zitadel-client 1.4.1 → 1.5.0

data/lib/zitadel-client/api_client.rb

@@ -1,376 +0,0 @@
-# frozen_string_literal: true
-
-# rubocop:disable Style/ClassVars
-# rubocop:disable Metrics/AbcSize
-# rubocop:disable Metrics/CyclomaticComplexity
-# rubocop:disable Metrics/MethodLength
-# rubocop:disable Metrics/PerceivedComplexity
-# rubocop:disable Metrics/ClassLength
-
-require 'date'
-require 'json'
-require 'logger'
-require 'tempfile'
-require 'time'
-require 'typhoeus'
-require 'uri'
-
-module ZitadelClient
-  # ApiClient handles all HTTP interactions with the Zitadel API.
-  #
-  # It is responsible for:
-  # - Constructing and signing requests via the configured authenticator
-  # - Executing HTTP calls and handling errors (timeouts, non-2xx responses)
-  # - Streaming file downloads into temporary files
-  # - Deserializing JSON responses into Ruby types and model objects
-  #
-  # === Usage Example:
-  #   config = ZitadelClient::Configuration.new do |c|
-  #     c.authenticator = ZitadelClient::ClientCredentialsAuthenticator.builder(base_url, id, secret).build
-  #   end
-  #   client = ZitadelClient::ApiClient.new(config)
-  #   data, status, headers = client.call_api(:get, '/users', query_params: { limit: 10 })
-  class ApiClient
-    # The Configuration object holding settings to be used in the API client.
-    attr_accessor :config
-
-    # Defines the headers to be used in HTTP requests of all API calls by default.
-    #
-    # @return [Hash[String, String]]
-    attr_accessor :default_headers
-
-    # Initializes the ApiClient
-    # @option config [Configuration] Configuration for initializing the object, default to the
-    # default configuration.
-    def initialize(config = Configuration.new)
-      @config = config
-      @default_headers = {
-        'Content-Type' => 'application/json',
-        'User-Agent' => config.user_agent
-      }
-    end
-
-    # noinspection RubyClassVariableUsageInspection,RbsMissingTypeSignature
-    # @return [ZitadelClient::ApiClient]
-    def self.default
-      @@default ||= ApiClient.new
-    end
-
-    # Call an API with given options.
-    #
-    # @return [Array<(Object, Integer, Hash)>] an array of 3 elements:
-    #   the data deserialized from response body (which may be a Tempfile or nil), response status code and response headers.
-    # noinspection RbsMissingTypeSignature
-    def call_api(http_method, path, opts = {})
-      request = build_request(http_method, path, opts)
-      tempfile = nil
-      (download_file(request) { tempfile = _1 }) if opts[:return_type] == 'File'
-      response = request.run
-
-      @config.logger.debug "HTTP response body ~BEGIN~\n#{response.body}\n~END~\n" if @config.debugging
-
-      unless response.success?
-        if response.timed_out?
