workos 9.4.0 → 9.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ccece89bf392d369324892e98d39240f2257017895ab40a1b07d80b433b0d28a
-  data.tar.gz: 43915ec1d843df957f327388dbfa9cc54f93ed1c20b07bde5caf3f8eb78b78a3
+  metadata.gz: 1c34fe37d22956705fc72fc7bc0aabd35e5dde5a4a784263705ac684708d8482
+  data.tar.gz: 8d40b87964c3fb62b7f06bf58d9a93256a37aa45428741ba61f8f05fa0b93aba
 SHA512:
-  metadata.gz: 3a429c45d4294e40236c3a0ce87d2df053e2345208615e2f96a8035026cd849fbcd1a03c166ac268196ac5802fd6b412d9f861c3d870f6e218bdf0cb0f0f6b4b
-  data.tar.gz: 78001bbb9b8c29f2e525a76395df27fa6c7d8b8f2f652c439e9a423077732f7cdf8bb1a032fcc91e7c5b0f61e3c99e84e8c3588ca47a305a198680f78afca7f7
+  metadata.gz: 43edc59178986404b4ce4efbf2bfc614775dd53a82d987adea6e9713a38b71ab7b2c8c11e5579bdf26b83a48f980c493b2c387a2eb433c8dbc9293e4aa3edaf2
+  data.tar.gz: 3a302db04edaaf67e5b27e66a114587a7e9cef1d1ae163fad0e1b240207ac84faed2a60e7ebc8fabd62b0ea7ceb6ad84e64d1a0632830f6d87e7787c64e9fd20

data/.github/workflows/release-please.yml

@@ -3,10 +3,10 @@ name: Release Please
 on:
   push:
     branches:
-      - main
+      - v9.5.x
 
 concurrency:
-  group: release-please
+  group: release-please-v9.5.x
   cancel-in-progress: false
 
 permissions:
@@ -40,6 +40,7 @@ jobs:
         id: release
         with:
           token: ${{ steps.generate-token.outputs.token }}
+          target-branch: v9.5.x
 
   # While the release PR is open, enrich it before it merges. Runs as its
   # own job (gated on the PR existing) so a failure here can never block the

data/.last-synced-sha

@@ -1 +1 @@
-4b4e0618779460dbebc1cf5e0f02197c21796d1f
+23faa38318d596e581656934ed72c4a18476d742

data/.oagen-manifest.json

@@ -1,7 +1,6 @@
 {
   "version": 2,
   "language": "ruby",
-  "generatedAt": "2026-07-02T17:29:49.181Z",
   "files": [
     "lib/workos.rb",
     "lib/workos/admin_portal.rb",
@@ -2057,6 +2056,14 @@
     "PUT /user_management/users/{user_id}/connected_accounts/{slug}": {
       "sdkMethod": "update_user_connected_account",
       "service": "pipes"
+    },
+    "POST /user_management/authenticate#RadarEmailChallengeCodeSessionAuthenticateRequest": {
+      "sdkMethod": "authenticate_with_radar_email_challenge",
+      "service": "user_management"
+    },
+    "POST /user_management/authenticate#RadarSmsChallengeCodeSessionAuthenticateRequest": {
+      "sdkMethod": "authenticate_with_radar_sms_challenge",
+      "service": "user_management"
     }
   }
 }

data/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "9.4.0"
+  ".": "9.5.1"
 }

data/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## [9.5.1](https://github.com/workos/workos-ruby/compare/v9.5.0...v9.5.1) (2026-08-20)
+
+
+### Bug Fixes
+
+* explicitly evict connections if request does not complete as success ([bfee53e](https://github.com/workos/workos-ruby/commit/bfee53efbd80a2156cbd15b70b483be66913e714))
+
+## [9.5.0](https://github.com/workos/workos-ruby/compare/v9.4.0...v9.5.0) (2026-07-06)
+
+* [#514](https://github.com/workos/workos-ruby/pull/514) fix(generated): regenerate from spec
+
+  **Features**
+  * **[user_management](https://workos.com/docs/reference/authkit/user)**:
+    * Added model `UserRoleAssignmentSource`
+    * Added `source` to `UserRoleAssignment`
+    * Added enum `UserRoleAssignmentSourceType`
+    * Added parameter `UserManagementAuthentication.authorize.max_age`
+    * Added endpoint `GET /user_management/cors_origins`
+    * Added endpoint `GET /user_management/redirect_uris`
+
+  **Fixes**
+  * Restore mistakenly removed CreateMagicAuth logic from previous release
+
 ## [9.4.0](https://github.com/workos/workos-ruby/compare/v9.3.0...v9.4.0) (2026-07-02)
 
