require 'descope'

descope_client = Descope::Client.new(
  {
    project_id: '<project_id>',
    management_key: ENV['MGMT_KEY']
  }
)

# Every user must have a login ID. All other user information is optional
# For sign up either phone or email is required
email = 'desmond@descope.com'
user = {'name': 'Desmond Copeland', 'phone': '212-555-1234', 'email': email}
masked_address = descope_client.otp_sign_up(method: Descope::Mixins::Common::DeliveryMethod::EMAIL, login_id: 'someone@example.com', user: user)

jwt_response = descope_client.otp_verify_code(
    method: Descope::Mixins::Common::DeliveryMethod::EMAIL, login_id: 'someone@example.com', code: '123456'
)
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

masked_address = descope_client.magiclink_sign_up_or_in(
    method: Descope::Mixins::Common::DeliveryMethod::EMAIL,
    login_id: 'desmond@descope.com',
    uri: 'https://myapp.com/verify-magic-link', # Set redirect URI here or via console
)

jwt_response = descope_client.magiclink_verify_token('token-here')
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

res = descope_client.enchanted_link_sign_up_or_in(
    login_id: 'someone@example.com',
    uri: 'https://myapp.com/verify-enchanted-link', # Set redirect URI here or via console
)
link_identifier = res['linkId'] # Show the user which link they should press in their email
pending_ref = res['pendingRef'] # Used to poll for a valid session
masked_email = res['maskedEmail'] # The email that the message was sent to in a masked format

pending_ref = res['pendingRef']

def poll_for_session(descope_client, pending_ref)
  max_tries = 15
  i = 0
  done = false
  while !done && i < max_tries
    begin
      i += 1
      puts 'waiting 4 seconds for session to be created...'
      sleep(4)
      print '.'
      jwt_response = descope_client.enchanted_link_get_session(pending_ref)
      done = true
    rescue Descope::AuthException, Descope::Unauthorized => e
      puts "Failed pending session, err: #{e}"
      nil
    end

    if jwt_response
      puts "jwt_response: #{jwt_response}"
      refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME]['jwt']

      puts "refresh_token: #{refresh_token}"
      puts :'Done logging out!'
      descope_client.sign_out(refresh_token)
      puts 'User logged out'
      done = true
    end
  end
end

poll_for_session(descope_client, pending_ref)

begin
    descope_client.enchanted_link_verify_token(token=token)
    # Token is valid
rescue AuthException => e
  # Token is invalid
  puts "Failed to verify token, err: #{e}"
end

descope_client.oauth_start(
    provider: 'google', # Choose an oauth provider out of the supported providers
    return_url: 'https://my-app.com/handle-oauth', # Can be configured in the console instead of here
)

jwt_response = descope_client.oauth_exchange_token(code)
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

descope_client.saml_sign_in(
    tenant: 'my-tenant-ID', # Choose which tenant to log into
    return_url: 'https://my-app.com/handle-saml', # Can be configured in the console instead of here
    prompt: 'custom prompt here'
)

jwt_response = descope_client.saml_exchange_token(code)
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

# Every user must have a login ID. All other user information is optional
email = 'desmond@descope.com'
user = {name: 'Desmond Copeland', phone: '212-555-1234', email: 'someone@example.com'}
totp_response = descope_client.totp_sign_up(method: Descope::Mixins::Common::DeliveryMethod::EMAIL, login_id: 'someone@example.com', user: user)

# Use one of the provided options to have the user add their credentials to the authenticator
provisioning_url = totp_response['provisioningURL']
image = totp_response['image']
key = totp_response['key']

jwt_response = descope_client.totp_sign_in_code(
    login_id: 'someone@example.com',
    code: '123456' # Code from authenticator app
)
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

# Every user must have a login_id and a password. All other user information is optional
login_id = 'desmond@descope.com'
password = 'qYlvi65KaX'
user = {
    name: 'Desmond Copeland',
    email: login_id,
}
jwt_response = descope_client.password_sign_up(login_id:, password:, user:)
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

jwt_response = descope_client.password_sign_in(login_id:, password:)
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

# Start the reset process by sending a password reset prompt. In this example we'll assume
# that magic link is configured as the reset method. The optional redirect URL is used in the
# same way as in regular magic link authentication.
login_id = 'desmond@descope.com'
redirect_url = 'https://myapp.com/password-reset'
descope_client.password_reset(login_id:, redirect_url:)