-          raise 'Connection timed out'
-        elsif response.return_code != :ok
-          raise "Network error (#{response.return_code}): #{response.return_message}"
-        else
-          raise ApiError.new(response.code, response.headers, response.body)
-        end
-      end
-
-      data = if opts[:return_type] == 'File'
-               tempfile
-             elsif opts[:return_type]
-               deserialize(response, opts[:return_type])
-             end
-      [data, response.code, response.headers]
-    end
-
-    def build_request(http_method, path, opts = {})
-      url = URI.join("#{@config.authenticator.send(:host).chomp('/')}/", path).to_s
-      http_method = http_method.to_sym.downcase
-
-      query_params = opts[:query_params] || {}
-      form_params = opts[:form_params] || {}
-      follow_location = opts[:follow_location] || true
-      header_params = @default_headers.merge(opts[:header_params] || {}).merge(@config.authenticator.send(:auth_headers))
-
-      req_opts = {
-        method: http_method,
-        headers: header_params,
-        params: query_params,
-        params_encoding: @config.params_encoding,
-        timeout: @config.timeout,
-        ssl_verifypeer: @config.verify_ssl,
-        ssl_verifyhost: (@config.verify_ssl_host ? 2 : 0),
-        sslcert: @config.cert_file,
-        sslkey: @config.key_file,
-        verbose: @config.debugging,
-        followlocation: follow_location
-      }
-
-      # set custom cert, if provided
-      req_opts[:cainfo] = @config.ssl_ca_cert if @config.ssl_ca_cert
-
-      if %i[post patch put delete].include?(http_method)
-        req_body = build_request_body(header_params, form_params, opts[:body])
-        req_opts.update body: req_body
-        @config.logger.debug "HTTP request body param ~BEGIN~\n#{req_body}\n~END~\n" if @config.debugging
-      end
-
-      Typhoeus::Request.new(url, req_opts)
-    end
-
-    # Builds the HTTP request body
-    #
-    # @param [Hash] header_params Header parameters
-    # @param [Hash] form_params Query parameters
-    # @param [Object] body HTTP body (JSON/XML)
-    # @return [String] HTTP body data in the form of string
-    # noinspection RubyMismatchedReturnType,RubyArgCount,RbsMissingTypeSignature
-    def build_request_body(header_params, form_params, body)
-      # http form
-      if ['application/x-www-form-urlencoded',
-          'multipart/form-data'].include?(header_params['Content-Type'])
-        data = {}
-        form_params.each do |key, value|
-          data[key] = case value
-                      when ::File, ::Array, nil
-                        # let typhoeus handle File, Array and nil parameters
-                        value
-                      else
-                        value.to_s
-                      end
-        end
-      elsif body
-        data = body.is_a?(String) ? body : body.to_json
-      else
-        data = nil
-      end
-      data
-    end
-
-    # Save response body into a file in (the defined) temporary folder, using the filename
-    # from the "Content-Disposition" header if provided, otherwise a random filename.
-    # The response body is written to the file in chunks in order to handle files which
-    # size is larger than maximum Ruby String or even larger than the maximum memory a Ruby
-    # process can use.
-    #
-    # @see Configuration#temp_folder_path
-    #
-    # @return [Tempfile] the tempfile generated
-    # noinspection RbsMissingTypeSignature
-    def download_file(request)
-      tempfile = nil
-      encoding = nil
-
-      request.on_headers do |response|
-        content_disposition = response.headers['Content-Disposition']
-        if content_disposition && content_disposition =~ /filename=/i
-          filename = content_disposition[/filename=['"]?([^'"\s]+)['"]?/, 1]
-          prefix = sanitize_filename(filename)
-        else
-          prefix = 'download-'
-        end
-        prefix += '-' unless prefix.end_with?('-')
-        encoding = response.body.encoding
-        tempfile = Tempfile.open(prefix, @config.temp_folder_path, encoding: encoding)
-      end
-
-      request.on_body do |chunk|
-        chunk.force_encoding(encoding) if encoding
-        ensure_tempfile(tempfile).write(chunk)
-      end
-
-      request.on_complete do
-        t = ensure_tempfile(tempfile)
-        t.close
-        @config.logger.info "Temp file written to #{t.path}, please copy the file to a proper folder " \
-                            "with e.g. `FileUtils.cp(t.path, '/new/file/path')` otherwise the temp file " \
-                            "will be deleted automatically with GC. It's also recommended to delete the temp file " \
-                            'explicitly with `t.delete`'
-        yield t if block_given?
-      end
-    end
-
-    def ensure_tempfile(temp)
-      temp || (raise 'Tempfile not created')
-    end
-
-    # Check if the given MIME is a JSON MIME.
-    # JSON MIME examples:
-    #   application/json
-    #   application/json; charset=UTF8
-    #   APPLICATION/JSON
-    #   */*
-    # @param [String] mime MIME
-    # @return [Boolean] True if the MIME is application/json
-    # noinspection RbsMissingTypeSignature
-    def json_mime?(mime)
-      (mime == '*/*') || !(mime =~ %r{^Application/.*json(?!p)(;.*)?}i).nil?