 * [#508](https://github.com/workos/workos-ruby/pull/508) fix(generated): regenerate from spec

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    workos (9.4.0)
+    workos (9.5.1)
       jwt (~> 3.1)
       logger (~> 1.7)
       zeitwerk (~> 2.6)
@@ -153,7 +153,7 @@ CHECKSUMS
   unicode-emoji (4.2.0) sha256=519e69150f75652e40bf736106cfbc8f0f73aa3fb6a65afe62fefa7f80b0f80f
   webmock (3.26.2) sha256=774556f2ea6371846cca68c01769b2eac0d134492d21f6d0ab5dd643965a4c90
   webrick (1.9.2) sha256=beb4a15fc474defed24a3bda4ffd88a490d517c9e4e6118c3edce59e45864131
-  workos (9.4.0)
+  workos (9.5.1)
   yard (0.9.44) sha256=eb087e9b631ccd887b049f303d489963945452d5e2a7eb49a5a74a7cf6887f28
   yard-markdown (0.7.1) sha256=06c378632dfe7ba053be9ba469eb4701aa0470e36bcf7e5546f353eb90c1bfd1
   zeitwerk (2.7.5) sha256=d8da92128c09ea6ec62c949011b00ed4a20242b255293dd66bf41545398f73dd

data/lib/workos/base_client.rb

@@ -137,7 +137,20 @@ module WorkOS
         loggable_path = redact_path(request.path)
         log(:debug, "request start", method: request.method, path: loggable_path, attempt: attempt + 1)
         http = connection_for(base, timeout)
-        response = http.request(request)
+        request_completed = false
+        begin
+          response = http.request(request)
+          request_completed = true
+        ensure
+          # Any exit from #request other than a returned response can leave
+          # the socket mid-stream: a connection error the rescue below knows
+          # about, one it doesn't (OpenSSL::SSL::SSLError,
+          # Net::HTTPBadResponse), or a non-local exit such as an
+          # application-level Timeout.timeout or Thread#kill. A half-read
+          # socket handed back to the pool desyncs the *next* request on this
+          # thread, so drop it here rather than in the rescue.
+          evict_connection(base) unless request_completed
+        end
         return response if response.is_a?(Net::HTTPSuccess)
 
         if attempt < retries && retryable?(response)

data/lib/workos/user_management/magic_auth_send_magic_auth_code_and_return_response.rb

@@ -5,13 +5,38 @@
 module WorkOS
   class MagicAuthSendMagicAuthCodeAndReturnResponse < WorkOS::Types::BaseModel
     HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      user_id: :user_id,
+      email: :email,
+      expires_at: :expires_at,
+      created_at: :created_at,
+      updated_at: :updated_at,
+      code: :code,
       radar_auth_attempt_id: :radar_auth_attempt_id
     }.freeze
 
-    attr_accessor :radar_auth_attempt_id
+    attr_accessor \
+      :object,
+      :id,
+      :user_id,
+      :email,
+      :expires_at,
+      :created_at,
+      :updated_at,
+      :code,
+      :radar_auth_attempt_id
 
     def initialize(json)
       hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @user_id = hash[:user_id]
+      @email = hash[:email]
+      @expires_at = hash[:expires_at]
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+      @code = hash[:code]
       @radar_auth_attempt_id = hash[:radar_auth_attempt_id]
     end
   end

data/lib/workos/user_management/user_create_response.rb

@@ -3,5 +3,59 @@
 # This file is auto-generated by oagen. Do not edit.
 
