workosv2 2.15.0

data/lib/workosv2/webhook.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+# typed: true
+
+module WorkOSV2
+  # The Webhook class provides a lightweight wrapper around
+  # a WorkOSV2 Webhook resource. This class is not meant to be instantiated
+  # in user space, and is instantiated internally but exposed.
+  class Webhook
+    include HashProvider
+    extend T::Sig
+
+    attr_accessor :id, :event, :data, :created_at
+
+    sig { params(json: String).void }
+    def initialize(json)
+      raw = parse_json(json)
+
+      @id = T.let(raw.id, String)
+      @event = T.let(raw.event, String)
+      @data = raw.data
+      @created_at = T.let(raw.created_at, String)
+    end
+
+    def to_json(*)
+      {
+        id: id,
+        event: event,
+        data: data,
+        created_at: created_at,
+      }
+    end
+
+    private
+
+    sig do
+      params(
+        json_string: String,
+      ).returns(WorkOSV2::Types::WebhookStruct)
+    end
+    def parse_json(json_string)
+      hash = JSON.parse(json_string, symbolize_names: true)
+
+      WorkOSV2::Types::WebhookStruct.new(
+        id: hash[:id],
+        event: hash[:event],
+        data: hash[:data],
+        created_at: hash[:created_at],
+      )
+    end
+  end
+end

data/lib/workosv2/webhooks.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+# typed: true
+
+require 'openssl'
+
+module WorkOSV2
+  # The Webhooks module provides convenience methods for working with the WorkOSV2 webhooks.
+  # You'll need to extract the signature header and payload from the webhook request
+  # sig_header = request.headers['WorkOSV2-Signature']
+  # payload = request.body.read
+  #
+  # The secret is the Webhook Secret from your WorkOSV2 Dashboard
+  # The tolerance is for the timestamp validation
+  #
+  module Webhooks
+    class << self
+      extend T::Sig
+
+      DEFAULT_TOLERANCE = 180
+
+      # Initializes an Event object from a JSON payload
+      # rubocop:disable Layout/LineLength
+      #
+      # @param [String] payload The payload from the webhook sent by WorkOSV2. This is the RAW_POST_DATA of the request.
+      # @param [String] sig_header The signature from the webhook sent by WorkOSV2.
+      # @param [String] secret The webhook secret from the WorkOSV2 dashboard.
+      # @param [Integer] tolerance The time tolerance in seconds for the webhook.
+      #
+      # @example
+      #   WorkOSV2::Webhooks.construct_event(
+      #     payload: "{"id": "wh_123","data":{"id":"directory_user_01FAEAJCR3ZBZ30D8BD1924TVG","state":"active","emails":[{"type":"work","value":"blair@foo-corp.com","primary":true}],"idp_id":"00u1e8mutl6wlH3lL4x7","object":"directory_user","username":"blair@foo-corp.com","last_name":"Lunceford","first_name":"Blair","directory_id":"directory_01F9M7F68PZP8QXP8G7X5QRHS7","raw_attributes":{"name":{"givenName":"Blair","familyName":"Lunceford","middleName":"Elizabeth","honorificPrefix":"Ms."},"title":"Developer Success Engineer","active":true,"emails":[{"type":"work","value":"blair@foo-corp.com","primary":true}],"groups":[],"locale":"en-US","schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"userName":"blair@foo-corp.com","addresses":[{"region":"CO","primary":true,"locality":"Steamboat Springs","postalCode":"80487"}],"externalId":"00u1e8mutl6wlH3lL4x7","displayName":"Blair Lunceford","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"manager":{"value":"2","displayName":"Kathleen Chung"},"division":"Engineering","department":"Customer Success"}}},"event":"dsync.user.created"}",
+      #     sig_header: 't=1626125972272, v1=80f7ab7efadc306eb5797c588cee9410da9be4416782b497bf1e1bf4175fb928',
+      #     secret: 'LJlTiC19GmCKWs8AE0IaOQcos',
+      #   )
+      #