-    end
-
-    # Deserialize the response to the given return type.
-    #
-    # @param [Response] response HTTP response
-    # @param [String] return_type some examples: "User", "Array<User>", "Hash<String, Integer>"
-    # noinspection RbsMissingTypeSignature
-    def deserialize(response, return_type)
-      body = response.body
-      return nil if body.nil? || body.empty?
-
-      # return response body directly for String return type
-      return body.to_s if return_type == 'String'
-
-      # ensuring a default content type
-      content_type = response.headers['Content-Type'] || 'application/json'
-
-      raise "Content-Type is not supported: #{content_type}" unless json_mime?(content_type)
-
-      begin
-        data = JSON.parse("[#{body}]", symbolize_names: true)[0]
-      rescue JSON::ParserError => e
-        raise e unless %w[String Date Time].include?(return_type)
-
-        data = body
-      end
-
-      convert_to_type data, return_type
-    end
-
-    # Convert data to the given return type.
-    # @param [Object] data Data to be converted
-    # @param [String] return_type Return type
-    # @return [Mixed] Data in a particular type
-    # noinspection RubyArgCount,RubyMismatchedArgumentType,RbsMissingTypeSignature
-    def convert_to_type(data, return_type)
-      return nil if data.nil?
-
-      # noinspection RegExpRedundantEscape
-      case return_type
-      when 'String'
-        data.to_s
-      when 'Integer'
-        data.to_i
-      when 'Float'
-        data.to_f
-      when 'Boolean'
-        data == true
-      when 'Time'
-        # parse date time (expecting ISO 8601 format)
-        Time.parse data
-      when 'Date'
-        # parse date time (expecting ISO 8601 format)
-        Date.parse data
-      when 'Object'
-        # generic object (usually a Hash), return directly
-        data
-      when /\AArray<(.+)>\z/
-        # e.g. Array<Pet>
-        sub_type = ::Regexp.last_match(1)
-        data.map { |item| convert_to_type(item, sub_type) }
-      when /\AHash<String, (.+)>\z/
-        # e.g. Hash<String, Integer>
-        sub_type = ::Regexp.last_match(1)
-        {}.tap do |hash|
-          data.each { |k, v| hash[k] = convert_to_type(v, sub_type) }
-        end
-      else
-        # models (e.g. Pet) or oneOf
-        klass = ZitadelClient::Models.const_get(return_type)
-        klass.respond_to?(:openapi_one_of) ? klass.build(data) : klass.build_from_hash(data)
-      end
-    end
-
-    # Sanitize filename by removing path.
-    # e.g. ../../sun.gif becomes sun.gif
-    #
-    # @param [String] filename the filename to be sanitized
-    # @return [String] the sanitized filename
-    # noinspection RubyMismatchedReturnType,RbsMissingTypeSignature
-    def sanitize_filename(filename)
-      filename.split(%r{[/\\]}).last
-    end
-
-    # Return Accept header based on an array of accepts provided.
-    # @param [Array] accepts array for Accept
-    # @return [String] the Accept header (e.g. application/json)
-    # noinspection RubyArgCount,RbsMissingTypeSignature
-    def select_header_accept(accepts)
-      return nil if accepts.nil? || accepts.empty?
-
-      # use JSON when present, otherwise use all the provided
-      json_accept = accepts.find { |s| json_mime?(s) }
-      json_accept || accepts.join(',')
-    end
-
-    # Return Content-Type header based on an array of content types provided.
-    # @param [Array] content_types array for Content-Type
-    # @return [String] the Content-Type header  (e.g. application/json)
-    # noinspection RubyArgCount,RbsMissingTypeSignature
-    def select_header_content_type(content_types)
-      # return nil by default
-      return if content_types.nil? || content_types.empty?
