workos 5.29.0__tar.gz → 5.31.0__tar.gz

{workos-5.29.0 → workos-5.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: workos
-Version: 5.29.0
+Version: 5.31.0
 Summary: WorkOS Python Client
 Home-page: https://github.com/workos-inc/workos-python
 Author: WorkOS

{workos-5.29.0 → workos-5.31.0}/tests/test_session.py

@@ -51,6 +51,7 @@ class SessionFixtures:
             "roles": ["admin"],
             "permissions": ["read"],
             "entitlements": ["feature_1"],
+            "feature_flags": ["flag1", "flag2"],
             "exp": int(current_datetime.timestamp()) + 3600,
             "iat": int(current_datetime.timestamp()),
         }
@@ -244,6 +245,7 @@ class TestSessionBase(SessionFixtures):
             "roles": ["admin"],
             "permissions": ["read"],
             "entitlements": ["feature_1"],
+            "feature_flags": ["flag1", "flag2"],
         }
 
         with patch.object(Session, "unseal_data", return_value=mock_session), patch(
@@ -263,6 +265,7 @@ class TestSessionBase(SessionFixtures):
             assert response.roles == ["admin"]
             assert response.permissions == ["read"]
             assert response.entitlements == ["feature_1"]
+            assert response.feature_flags == ["flag1", "flag2"]
             assert response.user.id == session_constants["USER_ID"]
             assert response.impersonator is None
 
@@ -312,6 +315,7 @@ class TestSessionBase(SessionFixtures):
             "roles": ["admin", "member"],
             "permissions": ["read", "write"],
             "entitlements": ["feature_1"],
+            "feature_flags": ["flag1", "flag2"],
         }
 
         with patch.object(Session, "unseal_data", return_value=mock_session), patch(
@@ -331,6 +335,7 @@ class TestSessionBase(SessionFixtures):
             assert response.roles == ["admin", "member"]
             assert response.permissions == ["read", "write"]
             assert response.entitlements == ["feature_1"]
+            assert response.feature_flags == ["flag1", "flag2"]
             assert response.user.id == session_constants["USER_ID"]
             assert response.impersonator is None
 
@@ -410,6 +415,7 @@ class TestSession(SessionFixtures):
                 "roles": ["admin"],
                 "permissions": ["read"],
                 "entitlements": ["feature_1"],
+                "feature_flags": ["flag1", "flag2"],
             },
         ):
             response = session.refresh()
@@ -511,6 +517,7 @@ class TestAsyncSession(SessionFixtures):
                 "roles": ["admin"],
                 "permissions": ["read"],
                 "entitlements": ["feature_1"],
+                "feature_flags": ["flag1", "flag2"],
             },
         ):
             response = await session.refresh()

{workos-5.29.0 → workos-5.31.0}/tests/test_user_management.py

@@ -718,6 +718,37 @@ class TestUserManagement(UserManagementFixtures):
             "grant_type": "authorization_code",
         }
 
+    def test_authenticate_with_code_with_invitation_token(
+        self,
+        capture_and_mock_http_client_request,
+        mock_auth_response,
+        base_authentication_params,
+    ):
+        params = {
+            "code": "test_code",
+            "code_verifier": "test_code_verifier",
+            "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36",
+            "ip_address": "192.0.0.1",
+            "invitation_token": "invitation_token_12345",
+        }
+        request_kwargs = capture_and_mock_http_client_request(
+            self.http_client, mock_auth_response, 200
+        )
+
+        response = syncify(self.user_management.authenticate_with_code(**params))
+
+        assert request_kwargs["url"].endswith("user_management/authenticate")
+        assert request_kwargs["method"] == "post"
+        assert response.user.id == "user_01H7ZGXFP5C6BBQY6Z7277ZCT0"
+        assert response.organization_id == "org_12345"
+        assert response.access_token == "access_token_12345"
+        assert response.refresh_token == "refresh_token_12345"
+        assert request_kwargs["json"] == {
+            **params,
+            **base_authentication_params,
+            "grant_type": "authorization_code",
+        }
+
     def test_authenticate_with_magic_auth(
         self,
         capture_and_mock_http_client_request,