+      #   => #<WorkOSV2::Webhook:0x00007fa64b980910 @event="dsync.user.created", @data={:id=>"directory_user_01FAEAJCR3ZBZ30D8BD1924TVG", :state=>"active", :emails=>[{:type=>"work", :value=>"blair@foo-corp.com", :primary=>true}], :idp_id=>"00u1e8mutl6wlH3lL4x7", :object=>"directory_user", :username=>"blair@foo-corp.com", :last_name=>"Lunceford", :first_name=>"Blair", :directory_id=>"directory_01F9M7F68PZP8QXP8G7X5QRHS7", :raw_attributes=>{:name=>{:givenName=>"Blair", :familyName=>"Lunceford", :middleName=>"Elizabeth", :honorificPrefix=>"Ms."}, :title=>"Developer Success Engineer", :active=>true, :emails=>[{:type=>"work", :value=>"blair@foo-corp.com", :primary=>true}], :groups=>[], :locale=>"en-US", :schemas=>["urn:ietf:params:scim:schemas:core:2.0:User", "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"], :userName=>"blair@foo-corp.com", :addresses=>[{:region=>"CO", :primary=>true, :locality=>"Steamboat Springs", :postalCode=>"80487"}], :externalId=>"00u1e8mutl6wlH3lL4x7", :displayName=>"Blair Lunceford", :"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"=>{:manager=>{:value=>"2", :displayName=>"Kathleen Chung"}, :division=>"Engineering", :department=>"Customer Success"}}}>
+      #
+      # @return [WorkOSV2::Webhook]
+      # rubocop:enable Layout/LineLength
+      sig do
+        params(
+          payload: String,
+          sig_header: String,
+          secret: String,
+          tolerance: Integer,
+        ).returns(WorkOSV2::Webhook)
+      end
+      def construct_event(
+        payload:,
+        sig_header:,
+        secret:,
+        tolerance: DEFAULT_TOLERANCE
+      )
+        verify_header(payload: payload, sig_header: sig_header, secret: secret, tolerance: tolerance)
+        WorkOSV2::Webhook.new(payload)
+      end
+
+      # Verifies WorkOSV2-Signature header from request
+      # rubocop:disable Layout/LineLength
+      #
+      # @param [String] payload The payload from the webhook sent by WorkOSV2. This is the RAW_POST_DATA of the request.
+      # @param [String] sig_header The signature from the webhook sent by WorkOSV2.
+      # @param [String] secret The webhook secret from the WorkOSV2 dashboard.
+      # @param [Integer] tolerance The time tolerance in seconds for the webhook.
+      #
+      # @example
+      #   WorkOSV2::Webhooks.verify_header(
+      #     payload: "{"id": "wh_123","data":{"id":"directory_user_01FAEAJCR3ZBZ30D8BD1924TVG","state":"active","emails":[{"type":"work","value":"blair@foo-corp.com","primary":true}],"idp_id":"00u1e8mutl6wlH3lL4x7","object":"directory_user","username":"blair@foo-corp.com","last_name":"Lunchford","first_name":"Blair","directory_id":"directory_01F9M7F68PZP8QXP8G7X5QRHS7","raw_attributes":{"name":{"givenName":"Blair","familyName":"Lunchford","middleName":"Elizabeth","honorificPrefix":"Ms."},"title":"Developer Success Engineer","active":true,"emails":[{"type":"work","value":"blair@foo-corp.com","primary":true}],"groups":[],"locale":"en-US","schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"userName":"blair@foo-corp.com","addresses":[{"region":"CA","primary":true,"locality":"San Francisco","postalCode":"94016"}],"externalId":"00u1e8mutl6wlH3lL4x7","displayName":"Blair Lunchford","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"manager":{"value":"2","displayName":"Kate Chapman"},"division":"Engineering","department":"Customer Success"}}},"event":"dsync.user.created"}",
+      #     sig_header: 't=1626125972272, v1=80f7ab7efadc306eb5797c588cee9410da9be4416782b497bf1e1bf4175fb928',
+      #     secret: 'LJlTiC19GmCKWs8AE0IaOQcos',
+      #   )
+      #
+      #   => true
+      #
+      # @return Boolean
+      # rubocop:enable Layout/LineLength
+      sig do
+        params(
+          payload: String,
+          sig_header: String,
+          secret: String,
+          tolerance: Integer,
+        ).returns(T::Boolean)
+      end
+      # rubocop:disable Metrics/AbcSize
+      def verify_header(
+        payload:,
+        sig_header:,
+        secret:,
+        tolerance: DEFAULT_TOLERANCE
+      )
+        begin
+          timestamp, signature_hash = get_timestamp_and_signature_hash(sig_header: sig_header)
+        rescue StandardError
+          raise WorkOSV2::SignatureVerificationError.new(
+            message: 'Unable to extract timestamp and signature hash from header',
+          )
+        end
+
+        if signature_hash.empty?