-
-      # use JSON when present, otherwise use the first one
-      json_content_type = content_types.find { |s| json_mime?(s) }
-      json_content_type || content_types.first
-    end
-
-    # Convert object (array, hash, object, etc.) to JSON string.
-    # @param [Object] model object to be converted into JSON string
-    # @return [String] JSON string representation of the object
-    # noinspection RubyMismatchedReturnType,RbsMissingTypeSignature
-    def object_to_http_body(model)
-      return model if model.nil? || model.is_a?(String)
-
-      local_body = if model.is_a?(Array)
-                     model.map { |m| object_to_hash(m) }
-                   else
-                     object_to_hash(model)
-                   end
-      local_body.to_json
-    end
-
-    # Convert object(non-array) to hash.
-    # @param [Object] obj object to be converted into JSON string
-    # @return [String] JSON string representation of the object
-    # noinspection RubyMismatchedReturnType,RbsMissingTypeSignature
-    def object_to_hash(obj)
-      if obj.respond_to?(:to_hash)
-        obj.to_hash
-      else
-        obj
-      end
-    end
-
-    # Build parameter value according to the given collection format.
-    # @param [String] collection_format one of :csv, :ssv, :tsv, :pipes and :multi
-    # noinspection RbsMissingTypeSignature
-    def build_collection_param(param, collection_format)
-      case collection_format
-      when :csv
-        param.join(',')
-      when :ssv
-        param.join(' ')
-      when :tsv
-        param.join("\t")
-      when :pipes
-        param.join('|')
-      when :multi
-        # return the array directly as typhoeus will handle it as expected
-        param
-      else
-        raise "unknown collection format: #{collection_format.inspect}"
-      end
-    end
-  end
-end
-
-# rubocop:enable Style/ClassVars
-# rubocop:enable Metrics/AbcSize
-# rubocop:enable Metrics/CyclomaticComplexity
-# rubocop:enable Metrics/MethodLength
-# rubocop:enable Metrics/PerceivedComplexity
-# rubocop:enable Metrics/ClassLength

data/lib/zitadel-client/api_error.rb

@@ -1,29 +0,0 @@
-# frozen_string_literal: true
-
-module ZitadelClient
-  ##
-  # Represents an HTTP error returned from the Zitadel API.
-  #
-  # Exposes the HTTP status code, response headers, and response body.
-  class ApiError < ZitadelError
-    # @return [Integer] HTTP status code
-    attr_reader :code
-
-    # @return [Hash{String=>Array<String>}] HTTP response headers
-    attr_reader :response_headers
-
-    # @return [String, Typhoeus::Response] HTTP response body
-    attr_reader :response_body
-
-    ##
-    # @param code             [Integer]                     HTTP status code
-    # @param response_headers [Hash{String=>Array<String>}] HTTP response headers
-    # @param response_body    [String, Typhoeus::Response]  HTTP response body
-    def initialize(code, response_headers, response_body)
-      super("Error #{code}")
-      @code = code
-      @response_headers = response_headers
-      @response_body = response_body
-    end
-  end
-end

data/lib/zitadel-client/auth/authenticator.rb

@@ -1,78 +0,0 @@
-# frozen_string_literal: true
-
-require 'time'
-
-module ZitadelClient
-  module Auth
-    ##
-    # Abstract base class for authenticators.
-    #
-    # This class defines the basic structure for any authenticator by requiring the implementation
-    # of a method to retrieve authentication headers, and provides a way to store and retrieve the host.
-    #
-    class Authenticator
-      protected
-
-      attr_reader :host
-
-      ##
-      # Initializes the Authenticator with the specified host.
-      #
-      # @param host [String] the base URL or endpoint for the service.
-      #
-      def initialize(host)
-        @host = host
-      end
-
-      ##
-      # Retrieves the authentication headers to be sent with requests.
-      #
-      # Subclasses must override this method to return the appropriate headers.
-      #
-      # @raise [NotImplementedError] Always raised to require implementation in a subclass.