workos-5.31.0/tests/test_user_management_list_sessions.py

@@ -0,0 +1,73 @@
+from typing import Union
+
+import pytest
+
+from tests.utils.list_resource import list_response_of
+from tests.utils.syncify import syncify
+from tests.types.test_auto_pagination_function import TestAutoPaginationFunction
+from workos.user_management import AsyncUserManagement, UserManagement
+
+
+def _mock_session(id: str):
+    now = "2025-07-23T14:00:00.000Z"
+    return {
+        "object": "session",
+        "id": id,
+        "user_id": "user_123",
+        "organization_id": "org_123",
+        "status": "active",
+        "auth_method": "password",
+        "impersonator": None,
+        "ip_address": "192.168.1.1",
+        "user_agent": "Mozilla/5.0",
+        "expires_at": "2025-07-23T15:00:00.000Z",
+        "ended_at": None,
+        "created_at": now,
+        "updated_at": now,
+    }
+
+
+@pytest.mark.sync_and_async(UserManagement, AsyncUserManagement)
+class TestUserManagementListSessions:
+    @pytest.fixture(autouse=True)
+    def setup(self, module_instance: Union[UserManagement, AsyncUserManagement]):
+        self.http_client = module_instance._http_client
+        self.user_management = module_instance
+
+    def test_list_sessions_query_and_parsing(
+        self, capture_and_mock_http_client_request
+    ):
+        sessions = [_mock_session("session_1"), _mock_session("session_2")]
+        response = list_response_of(data=sessions)
+        request_kwargs = capture_and_mock_http_client_request(
+            self.http_client, response, 200
+        )
+
+        result = syncify(
+            self.user_management.list_sessions(
+                user_id="user_123", limit=10, before="before_id", order="desc"
+            )
+        )
+
+        assert request_kwargs["url"].endswith("user_management/users/user_123/sessions")
+        assert request_kwargs["method"] == "get"
+        assert request_kwargs["params"]["limit"] == 10
+        assert request_kwargs["params"]["before"] == "before_id"
+        assert request_kwargs["params"]["order"] == "desc"
+        assert "after" not in request_kwargs["params"]
+        assert len(result.data) == 2
+        assert result.data[0].id == "session_1"
+        assert result.list_metadata.before is None
+        assert result.list_metadata.after is None
+
+    def test_list_sessions_auto_pagination(
+        self, test_auto_pagination: TestAutoPaginationFunction
+    ):
+        data = [_mock_session(str(i)) for i in range(40)]
+        test_auto_pagination(
+            http_client=self.http_client,
+            list_function=self.user_management.list_sessions,
+            list_function_params={"user_id": "user_123"},
+            expected_all_page_data=data,
+            url_path_keys=["user_id"],
+        )

workos-5.31.0/tests/test_user_management_revoke_session.py

@@ -0,0 +1,47 @@
+from typing import Union
+
+import pytest
+
+from tests.utils.syncify import syncify
+from workos.user_management import AsyncUserManagement, UserManagement
+
+
+def _mock_session(id: str):
+    now = "2025-07-23T14:00:00.000Z"
+    return {
+        "object": "session",
+        "id": id,
+        "user_id": "user_123",
+        "organization_id": "org_123",
+        "status": "revoked",
+        "auth_method": "password",
+        "ip_address": "192.168.1.1",
+        "user_agent": "Mozilla/5.0",
+        "expires_at": "2025-07-23T15:00:00.000Z",
+        "ended_at": now,
+        "created_at": now,
+        "updated_at": now,
+    }
+
+
+@pytest.mark.sync_and_async(UserManagement, AsyncUserManagement)
+class TestUserManagementRevokeSession:
+    @pytest.fixture(autouse=True)
+    def setup(self, module_instance: Union[UserManagement, AsyncUserManagement]):
+        self.http_client = module_instance._http_client
+        self.user_management = module_instance
+
+    def test_revoke_session(self, capture_and_mock_http_client_request):
+        mock = _mock_session("session_abc")
+        request_kwargs = capture_and_mock_http_client_request(
+            self.http_client, mock, 200
+        )
+
+        response = syncify(
+            self.user_management.revoke_session(session_id="session_abc")
+        )
+
+        assert request_kwargs["url"].endswith("user_management/sessions/revoke")
+        assert request_kwargs["method"] == "post"
+        assert request_kwargs["json"] == {"session_id": "session_abc"}
+        assert response.id == "session_abc"

{workos-5.29.0 → workos-5.31.0}/workos/__about__.py

@@ -12,7 +12,7 @@ __package_name__ = "workos"
 
 __package_url__ = "https://github.com/workos-inc/workos-python"
 
-__version__ = "5.29.0"
+__version__ = "5.31.0"
 
