workosv2 2.15.0

data/spec/lib/workos/webhooks_spec.rb

@@ -0,0 +1,236 @@
+# frozen_string_literal: true
+# typed: false
+
+require 'json'
+require 'openssl'
+
+describe WorkOSV2::Webhooks do
+  before(:each) do
+    @payload = File.read("#{SPEC_ROOT}/support/webhook_payload.txt")
+    @secret = 'secret'
+    @timestamp = Time.at(Time.now.to_i * 1000)
+    unhashed_string = "#{@timestamp.to_i}.#{@payload}"
+    digest = OpenSSL::Digest.new('sha256')
+    @signature_hash = OpenSSL::HMAC.hexdigest(digest, @secret, unhashed_string)
+    @expectation = {
+      id: 'directory_user_01FAEAJCR3ZBZ30D8BD1924TVG',
+      state: 'active',
+      emails: [{
+        type: 'work',
+        value: 'blair@foo-corp.com',
+        primary: true,
+      }],
+      idp_id: '00u1e8mutl6wlH3lL4x7',
+      object: 'directory_user',
+      username: 'blair@foo-corp.com',
+      last_name: 'Lunchford',
+      first_name: 'Blair',
+      directory_id: 'directory_01F9M7F68PZP8QXP8G7X5QRHS7',
+      raw_attributes: {
+        name: {
+          givenName: 'Blair',
+          familyName: 'Lunchford',
+          middleName: 'Elizabeth',
+          honorificPrefix: 'Ms.',
+        },
+        title: 'Developer Success Engineer',
+        active: true,
+        emails: [{
+          type: 'work',
+          value: 'blair@foo-corp.com',
+          primary: true,
+        }],
+        groups: [],
+        locale: 'en-US',
+        schemas: [
+          'urn:ietf:params:scim:schemas:core:2.0:User',
+          'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User'
+        ],
+        userName: 'blair@foo-corp.com',
+        addresses: [{
+          region: 'CA',
+          primary: true,
+          locality: 'San Francisco',
+          postalCode: '94016',
+        }],
+        externalId: '00u1e8mutl6wlH3lL4x7',
+        displayName: 'Blair Lunchford',
+        "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User": {
+          manager: {
+            value: '2',
+            displayName: 'Kate Chapman',
+          },
+          division: 'Engineering',
+          department: 'Customer Success',
+        },
+      },
+    }
+  end
+
+  # rubocop:disable Metrics/BlockLength
+  shared_examples 'WorkOSV2-Signature header failures' do
+    context 'with an empty header' do
+      it 'raises an error' do
+        expect do
+          described_class.construct_event(
+            payload: @payload,
+            sig_header: '',
+            secret: @secret,
+          )
+        end.to raise_error(
+          WorkOSV2::SignatureVerificationError,
+          'Unable to extract timestamp and signature hash from header',
+        )
+      end
+    end
+
+    context 'with an empty signature hash' do
+      it 'raises an error' do
+        expect do
+          described_class.construct_event(
+            payload: @payload,
+            sig_header: "t=#{@timestamp.to_i}, v1=",
+            secret: @secret,
+          )
+        end.to raise_error(
+          WorkOSV2::SignatureVerificationError,
+          'No signature hash found with expected scheme v1',
+        )
+      end
+    end
+
+    context 'with an incorrect signature hash' do
+      it 'raises an error' do
+        expect do
+          described_class.construct_event(
+            payload: @payload,
+            sig_header: "t=#{@timestamp.to_i}, v1=99999",
+            secret: @secret,
+          )
+        end.to raise_error(
+          WorkOSV2::SignatureVerificationError,
+          'Signature hash does not match the expected signature hash for payload',
+        )
+      end
+    end
+
+    context 'with an incorrect payload' do
+      it 'raises an error' do
+        expect do
+          described_class.construct_event(
+            payload: 'invalid',
+            sig_header: "t=#{@timestamp.to_i}, v1=#{@signature_hash}",
+            secret: @secret,
+          )
+        end.to raise_error(
+          WorkOSV2::SignatureVerificationError,
+          'Signature hash does not match the expected signature hash for payload',
+        )
+      end
+    end
+
+    context 'with an incorrect webhook secret' do
+      it 'raises an error' do
+        expect do
+          described_class.construct_event(
+            payload: @payload,
+            sig_header: "t=#{@timestamp.to_i}, v1=#{@signature_hash}",
+            secret: 'invalid',
+          )
