end
+
+    sig { params(value: String).returns(String) }
+    def name=(value); end
+
+    sig { returns(String) }
+    def value; end
+
+    sig { params(value: String).returns(String) }
+    def value=(value); end
+
+    sig { returns(T::Hash[Symbol, T.untyped]) }
+    def to_h; end
+
+    sig { params(args: T.untyped).returns(String) }
+    def to_json(*args); end
+  end
+end

data/rbi/workos/waitlist_user_approved.rbi

@@ -9,6 +9,12 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
     sig { returns(String) }
     def id; end
 
@@ -39,12 +45,6 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::EventContext)).returns(T.nilable(WorkOS::EventContext)) }
     def context=(value); end
 
-    sig { returns(String) }
-    def object; end
-
-    sig { params(value: String).returns(String) }
-    def object=(value); end
-
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/waitlist_user_created.rbi

@@ -9,6 +9,12 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
     sig { returns(String) }
     def id; end
 
@@ -39,12 +45,6 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::EventContext)).returns(T.nilable(WorkOS::EventContext)) }
     def context=(value); end
 
-    sig { returns(String) }
-    def object; end
-
-    sig { params(value: String).returns(String) }
-    def object=(value); end
-
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/waitlist_user_denied.rbi

@@ -9,6 +9,12 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
     sig { returns(String) }
     def id; end
 
@@ -39,12 +45,6 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::EventContext)).returns(T.nilable(WorkOS::EventContext)) }
     def context=(value); end
 
-    sig { returns(String) }
-    def object; end
-
-    sig { params(value: String).returns(String) }
-    def object=(value); end
-
     sig { returns(T::Hash[Symbol, T.untyped]) }
     def to_h; end
 

data/rbi/workos/webhook_endpoint.rbi

@@ -1,4 +1,5 @@
 # frozen_string_literal: true
+
 # This file is auto-generated by oagen. Do not edit.
 
 # typed: strong

data/rbi/workos/webhooks.rbi

@@ -25,7 +25,7 @@ module WorkOS
         endpoint_url: String,
         events: T::Array[String],
         request_options: T::Hash[Symbol, T.untyped]
-      ).returns(WorkOS::WebhookEndpointJson)
+      ).returns(WorkOS::WebhookEndpoint)
     end
     def create_webhook_endpoint(endpoint_url:, events:, request_options:); end
 
@@ -36,7 +36,7 @@ module WorkOS
         status: T.nilable(String),
         events: T.nilable(T::Array[String]),
         request_options: T::Hash[Symbol, T.untyped]
-      ).returns(WorkOS::WebhookEndpointJson)
+      ).returns(WorkOS::WebhookEndpoint)
     end
     def update_webhook_endpoint(id:, endpoint_url:, status:, events:, request_options:); end
 

data/renovate.json

@@ -1,66 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:recommended"
-  ],
-  "dependencyDashboard": false,
-  "schedule": [
-    "on the 15th day of the month before 12pm"
-  ],
-  "timezone": "UTC",
-  "rebaseWhen": "conflicted",
-  "packageRules": [
-    {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "pinDigests": true,
-      "extractVersion": "^v(?<version>\\d+\\.\\d+\\.\\d+)$"
-    },
-    {
-      "matchUpdateTypes": [
-        "minor",
-        "patch"
-      ],
-      "automerge": true,
-      "groupName": "minor and patch updates"
-    },
-    {
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "automerge": false
-    },
-    {
-      "matchUpdateTypes": [
-        "digest"
-      ],
-      "automerge": false
-    },
-    {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "minor",
-        "patch",
-        "digest",
-        "pinDigest"
-      ],
-      "groupName": "github actions non-major",
-      "groupSlug": "github-actions-non-major",
-      "automerge": true
-    },
-    {
-      "matchManagers": [
-        "github-actions"
-      ],
-      "matchUpdateTypes": [
-        "major"
-      ],
-      "groupName": "github actions major",
-      "groupSlug": "github-actions-major",
-      "automerge": false
-    }
+    "github>workos/renovate-config:public"
   ]
 }

data/test/workos/test_api_keys.rb

@@ -39,12 +39,20 @@ class ApiKeysTest < Minitest::Test
     assert_nil result
   end
 