 __author__ = "WorkOS"
 

{workos-5.29.0 → workos-5.31.0}/workos/session.py

@@ -4,6 +4,7 @@ from typing import TYPE_CHECKING, List, Protocol
 from functools import lru_cache
 import json
 from typing import Any, Dict, Optional, Union, cast
+
 import jwt
 from jwt import PyJWKClient
 from cryptography.fernet import Fernet
@@ -107,6 +108,7 @@ class SessionModule(Protocol):
             entitlements=decoded.get("entitlements", None),
             user=session["user"],
             impersonator=session.get("impersonator", None),
+            feature_flags=decoded.get("feature_flags", None),
         )
 
     def refresh(
@@ -235,6 +237,7 @@ class Session(SessionModule):
                 entitlements=decoded.get("entitlements", None),
                 user=auth_response.user,
                 impersonator=auth_response.impersonator,
+                feature_flags=decoded.get("feature_flags", None),
             )
         except Exception as e:
             return RefreshWithSessionCookieErrorResponse(
@@ -326,6 +329,7 @@ class AsyncSession(SessionModule):
                 entitlements=decoded.get("entitlements", None),
                 user=auth_response.user,
                 impersonator=auth_response.impersonator,
+                feature_flags=decoded.get("feature_flags", None),
             )
         except Exception as e:
             return RefreshWithSessionCookieErrorResponse(

{workos-5.29.0 → workos-5.31.0}/workos/types/list_resource.py

@@ -34,6 +34,7 @@ from workos.types.mfa import AuthenticationFactor
 from workos.types.organizations import Organization
 from workos.types.sso import ConnectionWithDomains
 from workos.types.user_management import Invitation, OrganizationMembership, User
+from workos.types.user_management.session import Session as UserManagementSession
 from workos.types.vault import ObjectDigest
 from workos.types.workos_model import WorkOSModel
 from workos.utils.request_helper import DEFAULT_LIST_RESPONSE_LIMIT
@@ -54,6 +55,7 @@ ListableResource = TypeVar(
     AuthorizationResource,
     AuthorizationResourceType,
     User,
+    UserManagementSession,
     ObjectDigest,
     Warrant,
     WarrantQueryResult,

{workos-5.29.0 → workos-5.31.0}/workos/types/user_management/__init__.py

@@ -9,3 +9,4 @@ from .password_hash_type import *
 from .password_reset import *
 from .user_management_provider_type import *
 from .user import *
+from .session import *

{workos-5.29.0 → workos-5.31.0}/workos/types/user_management/authenticate_with_common.py

@@ -19,6 +19,7 @@ class AuthenticateWithCodeParameters(AuthenticateWithBaseParameters):
     code_verifier: Union[str, None]
     grant_type: Literal["authorization_code"]
     session: Union[SessionConfig, None]
+    invitation_token: Union[str, None]
 
 
 class AuthenticateWithMagicAuthParameters(AuthenticateWithBaseParameters):

{workos-5.29.0 → workos-5.31.0}/workos/types/user_management/list_filters.py

@@ -23,3 +23,7 @@ class OrganizationMembershipsListFilters(ListArgs, total=False):
 
 class AuthenticationFactorsListFilters(ListArgs, total=False):
     user_id: str
+
+
+class SessionsListFilters(ListArgs, total=False):
+    user_id: str

{workos-5.29.0 → workos-5.31.0}/workos/types/user_management/session.py

@@ -24,6 +24,7 @@ class AuthenticateWithSessionCookieSuccessResponse(WorkOSModel):
     user: User
     impersonator: Optional[Impersonator] = None
     entitlements: Optional[Sequence[str]] = None
+    feature_flags: Optional[Sequence[str]] = None
 
 
 class AuthenticateWithSessionCookieErrorResponse(WorkOSModel):
@@ -45,3 +46,34 @@ class RefreshWithSessionCookieErrorResponse(WorkOSModel):
 class SessionConfig(TypedDict, total=False):
     seal_session: bool
     cookie_password: str
+
+
+AuthMethodType = Literal[
+    "external_auth",
+    "impersonation",
+    "magic_code",
+    "migrated_session",
+    "oauth",
+    "passkey",
+    "password",
+    "sso",
+    "unknown",
+]
+
+
+class Session(WorkOSModel):
+    """Representation of a WorkOS User Management Session."""
+
+    object: Literal["session"]
+    id: str
+    user_id: str
+    organization_id: Optional[str] = None
+    status: str
+    auth_method: AuthMethodType
+    impersonator: Optional[Impersonator] = None
+    ip_address: Optional[str] = None
+    user_agent: Optional[str] = None
+    expires_at: str
+    ended_at: Optional[str] = None
+    created_at: str
+    updated_at: str