 module WorkOS
-  UserCreateResponse = MagicAuthSendMagicAuthCodeAndReturnResponse
+  class UserCreateResponse < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      object: :object,
+      id: :id,
+      first_name: :first_name,
+      last_name: :last_name,
+      name: :name,
+      profile_picture_url: :profile_picture_url,
+      email: :email,
+      email_verified: :email_verified,
+      external_id: :external_id,
+      metadata: :metadata,
+      last_sign_in_at: :last_sign_in_at,
+      locale: :locale,
+      created_at: :created_at,
+      updated_at: :updated_at,
+      radar_auth_attempt_id: :radar_auth_attempt_id
+    }.freeze
+
+    attr_accessor \
+      :object,
+      :id,
+      :first_name,
+      :last_name,
+      :name,
+      :profile_picture_url,
+      :email,
+      :email_verified,
+      :external_id,
+      :metadata,
+      :last_sign_in_at,
+      :locale,
+      :created_at,
+      :updated_at,
+      :radar_auth_attempt_id
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @object = hash[:object]
+      @id = hash[:id]
+      @first_name = hash[:first_name]
+      @last_name = hash[:last_name]
+      @name = hash[:name]
+      @profile_picture_url = hash[:profile_picture_url]
+      @email = hash[:email]
+      @email_verified = hash[:email_verified]
+      @external_id = hash[:external_id]
+      @metadata = hash[:metadata] || {}
+      @last_sign_in_at = hash[:last_sign_in_at]
+      @locale = hash[:locale]
+      @created_at = hash[:created_at]
+      @updated_at = hash[:updated_at]
+      @radar_auth_attempt_id = hash[:radar_auth_attempt_id]
+    end
+  end
 end

data/lib/workos/user_management.rb

@@ -133,6 +133,8 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param signals_id [String, nil]
+    # @param radar_auth_attempt_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_password(
@@ -142,6 +144,8 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      signals_id: nil,
+      radar_auth_attempt_id: nil,
       request_options: {}
     )
       body = {
@@ -153,7 +157,9 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "signals_id" => signals_id,
+        "radar_auth_attempt_id" => radar_auth_attempt_id
       }.compact
       response = @client.request(
         method: :post,
@@ -172,6 +178,7 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param signals_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_code(
@@ -181,6 +188,7 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      signals_id: nil,
       request_options: {}
     )
       body = {
@@ -192,7 +200,8 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "signals_id" => signals_id
       }.compact
       response = @client.request(
         method: :post,
@@ -247,6 +256,7 @@ module WorkOS
     # @param ip_address [String, nil]
     # @param device_id [String, nil]
     # @param user_agent [String, nil]
+    # @param radar_auth_attempt_id [String, nil]
     # @param request_options [Hash] Per-request overrides.
     # @return [WorkOS::AuthenticateResponse]
     def authenticate_with_magic_auth(
@@ -256,6 +266,7 @@ module WorkOS
       ip_address: nil,
       device_id: nil,
       user_agent: nil,
+      radar_auth_attempt_id: nil,
       request_options: {}
     )
       body = {
@@ -267,7 +278,8 @@ module WorkOS
         "invitation_token" => invitation_token,
         "ip_address" => ip_address,
         "device_id" => device_id,
-        "user_agent" => user_agent
+        "user_agent" => user_agent,
+        "radar_auth_attempt_id" => radar_auth_attempt_id
       }.compact
       response = @client.request(
         method: :post,
@@ -422,6 +434,87 @@ module WorkOS
       WorkOS::AuthenticateResponse.new(response.body)
     end
 
+    # Authenticate with radar email challenge.
+    # @param code [String]
+    # @param radar_challenge_id [String]
+    # @param pending_authentication_token [String]
+    # @param ip_address [String, nil]
+    # @param device_id [String, nil]
+    # @param user_agent [String, nil]
+    # @param request_options [Hash] Per-request overrides.
+    # @return [WorkOS::AuthenticateResponse]
+    def authenticate_with_radar_email_challenge(
+      code:,
+      radar_challenge_id:,
+      pending_authentication_token:,
+      ip_address: nil,
+      device_id: nil,
+      user_agent: nil,
+      request_options: {}
+    )
+      body = {
+        "grant_type" => "urn:workos:oauth:grant-type:radar-email-challenge:code",
+        "client_id" => @client.client_id,
+        "client_secret" => @client.api_key,
+        "code" => code,
+        "radar_challenge_id" => radar_challenge_id,
+        "pending_authentication_token" => pending_authentication_token,
+        "ip_address" => ip_address,
+        "device_id" => device_id,
+        "user_agent" => user_agent
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/authenticate",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      WorkOS::AuthenticateResponse.new(response.body)
+    end
+
+    # Authenticate with radar sms challenge.
+    # @param code [String]
+    # @param verification_id [String]
+    # @param phone_number [String]
+    # @param pending_authentication_token [String]
+    # @param ip_address [String, nil]
+    # @param device_id [String, nil]
+    # @param user_agent [String, nil]
+    # @param request_options [Hash] Per-request overrides.
+    # @return [WorkOS::AuthenticateResponse]
+    def authenticate_with_radar_sms_challenge(
+      code:,
+      verification_id:,
+      phone_number:,
+      pending_authentication_token:,
+      ip_address: nil,
+      device_id: nil,
+      user_agent: nil,
+      request_options: {}
+    )
+      body = {
+        "grant_type" => "urn:workos:oauth:grant-type:radar-sms-challenge:code",
+        "client_id" => @client.client_id,
+        "client_secret" => @client.api_key,
+        "code" => code,
+        "verification_id" => verification_id,
+        "phone_number" => phone_number,
+        "pending_authentication_token" => pending_authentication_token,
+        "ip_address" => ip_address,
+        "device_id" => device_id,
+        "user_agent" => user_agent
+      }.compact
+      response = @client.request(
+        method: :post,
+        path: "/user_management/authenticate",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      WorkOS::AuthenticateResponse.new(response.body)
+    end
+
     # Get device authorization URL
     # @param client_id [String] The WorkOS client ID for your application.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)

