Merge branch 'main' into FGI-1575_manage_connected_accounts

Author: sam-muncke

.github/workflows/codeql.yml

@@ -36,18 +36,18 @@ jobs:
         run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
 
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/publish.yml

@@ -32,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
           fetch-tags: true

.github/workflows/rl-scanner.yml

@@ -31,7 +31,7 @@ jobs:
       scan-status: ${{ steps.rl-scan-conclusion.outcome }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 0
           fetch-tags: true

.github/workflows/snyk.yml

@@ -31,10 +31,10 @@ jobs:
       - if: github.actor == 'dependabot[bot]' || github.event_name == 'merge_group'
         run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
         with:
           ref: ${{ github.event.pull_request.head.sha || github.ref }}
 
-      - uses: snyk/actions/python@b98d498629f1c368650224d6d212bf7dfa89e4bf # pin@0.4.0
+      - uses: snyk/actions/python@9adf32b1121593767fc3c057af55b55db032dc04 # pin@1.0.0
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

.github/workflows/test.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v5
+      uses: actions/checkout@v6
 
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v6

.version

@@ -1 +1 @@
-1.0.0b6
+1.0.0b7

CHANGELOG.md

@@ -1,15 +1,21 @@
 # Change Log
 
-## [1.0.0.b6](https://github.com/auth0/auth0-server-python/tree/1.0.0.b6) (2025-11-18)
-[Full Changelog](https://github.com/auth0/auth0-server-python/compare/1.0.0b5...1.0.0.b6)
+## [1.0.0.b7](https://github.com/auth0/auth0-server-python/tree/1.0.0b7) (2026-01-06)
+[Full Changelog](https://github.com/auth0/auth0-server-python/compare/1.0.0b6...1.0.0b7)
+
+**Added**
+- docs: Add user unlinking example [\#62](https://github.com/auth0/auth0-server-python/pull/62)
+
+## [1.0.0b6](https://github.com/auth0/auth0-server-python/tree/1.0.0b6) (2025-11-18)
+[Full Changelog](https://github.com/auth0/auth0-server-python/compare/1.0.0b5...1.0.0b6)
 
 **Added**
 - feat: FGI-1573 add MRRT support  [\#58](https://github.com/auth0/auth0-server-python/pull/58) ([sam-muncke](https://github.com/sam-muncke))
 
 - feat: FGI-1573 add connected account support  [\#57](https://github.com/auth0/auth0-server-python/pull/57) ([sam-muncke](https://github.com/sam-muncke))
 
-## [1.0.0.b5](https://github.com/auth0/auth0-server-python/tree/1.0.0.b5) (2025-09-15)
-[Full Changelog](https://github.com/auth0/auth0-server-python/compare/auth0_server_python-v1.0.0b4...1.0.0.b5)
+## [1.0.0b5](https://github.com/auth0/auth0-server-python/tree/1.0.0b5) (2025-09-15)
+[Full Changelog](https://github.com/auth0/auth0-server-python/compare/auth0_server_python-v1.0.0b4...1.0.0b5)
 
 **Added**
 - feat: Updates for CIBA with Email [\#28](https://github.com/auth0/auth0-server-python/pull/28) ([adamjmcgrath](https://github.com/adamjmcgrath))

examples/UserLinking.md

@@ -127,3 +127,103 @@ link_user_url = await server_client.start_link_user(options, store_options=store
 ```
 
 Read more above in [Configuring the Transaction and State Store](./ConfigureStore.md).
+
+## Start Unlinking The User
+
+User unlinking allows you to remove a previously linked identity from a user account. The process is similar to linking and begins by calling `start_unlink_user()` to obtain an authorization URL.
+
+```python
+# Start the unlink user flow by providing the connection to unlink.
+options = {
+    "connection": "google-oauth2",  # The connection to unlink
+    "authorization_params": {"redirect_uri": "http://localhost:3000/auth/callback"},
+    "app_state": {"returnTo": "http://localhost:3000/profile"}
+}
+
+# Assume store_options contains Request/Response objects required by the state store.
+store_options = {"request": request, "response": response}
+
+unlink_user_url = await server_client.start_unlink_user(options, store_options=store_options)
+
+# Redirect the user to unlink_user_url
+# (In a FastAPI route, you would return a RedirectResponse with unlink_user_url)
+```
+
+Once the unlink user flow is completed, the user will be redirected back to the `redirect_uri` specified in the `authorization_params`. At that point, it's required to call `complete_unlink_user()` to finalize the user-unlinking process. Read more below in [Complete Unlinking The User](#complete-unlinking-the-user).
+
+### Passing `authorization_params`
+
+Just like `start_link_user()`, you can customize the parameters passed to the `/authorize` endpoint:
+
+1. **Globally:**
+    Configure them when instantiating the `ServerClient`.
+
+2. **Per-call Override:**
+    Supply them when calling `start_unlink_user()`.
+
+```python
+options = {
+    "connection": "google-oauth2",
+    "authorization_params": {
+        "redirect_uri": "http://localhost:3000/auth/callback",
+        "audience": "urn:custom:api"
+    }
+}
+unlink_user_url = await server_client.start_unlink_user(options, store_options=store_options)
+```
+
+>[!NOTE]
+> Any `authorization_params` property specified when calling `start_unlink_user()` will override the same, statically configured, `authorization_params` property on `ServerClient`.
+
+### Passing App State
+
+The `app_state` parameter allows you to pass custom data (for example, a return URL) that will be returned when the unlinking process is complete.
+
+```python
+options = {
+    "connection": "google-oauth2",
+    "app_state": {"return_to": "http://localhost:3000/profile"}
+}
+unlink_user_url = await server_client.start_unlink_user(options, store_options=store_options)
+
+# Later, when completing unlinking:
+result = await server_client.complete_unlink_user(callback_url, store_options=store_options)
+print(result.get("app_state").get("return_to"))  # Should output "http://localhost:3000/profile"
+```
+
+### Passing Store Options
+
+Every method that interacts with the state or transaction store accepts a second parameter, `store_options`. This parameter should include the HTTP request and response objects (or equivalents) needed to manage cookies or sessions.
+
+```python
+store_options = {"request": request, "response": response}
+unlink_user_url = await server_client.start_unlink_user(options, store_options=store_options)
+```
+
+Read more above in [Configuring the Transaction and State Store](./ConfigureStore.md).
+
+## Complete Unlinking The User
+
+After the user has been redirected back to your application (at the `redirect_uri`), you need to complete the unlinking process. This is done by calling `complete_unlink_user()`, which extracts the necessary parameters from the callback URL and returns the `app_state`.
+
+```python
+# Complete the unlinking process:
+result = await server_client.complete_unlink_user(callback_url, store_options=store_options)
+
+# Retrieve the app_state:
+print(result.get("app_state").get("return_to"))
+```
+
+> [!NOTE]
+> The URL passed to `complete_unlink_user()` should be the full callback URL from Auth0, including the `state` and `code` parameters.
+
+### Passing Store Options
+
+Just like most methods, `complete_unlink_user()` accepts a second argument that is used to pass to the configured Transaction and State Store:
+
+```python
+store_options = {"request": request, "response": response}
+result = await server_client.complete_unlink_user(callback_url, store_options=store_options)
+```
+
+Read more above in [Configuring the Transaction and State Store](./ConfigureStore.md).