{workos-5.29.0 → workos-5.31.0}/workos/user_management.py

@@ -48,6 +48,7 @@ from workos.types.user_management.list_filters import (
 from workos.types.user_management.password_hash_type import PasswordHashType
 from workos.types.user_management.screen_hint import ScreenHintType
 from workos.types.user_management.session import SessionConfig
+from workos.types.user_management.session import Session as UserManagementSession
 from workos.types.user_management.user_management_provider_type import (
     UserManagementProviderType,
 )
@@ -86,6 +87,8 @@ MAGIC_AUTH_DETAIL_PATH = "user_management/magic_auth/{0}"
 MAGIC_AUTH_PATH = "user_management/magic_auth"
 USER_SEND_MAGIC_AUTH_PATH = "user_management/magic_auth/send"
 USER_AUTH_FACTORS_PATH = "user_management/users/{0}/auth_factors"
+USER_SESSIONS_PATH = "user_management/users/{0}/sessions"
+SESSIONS_REVOKE_PATH = "user_management/sessions/revoke"
 EMAIL_VERIFICATION_DETAIL_PATH = "user_management/email_verification/{0}"
 INVITATION_PATH = "user_management/invitations"
 INVITATION_DETAIL_PATH = "user_management/invitations/{0}"
@@ -109,6 +112,12 @@ InvitationsListResource = WorkOSListResource[
     Invitation, InvitationsListFilters, ListMetadata
 ]
 
+from workos.types.user_management.list_filters import SessionsListFilters
+
+SessionsListResource = WorkOSListResource[
+    UserManagementSession, SessionsListFilters, ListMetadata
+]
+
 
 class UserManagementModule(Protocol):
     """Offers methods for using the WorkOS User Management API."""
@@ -488,6 +497,7 @@ class UserManagementModule(Protocol):
         code_verifier: Optional[str] = None,
         ip_address: Optional[str] = None,
         user_agent: Optional[str] = None,
+        invitation_token: Optional[str] = None,
     ) -> SyncOrAsync[AuthenticationResponse]:
         """Authenticates an OAuth user or a user that is logging in through SSO.
 
@@ -498,6 +508,7 @@ class UserManagementModule(Protocol):
                 url as part of the PKCE flow. This parameter is required when the client secret is not present. (Optional)
             ip_address (str): The IP address of the request from the user who is attempting to authenticate. (Optional)
             user_agent (str): The user agent of the request from the user who is attempting to authenticate. (Optional)
+            invitation_token (str): The token of an Invitation, if required. (Optional)
 
         Returns:
             AuthenticationResponse: Authentication response from WorkOS.
@@ -718,6 +729,20 @@ class UserManagementModule(Protocol):
         """
         ...
 
+    def list_sessions(
+        self,
+        *,
+        user_id: str,
+        limit: Optional[int] = None,
+        before: Optional[str] = None,
+        after: Optional[str] = None,
+        order: Optional[PaginationOrder] = "desc",
+    ) -> SyncOrAsync["SessionsListResource"]: ...
+
+    def revoke_session(
+        self, *, session_id: str
+    ) -> SyncOrAsync[UserManagementSession]: ...
+
     def get_magic_auth(self, magic_auth_id: str) -> SyncOrAsync[MagicAuth]:
         """Get the details of a Magic Auth object.
 
@@ -1166,6 +1191,7 @@ class UserManagement(UserManagementModule):
         code_verifier: Optional[str] = None,
         ip_address: Optional[str] = None,
         user_agent: Optional[str] = None,
+        invitation_token: Optional[str] = None,
     ) -> AuthKitAuthenticationResponse:
         if (
             session is not None
@@ -1181,6 +1207,7 @@ class UserManagement(UserManagementModule):
             "user_agent": user_agent,
             "code_verifier": code_verifier,
             "session": session,
+            "invitation_token": invitation_token,
         }
 
         return self._authenticate_with(
@@ -1373,6 +1400,54 @@ class UserManagement(UserManagementModule):
 
         return MagicAuth.model_validate(response)
 