+        end.to raise_error(
+          WorkOSV2::SignatureVerificationError,
+          'Signature hash does not match the expected signature hash for payload',
+        )
+      end
+    end
+
+    context 'with a timestamp outside tolerance' do
+      it 'raises an error' do
+        expect do
+          described_class.construct_event(
+            payload: @payload,
+            sig_header: "t=#{@timestamp.to_i - (200 * 1000)}, v1=#{@signature_hash}",
+            secret: @secret,
+          )
+        end.to raise_error(
+          WorkOSV2::SignatureVerificationError,
+          'Timestamp outside the tolerance zone',
+        )
+      end
+    end
+  end
+  # rubocop:enable Metrics/BlockLength
+
+  describe '.construct_event' do
+    it_behaves_like 'WorkOSV2-Signature header failures'
+
+    context 'with the correct payload, sig_header, and secret' do
+      it 'returns a webhook event' do
+        webhook = described_class.construct_event(
+          payload: @payload,
+          sig_header: "t=#{@timestamp.to_i}, v1=#{@signature_hash}",
+          secret: @secret,
+        )
+
+        expect(webhook.data).to eq(@expectation)
+        expect(webhook.event).to eq('dsync.user.created')
+        expect(webhook.id).to eq('wh_123')
+      end
+    end
+
+    context 'with the correct payload, sig_header, secret, and tolerance' do
+      it 'returns a webhook event' do
+        webhook = described_class.construct_event(
+          payload: @payload,
+          sig_header: "t=#{@timestamp.to_i}, v1=#{@signature_hash}",
+          secret: @secret,
+          tolerance: 300,
+        )
+
+        expect(webhook.data).to eq(@expectation)
+        expect(webhook.event).to eq('dsync.user.created')
+        expect(webhook.id).to eq('wh_123')
+      end
+    end
+  end
+
+  describe '.verify_header' do
+    it_behaves_like 'WorkOSV2-Signature header failures'
+
+    it 'returns true when the signature is valid' do
+      described_class.verify_header(
+        payload: @payload,
+        sig_header: "t=#{@timestamp.to_i}, v1=#{@signature_hash}",
+        secret: @secret,
+      )
+    end
+  end
+
+  describe '.get_timestamp_and_signature_hash' do
+    it_behaves_like 'WorkOSV2-Signature header failures'
+
+    it 'returns the timestamp and signature when the signature is valid' do
+      timestamp_int = @timestamp.to_i
+      timestamp_and_signature = described_class.get_timestamp_and_signature_hash(
+        sig_header: "t=#{timestamp_int}, v1=#{@signature_hash}",
+      )
+
+      expect(timestamp_and_signature).to eq([timestamp_int.to_s, @signature_hash])
+    end
+  end
+
+  describe '.compute_signature' do
+    it_behaves_like 'WorkOSV2-Signature header failures'
+
+    it 'returns the computed signature' do
+      timestamp_int = @timestamp.to_i
+      signature = described_class.compute_signature(
+        timestamp: timestamp_int.to_s,
+        payload: @payload,
+        secret: @secret,
+      )
+
+      expect(signature).to eq(@signature_hash)
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+# typed: false
+
+require 'simplecov'
+SimpleCov.start
+
+if ENV['CI'] == 'true'
+  require 'codecov'
+  SimpleCov.formatter = SimpleCov::Formatter::Codecov
+end
+
+$LOAD_PATH << File.join(File.dirname(__FILE__), '..', 'lib')
+$LOAD_PATH << File.join(File.dirname(__FILE__))
+
+require 'rubygems'
+require 'rspec'
+require 'webmock/rspec'
+require 'workosv2'
+require 'vcr'
+
+# Support
+Dir['./spec/support/**/*.rb'].sort.each { |f| require f }
+
+SPEC_ROOT = File.dirname __FILE__
+
+VCR.configure do |config|
+  config.cassette_library_dir = 'spec/support/fixtures/vcr_cassettes'
+  config.filter_sensitive_data('<API_KEY>') { WorkOSV2.config.key }
+  config.hook_into :webmock
+end
+
+RSpec.configure do |config|
+  config.expect_with :rspec do |expectations|
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+
+  config.mock_with :rspec do |mocks|
+    mocks.verify_partial_doubles = true
+  end
+
+  config.shared_context_metadata_behavior = :apply_to_host_groups
+
+  WebMock::API.prepend(Module.new do
+    extend self
+
+    # Disable VCR when a WebMock stub is created
+    # for clearer spec failure messaging
+    def stub_request(*args)
+      VCR.turn_off!
+      super
+    end
+  end)
+
+  config.before(:all) { WorkOSV2.config.key ||= '' }
+  config.before(:each) { VCR.turn_on! }
+end