-      #
-      # @return [Hash{String => String}]
-      #
-      def auth_headers
-        # :nocov:
-        raise NotImplementedError,
-              "#{self.class}#get_auth_headers is an abstract method. Please override it in a subclass."
-        # :nocov:
-      end
-    end
-
-    ##
-    # Abstract builder class for constructing OAuth authenticator instances.
-    #
-    # This builder provides common configuration options such as the OpenId instance and authentication scopes.
-    #
-    class OAuthAuthenticatorBuilder
-      protected
-
-      attr_reader :open_id, :auth_scopes
-
-      ##
-      # Initializes the OAuthAuthenticatorBuilder with a given host.
-      #
-      # @param host [String] the base URL for the OAuth provider.
-      #
-      def initialize(host)
-        @open_id = OpenId.new(host)
-        @auth_scopes = Set.new(%w[openid urn:zitadel:iam:org:project:id:zitadel:aud])
-      end
-
-      public
-
-      ##
-      # Sets the authentication scopes for the OAuth authenticator.
-      #
-      # @param scopes [Array<String>] a variable number of scope strings.
-      # @return [self] the builder instance to allow for method chaining.
-      #
-      def scopes(*scopes)
-        @auth_scopes = Set.new(scopes)
-        self
-      end
-    end
-  end
-end

data/lib/zitadel-client/auth/client_credentials_authenticator.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-
-module ZitadelClient
-  module Auth
-    # ClientCredentialsAuthenticator implements the client credentials flow.
-    class ClientCredentialsAuthenticator < ZitadelClient::Auth::OAuthAuthenticator
-      # Constructs a ClientCredentialsAuthenticator using client credentials flow.
-      #
-      # @param open_id [OpenId] The OpenId instance with OAuth endpoint info.
-      # @param client_id [String] The OAuth client identifier.
-      # @param client_secret [String] The OAuth client secret.
-      # @param auth_scopes [Set<String>] The scope(s) for the token request.
-      def initialize(open_id, client_id, client_secret, auth_scopes)
-        # noinspection RubyArgCount
-        super(open_id, auth_scopes, OAuth2::Client.new(client_id, client_secret, {
-                                                         site: open_id.host_endpoint,
-                                                         token_url: open_id.token_endpoint
-                                                       }))
-      end
-
-      # Returns a new builder for constructing a ClientCredentialsAuthenticator.
-      #
-      # @param host [String] The OAuth provider's base URL.
-      # @param client_id [String] The OAuth client identifier.
-      # @param client_secret [String] The OAuth client secret.
-      # @return [ClientCredentialsAuthenticatorBuilder] A builder instance.
-      def self.builder(host, client_id, client_secret)
-        ClientCredentialsAuthenticatorBuilder.new(host, client_id, client_secret)
-      end
-
-      protected
-
-      # Overrides the base get_grant to return client credentials grant parameters.
-
-      # @return [OAuth2::AccessToken] A hash containing the grant type.
-      def get_grant(client, auth_scopes)
-        client.client_credentials.get_token({ scope: auth_scopes })
-      end
-
-      # Builder class for ClientCredentialsAuthenticator.
-      class ClientCredentialsAuthenticatorBuilder < OAuthAuthenticatorBuilder
-        # Initializes the builder with host, client ID, and client secret.
-        #
-        # @param host [String] The OAuth provider's base URL.
-        # @param client_id [String] The OAuth client identifier.
-        # @param client_secret [String] The OAuth client secret.
-        def initialize(host, client_id, client_secret)
-          # noinspection RubyArgCount
-          super(host)
-          @client_id = client_id
-          @client_secret = client_secret
-        end
-
-        # Constructs and returns a ClientCredentialsAuthenticator using the configured parameters.
-        #
-        # @return [ClientCredentialsAuthenticator] A configured instance.
