fix: harden session sealing, log redaction, and webhook tolerance checks

[gjtorikian]

Summary

• Session cookie_password hardening: require cookie_password.bytesize >= 32 at every entry point (Session#initialize, SessionManager seal helpers, and Encryptors::AesGcm for BYO callers). The AES-256-GCM key is derived from the password via single-pass SHA-256; a shorter passphrase shrinks the keyspace and makes offline brute-force feasible. Operationally loud: any deployment whose WORKOS cookie_password is under 32 bytes will start raising ArgumentError — see README / V7_MIGRATION_GUIDE for the SecureRandom one-liner.
• Session refresh durability: persist @seal_data / @cookie_password before decoding the freshly-minted access token so a transient JWKS error doesn't strand the session on a rotated (revoked) refresh token. Source user / impersonator / organization_id from the auth response directly.
• JWT exp required: pass required_claims: ['exp'] to JWT.decode and treat decoded["exp"].nil? as expired in Session#authenticate so include_expired: true cannot return authenticated: true for a token without an expiry.
• Base client log redaction: redact bearer-token path segments (invitation by_token, magic_auth, password reset, email verification, sessions authorize/logout) before they hit :debug / :info / :warn log lines. Wire request is unchanged.
• Symmetric tolerance in Webhooks#verify_header and Actions#verify_header: use .abs so a future-dated timestamp (clock skew or attacker-supplied) is rejected like a stale one.
• PKCE helper hygiene: UserManagement#get_authorization_url_with_pkce now strips caller-supplied code_challenge / code_challenge_method from **opts, mirroring the existing :state pattern, so callers can't override the freshly-generated challenge or trigger an ArgumentError collision.

Test plan

• bundle exec rake test passes
• Existing session/cookie_password tests still pass; new tests cover the < 32-byte rejection paths
• Webhook + Actions verify_header reject future-dated timestamps
• Spot-check: log output for an invitation by_token request shows redaction
• Manual: a session refresh whose JWKS fetch fails leaves the previously-good session unchanged

[greptile-apps]

Greptile Summary

This PR hardens several security-sensitive subsystems: it enforces a 32-byte minimum on cookie_password at every entry point, flips the session-durability order so @seal_data is persisted before JWT decode, adds symmetric timestamp rejection for webhook/action tolerance checks, redacts token-bearing path segments from log output, and strips caller-supplied PKCE params from get_authorization_url_with_pkce.

• Cookie-password hardening: Session#initialize, SessionManager#validate_cookie_password!, and Encryptors::AesGcm#validate_key! all now raise ArgumentError for keys under 32 bytes; documented in README and V7_MIGRATION_GUIDE.
• Refresh durability: @seal_data / @cookie_password are written before decode_jwt is called so a transient JWKS failure no longer strands the session — though RefreshError still doesn't expose sealed_session, limiting how much a typical caller can benefit.
• Log redaction: BaseClient#redact_path replaces token-bearing path segments with [REDACTED]; sessions/logout and sessions/authorize tokens remain unredacted because they appear as query parameters.

Confidence Score: 4/5

Safe to merge with one fix: decode_jwt should add required_claims: ['exp'] to match the stated intent and close the gap in the refresh path.

The password-hardening and tolerance fixes are correct and well-tested. The durability reordering achieves its in-memory goal. The missing required_claims: ['exp'] in decode_jwt means Session#refresh can return RefreshSuccess(authenticated: true) for a token that immediately appears expired on the next authenticate call, an inconsistency between the two code paths.

lib/workos/session_manager.rb — decode_jwt is missing required_claims: ['exp'], creating an inconsistency between the authenticate and refresh code paths.

Important Files Changed

Filename	Overview
lib/workos/session.rb	Adds cookie_password minimum-length guard, fixes is_expired nil check, and reorders @seal_data/@cookie_password assignment to persist state before JWT decode.
lib/workos/session_manager.rb	Adds validate_cookie_password! helper wired into seal/unseal entry points. decode_jwt still omits required_claims: ['exp'], iss validation, and aud validation.
lib/workos/base_client.rb	Introduces redact_path for token-bearing path segments. Sessions logout/authorize tokens in query params remain unredacted.
lib/workos/encryptors/aes_gcm.rb	Adds minimum key-length validation and refactors v7/legacy fallback into nested begin/rescue. Changes are correct and safe.
lib/workos/webhooks.rb	Adds .abs for symmetric tolerance check. Low-risk one-line fix.
lib/workos/actions.rb	Same symmetric tolerance fix as webhooks.rb.
lib/workos/user_management.rb	Strips caller-supplied code_challenge/code_challenge_method from opts in get_authorization_url_with_pkce.

Comments Outside Diff (1)

1. lib/workos/session_manager.rb, line 175-186 (link)

   required_claims: ['exp'] described in PR but not implemented

   The PR description states "pass required_claims: ['exp'] to JWT.decode", yet decode_jwt does not include that option. Without it, a server-issued token that omits the exp claim is decoded successfully by the JWT gem (with verify_expiration: true enabled, the gem simply skips the check when the claim is absent rather than raising). The decoded["exp"].nil? guard added to Session#authenticate catches this on the authentication path, but Session#refresh calls decode_jwt at line 123 with no subsequent nil check — a token without exp would produce RefreshSuccess(authenticated: true) even though the follow-on authenticate call would immediately report authenticated: false (expired). Adding required_claims: ['exp'] to decode_jwt would enforce the invariant on both code paths and make the intent explicit.

   Rule Used: JWTs should always be validated before use and the... (source)

_{Reviews (4): Last reviewed commit: "test(webhooks,actions): cover future-dat..." | Re-trigger Greptile}