zitadel-client 1.3.2 → 1.4.1

data/lib/zitadel-client/api_client.rb

@@ -278,7 +278,7 @@ module ZitadelClient
         end
       else
         # models (e.g. Pet) or oneOf
-        klass = ZitadelClient.const_get(return_type)
+        klass = ZitadelClient::Models.const_get(return_type)
         klass.respond_to?(:openapi_one_of) ? klass.build(data) : klass.build_from_hash(data)
       end
     end

data/lib/zitadel-client/auth/authenticator.rb

@@ -3,74 +3,76 @@
 require 'time'
 
 module ZitadelClient
-  ##
-  # Abstract base class for authenticators.
-  #
-  # This class defines the basic structure for any authenticator by requiring the implementation
-  # of a method to retrieve authentication headers, and provides a way to store and retrieve the host.
-  #
-  class Authenticator
-    protected
-
-    attr_reader :host
-
+  module Auth
     ##
-    # Initializes the Authenticator with the specified host.
+    # Abstract base class for authenticators.
     #
-    # @param host [String] the base URL or endpoint for the service.
+    # This class defines the basic structure for any authenticator by requiring the implementation
+    # of a method to retrieve authentication headers, and provides a way to store and retrieve the host.
     #
-    def initialize(host)
-      @host = host
-    end
+    class Authenticator
+      protected
 
-    ##
-    # Retrieves the authentication headers to be sent with requests.
-    #
-    # Subclasses must override this method to return the appropriate headers.
-    #
-    # @raise [NotImplementedError] Always raised to require implementation in a subclass.
-    #
-    # @return [Hash{String => String}]
-    #
-    def auth_headers
-      # :nocov:
-      raise NotImplementedError,
-            "#{self.class}#get_auth_headers is an abstract method. Please override it in a subclass."
-      # :nocov:
-    end
-  end
+      attr_reader :host
 
-  ##
-  # Abstract builder class for constructing OAuth authenticator instances.
-  #
-  # This builder provides common configuration options such as the OpenId instance and authentication scopes.
-  #
-  class OAuthAuthenticatorBuilder
-    protected
+      ##
+      # Initializes the Authenticator with the specified host.
+      #
+      # @param host [String] the base URL or endpoint for the service.
+      #
+      def initialize(host)
+        @host = host
+      end
 
-    attr_reader :open_id, :auth_scopes
+      ##
+      # Retrieves the authentication headers to be sent with requests.
+      #
+      # Subclasses must override this method to return the appropriate headers.
+      #
+      # @raise [NotImplementedError] Always raised to require implementation in a subclass.
+      #
+      # @return [Hash{String => String}]
+      #
+      def auth_headers
+        # :nocov:
+        raise NotImplementedError,
+              "#{self.class}#get_auth_headers is an abstract method. Please override it in a subclass."
+        # :nocov:
+      end
+    end
 
     ##
-    # Initializes the OAuthAuthenticatorBuilder with a given host.
+    # Abstract builder class for constructing OAuth authenticator instances.
     #
-    # @param host [String] the base URL for the OAuth provider.
+    # This builder provides common configuration options such as the OpenId instance and authentication scopes.
     #
-    def initialize(host)
-      @open_id = OpenId.new(host)
-      @auth_scopes = Set.new(%w[openid urn:zitadel:iam:org:project:id:zitadel:aud])
-    end
+    class OAuthAuthenticatorBuilder
+      protected
 
-    public
+      attr_reader :open_id, :auth_scopes
 
-    ##
-    # Sets the authentication scopes for the OAuth authenticator.
-    #
-    # @param scopes [Array<String>] a variable number of scope strings.
-    # @return [self] the builder instance to allow for method chaining.
-    #
-    def scopes(*scopes)
-      @auth_scopes = Set.new(scopes)
-      self
+      ##
+      # Initializes the OAuthAuthenticatorBuilder with a given host.
+      #
+      # @param host [String] the base URL for the OAuth provider.
+      #
+      def initialize(host)
+        @open_id = OpenId.new(host)
+        @auth_scopes = Set.new(%w[openid urn:zitadel:iam:org:project:id:zitadel:aud])
+      end
+
+      public
+
+      ##
+      # Sets the authentication scopes for the OAuth authenticator.
+      #
+      # @param scopes [Array<String>] a variable number of scope strings.
+      # @return [self] the builder instance to allow for method chaining.
+      #
+      def scopes(*scopes)
+        @auth_scopes = Set.new(scopes)
+        self
+      end
     end
   end
 end