data/spec/support/fixtures/vcr_cassettes/audit_logs/create_event.yml

@@ -0,0 +1,59 @@
+---
+http_interactions:
+  - request:
+      method: post
+      uri: https://api.workos.com/audit_logs/events
+      body:
+        encoding: UTF-8
+        string: '{"organization_id":"org_123","event":{"action":"user.signed_in","occurred_at":"2022-08-22T15:04:19.704Z","actor":{"id":"user_123","type":"user","name":"User","metadata":{"foo":"bar"}},"targets":[{"id":"team_123","type":"team","name":"Team","metadata":{"foo":"bar"}}],"context":{"location":"1.1.1.1","user_agent":"Mozilla"}}}'
+      headers:
+        Content-Type: "application/json"
+        Accept-Encoding: "gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
+        Accept: "*/*"
+        User-Agent: "WorkOSV2; ruby/3.0.2; x86_64-darwin21; v2.5.1"
+        Authorization: "Bearer example_api_key"
+    response:
+      status:
+        code: 201
+        message: Created
+      headers:
+        Server:
+          - Cowboy
+        Connection:
+          - keep-alive
+        Access-Control-Allow-Origin:
+          - https://dashboard.workos.com
+        Vary:
+          - Origin, Accept-Encoding
+        Access-Control-Allow-Credentials:
+          - "true"
+        X-Dns-Prefetch-Control:
+          - "off"
+        X-Frame-Options:
+          - SAMEORIGIN
+        Strict-Transport-Security:
+          - max-age=15552000; includeSubDomains
+        X-Download-Options:
+          - noopen
+        X-Content-Type-Options:
+          - nosniff
+        X-Xss-Protection:
+          - 1; mode=block
+        X-Request-Id:
+          - 1cf9b8e7-5910-4a6d-a333-46bcf841422e
+        Content-Type:
+          - application/json; charset=utf-8
+        Content-Length:
+          - "16"
+        Etag:
+          - W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
+        Date:
+          - Sat, 11 Jan 2020 04:22:48 GMT
+        Via:
+          - 1.1 vegur
+      body:
+        encoding: UTF-8
+        string: '{"success":true}'
+      http_version:
+    recorded_at: Sat, 11 Jan 2020 04:22:48 GMT
+recorded_with: VCR 5.0.0

data/spec/support/fixtures/vcr_cassettes/audit_logs/create_event_custom_idempotency_key.yml

@@ -0,0 +1,60 @@
+---
+http_interactions:
+  - request:
+      method: post
+      uri: https://api.workos.com/audit_logs/events
+      body:
+        encoding: UTF-8
+        string: '{"organization_id":"org_123","event":{"action":"user.signed_in","occurred_at":"2022-08-22T15:04:19.704Z","actor":{"id":"user_123","type":"user","name":"User","metadata":{"foo":"bar"}},"targets":[{"id":"team_123","type":"team","name":"Team","metadata":{"foo":"bar"}}],"context":{"location":"1.1.1.1","user_agent":"Mozilla"}}}'
+      headers:
+        Content-Type: "application/json"
+        Accept-Encoding: "gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
+        Accept: "*/*"
+        User-Agent: "WorkOSV2; ruby/3.0.2; x86_64-darwin21; v2.5.1"
+        Authorization: "Bearer example_api_key"
+        Idempotency-Key: "idempotency_key"
+    response:
+      status:
+        code: 201
+        message: Created
+      headers:
+        Server:
+          - Cowboy
+        Connection:
+          - keep-alive
+        Access-Control-Allow-Origin:
+          - https://dashboard.workos.com
+        Vary:
+          - Origin, Accept-Encoding
+        Access-Control-Allow-Credentials:
+          - "true"
+        X-Dns-Prefetch-Control:
+          - "off"
+        X-Frame-Options:
+          - SAMEORIGIN
+        Strict-Transport-Security:
+          - max-age=15552000; includeSubDomains
+        X-Download-Options:
+          - noopen
+        X-Content-Type-Options:
+          - nosniff
+        X-Xss-Protection:
+          - 1; mode=block
+        X-Request-Id:
+          - 1cf9b8e7-5910-4a6d-a333-46bcf841422e
+        Content-Type:
+          - application/json; charset=utf-8
+        Content-Length:
+          - "16"
+        Etag:
+          - W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
+        Date:
+          - Sat, 11 Jan 2020 04:22:48 GMT
+        Via:
+          - 1.1 vegur
+      body:
+        encoding: UTF-8
+        string: '{"success":true}'
+      http_version:
+    recorded_at: Sat, 11 Jan 2020 04:22:48 GMT
+recorded_with: VCR 5.0.0