data/lib/workos/version.rb

@@ -2,5 +2,5 @@
 
 # @oagen-ignore-file
 module WorkOS
-  VERSION = "9.4.0"
+  VERSION = "9.5.1"
 end

data/rbi/workos/magic_auth_send_magic_auth_code_and_return_response.rbi

@@ -9,6 +9,54 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
+    sig { returns(String) }
+    def id; end
+
+    sig { params(value: String).returns(String) }
+    def id=(value); end
+
+    sig { returns(String) }
+    def user_id; end
+
+    sig { params(value: String).returns(String) }
+    def user_id=(value); end
+
+    sig { returns(String) }
+    def email; end
+
+    sig { params(value: String).returns(String) }
+    def email=(value); end
+
+    sig { returns(String) }
+    def expires_at; end
+
+    sig { params(value: String).returns(String) }
+    def expires_at=(value); end
+
+    sig { returns(String) }
+    def created_at; end
+
+    sig { params(value: String).returns(String) }
+    def created_at=(value); end
+
+    sig { returns(String) }
+    def updated_at; end
+
+    sig { params(value: String).returns(String) }
+    def updated_at=(value); end
+
+    sig { returns(String) }
+    def code; end
+
+    sig { params(value: String).returns(String) }
+    def code=(value); end
+
     sig { returns(T.nilable(String)) }
     def radar_auth_attempt_id; end
 

data/rbi/workos/user_create_response.rbi

@@ -9,6 +9,90 @@ module WorkOS
     sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
     def initialize(json); end
 
+    sig { returns(String) }
+    def object; end
+
+    sig { params(value: String).returns(String) }
+    def object=(value); end
+
+    sig { returns(String) }
+    def id; end
+
+    sig { params(value: String).returns(String) }
+    def id=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def first_name; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def first_name=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def last_name; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def last_name=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def name; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def name=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def profile_picture_url; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def profile_picture_url=(value); end
+
+    sig { returns(String) }
+    def email; end
+
+    sig { params(value: String).returns(String) }
+    def email=(value); end
+
+    sig { returns(T::Boolean) }
+    def email_verified; end
+
+    sig { params(value: T::Boolean).returns(T::Boolean) }
+    def email_verified=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def external_id; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def external_id=(value); end
+
+    sig { returns(T.nilable(T::Hash[String, String])) }
+    def metadata; end
+
+    sig { params(value: T.nilable(T::Hash[String, String])).returns(T.nilable(T::Hash[String, String])) }
+    def metadata=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def last_sign_in_at; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def last_sign_in_at=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def locale; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def locale=(value); end
+
+    sig { returns(String) }
+    def created_at; end
+
+    sig { params(value: String).returns(String) }
+    def created_at=(value); end
+
+    sig { returns(String) }
+    def updated_at; end
+
+    sig { params(value: String).returns(String) }
+    def updated_at=(value); end
+
     sig { returns(T.nilable(String)) }
     def radar_auth_attempt_id; end
 

data/test/workos/test_base_client.rb

@@ -82,6 +82,24 @@ class BaseClientTest < Minitest::Test
     end
   end
 
+  # A pooled connection that either returns a canned response or raises when
+  # driven, so execute_request can be exercised without real TCP+TLS.
+  class StubConnection < FakeConnection
+    attr_accessor :read_timeout, :open_timeout
+
+    def initialize(response: nil, error: nil, **kwargs)
+      super(**kwargs)
+      @response = response
+      @error = error
+    end
+
+    def request(_request)
+      raise @error if @error
+
+      @response
+    end
+  end
+
   def setup
     @client = WorkOS::BaseClient.new(api_key: "sk_test_123", max_retries: 1)
   end
@@ -179,6 +197,143 @@ class BaseClientTest < Minitest::Test
     refute keep.finished
   end
 