data/lib/zitadel-client/auth/client_credentials_authenticator.rb

@@ -1,62 +1,62 @@
 # frozen_string_literal: true
 
-require 'oauth2'
-
 module ZitadelClient
-  # ClientCredentialsAuthenticator implements the client credentials flow.
-  class ClientCredentialsAuthenticator < ZitadelClient::OAuthAuthenticator
-    # Constructs a ClientCredentialsAuthenticator using client credentials flow.
-    #
-    # @param open_id [OpenId] The OpenId instance with OAuth endpoint info.
-    # @param client_id [String] The OAuth client identifier.
-    # @param client_secret [String] The OAuth client secret.
-    # @param auth_scopes [Set<String>] The scope(s) for the token request.
-    def initialize(open_id, client_id, client_secret, auth_scopes)
-      # noinspection RubyArgCount
-      super(open_id, auth_scopes, OAuth2::Client.new(client_id, client_secret, {
-                                                       site: open_id.host_endpoint,
-                                                       token_url: open_id.token_endpoint
-                                                     }))
-    end
-
-    # Returns a new builder for constructing a ClientCredentialsAuthenticator.
-    #
-    # @param host [String] The OAuth provider's base URL.
-    # @param client_id [String] The OAuth client identifier.
-    # @param client_secret [String] The OAuth client secret.
-    # @return [ClientCredentialsAuthenticatorBuilder] A builder instance.
-    def self.builder(host, client_id, client_secret)
-      ClientCredentialsAuthenticatorBuilder.new(host, client_id, client_secret)
-    end
-
-    protected
-
-    # Overrides the base get_grant to return client credentials grant parameters.
-
-    # @return [OAuth2::AccessToken] A hash containing the grant type.
-    def get_grant(client, auth_scopes)
-      client.client_credentials.get_token({ scope: auth_scopes })
-    end
-
-    # Builder class for ClientCredentialsAuthenticator.
-    class ClientCredentialsAuthenticatorBuilder < OAuthAuthenticatorBuilder
-      # Initializes the builder with host, client ID, and client secret.
+  module Auth
+    # ClientCredentialsAuthenticator implements the client credentials flow.
+    class ClientCredentialsAuthenticator < ZitadelClient::Auth::OAuthAuthenticator
+      # Constructs a ClientCredentialsAuthenticator using client credentials flow.
       #
-      # @param host [String] The OAuth provider's base URL.
+      # @param open_id [OpenId] The OpenId instance with OAuth endpoint info.
       # @param client_id [String] The OAuth client identifier.
       # @param client_secret [String] The OAuth client secret.
-      def initialize(host, client_id, client_secret)
+      # @param auth_scopes [Set<String>] The scope(s) for the token request.
+      def initialize(open_id, client_id, client_secret, auth_scopes)
         # noinspection RubyArgCount
-        super(host)
-        @client_id = client_id
-        @client_secret = client_secret
+        super(open_id, auth_scopes, OAuth2::Client.new(client_id, client_secret, {
+                                                         site: open_id.host_endpoint,
+                                                         token_url: open_id.token_endpoint
+                                                       }))
       end
 
-      # Constructs and returns a ClientCredentialsAuthenticator using the configured parameters.
+      # Returns a new builder for constructing a ClientCredentialsAuthenticator.
       #
-      # @return [ClientCredentialsAuthenticator] A configured instance.
-      def build
-        ClientCredentialsAuthenticator.new(open_id, @client_id, @client_secret, auth_scopes)
+      # @param host [String] The OAuth provider's base URL.
+      # @param client_id [String] The OAuth client identifier.
+      # @param client_secret [String] The OAuth client secret.
+      # @return [ClientCredentialsAuthenticatorBuilder] A builder instance.
+      def self.builder(host, client_id, client_secret)
+        ClientCredentialsAuthenticatorBuilder.new(host, client_id, client_secret)
+      end
+
+      protected
+
+      # Overrides the base get_grant to return client credentials grant parameters.
+
+      # @return [OAuth2::AccessToken] A hash containing the grant type.
+      def get_grant(client, auth_scopes)
+        client.client_credentials.get_token({ scope: auth_scopes })
+      end
+
+      # Builder class for ClientCredentialsAuthenticator.
+      class ClientCredentialsAuthenticatorBuilder < OAuthAuthenticatorBuilder
+        # Initializes the builder with host, client ID, and client secret.
+        #
+        # @param host [String] The OAuth provider's base URL.
+        # @param client_id [String] The OAuth client identifier.
+        # @param client_secret [String] The OAuth client secret.
+        def initialize(host, client_id, client_secret)
+          # noinspection RubyArgCount
+          super(host)
+          @client_id = client_id
+          @client_secret = client_secret
+        end
+
+        # Constructs and returns a ClientCredentialsAuthenticator using the configured parameters.
+        #
+        # @return [ClientCredentialsAuthenticator] A configured instance.
+        def build
+          ClientCredentialsAuthenticator.new(open_id, @client_id, @client_secret, auth_scopes)
+        end
       end
     end
   end

