workos 9.5.1 → 10.0.0

data/test/workos/test_authorization_model_round_trip.rb

@@ -386,6 +386,243 @@ class AuthorizationModelRoundTripTest < Minitest::Test
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_permission_created_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "permission.created",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PermissionCreated.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_permission_created_data_round_trip
+    fixture = {
+      "object" => "permission",
+      "id" => "stub",
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "system" => true,
+      "resource_type_slug" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::PermissionCreatedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:description]
+    assert_equal fixture["system"], json[:system]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_permission_deleted_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "permission.deleted",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PermissionDeleted.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_permission_deleted_data_round_trip
+    fixture = {
+      "object" => "permission",
+      "id" => "stub",
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "system" => true,
+      "resource_type_slug" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::PermissionDeletedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:description]
+    assert_equal fixture["system"], json[:system]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_permission_updated_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "permission.updated",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::PermissionUpdated.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_permission_updated_data_round_trip
+    fixture = {
+      "object" => "permission",
+      "id" => "stub",
+      "slug" => "stub",
+      "name" => "stub",
+      "description" => nil,
+      "system" => true,
+      "resource_type_slug" => "stub",
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::PermissionUpdatedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["name"], json[:name]
+    assert_nil json[:description]
+    assert_equal fixture["system"], json[:system]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_created_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "role.created",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::RoleCreated.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_created_data_round_trip
+    fixture = {
+      "object" => "role",
+      "slug" => "stub",
+      "resource_type_slug" => "stub",
+      "permissions" => [],
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::RoleCreatedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_deleted_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "role.deleted",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::RoleDeleted.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_deleted_data_round_trip
+    fixture = {
+      "object" => "role",
+      "slug" => "stub",
+      "resource_type_slug" => "stub",
+      "permissions" => [],
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::RoleDeletedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_updated_round_trip
+    fixture = {
+      "object" => "event",
+      "id" => "stub",
+      "event" => "role.updated",
+      "data" => {},
+      "created_at" => "stub",
+      "context" => {}
+    }
+    model = WorkOS::RoleUpdated.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["created_at"], json[:created_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_role_updated_data_round_trip
+    fixture = {
+      "object" => "role",
+      "slug" => "stub",
+      "resource_type_slug" => "stub",
+      "permissions" => [],
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::RoleUpdatedData.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["slug"], json[:slug]
+    assert_equal fixture["resource_type_slug"], json[:resource_type_slug]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_user_role_assignment_resource_round_trip
     fixture = {
       "id" => "stub",

data/test/workos/test_base_client.rb

@@ -82,24 +82,6 @@ class BaseClientTest < Minitest::Test
     end
   end
 
-  # A pooled connection that either returns a canned response or raises when
-  # driven, so execute_request can be exercised without real TCP+TLS.
-  class StubConnection < FakeConnection
-    attr_accessor :read_timeout, :open_timeout
-
-    def initialize(response: nil, error: nil, **kwargs)
-      super(**kwargs)
-      @response = response
-      @error = error
-    end
-
-    def request(_request)
-      raise @error if @error
-
-      @response
-    end
-  end
-
   def setup
     @client = WorkOS::BaseClient.new(api_key: "sk_test_123", max_retries: 1)
   end
@@ -137,6 +119,33 @@ class BaseClientTest < Minitest::Test
     assert_equal "idem_123", request["Idempotency-Key"]
   end
 
+  # The body is serialized verbatim (no `.compact`), so an explicit `nil` is
+  # sent as JSON `null` — this is what lets generated methods clear a nullable
+  # field. Omission is handled upstream in the generated method, not here.
+  def test_put_request_serializes_explicit_nil_as_json_null
+    request = @client.put_request(path: "/widgets/w_1", auth: true, body: {"external_id" => nil})
+
+    assert_equal({"external_id" => nil}, JSON.parse(request.body))
+  end
+
+  def test_post_request_serializes_explicit_nil_as_json_null
+    request = @client.post_request(path: "/widgets", auth: true, body: {"external_id" => nil})
+
+    assert_equal({"external_id" => nil}, JSON.parse(request.body))
+  end
+
+  def test_patch_request_serializes_explicit_nil_as_json_null
+    request = @client.patch_request(path: "/widgets/w_1", auth: true, body: {"external_id" => nil})
+
+    assert_equal({"external_id" => nil}, JSON.parse(request.body))
+  end
+
+  def test_delete_request_serializes_explicit_nil_as_json_null
+    request = @client.delete_request(path: "/widgets/w_1", auth: true, body: {"external_id" => nil})
+
+    assert_equal({"external_id" => nil}, JSON.parse(request.body))
+  end
+
   def test_retry_path_generates_idempotency_key_for_mutating_requests
     stub_request(:post, "https://api.workos.com/widgets")
       .to_return({status: 500, body: '{"message":"retry"}'}, {status: 200, body: "{}"})
@@ -197,143 +206,6 @@ class BaseClientTest < Minitest::Test
     refute keep.finished
   end
 