# The refresh token is required to make sure the user is authenticated.
err = descope_client.password_update(login_id:, new_password: 'xyz123', token: 'token-here')

# Replaces the user's current password with a new one
jwt_response = descope_client.password_replace(login_id: 'login', old_password: '1234', new_password: '4567')
session_token = jwt_response[Descope::Mixins::Common::SESSION_TOKEN_NAME].fetch('jwt')
refresh_token = jwt_response[Descope::Mixins::Common::REFRESH_SESSION_TOKEN_NAME].fetch('jwt')

# Validate the session. Will raise if expired
begin
    jwt_response = descope_client.validate_session('session_token')
rescue AuthException => e
    # Session expired
end

# If validate_session raises an exception, you will need to refresh the session using
jwt_response = descope_client.refresh_session('refresh_token')

# Alternatively, you could combine the two and
# have the session validated and automatically refreshed when expired
jwt_response = descope_client.validate_and_refresh_session('session_token', 'refresh_token')

# You can validate specific permissions
valid_permissions = descope_client.validate_tenant_permissions(
    jwt_response: 'resp', tenant: 'my-tenant-ID', permissions: ['Permission to validate']
)

unless valid_permissions
    # Deny access
end

# Or validate roles directly
valid_roles = descope_client.validate_tenant_roles(
    jwt_response: 'resp', tenant: 'my-tenant-ID', roles: ['Role to validate']
)

unless valid_roles
    # Deny access
end

# You can validate specific permissions
valid_permissions = descope_client.validate_permissions(
    jwt_response: 'resp', permissions: ['Permission to validate']
)
unless valid_permissions
    # Deny access
end

# Or validate roles directly
valid_roles = descope_client.validate_roles(
    jwt_response: 'resp', roles: ['Role to validate']
)

unless valid_roles
    # Deny access
end

tenant_id = 't1'
jwt_response = descope_client.select_tenant(tenant_id:, refresh_token: 'refresh_token')

descope_client.sign_out('refresh_token')

descope_client.sign_out_all('refresh_token')

users_history_resp = descope_client.history(refresh_token)
for user_history in users_history_resp:
    # Do something

require 'descope'

# Initialized after setting the DESCOPE_PROJECT_ID and the DESCOPE_MANAGEMENT_KEY env vars
project_id = '<project_id>'
client = Descope::Client.new(
        {
                project_id: project_id,
                management_key: ENV['MGMT_KEY']
        }
)

# You can optionally set your own ID when creating a tenant
descope_client.create_tenant(
        name: 'My First Tenant',
        id: 'my-custom-id', # This is optional.
        self_provisioning_domains: ['domain.com'],
        custom_attributes: { 'attribute-name': 'value' },
)

# Update will override all fields as is. Use carefully.
descope_client.update_tenant(
        id: 'my-custom-id',
        name: 'My First Tenant',
        self_provisioning_domains: %w[domain.com another-domain.com],
        custom_attributes: { 'attribute-name': 'value' },
)

# Tenant deletion cannot be undone. Use carefully.
descope_client.delete_tenant('my-custom-id')

# Load tenant by id
tenant_resp = descope_client.load_tenant('my-custom-id')

# Load all tenants
tenants_resp = descope_client.load_all_tenants
tenants = tenants_resp['tenants']
tenants.each do |tenant|
  # Do something
end

# search all tenants
tenants_resp = descope_client.search_all_tenants(ids: ['id1'], names: ['name1'], custom_attributes: { 'k1': 'v1' }, self_provisioning_domains: ['spd1'])
tenants = tenants_resp['tenants']
tenants.each do |tenant|
  # Do something
  tenant_id = tenant['id']
end

# A user must have a login ID, other fields are optional.
# Roles should be set directly if no tenants exist, otherwise set
# on a per-tenant basis.
descope_client.create_user(
        login_id: 'desmond@descope.com',
        email: 'desmond@descope.com',
        display_name: 'Desmond Copeland',
        user_tenants: [
                AssociatedTenant('my-tenant-id', ['role-name1']),
        ],
)

# Alternatively, a user can be created and invited via an email message.
# Make sure to configure the invite URL in the Descope console prior to using this function,
# and that an email address is provided in the information.
associated_tenants = [{ tenant_id: 'tenant_id1', role_names: %w[role_name1 role_name2] }]
descope_client.invite_user(
        login_id: 'desmond@descope.com',
        email: 'desmond@descope.com',
        display_name: 'Desmond Copeland',
        user_tenants: client.associated_tenants_to_hash_array(associated_tenants),
)

