Authorization Resources endpoints for Internal ID by swaroopAkkineniWorkos · Pull Request #1471 · workos/workos-node

swaroopAkkineniWorkos · 2026-02-09T19:08:59Z

linear: https://linear.app/workos/issue/ENT-4372/sdk-updates

I decided to break up the work for ENT-4372 into a smaller pr's that we can be easily reviewed and merge them into ENT-4372-base-authorization-branch. Then we can have one final merge that merges ENT-4372-base-authorization-branch into the main.

desc: the goal of this pr is to implement the following endpoints in the node sdk.


getResource()    ~ GET /authorization/resources/{resource_id}
createResource() ~ POST /authorization/resources
updateResource() ~ PATCH /authorization/resources/{resource_id}
deleteResource() ~ DELETE /authorization/resources/{resource_id}

Each one should call their corresponding new fga endpoint

linear · 2026-02-09T19:09:05Z

ENT-4372 SDK Updates

swaroopAkkineniWorkos · 2026-02-09T23:40:49Z

@greptile plz review this pr

swaroopAkkineniWorkos · 2026-02-09T23:41:37Z

@claude plz review this pr

greptile-apps

_{9 files reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

src/authorization/serializers/update-authorization-resource-options.serializer.ts

src/authorization/serializers/create-authorization-resource-options.serializer.ts

greptile-apps · 2026-02-09T23:47:30Z

Additional Comments (1)

src/fga/serializers/authorization-resource.serializer.ts
Undefined optional fields

This serializer also always includes description / parent_resource_id even when the options don’t set them, which can result in sending undefined values to the API. Suggest omitting optional keys unless explicitly provided (same pattern as in the Authorization serializers).

export const serializeCreateAuthorizationResourceOptions = (
  options: CreateAuthorizationResourceOptions,
): SerializedCreateAuthorizationResourceOptions => ({
  organization_id: options.organizationId,
  resource_type_slug: options.resourceTypeSlug,
  external_id: options.externalId,
  name: options.name,
  ...(options.description !== undefined && { description: options.description }),
  ...(options.parentResourceId !== undefined && {
    parent_resource_id: options.parentResourceId,
  }),
});

swaroopAkkineniWorkos · 2026-02-10T15:55:30Z

@greptile plz re-review this pr

swaroopAkkineniWorkos · 2026-02-10T16:05:23Z

@greptile plz re-review this pr

greptile-apps · 2026-02-10T16:17:14Z

Greptile Overview

Greptile Summary

This PR adds Authorization Resources support to the Node SDK by introducing new resource interfaces, serializers/deserializers, a fixture, and unit tests. The Authorization client gains getResource, createResource, updateResource, and deleteResource, with request bodies serialized to omit optional fields when not provided and to preserve explicit null for clearing fields.

The new code fits into the existing src/authorization module structure (interfaces + serializers + client methods), mirroring patterns used for roles and permissions. Unit tests assert endpoint paths and request body shapes for omitted vs null fields.

One functional mismatch remains: the new methods currently call /authorization/resources... endpoints, but the PR description states these should call the corresponding FGA endpoints instead.

Confidence Score: 3/5

This PR is not safe to merge as-is due to a clear endpoint mismatch with the stated intent.
Most changes are straightforward (types/serializers/tests) and follow existing patterns, but the core client methods are wired to /authorization/resources rather than the FGA endpoints the PR is meant to target for Internal ID support, which is likely to cause runtime failures or incorrect behavior.
src/authorization/authorization.ts

Important Files Changed

Filename	Overview
src/authorization/authorization.spec.ts	Adds unit tests covering get/create/update/delete authorization resources, including omitted vs null optional fields.
src/authorization/authorization.ts	Adds get/create/update/delete Resource methods, but currently targets /authorization/resources endpoints despite PR intent to call FGA endpoints.
src/authorization/fixtures/authorization-resource.json	Adds fixture JSON for authorization_resource API response used by new tests.
src/authorization/interfaces/authorization-resource.interface.ts	Introduces interfaces for AuthorizationResource plus create/update option and serialized shapes (supports optional vs null fields).
src/authorization/interfaces/index.ts	Exports new authorization-resource interfaces from the authorization interfaces barrel.
src/authorization/serializers/authorization-resource.serializer.ts	Adds deserializer mapping snake_case API response to camelCase AuthorizationResource.
src/authorization/serializers/create-authorization-resource-options.serializer.ts	Adds serializer for createResource that omits optional keys unless explicitly provided (undefined vs null preserved).
src/authorization/serializers/index.ts	Exports new authorization-resource serializers from the authorization serializers barrel.
src/authorization/serializers/update-authorization-resource-options.serializer.ts	Adds serializer for updateResource that omits undefined keys while allowing explicit null to clear fields.