data/lib/zitadel-client/auth/no_auth_authenticator.rb

@@ -1,31 +1,33 @@
 # frozen_string_literal: true
 
 module ZitadelClient
-  ##
-  # A simple authenticator that performs no authentication.
-  #
-  # This authenticator is useful for cases where no token or credentials are required.
-  # It simply returns an empty dictionary for authentication headers.
-  #
-  class NoAuthAuthenticator < Authenticator
+  module Auth
     ##
-    # Initializes the NoAuthAuthenticator with a default host.
+    # A simple authenticator that performs no authentication.
     #
-    # @param host [String] the base URL for the service. Defaults to "http://localhost".
+    # This authenticator is useful for cases where no token or credentials are required.
+    # It simply returns an empty dictionary for authentication headers.
     #
-    def initialize(host = 'http://localhost')
-      super
-    end
+    class NoAuthAuthenticator < Authenticator
+      ##
+      # Initializes the NoAuthAuthenticator with a default host.
+      #
+      # @param host [String] the base URL for the service. Defaults to "http://localhost".
+      #
+      def initialize(host = 'http://localhost')
+        super
+      end
 
-    protected
+      protected
 
-    ##
-    # Returns an empty dictionary since no authentication is performed.
-    #
-    # @return [Hash{String => String}] an empty hash.
-    #
-    def auth_headers
-      {}
+      ##
+      # Returns an empty dictionary since no authentication is performed.
+      #
+      # @return [Hash{String => String}] an empty hash.
+      #
+      def auth_headers
+        {}
+      end
     end
   end
 end

data/lib/zitadel-client/auth/o_auth_authenticator.rb

@@ -3,88 +3,95 @@
 require 'time'
 require 'oauth2'
 
-module ZitadelClient
-  ##
-  # Base class for OAuth-based authentication using an OAuth2 client.
-  #
-  # Attributes:
-  #   open_id: An object providing OAuth endpoint information.
-  #   auth_session: An OAuth2Session instance used for fetching tokens.
-  #
-  class OAuthAuthenticator < Authenticator
-    protected
+OAuth2.configure do |config|
+  # noinspection RubyResolve
+  config.silence_extra_tokens_warning = true
+end
 
+module ZitadelClient
+  module Auth
     ##
-    # Constructs an OAuthAuthenticator.
+    # Base class for OAuth-based authentication using an OAuth2 client.
     #
-    # @param open_id [OpenId] An object that must implement `get_host_endpoint` and `get_token_endpoint`.
-    # @param auth_session [OAuth2Session] The OAuth2Session instance used for token requests.
+    # Attributes:
+    #   open_id: An object providing OAuth endpoint information.
+    #   auth_session: An OAuth2Session instance used for fetching tokens.
     #
-    def initialize(open_id, auth_scopes, auth_session)
-      super(open_id.host_endpoint)
-      @open_id = open_id
-      @token = nil
-      @auth_session = auth_session
-      @auth_scopes = auth_scopes.to_a.join(' ')
-    end
+    class OAuthAuthenticator < Authenticator
+      protected
 
-    ##
-    # Returns the current access token, refreshing it if necessary.
-    #
-    # @return [String] The current access token.
-    #
-    def auth_token
-      token = @token
-      if token.nil? || token.expired?
-        refresh_token
-        token = @token
+      ##
+      # Constructs an OAuthAuthenticator.
+      #
+      # @param open_id [OpenId] An object that must implement `get_host_endpoint` and `get_token_endpoint`.
+      # @param auth_session [OAuth2Session] The OAuth2Session instance used for token requests.
+      #
+      def initialize(open_id, auth_scopes, auth_session)
+        super(open_id.host_endpoint)
+        @open_id = open_id
+        @token = nil
+        @auth_session = auth_session
+        @auth_scopes = auth_scopes.to_a.join(' ')
       end
 
-      raise 'Token is nil after refresh' if token.nil?
+      ##
+      # Returns the current access token, refreshing it if necessary.
+      #
+      # @return [String] The current access token.
+      #
+      def auth_token
+        token = @token
+        if token.nil? || token.expired?
+          refresh_token
+          token = @token
+        end
 
-      token.token
-    end
+        raise 'Token is nil after refresh' if token.nil?
 
