feat: close remaining API parity gaps, fix transport-layer bugs found against rc.7

.github/workflows/ci.yml

@@ -44,11 +44,11 @@ jobs:
         run: |
           docker run -d --name authorizer \
             -p 8080:8080 -p 9091:9091 \
-            quay.io/authorizer/authorizer:2.3.0 \
+            quay.io/authorizer/authorizer:2.4.0-rc.7 \
             --database-type=sqlite --database-url=test.db \
             --jwt-type=HS256 --jwt-secret=test \
             --admin-secret=admin --client-id=ci-client --client-secret=secret \
-            --grpc-insecure=true
+            --grpc-insecure=true --disable-mfa
           for i in $(seq 1 30); do
             curl -fsS http://localhost:8080/health && break || sleep 2
           done

src/authorizer/__init__.py

@@ -18,6 +18,7 @@
     AddEmailTemplateRequest,
     AddOrgMemberRequest,
     AddTrustedIssuerRequest,
+    AddVerifiedOrgDomainRequest,
     AddWebhookRequest,
     AdminLoginRequest,
     AdminMeta,
@@ -35,9 +36,11 @@
     CreateOrganizationRequest,
     CreateOrgOIDCConnectionRequest,
     CreateOrgSAMLConnectionRequest,
+    CreateSAMLServiceProviderRequest,
     CreateScimEndpointRequest,
     CreateScimEndpointResponse,
     DeleteEmailTemplateRequest,
+    DeleteOrgDomainRequest,
     DeleteUserRequest,
     EmailTemplate,
     EmailTemplatesResponse,
@@ -60,45 +63,64 @@
     GetTokenRequest,
     GetTokenResponse,
     GetUserRequest,
+    ImportSAMLSPMetadataRequest,
     InviteMembersRequest,
     InviteMembersResponse,
     ListAuditLogRequest,
     ListClientsRequest,
     ListOrganizationsRequest,
+    ListOrgDomainsRequest,
     ListOrgMembersRequest,
     ListPermissionsRequest,
     ListPermissionsResponse,
+    ListSAMLIDPKeysRequest,
+    ListSAMLServiceProvidersRequest,
     ListTrustedIssuersRequest,
+    ListUsersRequest,
     ListWebhookLogRequest,
+    LockMfaRequest,
     LoginRequest,
     MagicLinkLoginRequest,
     MetaData,
     OAuthProviders,
     Organization,
     OrganizationRequest,
     OrganizationsResponse,
+    OrgDomain,
+    OrgDomainChallenge,
+    OrgDomainsResponse,
     OrgMember,
     OrgMembersResponse,
     OrgOIDCConnection,
     OrgOIDCConnectionRequest,
     OrgSAMLConnection,
     OrgSAMLConnectionRequest,
+    OtpMfaSetupRequest,
     PaginatedRequest,
     Pagination,
     PaginationRequest,
     Permission,
     PermissionCheckInput,
     PermissionCheckResult,
     RemoveOrgMemberRequest,
+    RequestOrgDomainRequest,
     ResendOTPRequest,
     ResendVerifyEmailRequest,
     ResetPasswordRequest,
     ResponseTypes,
+    RetireSAMLIDPKeyRequest,
     RevokeTokenRequest,
+    RotateSAMLIDPCertRequest,
+    SAMLIDPKey,
+    SAMLServiceProvider,
+    SAMLServiceProviderRequest,
+    SAMLServiceProvidersResponse,
+    SAMLSPMetadataParseResult,
     ScimEndpoint,
     ScimEndpointRequest,
     SessionQueryRequest,
     SignUpRequest,
+    SkipMfaSetupRequest,
     TestEndpointRequest,
     TestEndpointResponse,
     TokenType,
@@ -112,10 +134,14 @@
     UpdateOrgOIDCConnectionRequest,
     UpdateOrgSAMLConnectionRequest,
     UpdateProfileRequest,
+    UpdateSAMLServiceProviderRequest,
     UpdateTrustedIssuerRequest,
     UpdateUserRequest,
     UpdateWebhookRequest,
     User,
+    UserOrganization,
+    UserOrganizationsRequest,
+    UserOrganizationsResponse,
     UsersResponse,
     ValidateJWTTokenRequest,
     ValidateJWTTokenResponse,
@@ -124,7 +150,16 @@
     VerificationRequest,
     VerificationRequestsResponse,
     VerifyEmailRequest,
+    VerifyOrgDomainRequest,
     VerifyOTPRequest,
+    WebauthnCredentialInfo,
+    WebauthnDeleteCredentialRequest,
+    WebauthnLoginOptionsRequest,
+    WebauthnLoginOptionsResponse,
+    WebauthnLoginVerifyRequest,
+    WebauthnRegistrationOptionsRequest,
+    WebauthnRegistrationOptionsResponse,
+    WebauthnRegistrationVerifyRequest,
     Webhook,
     WebhookLog,
     WebhookLogsResponse,
@@ -135,21 +170,22 @@
 __version__ = "0.1.0"
 