+    def list_sessions(
+        self,
+        *,
+        user_id: str,
+        limit: Optional[int] = DEFAULT_LIST_RESPONSE_LIMIT,
+        before: Optional[str] = None,
+        after: Optional[str] = None,
+        order: Optional[PaginationOrder] = "desc",
+    ) -> "SessionsListResource":
+        limit_value: int = limit if limit is not None else DEFAULT_LIST_RESPONSE_LIMIT
+
+        params: ListArgs = {
+            "limit": limit_value,
+            "before": before,
+            "after": after,
+            "order": order,
+        }
+
+        response = self._http_client.request(
+            USER_SESSIONS_PATH.format(user_id),
+            method=REQUEST_METHOD_GET,
+            params=params,
+        )
+
+        list_args: SessionsListFilters = {
+            "limit": limit_value,
+            "before": before,
+            "after": after,
+            "user_id": user_id,
+        }
+        if order is not None:
+            list_args["order"] = order
+
+        return SessionsListResource(
+            list_method=self.list_sessions,
+            list_args=list_args,
+            **ListPage[UserManagementSession](**response).model_dump(),
+        )
+
+    def revoke_session(self, *, session_id: str) -> UserManagementSession:
+        json = {"session_id": session_id}
+
+        response = self._http_client.request(
+            SESSIONS_REVOKE_PATH, method=REQUEST_METHOD_POST, json=json
+        )
+
+        return UserManagementSession.model_validate(response)
+
     def enroll_auth_factor(
         self,
         *,
@@ -1807,6 +1882,7 @@ class AsyncUserManagement(UserManagementModule):
         code_verifier: Optional[str] = None,
         ip_address: Optional[str] = None,
         user_agent: Optional[str] = None,
+        invitation_token: Optional[str] = None,
     ) -> AuthKitAuthenticationResponse:
         if (
             session is not None
@@ -1822,6 +1898,7 @@ class AsyncUserManagement(UserManagementModule):
             "user_agent": user_agent,
             "code_verifier": code_verifier,
             "session": session,
+            "invitation_token": invitation_token,
         }
 
         return await self._authenticate_with(
@@ -2027,6 +2104,54 @@ class AsyncUserManagement(UserManagementModule):
 
         return MagicAuth.model_validate(response)
 
+    async def list_sessions(
+        self,
+        *,
+        user_id: str,
+        limit: Optional[int] = DEFAULT_LIST_RESPONSE_LIMIT,
+        before: Optional[str] = None,
+        after: Optional[str] = None,
+        order: Optional[PaginationOrder] = "desc",
+    ) -> "SessionsListResource":
+        limit_value: int = limit if limit is not None else DEFAULT_LIST_RESPONSE_LIMIT
+
+        params: ListArgs = {
+            "limit": limit_value,
+            "before": before,
+            "after": after,
+            "order": order,
+        }
+
+        response = await self._http_client.request(
+            USER_SESSIONS_PATH.format(user_id),
+            method=REQUEST_METHOD_GET,
+            params=params,
+        )
+
+        list_args: SessionsListFilters = {
+            "limit": limit_value,
+            "before": before,
+            "after": after,
+            "user_id": user_id,
+        }
+        if order is not None:
+            list_args["order"] = order
+
+        return SessionsListResource(
+            list_method=self.list_sessions,
+            list_args=list_args,
+            **ListPage[UserManagementSession](**response).model_dump(),
+        )
+
+    async def revoke_session(self, *, session_id: str) -> UserManagementSession:
+        json = {"session_id": session_id}
+
+        response = await self._http_client.request(
+            SESSIONS_REVOKE_PATH, method=REQUEST_METHOD_POST, json=json
+        )
+
+        return UserManagementSession.model_validate(response)
+
     async def enroll_auth_factor(
         self,
         *,

{workos-5.29.0 → workos-5.31.0}/workos.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: workos
-Version: 5.29.0
+Version: 5.31.0
 Summary: WorkOS Python Client
 Home-page: https://github.com/workos-inc/workos-python
 Author: WorkOS

{workos-5.29.0 → workos-5.31.0}/workos.egg-info/SOURCES.txt

@@ -16,6 +16,8 @@ tests/test_session.py
 tests/test_sso.py
 tests/test_sync_http_client.py
 tests/test_user_management.py
+tests/test_user_management_list_sessions.py
+tests/test_user_management_revoke_session.py
 tests/test_vault.py
 tests/test_webhooks.py
 tests/test_widgets.py