+  def test_create_api_key_expire_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/api_keys/stub/expire(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.api_keys.create_api_key_expire(id: "stub")
+    refute_nil result
+  end
+
   # Parameterized authentication error tests (one per endpoint).
   [
     {name: :list_organization_api_keys, verb: :get, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub"}},
     {name: :create_organization_api_key, verb: :post, url: %r{\Ahttps://api\.workos\.com/organizations/stub/api_keys(\?|\z)}, args: {organization_id: "stub", name: "stub"}},
     {name: :create_validation, verb: :post, url: %r{\Ahttps://api\.workos\.com/api_keys/validations(\?|\z)}, args: {value: "stub"}},
-    {name: :delete_api_key, verb: :delete, url: %r{\Ahttps://api\.workos\.com/api_keys/stub(\?|\z)}, args: {id: "stub"}}
+    {name: :delete_api_key, verb: :delete, url: %r{\Ahttps://api\.workos\.com/api_keys/stub(\?|\z)}, args: {id: "stub"}},
+    {name: :create_api_key_expire, verb: :post, url: %r{\Ahttps://api\.workos\.com/api_keys/stub/expire(\?|\z)}, args: {id: "stub"}}
   ].each do |spec|
     define_method("test_#{spec[:name]}_raises_authentication_error_on_401") do
       stub_request(spec[:verb], spec[:url])

data/test/workos/test_base_client.rb

@@ -86,6 +86,14 @@ class BaseClientTest < Minitest::Test
     @client = WorkOS::BaseClient.new(api_key: "sk_test_123", max_retries: 1)
   end
 
+  def teardown
+    super
+    # Close any open connections and clear the thread-local cache to avoid
+    # leaking sockets between tests.
+    @client.shutdown
+    Thread.current[:workos_connections] = nil
+  end
+
   def test_request_dispatches_known_methods
     client = RecordingClient.new(api_key: "sk_test_123")
 
@@ -171,6 +179,62 @@ class BaseClientTest < Minitest::Test
     refute keep.finished
   end
 
+  # Regression test for https://github.com/workos/workos-ruby/issues/496
+  #
+  # The connection cache must be isolated per thread. A previous version
+  # keyed it on Fiber[] (inheritable fiber storage), which is inherited *by
+  # reference* by child threads — so a Net::HTTP socket warmed in a parent
+  # thread leaked into every worker thread spawned afterward (Solid Queue,
+  # Puma, etc.) and got driven concurrently, corrupting the stream.
+  def test_connection_cache_is_not_shared_with_threads_spawned_after_warming
+    # Warm a connection in the "parent" thread before spawning workers.
+    parent_cache = @client.send(:thread_connections)
+    warm = FakeConnection.new
+    parent_cache["https:api.workos.com:443:30"] = warm
+
+    results = Array.new(4) do
+      Thread.new do
+        cache = @client.send(:thread_connections)
+        {cache_id: cache.object_id, leaked: cache.value?(warm), size: cache.size}
+      end
+    end.map(&:value)
+
+    results.each do |r|
+      refute_equal parent_cache.object_id, r[:cache_id],
+        "worker thread must not share the parent thread's connection cache"
+      refute r[:leaked],
+        "parent thread's warmed connection leaked into a worker thread"
+      assert_equal 0, r[:size],
+        "worker thread should start with an empty, isolated cache"
+    end
+
+    # The parent's own cache is left intact.
+    assert_same warm, parent_cache["https:api.workos.com:443:30"]
+  end
+
+  # Exercises the connection_for path (not just the storage helper):
+  # each thread must open and cache its *own* Net::HTTP connection rather
+  # than reusing one established on another thread.
+  #
+  # Net::HTTP#start is stubbed to avoid real TCP+TLS connections.
+  def test_connection_for_opens_a_distinct_connection_per_thread
+    original_start = Net::HTTP.instance_method(:start)
+    Net::HTTP.define_method(:start) { self }
+
+    parent_conn = @client.send(:connection_for, "https://api.workos.com", 30)
+
+    worker_conns = Array.new(4) do
+      Thread.new { @client.send(:connection_for, "https://api.workos.com", 30).object_id }
+    end.map(&:value)
+
+    refute_includes worker_conns, parent_conn.object_id,
+      "a worker thread reused a connection opened on another thread"
+    assert_equal worker_conns.length, worker_conns.uniq.length,
+      "worker threads must each get a distinct connection"
+  ensure
+    Net::HTTP.define_method(:start, original_start)
+  end
+
   def test_redact_path_strips_invitation_token_segment
     redacted = @client.send(:redact_path, "/user_management/invitations/by_token/invtoken_secret123")
     assert_equal "/user_management/invitations/by_token/[REDACTED]", redacted