module WorkOS::SSO

The SSO module provides convenience methods for working with the WorkOS SSO platform. You'll need a valid API key, a client ID, and to have created an SSO connection on your WorkOS dashboard.

@see docs.workos.com/sso/overview

Constants

PROVIDERS

Public Class Methods

authorization_url( redirect_uri:, client_id: nil, domain: nil, provider: nil, connection: nil, state: '' ) click to toggle source
# File lib/workos/sso.rb, line 64
def authorization_url(
  redirect_uri:,
  client_id: nil,
  domain: nil,
  provider: nil,
  connection: nil,
  state: ''
)
  validate_authorization_url_arguments(
    provider: provider,
    domain: domain,
    connection: connection,
  )

  query = URI.encode_www_form({
    client_id: client_id,
    redirect_uri: redirect_uri,
    response_type: 'code',
    state: state,
    domain: domain,
    provider: provider,
    connection: connection,
  }.compact)

  "https://#{WorkOS::API_HOSTNAME}/sso/authorize?#{query}"
end
delete_connection(id:) click to toggle source
# File lib/workos/sso.rb, line 214
def delete_connection(id:)
  request = delete_request(
    auth: true,
    path: "/connections/#{id}",
  )

  response = execute_request(request: request)

  response.is_a? Net::HTTPSuccess
end
get_connection(id:) click to toggle source
# File lib/workos/sso.rb, line 193
def get_connection(id:)
  request = get_request(
    auth: true,
    path: "/connections/#{id}",
  )

  response = execute_request(request: request)

  WorkOS::Connection.new(response.body)
end
get_profile(access_token:) click to toggle source
# File lib/workos/sso.rb, line 96
def get_profile(access_token:)
  response = execute_request(
    request: get_request(
      path: '/sso/profile',
      auth: true,
      access_token: access_token,
    ),
  )

  WorkOS::Profile.new(response.body)
end
list_connections(options = {}) click to toggle source
# File lib/workos/sso.rb, line 156
def list_connections(options = {})
  response = execute_request(
    request: get_request(
      path: '/connections',
      auth: true,
      params: options,
    ),
  )

  parsed_response = JSON.parse(response.body)
  connections = parsed_response['data'].map do |connection|
    ::WorkOS::Connection.new(connection.to_json)
  end

  WorkOS::Types::ListStruct.new(
    data: connections,
    list_metadata: parsed_response['listMetadata'],
  )
end
profile_and_token(code:, client_id: nil) click to toggle source
# File lib/workos/sso.rb, line 121
def profile_and_token(code:, client_id: nil)
  body = {
    client_id: client_id,
    client_secret: WorkOS.key!,
    grant_type: 'authorization_code',
    code: code,
  }

  response = client.request(post_request(path: '/sso/token', body: body))
  check_and_raise_profile_and_token_error(response: response)

  WorkOS::ProfileAndToken.new(response.body)
end

Private Class Methods

check_and_raise_profile_and_token_error(response:) click to toggle source

rubocop:disable Metrics/MethodLength

# File lib/workos/sso.rb, line 252
def check_and_raise_profile_and_token_error(response:)
  begin
    body = JSON.parse(response.body)
    return if body['access_token'] && body['profile']

    message = body['message']
    error = body['error']
    error_description = body['error_description']
    request_id = response['x-request-id']
  rescue StandardError
    message = 'Something went wrong'
  end

  raise APIError.new(
    message: message,
    error: error,
    error_description: error_description,
    http_status: nil,
    request_id: request_id,
  )
end
validate_authorization_url_arguments( domain:, provider:, connection: ) click to toggle source
# File lib/workos/sso.rb, line 234
def validate_authorization_url_arguments(
  domain:,
  provider:,
  connection:
)
  if [domain, provider, connection].all?(&:nil?)
    raise ArgumentError, 'Either connection, domain, or ' \
      'provider is required.'
  end

  return unless provider && !PROVIDERS.include?(provider)

  raise ArgumentError, "#{provider} is not a valid value." \
    " `provider` must be in #{PROVIDERS}"
end