feat(sdk): complete management SDK methods + fix mgmt user logout - #123
Conversation
… logout Adds ~75 missing management methods across the 11 existing modules to reach parity with the Go SDK, and fixes real bugs found along the way. Bug fixes: - User: add mgmt logoutUser()/logoutUserByUserId() (service-to-service revoke-by-loginId/userId, no refresh token) — the auth-side logout() only revokes by refresh token and could not serve this flow. Closes descope/etc#16685. - OutboundApps: existing fetchUserToken/deleteUserTokens/deleteTokenById used dead paths (/v1/mgmt/outboundapp/...); corrected to /v1/mgmt/outbound/app/... to match the backend/go-sdk routes. Note: the reported User::update() "displayName vs name" bug is NOT a bug — the backend accepts both keys (protojson recognizes the proto field name and the json_name), and go-sdk itself sends displayName. Left as-is. New methods per module (bodies/paths matched to go-sdk verbatim): - Tenant: createWithId, getSettings, configureSettings, generate/revokeSSOConfigurationLink, updateDefaultRoles - SSOApplication: create/updateWSFedApplication, get/rotateApplicationSecret - User: createBatch, patch, patchBatch, deleteBatch, import, loadUsers, searchAllTestUsers, updateRecoveryEmail/Phone, get/create/deleteCustomAttributes, updateUserNames, addTenantRoles, removePasskey, listPasskeys, removeTotpSeed, getProviderTokenWithOptions, generateEmbeddedLinkSignUp, list/removeTrustedDevices - AccessKey: activateBatch, deactivateBatch, deleteBatch, rotate - SSO: loadAllSettings, configureSSORedirectURL, newSettings, getSettings, configureSettings, configureMetadata, configureMapping, recalculateSSOMappings - JWT: impersonateStepup, stopImpersonation, signIn, signUp, signUpOrIn, anonymous - Permission/Role: createBatch, updateWithId, updateBatch, deleteWithId, deleteBatch - Flow: runManagementFlow, runManagementFlowAsync, getManagementFlowAsyncResult, deleteFlows - Audit: searchAll, createAuditWebhook (both on the v2 endpoints) - OutboundApps: create/update/delete/load/loadAllApplications, token fetch/upload/batch-upload variants, listAppsWithUserToken Also: add API::doPatch() (user patch endpoints), ~65 MgmtV1 path constants, and extend ManagementParityTest to assert every new method exists. All 80 tests pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
🐕 Review complete — View session on Shuni Portal 🐾 |
🐕 Suggested ReviewersThe review strategy emphasizes selecting contributors with diverse file coverage to ensure both broad management SDK expertise and specific focus on user management features, facilitating thorough review of the SDK parity extensions and bug fixes.
Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best. |
![shuni-bot[bot]](https://avatars.githubusercontent.com/in/2536750?s=60&v=4){kind=small}
There was a problem hiding this comment.
🐕 Shuni's Review
Completes the management-SDK go-parity effort — ~75 new methods across 11 modules, ~65 path constants, and a new doPatch. I fetched the go-sdk route table and diffed the new paths/bodies against it; the vast majority line up (outbound app create-flat / update-app-wrapped asymmetry is intentional and matches go-sdk).
Sniffed out 2 issues:
- 1 🟠 HIGH: test-user search uses the wrong API version (v1, should be v2)
- 1 🟡 MEDIUM:
configureSettingslets caller settings override the target tenant
See inline comments. Otherwise good bones! Woof!
Add usage examples for the ~75 new management methods across all 11 module sections (User, Tenant, Role, Permission, AccessKey, SSOApplication, SSO Settings, JWT, Flow, Outbound Apps) plus a new Audit Management Functions section. Signatures match the implementation exactly. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Update: README docs for all ~75 new methods added in e4a173a (per-module usage examples + new Audit section). The "README docs (follow-up)" item in the description is now done and included in this PR. |
…fig link - TEST_USER_SEARCH_ALL_PATH: v1 → v2 (/v2/mgmt/user/search/test; backend only serves v2, v1 would 404). - TENANT_GENERATE_SSO_CONFIGURATION_LINK_PATH: v1 → v2 to match go-sdk (backend serves both; v2 is the go-sdk route). - Tenant::configureSettings: merge explicit tenantId last so a stray 'tenantId' key in the caller's $settings array cannot redirect the call to another tenant. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
@shuni please re-review |
|
🐕 Review complete — View session on Shuni Portal 🐾 |
There was a problem hiding this comment.
🐕 Shuni's Review
Re-sniffed the management-SDK go-parity PR. Both issues from the prior pass are fixed in 0160885 and the threads are resolved:
- 🟠 test-user search path v1 → v2 ✅
- 🟡
configureSettingsnow merges the explicittenantIdlast ✅
I also re-verified the author's bonus fix (tenant/adminlinks/sso/generate → v2, revoke left on v1) against the go-sdk route table — the version split is exactly right.