data/spec/support/fixtures/vcr_cassettes/audit_logs/create_event_invalid.yml

@@ -0,0 +1,59 @@
+---
+http_interactions:
+  - request:
+      method: post
+      uri: https://api.workos.com/audit_logs/events
+      body:
+        encoding: UTF-8
+        string: '{"organization_id":"org_123","event":{"action":"user.signed_in","occurred_at":"2022-08-22T15:04:19.704Z","actor":{"id":"user_123","type":"user","name":"User","metadata":{"foo":"bar"}},"targets":[{"id":"team_123","type":"team","name":"Team","metadata":{"foo":"bar"}}],"context":{"location":"1.1.1.1","user_agent":"Mozilla"}}}'
+      headers:
+        Content-Type: "application/json"
+        Accept-Encoding: "gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
+        Accept: "*/*"
+        User-Agent: "WorkOSV2; ruby/3.0.2; x86_64-darwin21; v2.5.1"
+        Authorization: "Bearer example_api_key"
+    response:
+      status:
+        code: 400
+        message: Bad Request
+      headers:
+        Server:
+          - Cowboy
+        Connection:
+          - keep-alive
+        Access-Control-Allow-Origin:
+          - https://dashboard.workos.com
+        Vary:
+          - Origin, Accept-Encoding
+        Access-Control-Allow-Credentials:
+          - "true"
+        X-Dns-Prefetch-Control:
+          - "off"
+        X-Frame-Options:
+          - SAMEORIGIN
+        Strict-Transport-Security:
+          - max-age=15552000; includeSubDomains
+        X-Download-Options:
+          - noopen
+        X-Content-Type-Options:
+          - nosniff
+        X-Xss-Protection:
+          - 1; mode=block
+        X-Request-Id:
+          - 1cf9b8e7-5910-4a6d-a333-46bcf841422e
+        Content-Type:
+          - application/json; charset=utf-8
+        Content-Length:
+          - "16"
+        Etag:
+          - W/"10-oV4hJxRVSENxc/wX8+mA4/Pe4tA"
+        Date:
+          - Sat, 11 Jan 2020 04:22:48 GMT
+        Via:
+          - 1.1 vegur
+      body:
+        encoding: UTF-8
+        string: '{"code":"invalid_audit_log","message":"Invalid Audit Log event","errors":[{"instancePath":"/targets/0/type","schemaPath":"#/properties/targets/allOf/0/contains/properties/type/const","keyword":"const","params":{"allowValues":["team"]},"message":"must be equal to constant","schema":"team","parentSchema":{"enum":["team"],"type":"string"},"data":"user"}]}'
+      http_version:
+    recorded_at: Sat, 11 Jan 2020 04:22:48 GMT
+recorded_with: VCR 5.0.0

