Support entitlements in the Session

[adam-h]

With WorkOS now integrating with Stripe to include entitlements in the session [1], it'd be great to have this built-in to the ruby library.

For now we're working around it by re-decoding the access token in our application to access the entitlements, something like:

# Assuming `session_data` is already defined with the sealed session data
session_instance = WorkOS::UserManagement.load_sealed_session \
  client_id: credentials.client_id,
  session_data:,
  cookie_password: credentials.cookie_password

# Reach into `WorkOS::Session` and re-decode the JWT to get the underlying access token
unsealed_session = WorkOS::Session.unseal_data(session_instance.session_data, session_instance.cookie_password)
token = JWT.decode(unsealed_session[:access_token], nil, true, algorithms: session_instance.jwks_algorithms, jwks: session_instance.jwks).first

# We now have the underlying token, and through it the entitlements
puts token["entitlements"]

This works for now, so it's not super urgent for us, it's just not very clean code :)

1: https://workos.com/docs/user-management/entitlements

[adam-h]

Also, as this may be useful to others, we have a service class to use the internal WorkOS API methods to be able to get and set the stripe_customer_id on the organisation until it's also available in the API.

# Manually implemented organisation API integration
# until workos-ruby includes the stripe_customer_id attr
class WorkosStripeService
  class << self
    include WorkOS::Client

    def fetch_workos_organization(id)
      fail "Missing organization id" unless id.present?

      org_response = execute_request(request: get_request(
        auth: true,
        path: "/organizations/#{id}",
      ))
      JSON.parse(org_response.body, symbolize_names: true)
    end

    # Manually implemented until workos-ruby includes the stripe_customer_id attr
    def update_workos_organisation!(id, name:, stripe_customer_id:)
      update_response = execute_request(request: put_request(
        auth: true,
        body: {
          name:,
          stripe_customer_id:
        },
        path: "/organizations/#{id}"
      ))
      parsed = JSON.parse(update_response.body, symbolize_names: true)
      fail parsed["message"] if parsed["message"]
      parsed
    end
  end
end

Usage:

# Get
workos_organization_data = WorkosStripeService.fetch_workos_organization(org_id)
puts workos_organization_data[:stripe_customer_id]

# Set
WorkosStripeService.update_workos_organisation!(org_id, name: org_name, stripe_customer_id: stripe_customer_id)

[Teyler7]

The second comment is related to #346.