+          raise WorkOSV2::SignatureVerificationError.new(
+            message: 'No signature hash found with expected scheme v1',
+          )
+        end
+
+        timestamp_to_time = Time.at(timestamp.to_i / 1000)
+
+        if timestamp_to_time < Time.now - tolerance
+          raise WorkOSV2::SignatureVerificationError.new(
+            message: 'Timestamp outside the tolerance zone',
+          )
+        end
+
+        expected_sig = compute_signature(timestamp: timestamp, payload: payload, secret: secret)
+        unless secure_compare(str_a: expected_sig, str_b: signature_hash)
+          raise WorkOSV2::SignatureVerificationError.new(
+            message: 'Signature hash does not match the expected signature hash for payload',
+          )
+        end
+
+        true
+      end
+      # rubocop:enable Metrics/AbcSize
+
+      # Extracts timestamp and signature hash from WorkOSV2-Signature header
+      #
+      # @param [String] sig_header The signature from the webhook sent by WorkOSV2.
+      #
+      # @example
+      #   WorkOSV2::Webhooks.get_timestamp_and_signature_hash(
+      #     sig_header: 't=1626125972272, v1=80f7ab7efadc306eb5797c588cee9410da9be4416782b497bf1e1bf4175fb928',
+      #   )
+      #
+      #   => ['1626125972272', '80f7ab7efadc306eb5797c588cee9410da9be4416782b497bf1e1bf4175fb928']
+      #
+      # @return Array
+      sig do
+        params(
+          sig_header: String,
+        ).returns([String, String])
+      end
+      def get_timestamp_and_signature_hash(
+        sig_header:
+      )
+        timestamp, signature_hash = sig_header.split(', ')
+
+        if timestamp.nil? || signature_hash.nil?
+          raise WorkOSV2::SignatureVerificationError.new(
+            message: 'Unable to extract timestamp and signature hash from header',
+          )
+        end
+
+        timestamp = timestamp.sub('t=', '')
+        signature_hash = signature_hash.sub('v1=', '')
+
+        [timestamp, signature_hash]
+      end
+
+      # Computes expected signature
+      # rubocop:disable Layout/LineLength
+      #
+      # @param [String] timestamp The timestamp from the webhook signature.
+      # @param [String] payload The payload from the webhook sent by WorkOSV2. This is the RAW_POST_DATA of the request.
+      # @param [String] secret The webhook secret from the WorkOSV2 dashboard.
+      #
+      # @example
+      #   WorkOSV2::Webhooks.compute_signature(
+      #     timestamp: '1626125972272',
+      #     payload: "{"id": "wh_123","data":{"id":"directory_user_01FAEAJCR3ZBZ30D8BD1924TVG","state":"active","emails":[{"type":"work","value":"blair@foo-corp.com","primary":true}],"idp_id":"00u1e8mutl6wlH3lL4x7","object":"directory_user","username":"blair@foo-corp.com","last_name":"Lunchford","first_name":"Blair","directory_id":"directory_01F9M7F68PZP8QXP8G7X5QRHS7","raw_attributes":{"name":{"givenName":"Blair","familyName":"Lunchford","middleName":"Elizabeth","honorificPrefix":"Ms."},"title":"Developer Success Engineer","active":true,"emails":[{"type":"work","value":"blair@foo-corp.com","primary":true}],"groups":[],"locale":"en-US","schemas":["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"userName":"blair@foo-corp.com","addresses":[{"region":"CA","primary":true,"locality":"San Francisco","postalCode":"94016"}],"externalId":"00u1e8mutl6wlH3lL4x7","displayName":"Blair Lunchford","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User":{"manager":{"value":"2","displayName":"Kate Chapman"},"division":"Engineering","department":"Customer Success"}}},"event":"dsync.user.created"}",
+      #     secret: 'LJlTiC19GmCKWs8AE0IaOQcos',
+      #   )
+      #
+      #   => '80f7ab7efadc306eb5797c588cee9410da9be4416782b497bf1e1bf4175fb928'
