Skip to content

feat(auth): add auth management key support for disabled auth methods #283

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
itaihanski wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(auth): add auth management key support for disabled auth methods #283

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions src/main/java/com/descope/client/Config.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,13 @@ public class Config {
// fail.
private String managementKey;

// AuthManagementKey (optional, "") - used to provide a management key to use
// with Authentication APIs whose public access has been disabled.
// If empty, this value is retrieved from the DESCOPE_AUTH_MANAGEMENT_KEY
// environment variable instead. If neither values are set then any disabled
// authentication methods API calls will fail.
private String authManagementKey;

// PublicKey (optional, "") - used to override or implicitly use a dedicated public key in order
// to decrypt and validate the JWT tokens during ValidateSessionRequest().
// If empty, will attempt to fetch all public keys from the specified project id.
Expand Down Expand Up @@ -73,4 +80,11 @@ public String initializeManagementKey() {
}
return this.managementKey;
}

public String initializeAuthManagementKey() {
if (StringUtils.isBlank(this.authManagementKey)) {
this.authManagementKey = EnvironmentUtils.getAuthManagementKey();
}
return this.authManagementKey;
}
}
2 changes: 2 additions & 0 deletions src/main/java/com/descope/client/DescopeClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,7 @@ public DescopeClient(Config config) throws DescopeException {
log.debug("Provided public key is set, forcing only provided public key validation");
}
config.initializeManagementKey();
config.initializeAuthManagementKey();
config.initializeBaseURL();

Client client = getClient(config);
Expand All @@ -69,6 +70,7 @@ private static Client getClient(Config config) {
.uri(StringUtils.isBlank(config.getDescopeBaseUrl()) ? baseUrl : config.getDescopeBaseUrl())
.projectId(projectId)
.managementKey(config.getManagementKey())
.authManagementKey(config.getAuthManagementKey())
.headers(
Collections.isEmpty(config.getCustomDefaultHeaders())
? new HashMap<>() : new HashMap<>(config.getCustomDefaultHeaders()))
Expand Down
1 change: 1 addition & 0 deletions src/main/java/com/descope/literals/AppConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ public class AppConstants {
public static final String PROJECT_ID_ENV_VAR = "DESCOPE_PROJECT_ID";
public static final String PUBLIC_KEY_ENV_VAR = "DESCOPE_PUBLIC_KEY";
public static final String MANAGEMENT_KEY_ENV_VAR = "DESCOPE_MANAGEMENT_KEY";
public static final String AUTH_MANAGEMENT_KEY_ENV_VAR = "DESCOPE_AUTH_MANAGEMENT_KEY";
public static final String BASE_URL_ENV_VAR = "DESCOPE_BASE_URL";
public static final String AUTHORIZATION_HEADER_NAME = "Authorization";
public static final String BEARER_AUTHORIZATION_PREFIX = "Bearer ";
Expand Down
1 change: 1 addition & 0 deletions src/main/java/com/descope/model/client/Client.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ public class Client {
private String uri;
private String projectId;
private String managementKey;
private String authManagementKey;
private Map<String, String> headers;
private SdkInfo sdkInfo;
private Key providedKey;
Expand Down
12 changes: 11 additions & 1 deletion src/main/java/com/descope/sdk/auth/impl/AuthenticationsBase.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,11 @@ abstract class AuthenticationsBase extends SdkServicesBase implements Authentica

ApiProxy getApiProxy() {
String projectId = client.getProjectId();
String authManagementKey = client.getAuthManagementKey();
if (StringUtils.isNotBlank(projectId)) {
if (StringUtils.isNotBlank(authManagementKey)) {
return ApiProxyBuilder.buildProxy(() -> String.format("Bearer %s:%s", projectId, authManagementKey), client);
}
Comment on lines +40 to +44
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new logic that includes authManagementKey in the Authorization header lacks test coverage. Similar authentication tests exist in AuthenticationServiceImplTest.java and other test files. Consider adding tests to verify the Authorization header format when authManagementKey is present and absent.

Copilot uses AI. Check for mistakes.
return ApiProxyBuilder.buildProxy(() -> "Bearer " + projectId, client);
}
return ApiProxyBuilder.buildProxy(client.getSdkInfo());
Expand All @@ -49,7 +53,13 @@ ApiProxy getApiProxy(String refreshToken) {
return getApiProxy();
}

String token = String.format("Bearer %s:%s", projectId, refreshToken);
String authManagementKey = client.getAuthManagementKey();
String token;
if (StringUtils.isNotBlank(authManagementKey)) {
token = String.format("Bearer %s:%s:%s", projectId, refreshToken, authManagementKey);
} else {
token = String.format("Bearer %s:%s", projectId, refreshToken);
}
Comment on lines +56 to +62
Copy link

Copilot AI Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The modified refresh token logic that conditionally includes authManagementKey lacks test coverage. Add tests to verify the correct Authorization header format with and without authManagementKey in the refresh token flow.

Copilot uses AI. Check for mistakes.
return ApiProxyBuilder.buildProxy(() -> token, client);
}

Expand Down
5 changes: 5 additions & 0 deletions src/main/java/com/descope/utils/EnvironmentUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
package com.descope.utils;

import static com.descope.literals.AppConstants.AUTH_MANAGEMENT_KEY_ENV_VAR;
import static com.descope.literals.AppConstants.BASE_URL_ENV_VAR;
import static com.descope.literals.AppConstants.MANAGEMENT_KEY_ENV_VAR;
import static com.descope.literals.AppConstants.PROJECT_ID_ENV_VAR;
Expand Down Expand Up @@ -27,4 +28,8 @@ public static String getPublicKey() {
public static String getManagementKey() {
return dotenv.get(MANAGEMENT_KEY_ENV_VAR);
}

public static String getAuthManagementKey() {
return dotenv.get(AUTH_MANAGEMENT_KEY_ENV_VAR);
}
}
Loading