No new issues found — good bones! Woof! 🦴
|
@shuni-dev review like linus |
|
🐕 Review complete — View session on Shuni Portal 🐾 |
![shuni-bot-dev[bot]](https://avatars.githubusercontent.com/u/97479186?s=60&v=4){kind=small}
There was a problem hiding this comment.
🐕 Shuni's Review
Fills the management-SDK parity gaps across 11 modules and fixes the mgmt user logout + outbound-app path bugs. Solid, careful work — request bodies and v1/v2 prefixes check out against go-sdk.
Sniffed out 3 issues:
- 1 🟡 MEDIUM: Permission batch methods drop the API response (Role's don't)
- 2 🟢 LOW: dead duplicate path constant, duplicate
deleteFlows/delete
Nothing blocking — good bones! Woof!
…s alias - Remove unused $OUTBOUND_APP_FETCH_USER_TOKEN_PATH (dead duplicate of $OUTBOUND_APP_USER_TOKEN_PATH; fetchUserToken already uses the latter). - deleteFlows() now delegates to delete() instead of duplicating the body, keeping the go-sdk-parity method name without a second implementation. Permission::createBatch/updateBatch intentionally return void — go-sdk's Permission.CreateBatch/UpdateBatch return error only (unlike Role's batch which returns the roles), so void matches parity. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Rename all "go-sdk" references in code comments, PHPDoc, and README to "Go SDK". Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Reword the added code comments, PHPDoc, and README so they describe the methods' own request shapes and behavior directly, instead of referencing another SDK. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dorsha
changed the title
3 participants
Relates to descope/etc#16685.
TL;DR
Completes the management SDK surface (follow-up to #122) by filling the method gaps in all 11 existing management modules, and fixes the real bugs surfaced by descope/etc#16685.
Bug findings from descope/etc#16685
mgmt user logout— REAL, fixed. The SDK only had auth-sidelogout($refreshToken)/logoutAll($refreshToken), which can't do a service-to-service revoke byuserId/loginId. AddedUser::logoutUser()andUser::logoutUserByUserId()(POST/v1/mgmt/user/logout).User::update()sendsdisplayNamenotname— NOT a bug. Verified empirically against the generated backend proto:protojsonaccepts bothdisplayName(proto field name) andname(itsjson_name) for the same field. SendingdisplayNamedoes not clear the name. Left unchanged.Bonus bug fixed
OutboundAppsfetchUserToken/deleteUserTokens/deleteTokenByIdused dead paths (/v1/mgmt/outboundapp/...). The backend serves/v1/mgmt/outbound/app/.... Corrected.What's added (~75 methods, request bodies/paths matched to the Descope management API)
createWithId,getSettings,configureSettings,generateSSOConfigurationLink,revokeSSOConfigurationLink,updateDefaultRolescreateWSFedApplication,updateWSFedApplication,getApplicationSecret,rotateApplicationSecretlogoutUser,logoutUserByUserId,createBatch,patch,patchBatch,deleteBatch,import,loadUsers,searchAllTestUsers,updateRecoveryEmail,updateRecoveryPhone,getCustomAttributes,createCustomAttributes,deleteCustomAttributes,updateUserNames,addTenantRoles,removePasskey,listPasskeys,removeTotpSeed,getProviderTokenWithOptions,generateEmbeddedLinkSignUp,listTrustedDevices,removeTrustedDevicesactivateBatch,deactivateBatch,deleteBatch,rotateloadAllSettings(v2),configureSSORedirectURL,newSettings,getSettings,configureSettings,configureMetadata,configureMapping,recalculateSSOMappingsimpersonateStepup,stopImpersonation,signIn,signUp,signUpOrIn,anonymouscreateBatch,updateWithId,updateBatch,deleteWithId,deleteBatchrunManagementFlow,runManagementFlowAsync,getManagementFlowAsyncResult,deleteFlowssearchAll,createAuditWebhook(both on v2 endpoints)create/update/delete/load/loadAllApplications,fetchLatest*Token,fetchTenantToken,listAppsWithUserToken,upload*ApiKey,upload*Token,batchUpload*TokensInfra
API::doPatch()for the user patch endpoints.MgmtV1path constants, verified against the backend proto HTTP rules. The audit-webhook and SSO load-all-settings endpoints correctly use the v2 prefix.Verification
php -lclean on all changed files.createBatchthat was wrongly forcinginvite=true, always-sendverifiedon recovery updates, a nested-user duplicate field in mgmt signup) were fixed on this branch.Not included (out of scope for this PR)
🤖 Generated with Claude Code