+      #
+      # @return String
+      # rubocop:enable Layout/LineLength
+      sig do
+        params(
+          timestamp: String,
+          payload: String,
+          secret: String,
+        ).returns(String)
+      end
+      def compute_signature(
+        timestamp:,
+        payload:,
+        secret:
+      )
+        unhashed_string = "#{timestamp}.#{payload}"
+        digest = OpenSSL::Digest.new('sha256')
+        OpenSSL::HMAC.hexdigest(digest, secret, unhashed_string)
+      end
+
+      # Constant time string comparison to prevent timing attacks
+      # Code borrowed from ActiveSupport
+      sig do
+        params(
+          str_a: String,
+          str_b: String,
+        ).returns(T::Boolean)
+      end
+      def secure_compare(
+        str_a:,
+        str_b:
+      )
+        return false unless str_a.bytesize == str_b.bytesize
+
+        l = T.unsafe(str_a.unpack("C#{str_a.bytesize}"))
+
+        res = 0
+        str_b.each_byte { |byte| res |= byte ^ l.shift }
+
+        res.zero?
+      end
+    end
+  end
+end

data/lib/workosv2.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+# typed: true
+
+require 'workosv2/version'
+require 'sorbet-runtime'
+require 'json'
+require 'workosv2/hash_provider'
+require 'workosv2/configuration'
+
+# Use the WorkOSV2 module to authenticate your
+# requests to the WorkOSV2 API. The gem will read
+# your API key automatically from the ENV var `WORKOS_API_KEY`.
+# Alternatively, you can set the key yourself with
+# `WorkOSV2.key = [your api key]` somewhere in the load path of
+# your application, such as an initializer.
+module WorkOSV2
+  API_HOSTNAME = ENV['WORKOS_API_HOSTNAME'] || 'api.workos.com'
+
+  def self.key=(value)
+    warn '`WorkOSV2.key=` is deprecated. Use `WorkOSV2.configure` instead.'
+
+    config.key = value
+  end
+
+  def self.key
+    warn '`WorkOSV2.key` is deprecated. Use `WorkOSV2.configure` instead.'
+
+    config.key
+  end
+
+  def self.config
+    @config ||= Configuration.new
+  end
+
+  def self.configure
+    yield(config)
+  end
+
+  autoload :Types, 'workosv2/types'
+  autoload :Client, 'workosv2/client'
+  autoload :Configuration, 'workosv2/configuration'
+  autoload :AuditLogExport, 'workosv2/audit_log_export'
+  autoload :AuditLogs, 'workosv2/audit_logs'
+  autoload :AuditTrail, 'workosv2/audit_trail'
+  autoload :Connection, 'workosv2/connection'
+  autoload :DirectorySync, 'workosv2/directory_sync'
+  autoload :Directory, 'workosv2/directory'
+  autoload :DirectoryGroup, 'workosv2/directory_group'
+  autoload :Event, 'workosv2/event'
+  autoload :Events, 'workosv2/events'
+  autoload :Organization, 'workosv2/organization'
+  autoload :Organizations, 'workosv2/organizations'
+  autoload :Passwordless, 'workosv2/passwordless'
+  autoload :Portal, 'workosv2/portal'
+  autoload :Profile, 'workosv2/profile'
+  autoload :ProfileAndToken, 'workosv2/profile_and_token'
+  autoload :SSO, 'workosv2/sso'
+  autoload :DirectoryUser, 'workosv2/directory_user'
+  autoload :Webhook, 'workosv2/webhook'
+  autoload :Webhooks, 'workosv2/webhooks'
+  autoload :MFA, 'workosv2/mfa'
+  autoload :Factor, 'workosv2/factor'
+  autoload :Challenge, 'workosv2/challenge'
+  autoload :VerifyChallenge, 'workosv2/verify_challenge'
+  autoload :DeprecatedHashWrapper, 'workosv2/deprecated_hash_wrapper'
+
+
+  # Errors
+  autoload :APIError, 'workosv2/errors'
+  autoload :AuthenticationError, 'workosv2/errors'
+  autoload :InvalidRequestError, 'workosv2/errors'
+  autoload :SignatureVerificationError, 'workosv2/errors'
+  autoload :TimeoutError, 'workosv2/errors'
+
+  # Remove WORKOS_KEY at some point in the future. Keeping it here now for
+  # backwards compatibility.