-        def build
-          ClientCredentialsAuthenticator.new(open_id, @client_id, @client_secret, auth_scopes)
-        end
-      end
-    end
-  end
-end

data/lib/zitadel-client/auth/no_auth_authenticator.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-module ZitadelClient
-  module Auth
-    ##
-    # A simple authenticator that performs no authentication.
-    #
-    # This authenticator is useful for cases where no token or credentials are required.
-    # It simply returns an empty dictionary for authentication headers.
-    #
-    class NoAuthAuthenticator < Authenticator
-      ##
-      # Initializes the NoAuthAuthenticator with a default host.
-      #
-      # @param host [String] the base URL for the service. Defaults to "http://localhost".
-      #
-      def initialize(host = 'http://localhost')
-        super
-      end
-
-      protected
-
-      ##
-      # Returns an empty dictionary since no authentication is performed.
-      #
-      # @return [Hash{String => String}] an empty hash.
-      #
-      def auth_headers
-        {}
-      end
-    end
-  end
-end

data/lib/zitadel-client/auth/o_auth_authenticator.rb

@@ -1,97 +0,0 @@
-# frozen_string_literal: true
-
-require 'time'
-require 'oauth2'
-
-OAuth2.configure do |config|
-  # noinspection RubyResolve
-  config.silence_extra_tokens_warning = true
-end
-
-module ZitadelClient
-  module Auth
-    ##
-    # Base class for OAuth-based authentication using an OAuth2 client.
-    #
-    # Attributes:
-    #   open_id: An object providing OAuth endpoint information.
-    #   auth_session: An OAuth2Session instance used for fetching tokens.
-    #
-    class OAuthAuthenticator < Authenticator
-      protected
-
-      ##
-      # Constructs an OAuthAuthenticator.
-      #
-      # @param open_id [OpenId] An object that must implement `get_host_endpoint` and `get_token_endpoint`.
-      # @param auth_session [OAuth2Session] The OAuth2Session instance used for token requests.
-      #
-      def initialize(open_id, auth_scopes, auth_session)
-        super(open_id.host_endpoint)
-        @open_id = open_id
-        @token = nil
-        @auth_session = auth_session
-        @auth_scopes = auth_scopes.to_a.join(' ')
-      end
-
-      ##
-      # Returns the current access token, refreshing it if necessary.
-      #
-      # @return [String] The current access token.
-      #
-      def auth_token
-        token = @token
-        if token.nil? || token.expired?
-          refresh_token
-          token = @token
-        end
-
-        raise 'Token is nil after refresh' if token.nil?
-
-        token.token
-      end
-
-      ##
-      # Retrieves authentication headers.
-      #
-      # @return [Hash{String => String}] A hash containing the 'Authorization' header.
-      #
-      def auth_headers
-        { 'Authorization' => "Bearer #{auth_token}" }
-      end
-
-      ##
-      # Builds and returns a hash of grant parameters required for the token request.
-      #
-      # The base class will invoke this method by passing its OAuth2 client.
-      # The subclass implementation should return the result of either:
-      #   client.client_credentials.get_token(scope: scopes)
-      # or
-      #   client.assertion.get_token(claims)
-      #
-      # @param auth_client [OAuth2::Client] The OAuth2 client instance.
-      # @param [String] auth_scopes
-      # @return [OAuth2::AccessToken] A hash of parameters used to fetch a token.
-      #
-      def get_grant(auth_client, auth_scopes)
-        # :nocov:
-        raise NotImplementedError, "#{self.class}#get_grant must be implemented"
-        # :nocov:
-      end
-
-      ##
-      # Refreshes the access token using the OAuth flow.
-      #
-      # It uses `get_grant` to obtain all necessary parameters for the token request.
-      #
-      # @return [OAuth2::AccessToken] A new Token instance.
-      # @raise [RuntimeError] if the token refresh fails.
-      #
-      def refresh_token
-        @token = get_grant(@auth_session, @auth_scopes)
-      rescue StandardError => e
-        raise ZitadelError.new("Failed to refresh token: #{e.message}"), cause: e
-      end
-    end
-  end
-end