-  # An exception execute_request's rescue clause doesn't list still leaves the
-  # socket mid-stream, so the connection must not survive in the pool for the
-  # next request on this thread to pick up.
-  def test_unlisted_request_error_evicts_the_pooled_connection
-    conn = StubConnection.new(error: Net::HTTPBadResponse.new("wrong version"))
-    cache = @client.send(:thread_connections)
-    cache["https:api.workos.com:443:30"] = conn
-
-    assert_raises(Net::HTTPBadResponse) do
-      @client.execute_request(request: Net::HTTP::Get.new("/things"))
-    end
-
-    refute cache.key?("https:api.workos.com:443:30"),
-      "a connection whose request did not complete must not stay pooled"
-    assert conn.finished
-  end
-
-  def test_completed_request_keeps_the_connection_pooled
-    conn = StubConnection.new(response: Net::HTTPOK.new("1.1", "200", "OK"))
-    cache = @client.send(:thread_connections)
-    cache["https:api.workos.com:443:30"] = conn
-
-    @client.execute_request(request: Net::HTTP::Get.new("/things"))
-
-    assert cache.key?("https:api.workos.com:443:30")
-    refute conn.finished
-  end
-
-  # Raised asynchronously into the worker thread to stand in for a caller-side
-  # abort: Timeout.timeout, Thread#kill, a signal handler unwinding the stack.
-  # It descends from Exception rather than StandardError so that nothing in
-  # execute_request can catch it — the `ensure` is the only cleanup that runs.
-  class AbortSignal < Exception; end # standard:disable Lint/InheritException
-
-  # End-to-end regression test over a real keep-alive socket, for the failure
-  # the eviction actually prevents: request one is abandoned mid-flight, the
-  # server then writes response one onto that socket, and request two on the
-  # same thread reads those stale bytes as if they were its own response.
-  #
-  # Before the fix, request two sees marker "one" (or a mangled response) off
-  # the pooled socket. After it, the abandoned socket is closed and the server
-  # accepts a fresh connection for request two.
-  def test_aborted_request_does_not_leak_its_response_to_the_next_request
-    WebMock.disable!
-    server = TCPServer.new("127.0.0.1", 0)
-    port = server.addr[1]
-    client = WorkOS::BaseClient.new(
-      api_key: "sk_test_123",
-      base_url: "http://127.0.0.1:#{port}",
-      timeout: 5,
-      max_retries: 0
-    )
-
-    request_one_read = Queue.new
-    release_response_one = Queue.new
-    response_one_written = Queue.new
-    aborted = Queue.new
-    connections = Queue.new
-
-    server_thread = Thread.new do
-      # Connection one: read the request, then hold the response back until
-      # the client has been aborted and has unwound.
-      first = server.accept
-      connections << first
-      read_http_request(first)
-      request_one_read << true
-      release_response_one.pop
-      begin
-        write_http_response(first, {marker: "one"})
-      rescue Errno::EPIPE, Errno::ECONNRESET, IOError
-        # Expected once the fix closes the abandoned socket.
-      end
-      response_one_written << true
-
-      # Connection two: a fresh accept, which only completes because the
-      # client did not reuse the socket above.
-      second = server.accept
-      connections << second
-      read_http_request(second)
-      write_http_response(second, {marker: "two"})
-    end
-
-    worker = Thread.new do
-      begin
-        client.execute_request(request: Net::HTTP::Get.new("/one"))
-      rescue AbortSignal
-        # The caller unwinds but the thread survives and goes on to serve more
-        # work, the way a Puma or Solid Queue worker does. execute_request's
-        # `ensure` has already run by the time this body executes.
-        aborted << true
-        response_one_written.pop
-      end
-      response = client.execute_request(request: Net::HTTP::Get.new("/two"))
-      JSON.parse(response.body)["marker"]
-    end
-
-    marker = Timeout.timeout(15) do
-      request_one_read.pop
-      worker.raise(AbortSignal)
-      aborted.pop
-      release_response_one << true
-      worker.value
-    end
-
-    assert_equal "two", marker,
-      "request two read the abandoned socket's response instead of its own"
-  ensure
-    server_thread&.kill
-    worker&.kill
-    until connections.nil? || connections.empty?
-      socket = connections.pop
-      socket.close unless socket.closed?
-    end
-    server&.close
-    WebMock.enable!
-  end
-
-  def read_http_request(socket)
-    socket.gets # request line
-    loop do
-      line = socket.gets
-      break if line.nil? || line == "\r\n"
-    end
-  end
-
-  def write_http_response(socket, body)
-    payload = JSON.generate(body)
-    socket.write(
-      "HTTP/1.1 200 OK\r\n" \
-      "Content-Type: application/json\r\n" \
-      "Content-Length: #{payload.bytesize}\r\n" \
-      "Connection: keep-alive\r\n" \
-      "\r\n#{payload}"
-    )
-    socket.flush
-  end
-
   # Regression test for https://github.com/workos/workos-ruby/issues/496
   #
   # The connection cache must be isolated per thread. A previous version