+  key = ENV['WORKOS_API_KEY'] || ENV['WORKOS_KEY']
+  config.key = key unless key.nil?
+end

data/sorbet/config

@@ -0,0 +1,2 @@
+--dir
+.

data/sorbet/rbi/gems/addressable@2.8.0.rbi

@@ -0,0 +1,290 @@
+# typed: true
+
+# DO NOT EDIT MANUALLY
+# This is an autogenerated file for types exported from the `addressable` gem.
+# Please instead update this file by running `bin/tapioca gem addressable`.
+
+module Addressable; end
+
+module Addressable::IDNA
+  class << self
+    def to_ascii(input); end
+    def to_unicode(input); end
+    def unicode_normalize_kc(input); end
+
+    private
+
+    def lookup_unicode_combining_class(codepoint); end
+    def lookup_unicode_compatibility(codepoint); end
+    def lookup_unicode_composition(unpacked); end
+    def lookup_unicode_lowercase(codepoint); end
+    def punycode_adapt(delta, numpoints, firsttime); end
+    def punycode_basic?(codepoint); end
+    def punycode_decode(punycode); end
+    def punycode_decode_digit(codepoint); end
+    def punycode_delimiter?(codepoint); end
+    def punycode_encode(unicode); end
+    def punycode_encode_digit(d); end
+    def ucs4_to_utf8(char, buffer); end
+    def unicode_compose(unpacked); end
+    def unicode_compose_pair(ch_one, ch_two); end
+    def unicode_decompose(unpacked); end
+    def unicode_decompose_hangul(codepoint); end
+    def unicode_downcase(input); end
+    def unicode_sort_canonical(unpacked); end
+  end
+end
+
+Addressable::IDNA::ACE_MAX_LENGTH = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::ACE_PREFIX = T.let(T.unsafe(nil), String)
+Addressable::IDNA::COMPOSITION_TABLE = T.let(T.unsafe(nil), Hash)
+Addressable::IDNA::HANGUL_LBASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_LCOUNT = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_NCOUNT = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_SBASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_SCOUNT = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_TBASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_TCOUNT = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_VBASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::HANGUL_VCOUNT = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_BASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_DAMP = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_DELIMITER = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_INITIAL_BIAS = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_INITIAL_N = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_MAXINT = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_PRINT_ASCII = T.let(T.unsafe(nil), String)
+Addressable::IDNA::PUNYCODE_SKEW = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_TMAX = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::PUNYCODE_TMIN = T.let(T.unsafe(nil), Integer)
+class Addressable::IDNA::PunycodeBadInput < ::StandardError; end
+class Addressable::IDNA::PunycodeBigOutput < ::StandardError; end
+class Addressable::IDNA::PunycodeOverflow < ::StandardError; end
+Addressable::IDNA::UNICODE_DATA = T.let(T.unsafe(nil), Hash)
+Addressable::IDNA::UNICODE_DATA_CANONICAL = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_DATA_COMBINING_CLASS = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_DATA_COMPATIBILITY = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_DATA_EXCLUSION = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_DATA_LOWERCASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_DATA_TITLECASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_DATA_UPPERCASE = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_MAX_LENGTH = T.let(T.unsafe(nil), Integer)
+Addressable::IDNA::UNICODE_TABLE = T.let(T.unsafe(nil), String)
+Addressable::IDNA::UTF8_REGEX = T.let(T.unsafe(nil), Regexp)
+Addressable::IDNA::UTF8_REGEX_MULTIBYTE = T.let(T.unsafe(nil), Regexp)
+
+class Addressable::Template
+  def initialize(pattern); end
+
+  def ==(template); end
+  def eql?(template); end
+  def expand(mapping, processor = T.unsafe(nil), normalize_values = T.unsafe(nil)); end
+  def extract(uri, processor = T.unsafe(nil)); end