# Update will override all fields as is. Use carefully.
descope_client.update_user(
        login_id: 'desmond@descope.com',
        email: 'desmond@descope.com',
        display_name: 'Desmond Copeland',
        user_tenants: client.associated_tenants_to_hash_array(associated_tenants)
)

# Patch all user attribute in one api call
descope_client.patch_user(
        login_id: 'desmond@descope.com',
        email: 'desmond@descope.com',
        given_name: 'Desmond',
        family_name: 'Copeland',
        display_name: 'Desmond Copeland',
        user_tenants: client.associated_tenants_to_hash_array(associated_tenants)
)

# Update explicit data for a user rather than overriding all fields
descope_client.update_login_id(
        login_id: 'desmond@descope.com',
        new_login_id: 'bane@descope.com'
)

descope_client.update_phone(
        login_id: 'desmond@descope.com',
        phone: '+18005551234',
        verified: true
)

descope_client.user_remove_tenant_roles(
        login_id: 'desmond@descope.com',
        tenant_id: 'my-tenant-id',
        role_names: ['role-name1']
)

# User deletion cannot be undone. Use carefully.
descope_client.delete_user('desmond@descope.com')

# Load specific user
user_resp = descope_client.load_user('desmond@descope.com')
user = user_resp['user']

# If needed, users can be loaded using the user ID as well
user_resp = descope_client.load_by_user_id('<user-id>')
user = user_resp['user']

# Logout user from all devices by login ID
descope_client.logout_user('<login-id>')

# Logout user from all devices by user ID
descope_client.logout_user_by_id('<user-id>')

# Search all users, optionally according to tenant and/or role filter
# results can be paginated using the limit and page parameters
users_resp = descope_client.search_all_users(tenant_ids = ['my-tenant-id'])
users = users_resp['users']
users.each do |user|
  # Do something
end

# Set a user's temporary password
descope_client.set_temporary_password(login_id: '<login-id>', password:  '<some-password>');

# Set a user's password
descope_client.set_active_password(login_id: '<login-id>', password:  '<some-password>');

# Or alternatively, expire a user password
descope_client.expire_password('<login-id>')

# An access key must have a name and expiration, other fields are optional.
# Roles should be set directly if no tenants exist, otherwise set
# on a per-tenant basis. If custom_claims supplied they will be presented on the jwt.
# If customClaims is supplied, then those claims will be present in the JWT returned by calls to ExchangeAccessKey.
associated_tenants = [{ tenant_id: 'tenant_id1', role_names: %w[role_name1 role_name2] }]
create_resp = descope_client.create_access_key(
    name: 'name',
    expire_time: 1677844931,
    key_tenants: associated_tenants,
	custom_claims: {'k1': 'v1'}
)
key = create_resp['key']
cleartext = create_resp['cleartext'] # make sure to save the returned cleartext securely. It will not be returned again.

# Load a specific access key
access_key_resp = descope_client.load_access_key('key-id')
access_key = access_key_resp['key']

# Search all access keys, optionally according to a tenant filter
keys_resp = descope_client.search_all_access_keys(['my-tenant-id'])
keys = keys_resp['keys']
keys.each do |key|
        # Do something with key
end

# Update will rename the access key
descope_client.update_access_key(
    id: 'key-id',
    name: 'new name'
)

# Access keys can be deactivated to prevent usage. This can be undone using 'activate'.
descope_client.deactivate_access_key('key-id')

# Disabled access keys can be activated once again.
descope_client.activate_access_key('key-id')

# Access key deletion cannot be undone. Use carefully.
descope_client.delete_access_key('key-id')

# You can get SSO SAML settings for a tenant
sso_settings_res = descope_client.sso_get_settings('tenant-id')  

# You can configure SSO SAML settings manually by setting the required fields directly
descope_client.configure_sso_saml_metadata(
    tenant_id: '123', # Which tenant this configuration is for
    settings: {
      name: 'test',
      clientId: 'test',
      scope: ['test'],
      userAttrMapping: {
              loginId: 'test',
              username: 'test',
              name: 'test'
      },
      callbackDomain: 'test'   
    },
    redirect_url: 'https://your.domain.com', # Global redirection after successful authentication
    domain: 'tenant-users.com' # Users authentication with this domain will be logged in to this tenant
)

# You can optionally set a description for a permission.
descope_client.create_permission(
    name:'My Permission',
    description:'Optional description to briefly explain what this permission allows.'
)