-    ##
-    # Retrieves authentication headers.
-    #
-    # @return [Hash{String => String}] A hash containing the 'Authorization' header.
-    #
-    def auth_headers
-      { 'Authorization' => "Bearer #{auth_token}" }
-    end
+        token.token
+      end
 
-    ##
-    # Builds and returns a hash of grant parameters required for the token request.
-    #
-    # The base class will invoke this method by passing its OAuth2 client.
-    # The subclass implementation should return the result of either:
-    #   client.client_credentials.get_token(scope: scopes)
-    # or
-    #   client.assertion.get_token(claims)
-    #
-    # @param auth_client [OAuth2::Client] The OAuth2 client instance.
-    # @param [String] auth_scopes
-    # @return [OAuth2::AccessToken] A hash of parameters used to fetch a token.
-    #
-    def get_grant(auth_client, auth_scopes)
-      # :nocov:
-      raise NotImplementedError, "#{self.class}#get_grant must be implemented"
-      # :nocov:
-    end
+      ##
+      # Retrieves authentication headers.
+      #
+      # @return [Hash{String => String}] A hash containing the 'Authorization' header.
+      #
+      def auth_headers
+        { 'Authorization' => "Bearer #{auth_token}" }
+      end
 
-    ##
-    # Refreshes the access token using the OAuth flow.
-    #
-    # It uses `get_grant` to obtain all necessary parameters for the token request.
-    #
-    # @return [OAuth2::AccessToken] A new Token instance.
-    # @raise [RuntimeError] if the token refresh fails.
-    #
-    def refresh_token
-      @token = get_grant(@auth_session, @auth_scopes)
-    rescue StandardError => e
-      raise ZitadelError.new("Failed to refresh token: #{e.message}"), cause: e
+      ##
+      # Builds and returns a hash of grant parameters required for the token request.
+      #
+      # The base class will invoke this method by passing its OAuth2 client.
+      # The subclass implementation should return the result of either:
+      #   client.client_credentials.get_token(scope: scopes)
+      # or
+      #   client.assertion.get_token(claims)
+      #
+      # @param auth_client [OAuth2::Client] The OAuth2 client instance.
+      # @param [String] auth_scopes
+      # @return [OAuth2::AccessToken] A hash of parameters used to fetch a token.
+      #
+      def get_grant(auth_client, auth_scopes)
+        # :nocov:
+        raise NotImplementedError, "#{self.class}#get_grant must be implemented"
+        # :nocov:
+      end
+
+      ##
+      # Refreshes the access token using the OAuth flow.
+      #
+      # It uses `get_grant` to obtain all necessary parameters for the token request.
+      #
+      # @return [OAuth2::AccessToken] A new Token instance.
+      # @raise [RuntimeError] if the token refresh fails.
+      #
+      def refresh_token
+        @token = get_grant(@auth_session, @auth_scopes)
+      rescue StandardError => e
+        raise ZitadelError.new("Failed to refresh token: #{e.message}"), cause: e
+      end
     end
   end
 end

data/lib/zitadel-client/auth/open_id.rb

@@ -5,46 +5,48 @@ require 'uri'
 require 'net/http'
 
 module ZitadelClient
-  ##
-  # OpenId retrieves OpenID Connect configuration from a given host.
-  #
-  # It builds the well-known configuration URL from the provided hostname,
-  # fetches the configuration, and extracts the token endpoint.
-  #
-  class OpenId
-    attr_accessor :token_endpoint, :host_endpoint
-
+  module Auth
     ##
-    # Initializes a new OpenId instance.
+    # OpenId retrieves OpenID Connect configuration from a given host.
     #
-    # @param hostname [String] the hostname for the OpenID provider.
-    # @raise [RuntimeError] if the OpenID configuration cannot be fetched or the token_endpoint is missing.
+    # It builds the well-known configuration URL from the provided hostname,
+    # fetches the configuration, and extracts the token endpoint.
     #
-    # noinspection HttpUrlsUsage
-    def initialize(hostname)
-      hostname = "https://#{hostname}" unless hostname.start_with?('http://', 'https://')
-      @host_endpoint = hostname
-      well_known_url = self.class.build_well_known_url(hostname)
+    class OpenId
+      attr_accessor :token_endpoint, :host_endpoint
 