+  def freeze; end
+  def inspect; end
+  def keys; end
+  def match(uri, processor = T.unsafe(nil)); end
+  def named_captures; end
+  def names; end
+  def partial_expand(mapping, processor = T.unsafe(nil), normalize_values = T.unsafe(nil)); end
+  def pattern; end
+  def source; end
+  def to_regexp; end
+  def variable_defaults; end
+  def variables; end
+
+  private
+
+  def join_values(operator, return_value); end
+  def normalize_keys(mapping); end
+  def normalize_value(value); end
+  def ordered_variable_defaults; end
+  def parse_new_template_pattern(pattern, processor = T.unsafe(nil)); end
+  def parse_template_pattern(pattern, processor = T.unsafe(nil)); end
+  def transform_capture(mapping, capture, processor = T.unsafe(nil), normalize_values = T.unsafe(nil)); end
+  def transform_partial_capture(mapping, capture, processor = T.unsafe(nil), normalize_values = T.unsafe(nil)); end
+end
+
+Addressable::Template::EXPRESSION = T.let(T.unsafe(nil), Regexp)
+class Addressable::Template::InvalidTemplateOperatorError < ::StandardError; end
+class Addressable::Template::InvalidTemplateValueError < ::StandardError; end
+Addressable::Template::JOINERS = T.let(T.unsafe(nil), Hash)
+Addressable::Template::LEADERS = T.let(T.unsafe(nil), Hash)
+
+class Addressable::Template::MatchData
+  def initialize(uri, template, mapping); end
+
+  def [](key, len = T.unsafe(nil)); end
+  def captures; end
+  def inspect; end
+  def keys; end
+  def mapping; end
+  def names; end
+  def post_match; end
+  def pre_match; end
+  def string; end
+  def template; end
+  def to_a; end
+  def to_s; end
+  def uri; end
+  def values; end
+  def values_at(*indexes); end
+  def variables; end
+end
+
+Addressable::Template::RESERVED = T.let(T.unsafe(nil), String)
+class Addressable::Template::TemplateOperatorAbortedError < ::StandardError; end
+Addressable::Template::UNRESERVED = T.let(T.unsafe(nil), String)
+Addressable::Template::VARIABLE_LIST = T.let(T.unsafe(nil), Regexp)
+Addressable::Template::VARNAME = T.let(T.unsafe(nil), Regexp)
+Addressable::Template::VARSPEC = T.let(T.unsafe(nil), Regexp)
+
+class Addressable::URI
+  def initialize(options = T.unsafe(nil)); end
+
+  def +(uri); end
+  def ==(uri); end
+  def ===(uri); end
+  def absolute?; end
+  def authority; end
+  def authority=(new_authority); end
+  def basename; end
+  def default_port; end
+  def defer_validation; end
+  def display_uri; end
+  def domain; end
+  def dup; end
+  def empty?; end
+  def eql?(uri); end
+  def extname; end
+  def fragment; end
+  def fragment=(new_fragment); end
+  def freeze; end
+  def hash; end
+  def host; end
+  def host=(new_host); end
+  def hostname; end
+  def hostname=(new_hostname); end
+  def inferred_port; end
+  def inspect; end
+  def ip_based?; end
+  def join(uri); end
+  def join!(uri); end
+  def merge(hash); end
+  def merge!(uri); end
+  def normalize; end
+  def normalize!; end
+  def normalized_authority; end
+  def normalized_fragment; end
+  def normalized_host; end
+  def normalized_password; end
+  def normalized_path; end
+  def normalized_port; end
+  def normalized_query(*flags); end
+  def normalized_scheme; end
+  def normalized_site; end
+  def normalized_user; end
+  def normalized_userinfo; end
+  def omit(*components); end
+  def omit!(*components); end
+  def origin; end
+  def origin=(new_origin); end
+  def password; end
+  def password=(new_password); end
+  def path; end
+  def path=(new_path); end
+  def port; end
+  def port=(new_port); end
+  def query; end
+  def query=(new_query); end
+  def query_values(return_type = T.unsafe(nil)); end
+  def query_values=(new_query_values); end
+  def relative?; end
+  def request_uri; end
+  def request_uri=(new_request_uri); end
+  def route_from(uri); end
+  def route_to(uri); end
+  def scheme; end
+  def scheme=(new_scheme); end
+  def site; end
+  def site=(new_site); end
+  def tld; end
+  def tld=(new_tld); end
+  def to_hash; end
+  def to_s; end
+  def to_str; end
+  def user; end
+  def user=(new_user); end
+  def userinfo; end