+  # An exception execute_request's rescue clause doesn't list still leaves the
+  # socket mid-stream, so the connection must not survive in the pool for the
+  # next request on this thread to pick up.
+  def test_unlisted_request_error_evicts_the_pooled_connection
+    conn = StubConnection.new(error: Net::HTTPBadResponse.new("wrong version"))
+    cache = @client.send(:thread_connections)
+    cache["https:api.workos.com:443:30"] = conn
+
+    assert_raises(Net::HTTPBadResponse) do
+      @client.execute_request(request: Net::HTTP::Get.new("/things"))
+    end
+
+    refute cache.key?("https:api.workos.com:443:30"),
+      "a connection whose request did not complete must not stay pooled"
+    assert conn.finished
+  end
+
+  def test_completed_request_keeps_the_connection_pooled
+    conn = StubConnection.new(response: Net::HTTPOK.new("1.1", "200", "OK"))
+    cache = @client.send(:thread_connections)
+    cache["https:api.workos.com:443:30"] = conn
+
+    @client.execute_request(request: Net::HTTP::Get.new("/things"))
+
+    assert cache.key?("https:api.workos.com:443:30")
+    refute conn.finished
+  end
+
+  # Raised asynchronously into the worker thread to stand in for a caller-side
+  # abort: Timeout.timeout, Thread#kill, a signal handler unwinding the stack.
+  # It descends from Exception rather than StandardError so that nothing in
+  # execute_request can catch it — the `ensure` is the only cleanup that runs.
+  class AbortSignal < Exception; end # standard:disable Lint/InheritException
+
+  # End-to-end regression test over a real keep-alive socket, for the failure
+  # the eviction actually prevents: request one is abandoned mid-flight, the
+  # server then writes response one onto that socket, and request two on the
+  # same thread reads those stale bytes as if they were its own response.
+  #
+  # Before the fix, request two sees marker "one" (or a mangled response) off
+  # the pooled socket. After it, the abandoned socket is closed and the server
+  # accepts a fresh connection for request two.
+  def test_aborted_request_does_not_leak_its_response_to_the_next_request
+    WebMock.disable!
+    server = TCPServer.new("127.0.0.1", 0)
+    port = server.addr[1]
+    client = WorkOS::BaseClient.new(
+      api_key: "sk_test_123",
+      base_url: "http://127.0.0.1:#{port}",
+      timeout: 5,
+      max_retries: 0
+    )
+
+    request_one_read = Queue.new
+    release_response_one = Queue.new
+    response_one_written = Queue.new
+    aborted = Queue.new
+    connections = Queue.new
+
+    server_thread = Thread.new do
+      # Connection one: read the request, then hold the response back until
+      # the client has been aborted and has unwound.
+      first = server.accept
+      connections << first
+      read_http_request(first)
+      request_one_read << true
+      release_response_one.pop
+      begin
+        write_http_response(first, {marker: "one"})
+      rescue Errno::EPIPE, Errno::ECONNRESET, IOError
+        # Expected once the fix closes the abandoned socket.
+      end
+      response_one_written << true
+
+      # Connection two: a fresh accept, which only completes because the
+      # client did not reuse the socket above.
+      second = server.accept
+      connections << second
+      read_http_request(second)
+      write_http_response(second, {marker: "two"})
+    end
+
+    worker = Thread.new do
+      begin
+        client.execute_request(request: Net::HTTP::Get.new("/one"))
+      rescue AbortSignal
+        # The caller unwinds but the thread survives and goes on to serve more
+        # work, the way a Puma or Solid Queue worker does. execute_request's
+        # `ensure` has already run by the time this body executes.
+        aborted << true
+        response_one_written.pop
+      end
+      response = client.execute_request(request: Net::HTTP::Get.new("/two"))
+      JSON.parse(response.body)["marker"]
+    end
+
+    marker = Timeout.timeout(15) do
+      request_one_read.pop
+      worker.raise(AbortSignal)
+      aborted.pop
+      release_response_one << true
+      worker.value
+    end
+
+    assert_equal "two", marker,
+      "request two read the abandoned socket's response instead of its own"
+  ensure
+    server_thread&.kill
+    worker&.kill
+    until connections.nil? || connections.empty?
+      socket = connections.pop
+      socket.close unless socket.closed?
+    end
+    server&.close
+    WebMock.enable!
+  end
+
+  def read_http_request(socket)
+    socket.gets # request line
+    loop do
+      line = socket.gets
+      break if line.nil? || line == "\r\n"
+    end
+  end
+
+  def write_http_response(socket, body)
+    payload = JSON.generate(body)
+    socket.write(
+      "HTTP/1.1 200 OK\r\n" \
+      "Content-Type: application/json\r\n" \
+      "Content-Length: #{payload.bytesize}\r\n" \
+      "Connection: keep-alive\r\n" \
+      "\r\n#{payload}"
+    )
+    socket.flush
+  end
+
   # Regression test for https://github.com/workos/workos-ruby/issues/496
   #
   # The connection cache must be isolated per thread. A previous version