 __all__ = [
-    "AuthorizerClient",
-    "AsyncAuthorizerClient",
-    "AuthorizerAdminClient",
-    "AsyncAuthorizerAdminClient",
-    "AuthorizerError",
-    "AuthorizerConnectionError",
     "AddEmailTemplateRequest",
     "AddOrgMemberRequest",
     "AddTrustedIssuerRequest",
+    "AddVerifiedOrgDomainRequest",
     "AddWebhookRequest",
     "AdminLoginRequest",
     "AdminMeta",
     "AdminSignupRequest",
+    "AsyncAuthorizerAdminClient",
+    "AsyncAuthorizerClient",
     "AuditLog",
     "AuditLogsResponse",
+    "AuthorizerAdminClient",
+    "AuthorizerClient",
+    "AuthorizerConnectionError",
+    "AuthorizerError",
     "AuthToken",
     "CheckPermissionsRequest",
     "CheckPermissionsResponse",
@@ -162,9 +198,11 @@
     "CreateOrganizationRequest",
     "CreateOrgOIDCConnectionRequest",
     "CreateOrgSAMLConnectionRequest",
+    "CreateSAMLServiceProviderRequest",
     "CreateScimEndpointRequest",
     "CreateScimEndpointResponse",
     "DeleteEmailTemplateRequest",
+    "DeleteOrgDomainRequest",
     "DeleteUserRequest",
     "EmailTemplate",
     "EmailTemplatesResponse",
@@ -191,45 +229,64 @@
     "GRANT_TYPE_CLIENT_CREDENTIALS",
     "GRANT_TYPE_REFRESH_TOKEN",
     "GRANT_TYPE_TOKEN_EXCHANGE",
+    "ImportSAMLSPMetadataRequest",
     "InviteMembersRequest",
     "InviteMembersResponse",
     "ListAuditLogRequest",
     "ListClientsRequest",
     "ListOrganizationsRequest",
+    "ListOrgDomainsRequest",
     "ListOrgMembersRequest",
     "ListPermissionsRequest",
     "ListPermissionsResponse",
+    "ListSAMLIDPKeysRequest",
+    "ListSAMLServiceProvidersRequest",
     "ListTrustedIssuersRequest",
+    "ListUsersRequest",
     "ListWebhookLogRequest",
+    "LockMfaRequest",
     "LoginRequest",
     "MagicLinkLoginRequest",
     "MetaData",
     "OAuthProviders",
     "Organization",
     "OrganizationRequest",
     "OrganizationsResponse",
+    "OrgDomain",
+    "OrgDomainChallenge",
+    "OrgDomainsResponse",
     "OrgMember",
     "OrgMembersResponse",
     "OrgOIDCConnection",
     "OrgOIDCConnectionRequest",
     "OrgSAMLConnection",
     "OrgSAMLConnectionRequest",
+    "OtpMfaSetupRequest",
     "PaginatedRequest",
     "Pagination",
     "PaginationRequest",
     "Permission",
     "PermissionCheckInput",
     "PermissionCheckResult",
     "RemoveOrgMemberRequest",
+    "RequestOrgDomainRequest",
     "ResendOTPRequest",
     "ResendVerifyEmailRequest",
     "ResetPasswordRequest",
     "ResponseTypes",
+    "RetireSAMLIDPKeyRequest",
     "RevokeTokenRequest",
+    "RotateSAMLIDPCertRequest",
+    "SAMLIDPKey",
+    "SAMLServiceProvider",
+    "SAMLServiceProviderRequest",
+    "SAMLServiceProvidersResponse",
+    "SAMLSPMetadataParseResult",
     "ScimEndpoint",
     "ScimEndpointRequest",
     "SessionQueryRequest",
     "SignUpRequest",
+    "SkipMfaSetupRequest",
     "TestEndpointRequest",
     "TestEndpointResponse",
     "TOKEN_TYPE_ACCESS_TOKEN",
@@ -245,10 +302,14 @@
     "UpdateOrgOIDCConnectionRequest",
     "UpdateOrgSAMLConnectionRequest",
     "UpdateProfileRequest",
+    "UpdateSAMLServiceProviderRequest",
     "UpdateTrustedIssuerRequest",
     "UpdateUserRequest",
     "UpdateWebhookRequest",
     "User",
+    "UserOrganization",
+    "UserOrganizationsRequest",
+    "UserOrganizationsResponse",
     "UsersResponse",
     "ValidateJWTTokenRequest",
     "ValidateJWTTokenResponse",
@@ -257,7 +318,16 @@
     "VerificationRequest",
     "VerificationRequestsResponse",
     "VerifyEmailRequest",
+    "VerifyOrgDomainRequest",
     "VerifyOTPRequest",
+    "WebauthnCredentialInfo",
+    "WebauthnDeleteCredentialRequest",
+    "WebauthnLoginOptionsRequest",
+    "WebauthnLoginOptionsResponse",
+    "WebauthnLoginVerifyRequest",
+    "WebauthnRegistrationOptionsRequest",
+    "WebauthnRegistrationOptionsResponse",
+    "WebauthnRegistrationVerifyRequest",
     "Webhook",
     "WebhookLog",
     "WebhookLogsResponse",

src/authorizer/_core.py

@@ -148,7 +148,13 @@ def prepare_http(
             config.authorizer_url, spec.rest_method, spec.rest_path, body, full_headers
         )
         return req, "rest", spec.rest_unwrap
-    variables = {"data": data} if data is not None else None
+    # gql_flat_vars: a handful of GraphQL fields (webauthn_* ceremonies) take
+    # top-level scalar args instead of a single ``params: X`` input object, so
+    # the query variables ARE the data dict, not {"data": data}.
+    if spec.gql_flat_vars:
+        variables = data or None
+    else:
+        variables = {"data": data} if data is not None else None
     req = build_graphql_request(config.authorizer_url, spec.gql_query, variables, full_headers)
     return req, "graphql", spec.gql_field