data/spec/support/fixtures/vcr_cassettes/audit_logs/create_export.yml

@@ -0,0 +1,76 @@
+---
+http_interactions:
+  - request:
+      method: post
+      uri: https://api.workos.com/audit_logs/exports
+      body:
+        encoding: UTF-8
+        string: '{"organization_id":"org_123","range_start":"2022-06-22T15:04:19.704Z","range_end":"2022-08-22T15:04:19.704Z"}'
+      headers:
+        Content-Type:
+          - application/json
+        Accept-Encoding:
+          - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+        Accept:
+          - "*/*"
+        User-Agent:
+          - WorkOSV2; ruby/3.0.2; x86_64-darwin21; v2.5.1
+        Authorization:
+          - "Bearer example_api_key"
+    response:
+      status:
+        code: 201
+        message: Created
+      headers:
+        Date:
+          - Mon, 22 Aug 2022 17:47:49 GMT
+        Content-Type:
+          - application/json; charset=utf-8
+        Content-Length:
+          - "26"
+        Connection:
+          - keep-alive
+        Cf-Ray:
+          - 73ed6f92c9161847-ATL
+        Etag:
+          - W/"1a-pljHtlo127JYJR4E/RYOPb6ucbw"
+        Strict-Transport-Security:
+          - max-age=15552000; includeSubDomains
+        Vary:
+          - Origin, Accept-Encoding
+        Via:
+          - 1.1 spaces-router (a302eeabfffb)
+        Cf-Cache-Status:
+          - DYNAMIC
+        Access-Control-Allow-Credentials:
+          - "true"
+        Content-Security-Policy:
+          - "default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self'
+            https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src
+            'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests"
+        Expect-Ct:
+          - max-age=0
+        Referrer-Policy:
+          - no-referrer
+        X-Content-Type-Options:
+          - nosniff
+        X-Dns-Prefetch-Control:
+          - "off"
+        X-Download-Options:
+          - noopen
+        X-Frame-Options:
+          - SAMEORIGIN
+        X-Permitted-Cross-Domain-Policies:
+          - none
+        X-Request-Id:
+          - eb09b349-08f4-b79b-ccb2-87fa4609c1ee
+        X-Xss-Protection:
+          - "0"
+        Server:
+          - cloudflare
+      body:
+        encoding: UTF-8
+        string: '{"object":"audit_log_export","id":"audit_log_export_123","state":"pending","created_at":"2022-08-22T15:04:19.704Z","updated_at":"2022-08-22T15:04:19.704Z"}'
+      http_version:
+    recorded_at: Mon, 22 Aug 2022 17:47:49 GMT
+recorded_with: VCR 5.0.0

data/spec/support/fixtures/vcr_cassettes/audit_logs/create_export_with_filters.yml

@@ -0,0 +1,77 @@
+---
+http_interactions:
+  - request:
+      method: post
+      uri: https://api.workos.com/audit_logs/exports
+      body:
+        encoding: UTF-8
+        string:
+          '{"organization_id":"org_123","range_start":"2022-06-22T15:04:19.704Z","range_end":"2022-08-22T15:04:19.704Z","actions":["user.signed_in"],"actors":["Jon Smith"],"actor_names":["Jon Smith"],"actor_ids":["user_123"],"targets":["user","team"]}'
+      headers:
+        Content-Type:
+          - application/json
+        Accept-Encoding:
+          - gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+        Accept:
+          - "*/*"
+        User-Agent:
+          - WorkOSV2; ruby/3.0.2; x86_64-darwin21; v2.5.1
+        Authorization:
+          - "Bearer example_api_key"
+    response:
+      status:
+        code: 201
+        message: Created
+      headers:
+        Date:
+          - Mon, 22 Aug 2022 17:47:49 GMT
+        Content-Type:
+          - application/json; charset=utf-8
+        Content-Length:
+          - "26"
+        Connection:
+          - keep-alive
+        Cf-Ray:
+          - 73ed6f92c9161847-ATL
+        Etag:
+          - W/"1a-pljHtlo127JYJR4E/RYOPb6ucbw"
+        Strict-Transport-Security:
+          - max-age=15552000; includeSubDomains
+        Vary:
+          - Origin, Accept-Encoding
+        Via:
+          - 1.1 spaces-router (a302eeabfffb)
+        Cf-Cache-Status:
+          - DYNAMIC
+        Access-Control-Allow-Credentials:
+          - "true"
+        Content-Security-Policy:
+          - "default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self'
+            https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src
+            'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests"
+        Expect-Ct:
+          - max-age=0
+        Referrer-Policy:
+          - no-referrer
+        X-Content-Type-Options:
+          - nosniff
+        X-Dns-Prefetch-Control:
+          - "off"
+        X-Download-Options:
+          - noopen
+        X-Frame-Options:
+          - SAMEORIGIN
+        X-Permitted-Cross-Domain-Policies:
+          - none
+        X-Request-Id:
+          - eb09b349-08f4-b79b-ccb2-87fa4609c1ee
+        X-Xss-Protection:
+          - "0"
+        Server:
+          - cloudflare
+      body:
+        encoding: UTF-8
+        string: '{"object":"audit_log_export","id":"audit_log_export_123","state":"pending","created_at":"2022-08-22T15:04:19.704Z","updated_at":"2022-08-22T15:04:19.704Z"}'
+      http_version:
+    recorded_at: Mon, 22 Aug 2022 17:47:49 GMT
+recorded_with: VCR 5.0.0