fix: api-authorization create/update payload shape

[Subterrane]

Summary

Fixes #45 — create_api_authorization and update_api_authorization MCP tools both failed against the OneLogin API.

Root cause

• The ApiAuthorizationApp model only attr_accessibles name, description, and api_authorization_config_values_attributes. The MCP was sending audience at the top level, but the adapter expects it nested under configuration.audiences (plural). Unknown top-level fields are rejected.
• Api::V5::ApiAuthAppsController declares required_params :name, :only => [:create, :update] — so update is not a partial update. The MCP schema marked only auth_id required, so the model frequently omitted name and got a 400.
• Delete has no body and no required-params check, which is why the reporter confirmed delete still worked.

Changes

• New buildAuthorizationBody() helper hoists top-level audience / audiences / resource_identifier / access_token_expiration_minutes / refresh_token_expiration_minutes into a nested configuration object. Throws if conflicting top-level audience/audiences values are provided; precedence is configuration.audiences > audiences > audience.
• updateApiAuthorization now requires name (matches the server) and throws a descriptive error if missing.
• create_api_authorization schema exposes connector_id, nested configuration, and typed scopes ({value, description?}, value required) and claims ({name, user_attribute_mappings, user_attribute_macros?, attributes_transformations?}, name + user_attribute_mappings required) arrays. additionalProperties: false at every level.
• update_api_authorization schema requires name in addition to auth_id, and intentionally does not expose connector_id/scopes/claims — connector_id is attr_readonly on the model, and scopes/claims are create-only per the core-api adapter. Use add_authorization_scopes / add_authorization_claim etc. to manage them afterwards.

Test plan

• create_api_authorization with {name, description} succeeds (uses account default connector)
• create_api_authorization with {name, audience: "foo"} succeeds — audience is nested into configuration
• create_api_authorization with {name, configuration: {audiences: "foo"}} succeeds
• create_api_authorization with both audience: "a" and audiences: "b" fails with a clear error
• update_api_authorization with {auth_id, name, description} succeeds
• update_api_authorization without name returns a clear error before hitting the API
• delete_api_authorization still works (regression check)

[Copilot]

Pull request overview

This PR fixes the request payload shape and input validation for the create_api_authorization and update_api_authorization MCP tools so they work with the OneLogin API’s expected structure (notably, nesting audience/token settings under configuration and requiring name on update).

Changes:

• Added buildAuthorizationBody() to whitelist/reshape allowed fields and hoist convenience top-level fields into configuration.
• Updated create_api_authorization to send the reshaped body instead of raw args.
• Updated update_api_authorization to require name and to send the reshaped body (excluding auth_id).

[Copilot]

Pull request overview

Fixes the create_api_authorization and update_api_authorization MCP tools so they send an API-compatible payload shape to OneLogin, including properly nesting authorization configuration and enforcing the API’s requirement that name be present on update.

Changes:

• Added a buildAuthorizationBody() helper to normalize/hoist top-level convenience fields into configuration and to avoid sending unsupported top-level keys.
• Updated create/update handlers to use the new body builder; update now enforces name before calling the API.
• Expanded and tightened JSON schemas for create/update to expose connector_id, configuration, and optional scopes/claims, and to require name on update.

[Copilot]

Pull request overview

This PR fixes the request payload shape and validation for the create_api_authorization and update_api_authorization MCP tools so they work with OneLogin’s API expectations (notably nesting audience/token settings under configuration and requiring name on update).

Changes:

• Added a buildAuthorizationBody() helper to normalize/hoist convenience top-level fields into a nested configuration object and drop unknown keys.
• Updated createApiAuthorization and updateApiAuthorization to send the normalized body (and made name required for updates both in runtime checks and schema).
• Expanded the create_api_authorization schema to expose connector_id, configuration, and optional scopes/claims, and made create/update schemas strict (additionalProperties: false).