# Update will override all fields as is. Use carefully.
descope_client.mgmt.update_permission(
    name: 'My Permission',
    new_name: 'My Updated Permission',
    description: 'A revised description'
)

# Permission deletion cannot be undone. Use carefully.
descope_client.mgmt.permission.delete('My Updated Permission')

# Load all permissions
permissions_resp = descope_client.load_all_permissions
permissions = permissions_resp['permissions']
    permissions.each do |permission|
        # Do something
    end

# You can optionally set a description and associated permission for a roles.
descope_client.create_role(
    name: 'My Role',
    description: 'Optional description to briefly explain what this role allows.',
    permission_names: ['My Updated Permission'],
    tenant_id: 'Optionally scope this role for this specific tenant. If left empty, the role will be available to all tenants.'
)

# Update will override all fields as is. Use carefully.
descope_client.update_role(
    name: 'My Role',
    new_name: 'My Updated Role',
    description: 'A revised description',
    permission_names: ['My Updated Permission', 'Another Permission'],
    tenant_id: 'The tenant ID to which this role is associated, leave empty, if role is a global one'
)

# Role deletion cannot be undone. Use carefully.
descope_client.delete_role(name: 'My Updated Role',  tenant_id: 'The tenant ID to which this role is associated, leave empty, if role is a global one')

# Load all roles
roles_resp = descope_client.load_all_roles
roles = roles_resp['roles']
    roles.each do |role|
      # Do something
    end
# 

roles_resp = descope_client.search_roles(
  names: %w[role1 role2], # Search for roles with the names 'role1' and 'role2'
  role_name_like: 'role', # Search for roles that contain the string 'role'
  tenant_ids: %w[tenant1 tenant2], # Search for roles that are associated with the tenants 'tenant1' and 'tenant2'
  permission_names: %w[permission1 permission2] # Search for roles that have the permissions 'permission1' and 'permission2'
)

roles = roles_resp['roles']
roles.each do |role|
  # Do something
end

# List all project flows
flows_resp = descope_client.list_or_search_flows()
puts("Total number of flows: #{flows_resp['total']}")
flows = flows_resp['flows']
flows.each do |flow|
  # Do something
end

# Export a selected flow by id for the flow and matching screens.
exported_flow_and_screens = descope_client.export_flow('sign-up-or-in')

# Import a given flow and screens to the flow matching the id provided.
imported_flow_and_screens = descope_client.import_flow(
        flow_id: 'sign-up-or-in',
        flow: {},
        screens: []
)

# Export your project theme.
exported_theme = descope_client.export_theme

# Import a theme to your project.
imported_theme = descope_client.import_theme('theme')

# Load all groups for a given tenant id
groups_resp = descope_client.scim_search_groups(
        group_id: 'group_id',
        display_name: 'display_name',
        members: ['members'],
        external_id: 'external_id',
        excluded_attributes: { abc: '123' }
)

# Load SCIM group
group = descope_client.scim_load_group(
    tenant_id: 'tenant-id',
    group_id: 'group-id'
)

# Load SCIM group members
group = descope_client.scim_create_group(
        group_id: 'group_id',
        display_name: 'display_name',
        members: ['members'],
        external_id: 'external_id',
        excluded_attributes: { abc: '123' }
)

updated_jwt = descope_client.update_jwt(
    jwt: 'original-jwt',
    custom_claims: {
        'custom-key1': 'custom-value1',
        'custom-key2': 'custom-value2'
    },
)

token = descope_client.generate_embedded_link(login_id: 'desmond@descope.com', custom_claims: {'key1':'value1'})

# Full text search on last 10 days
audits = descope_client.audit_search(
        no_tenants: true,
        actions: ['LoginSucceed'],
        user_ids: %w[user1 user2],
        exclude_actions: %w[exclude1 exclude2],
        devices: %w[Bot Mobile Desktop Tablet Unknown],
        methods: %w[otp totp magiclink oauth saml password],
        geos: %w[US IL],
        remote_addresses: %w[remote1 remote2],
        login_ids: %w[login1 login2],
        tenants: %w[tenant1 tenant2],
        text: 'text123',
        from_ts: time.now - 10 * 24 * 60 * 60,
        to_ts: time.now - 1 * 24 * 60 * 60,
)