data/test/workos/test_user_management.rb

@@ -145,6 +145,36 @@ class UserManagementTest < Minitest::Test
     end
   end
 
+  def test_authenticate_with_radar_email_challenge_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.authenticate_with_radar_email_challenge(code: "stub", radar_challenge_id: "stub", pending_authentication_token: "stub")
+    refute_nil result
+  end
+
+  def test_authenticate_with_radar_email_challenge_raises_authentication_error_on_401
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: '{"message": "Unauthorized"}', status: 401)
+    assert_raises(WorkOS::AuthenticationError) do
+      @client.user_management.authenticate_with_radar_email_challenge(code: "stub", radar_challenge_id: "stub", pending_authentication_token: "stub")
+    end
+  end
+
+  def test_authenticate_with_radar_sms_challenge_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    refute_nil result
+  end
+
+  def test_authenticate_with_radar_sms_challenge_raises_authentication_error_on_401
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authenticate(\?|\z)})
+      .to_return(body: '{"message": "Unauthorized"}', status: 401)
+    assert_raises(WorkOS::AuthenticationError) do
+      @client.user_management.authenticate_with_radar_sms_challenge(code: "stub", verification_id: "stub", phone_number: "stub", pending_authentication_token: "stub")
+    end
+  end
+
   def test_create_device_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/authorize/device(\?|\z)})
       .to_return(body: "{}", status: 200)

data/test/workos/test_user_management_model_round_trip.rb

@@ -928,21 +928,60 @@ class UserManagementModelRoundTripTest < Minitest::Test
 
   def test_magic_auth_send_magic_auth_code_and_return_response_round_trip
     fixture = {
+      "object" => "magic_auth",
+      "id" => "stub",
+      "user_id" => "stub",
+      "email" => "stub",
+      "expires_at" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub",
+      "code" => "stub",
       "radar_auth_attempt_id" => "stub"
     }
     model = WorkOS::MagicAuthSendMagicAuthCodeAndReturnResponse.new(fixture.to_json)
     json = model.to_h
     assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["user_id"], json[:user_id]
+    assert_equal fixture["email"], json[:email]
+    assert_equal fixture["expires_at"], json[:expires_at]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    assert_equal fixture["code"], json[:code]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
   def test_user_create_response_round_trip
     fixture = {
+      "object" => "user",
+      "id" => "stub",
+      "first_name" => nil,
+      "last_name" => nil,
+      "name" => nil,
+      "profile_picture_url" => nil,
+      "email" => "stub",
+      "email_verified" => true,
+      "external_id" => nil,
+      "metadata" => {},
+      "last_sign_in_at" => nil,
+      "locale" => nil,
+      "created_at" => "stub",
+      "updated_at" => "stub",
       "radar_auth_attempt_id" => "stub"
     }
     model = WorkOS::UserCreateResponse.new(fixture.to_json)
     json = model.to_h
     assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_nil json[:first_name]
+    assert_nil json[:last_name]
+    assert_nil json[:profile_picture_url]
+    assert_equal fixture["email"], json[:email]
+    assert_equal fixture["email_verified"], json[:email_verified]
+    assert_nil json[:external_id]
+    assert_nil json[:last_sign_in_at]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: workos
 version: !ruby/object:Gem::Version
-  version: 9.4.0
+  version: 9.5.1
 platform: ruby
 authors:
 - WorkOS