data/test/workos/test_client_api_model_round_trip.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+require "test_helper"
+
+class ClientApiModelRoundTripTest < Minitest::Test
+  def test_client_api_token_round_trip
+    fixture = {
+      "organization_id" => "stub",
+      "user_id" => "stub"
+    }
+    model = WorkOS::ClientApiToken.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["organization_id"], json[:organization_id]
+    assert_equal fixture["user_id"], json[:user_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_client_api_token_response_round_trip
+    fixture = {
+      "token" => "stub"
+    }
+    model = WorkOS::ClientApiTokenResponse.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["token"], json[:token]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+end

data/test/workos/test_connect_model_round_trip.rb

@@ -5,6 +5,128 @@
 require "test_helper"
 
 class ConnectModelRoundTripTest < Minitest::Test
+  def test_user_object_round_trip
+    fixture = {
+      "id" => "stub",
+      "email" => "stub",
+      "first_name" => "stub",
+      "last_name" => "stub",
+      "name" => "stub",
+      "metadata" => {}
+    }
+    model = WorkOS::UserObject.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["email"], json[:email]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_user_consent_option_round_trip
+    fixture = {
+      "claim" => "stub",
+      "type" => "enum",
+      "label" => "stub",
+      "choices" => []
+    }
+    model = WorkOS::UserConsentOption.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["claim"], json[:claim]
+    assert_equal fixture["label"], json[:label]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_user_management_login_request_round_trip
+    fixture = {
+      "external_auth_id" => "stub",
+      "user" => {},
+      "user_consent_options" => []
+    }
+    model = WorkOS::UserManagementLoginRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["external_auth_id"], json[:external_auth_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_redirect_uri_input_round_trip
+    fixture = {
+      "uri" => "stub",
+      "default" => nil
+    }
+    model = WorkOS::RedirectUriInput.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["uri"], json[:uri]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_oauth_application_round_trip
+    fixture = {
+      "name" => "stub",
+      "application_type" => "oauth",
+      "description" => nil,
+      "scopes" => nil,
+      "redirect_uris" => nil,
+      "uses_pkce" => nil,
+      "is_first_party" => true,
+      "organization_id" => nil
+    }
+    model = WorkOS::CreateOAuthApplication.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["name"], json[:name]
+    assert_equal fixture["is_first_party"], json[:is_first_party]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_m2m_application_round_trip
+    fixture = {
+      "name" => "stub",
+      "application_type" => "m2m",
+      "description" => nil,
+      "scopes" => nil,
+      "organization_id" => "stub"
+    }
+    model = WorkOS::CreateM2MApplication.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["name"], json[:name]
+    assert_equal fixture["organization_id"], json[:organization_id]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_update_oauth_application_round_trip
+    fixture = {
+      "name" => "stub",
+      "description" => nil,
+      "scopes" => nil,
+      "redirect_uris" => nil
+    }
+    model = WorkOS::UpdateOAuthApplication.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_create_application_secret_round_trip
+    model = WorkOS::CreateApplicationSecret.new("{}")
+    json = model.to_h
+    assert_kind_of Hash, json
+  end
+
+  def test_external_auth_complete_response_round_trip
+    fixture = {
+      "redirect_uri" => "stub"
+    }
+    model = WorkOS::ExternalAuthCompleteResponse.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["redirect_uri"], json[:redirect_uri]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_connect_application_round_trip
     fixture = {
       "object" => "connect_application",
@@ -27,4 +149,57 @@ class ConnectModelRoundTripTest < Minitest::Test
     assert_equal fixture["updated_at"], json[:updated_at]
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
+
+  def test_new_connect_application_secret_round_trip
+    fixture = {
+      "object" => "connect_application_secret",
+      "id" => "stub",
+      "secret_hint" => "stub",
+      "last_used_at" => nil,
+      "created_at" => "stub",
+      "updated_at" => "stub",
+      "secret" => "stub"
+    }
+    model = WorkOS::NewConnectApplicationSecret.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["secret_hint"], json[:secret_hint]
+    assert_nil json[:last_used_at]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    assert_equal fixture["secret"], json[:secret]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_user_consent_option_choice_round_trip
+    fixture = {
+      "value" => "stub",
+      "label" => "stub"
+    }
+    model = WorkOS::UserConsentOptionChoice.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
+  def test_application_credentials_list_item_round_trip
+    fixture = {
+      "object" => "connect_application_secret",
+      "id" => "stub",
+      "secret_hint" => "stub",
+      "last_used_at" => nil,
+      "created_at" => "stub",
+      "updated_at" => "stub"
+    }
+    model = WorkOS::ApplicationCredentialsListItem.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["id"], json[:id]
+    assert_equal fixture["secret_hint"], json[:secret_hint]
+    assert_nil json[:last_used_at]
+    assert_equal fixture["created_at"], json[:created_at]
+    assert_equal fixture["updated_at"], json[:updated_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
 end