+  def userinfo=(new_userinfo); end
+
+  protected
+
+  def remove_composite_values; end
+  def replace_self(uri); end
+  def split_path(path); end
+  def validate; end
+
+  class << self
+    def convert_path(path); end
+    def encode(uri, return_type = T.unsafe(nil)); end
+    def encode_component(component, character_class = T.unsafe(nil), upcase_encoded = T.unsafe(nil)); end
+    def escape(uri, return_type = T.unsafe(nil)); end
+    def escape_component(component, character_class = T.unsafe(nil), upcase_encoded = T.unsafe(nil)); end
+    def form_encode(form_values, sort = T.unsafe(nil)); end
+    def form_unencode(encoded_value); end
+    def heuristic_parse(uri, hints = T.unsafe(nil)); end
+    def ip_based_schemes; end
+    def join(*uris); end
+    def normalize_component(component, character_class = T.unsafe(nil), leave_encoded = T.unsafe(nil)); end
+    def normalize_path(path); end
+    def normalized_encode(uri, return_type = T.unsafe(nil)); end
+    def parse(uri); end
+    def port_mapping; end
+    def unencode(uri, return_type = T.unsafe(nil), leave_encoded = T.unsafe(nil)); end
+    def unencode_component(uri, return_type = T.unsafe(nil), leave_encoded = T.unsafe(nil)); end
+    def unescape(uri, return_type = T.unsafe(nil), leave_encoded = T.unsafe(nil)); end
+    def unescape_component(uri, return_type = T.unsafe(nil), leave_encoded = T.unsafe(nil)); end
+  end
+end
+
+module Addressable::URI::CharacterClasses; end
+Addressable::URI::CharacterClasses::ALPHA = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::AUTHORITY = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::DIGIT = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::FRAGMENT = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::GEN_DELIMS = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::HOST = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::PATH = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::PCHAR = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::QUERY = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::RESERVED = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::SCHEME = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::SUB_DELIMS = T.let(T.unsafe(nil), String)
+Addressable::URI::CharacterClasses::UNRESERVED = T.let(T.unsafe(nil), String)
+Addressable::URI::EMPTY_STR = T.let(T.unsafe(nil), String)
+class Addressable::URI::InvalidURIError < ::StandardError; end
+Addressable::URI::NORMPATH = T.let(T.unsafe(nil), Regexp)
+module Addressable::URI::NormalizeCharacterClasses; end
+Addressable::URI::NormalizeCharacterClasses::FRAGMENT = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::NormalizeCharacterClasses::HOST = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::NormalizeCharacterClasses::PCHAR = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::NormalizeCharacterClasses::QUERY = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::NormalizeCharacterClasses::SCHEME = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::NormalizeCharacterClasses::UNRESERVED = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::PARENT = T.let(T.unsafe(nil), String)
+Addressable::URI::PORT_MAPPING = T.let(T.unsafe(nil), Hash)
+Addressable::URI::RULE_2A = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::RULE_2B_2C = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::RULE_2D = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::RULE_PREFIXED_PARENT = T.let(T.unsafe(nil), Regexp)
+Addressable::URI::SELF_REF = T.let(T.unsafe(nil), String)
+Addressable::URI::SEQUENCE_ENCODING_TABLE = T.let(T.unsafe(nil), Hash)
+Addressable::URI::SEQUENCE_UPCASED_PERCENT_ENCODING_TABLE = T.let(T.unsafe(nil), Hash)
+Addressable::URI::SLASH = T.let(T.unsafe(nil), String)
+Addressable::URI::URIREGEX = T.let(T.unsafe(nil), Regexp)
+module Addressable::VERSION; end
+Addressable::VERSION::MAJOR = T.let(T.unsafe(nil), Integer)
+Addressable::VERSION::MINOR = T.let(T.unsafe(nil), Integer)
+Addressable::VERSION::STRING = T.let(T.unsafe(nil), String)
+Addressable::VERSION::TINY = T.let(T.unsafe(nil), Integer)