Fix reset_password to handle wrapped API response

[nicknisi]

Fixes issue where reset_password returned a User object with all nil fields despite successful API calls.

Problem

Customer reported that after successfully resetting a password, the returned User object had all fields set to null:

{
  "id": null,
  "email": null,
  "first_name": null,
  ...
}

Investigation revealed the WorkOS API returns password reset responses in wrapped format {"user": {...}}, but the SDK was trying to parse it as a flat user object using User.new(response.body). This caused all fields to be nil because the User class looks for :id, :email, etc. at the top level, but they're nested under :user.

Solution

Updated reset_password (line 872) to use UserResponse.new(response.body).user to correctly unwrap the API response before extracting the User object.

Testing & Verification

• ✅ Verified bug exists on main branch (returns all nil fields)
• ✅ Verified fix works on feature branch (returns populated User object)
• ✅ Tested against real WorkOS API
• ✅ All 119 user_management tests pass
• ✅ Response format verified against Go and Node.js SDK implementations
• ✅ Updated VCR cassette to match current API format

Changes

• lib/workos/user_management.rb: Changed line 872 from WorkOS::User.new(response.body) to WorkOS::UserResponse.new(response.body).user
• spec/support/fixtures/vcr_cassettes/user_management/reset_password/valid.yml: Updated response body to reflect wrapped format

[greptile-apps]

Greptile Summary

• Fixed bug where reset_password returned User object with all nil fields by updating to use UserResponse.new(response.body).user instead of User.new(response.body)
• Updated VCR test fixture to match actual WorkOS API response format with wrapped {"user": {...}} structure

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The fix is a simple, well-tested change that correctly handles the API response format. The solution follows existing patterns in the codebase (send_verification_email and verify_email use the same UserResponse wrapper), and the updated VCR cassette confirms the API behavior.
• No files require special attention

Important Files Changed

Filename	Overview
lib/workos/user_management.rb	Fixed reset_password to correctly unwrap API response using UserResponse.new(response.body).user

Sequence Diagram

sequenceDiagram
    participant User
    participant SDK as "WorkOS SDK"
    participant API as "WorkOS API"
    participant UserResponse
    participant UserObj as "User Object"

    User->>SDK: "reset_password(token, new_password)"
    SDK->>API: "POST /user_management/password_reset/confirm"
    API-->>SDK: "{'user': {'id': '...', 'email': '...', ...}}"
    SDK->>UserResponse: "UserResponse.new(response.body)"
    UserResponse->>UserObj: "extract .user field"
    UserObj-->>SDK: "User object with populated fields"
    SDK-->>User: "return User object"

Loading

[greptile-apps]

_{2 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile
React with 👍 or 👎 to share your feedback on this new summary format}