-      uri = URI.parse(well_known_url)
-      response = Net::HTTP.get_response(uri)
-      raise "Failed to fetch OpenID configuration: HTTP #{response.code}" unless response.code.to_i == 200
+      ##
+      # Initializes a new OpenId instance.
+      #
+      # @param hostname [String] the hostname for the OpenID provider.
+      # @raise [RuntimeError] if the OpenID configuration cannot be fetched or the token_endpoint is missing.
+      #
+      # noinspection HttpUrlsUsage
+      def initialize(hostname)
+        hostname = "https://#{hostname}" unless hostname.start_with?('http://', 'https://')
+        @host_endpoint = hostname
+        well_known_url = self.class.build_well_known_url(hostname)
 
-      config = JSON.parse(response.body)
-      token_endpoint = config['token_endpoint']
-      raise 'token_endpoint not found in OpenID configuration' unless token_endpoint
+        uri = URI.parse(well_known_url)
+        response = Net::HTTP.get_response(uri)
+        raise "Failed to fetch OpenID configuration: HTTP #{response.code}" unless response.code.to_i == 200
 
-      @token_endpoint = token_endpoint
-    end
+        config = JSON.parse(response.body)
+        token_endpoint = config['token_endpoint']
+        raise 'token_endpoint not found in OpenID configuration' unless token_endpoint
 
-    ##
-    # Builds the well-known OpenID configuration URL for the given hostname.
-    #
-    # @param hostname [String] the hostname for the OpenID provider.
-    # @return [String] the well-known configuration URL.
-    #
-    def self.build_well_known_url(hostname)
-      URI.join(hostname, '/.well-known/openid-configuration').to_s
+        @token_endpoint = token_endpoint
+      end
+
+      ##
+      # Builds the well-known OpenID configuration URL for the given hostname.
+      #
+      # @param hostname [String] the hostname for the OpenID provider.
+      # @return [String] the well-known configuration URL.
+      #
+      def self.build_well_known_url(hostname)
+        URI.join(hostname, '/.well-known/openid-configuration').to_s
+      end
     end
   end
 end

data/lib/zitadel-client/auth/personal_access_token_authenticator.rb

@@ -1,33 +1,35 @@
 # frozen_string_literal: true
 
 module ZitadelClient
-  ##
-  # Personal Access Token Authenticator.
-  #
-  # Uses a static personal access token for API authentication.
-  #
-  class PersonalAccessTokenAuthenticator < Authenticator
+  module Auth
     ##
-    # Initializes the PersonalAccessTokenAuthenticator with host and token.
+    # Personal Access Token Authenticator.
     #
-    # @param host [String] the base URL for the service.
-    # @param token [String] the personal access token.
+    # Uses a static personal access token for API authentication.
     #
-    def initialize(host, token)
-      # noinspection RubyArgCount
-      super(ZitadelClient::UrlUtil.build_hostname(host))
-      @token = token
-    end
+    class PersonalAccessTokenAuthenticator < Authenticator
+      ##
+      # Initializes the PersonalAccessTokenAuthenticator with host and token.
+      #
+      # @param host [String] the base URL for the service.
+      # @param token [String] the personal access token.
+      #
+      def initialize(host, token)
+        # noinspection RubyArgCount
+        super(ZitadelClient::Utils::UrlUtil.build_hostname(host))
+        @token = token
+      end
 
-    protected
+      protected
 
-    ##
-    # Returns the authentication headers using the personal access token.
-    #
-    # @return [Hash{String => String}] a hash containing the 'Authorization' header.
-    #
-    def auth_headers
-      { 'Authorization' => "Bearer #{@token}" }
+      ##
+      # Returns the authentication headers using the personal access token.
+      #
+      # @return [Hash{String => String}] a hash containing the 'Authorization' header.
+      #
+      def auth_headers
+        { 'Authorization' => "Bearer #{@token}" }
+      end
     end
   end
 end