# Search successful logins in the last 30 days
audits = descope_client.audit_search(actions: ['LoginSucceed'])

descope_client.audit_create_event(
  actor_id: "UXXX", # required, for example a user ID
  tenant_id: "tenant-id", # required
  action: "pencil.created", # required
  type: "info", # either: info/warn/error # required
  data: {
        pencil_id: "PXXX",
        pencil_name: "Pencil Name"
  } # optional
)

# Load the existing schema
schema = descope_client.authz_load_schema

# Save schema and make sure to remove all namespaces not listed
descope_client.authz_save_schema(schema: schema, upgrade: true)

# Create a relation between a resource and user
descope_client.authz_create_relations(
        [
                { 
                        resource: 'some-doc',
                        relationDefinition: 'owner',
                        namespace: 'doc',
                        target: 'u1'
                }
        ]
)

# Check if target has the relevant relation
# The answer should be true because an owner is also a viewer
relations = descope_client.authz_has_relations?(
        [
                {
                        resource: 'some-doc',
                        relationDefinition: 'viewer',
                        namespace: 'doc',
                        target: 'u1'
                }
        ]
)

# Change the project name
descope.client.rename_project('new-project-name')

# Clone the current project, including its settings and configurations.
# Note that this action is supported only with a pro license or above.
# Users, tenants and access keys are not cloned.
clone_resp = descope.client.clone_project('new-project-name')

# User for test can be created, this user will be able to generate code/link without
# the need of 3rd party messaging services.
# Test user must have a loginId, other fields are optional.
# Roles should be set directly if no tenants exist, otherwise set
# on a per-tenant basis.

associated_tenants = [{ tenant_id: 'tenant_id1', role_names: %w[role_name1 role_name2] }]
descope_client.create_test_user(
        login_id: 'desmond@descope.com',
        email: 'desmond@descope.com',
        display_name: 'Desmond Copeland',
        user_tenants: client.associated_tenants_to_hash_array(associated_tenants)
)

# Now test user got created, and this user will be available until you delete it,
# you can use any management operation for test user CRUD.
# You can also delete all test users.
descope_client.delete_all_test_users

# OTP code can be generated for test user, for example:
resp = descope_client.generate_otp_for_test_user(
        method: Descope::Mixins::Common::DeliveryMethod::EMAIL, login_id: 'login-id'
)
code = resp['code']
# Now you can verify the code is valid (using descope_client.*.verify for example)

# Same as OTP, magic link can be generated for test user, for example:
resp = descope_client.generate_magic_link_for_test_user(
        method: Descope::Mixins::Common::DeliveryMethod::EMAIL,
        login_id: 'login-id',
)
link = resp['link']

# Enchanted link can be generated for test user, for example:
resp = descope_client.generate_enchanted_link_for_test_user(
        'login-id', ''
)
link = resp['link']
pending_ref = resp['pendingRef']

descope_client.create_sso_oidc_app(
  name: "My First sso app",
  login_page_url: "https://dummy.com/login",
  id: "my-custom-id", # this is optional
)

# Create SAML sso application
descope_client.create_saml_application(
  name: "My First sso app",
  login_page_url: "https://dummy.com/login",
  id: "my-custom-id", # this is optional
  use_metadata_info: true,
  metadata_url: "https://dummy.com/metadata",
  default_relay_state: "relayState",
  force_authentication: false,
  logout_redirect_url: "https://dummy.com/logout",
)

descope_client.update_sso_oidc_app(
  id: "my-custom-id",
  name: "My First sso app",
  login_page_url: "https://dummy.com/login",
)

descope_client.update_saml_application(
  id: "my-custom-id",
  name: "My First sso app",
  login_page_url: "https://dummy.com/login",
  use_metadata_info: false,
  entity_id: "ent1234",
  acs_url: "https://dummy.com/acs",
  certificate: "my cert"
)

descope_client.delete_sso_app('my-custom-id')

descope_client.load_sso_app('my-custom-id')

resp = descope_client.load_all_sso_apps
resp["apps"].each do |app|
  # Do something
end

begin
    descope_client.magiclink_sign_up_or_in(
        method: Descope::Mixins::Common::DeliveryMethod::EMAIL,
        login_id: 'desmond@descope.com',
        uri: 'https://myapp.com/verify-magic-link',
    )
rescue Descope::RateLimitException => e
    retry_after_seconds = e['API_RATE_LIMIT_RETRY_AFTER_HEADER']
    puts "Rate limit exceeded, retry after #{retry_after_seconds} seconds"
end
    # This variable indicates how many seconds until the next valid API call can take place.