Sequence Diagram

sequenceDiagram
  participant U as SDK Consumer
  participant A as Authorization client
  participant W as WorkOS HTTP client
  participant API as WorkOS API

  U->>A: getResource(resourceId)
  A->>W: GET /authorization/resources/{resourceId}
  W->>API: HTTP GET
  API-->>W: AuthorizationResourceResponse
  W-->>A: data
  A-->>U: AuthorizationResource (deserialized)

  U->>A: createResource(options)
  A->>A: serializeCreateResourceOptions(options)
  A->>W: POST /authorization/resources (body)
  W->>API: HTTP POST
  API-->>W: AuthorizationResourceResponse (201)
  W-->>A: data
  A-->>U: AuthorizationResource (deserialized)

  U->>A: updateResource({resourceId, ...})
  A->>A: serializeUpdateResourceOptions(options)
  A->>W: PATCH /authorization/resources/{resourceId} (body)
  W->>API: HTTP PATCH
  API-->>W: AuthorizationResourceResponse
  W-->>A: data
  A-->>U: AuthorizationResource (deserialized)

  U->>A: deleteResource(resourceId)
  A->>W: DELETE /authorization/resources/{resourceId}
  W->>API: HTTP DELETE
  API-->>W: 204 No Content
  W-->>A: void
  A-->>U: void

greptile-apps

_{9 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-10T16:17:18Z

src/authorization/authorization.ts

+  async getResource(resourceId: string): Promise<AuthorizationResource> {
+    const { data } = await this.workos.get<AuthorizationResourceResponse>(
+      `/authorization/resources/${resourceId}`,
+    );


Doesn’t call FGA endpoints

PR description says these Authorization Resources methods should call the corresponding FGA endpoints, but Authorization.getResource/createResource/updateResource/deleteResource are wired to /authorization/resources... instead of /fga/v1/resources.... As-is, this will hit a different API surface than intended and will break in environments where only the FGA endpoints exist/are supported for Internal IDs.

sorry, this is my fault. The new endpoints are part of the new fga flow

atainter

Looks good, but we might want to support those two extra options for the parent resources external_id + type slug

atainter · 2026-02-11T02:36:34Z

src/authorization/interfaces/authorization-resource.interface.ts

+  description?: string | null;
+  resourceTypeSlug: string;
+  organizationId: string;
+  parentResourceId?: string | null;


We're also going to support parentResourceExternalId + parentResourceTypeSlug. I haven't added support for them yet, but it's an action item from our bug bash

updated!, mind doublechecking when you get a chance @atainter. Gonna merge this into my base branchbut if anything is wrong, I can always update the base branch

atainter · 2026-02-11T02:37:57Z

src/authorization/authorization.spec.ts


 const workos = new WorkOS('sk_test_Sz3IQjepeSWaI4cMS4ms4sMuU');
 const testOrgId = 'org_01HXYZ123ABC456DEF789ABC';
+const testResourceId = 'resource_01HXYZ123ABC456DEF789ABC';


the prefix will be authz_resource_ after we merge https://github.com/workos/workos/pull/52102

updated in prep for it

Adding these endpoints to the sdk #1471 ``` getResource() ~ GET /authorization/resources/{resource_id} createResource() ~ POST /authorization/resources updateResource() ~ PATCH /authorization/resources/{resource_id} deleteResource() ~ DELETE /authorization/resources/{resource_id} ``` #1473 ``` check() | POST /authorization/organization_memberships/{om_id}/check ``` #1472 ``` listResources() | GET /authorization/organizations/{org_id}/resources getResourceByExternalId() | GET /authorization/organizations/{org_id}/resources/{type}/{external_id} updateResourceByExternalId() | PATCH /authorization/organizations/{org_id}/resources/{type}/{external_id} deleteResourceByExternalId() | DELETE /authorization/organizations/{org_id}/resources/{type}/{external_id} ``` #1474 ``` listRoleAssignments() | GET /authorization/organization_memberships/{om_id}/role_assignments assignRole() | POST /authorization/organization_memberships/{om_id}/role_assignments removeRole() | DELETE /authorization/organization_memberships/{om_id}/role_assignments removeRoleAssignment() | DELETE /authorization/organization_memberships/{om_id}/role_assignments/{ra_id} ``` #1478 ``` listResourcesForMembership() | GET /authorization/organization_memberships/{om_id}/resources listMembershipsForResource() | GET /authorization/resources/{resource_id}/organization_memberships listMembershipsForResourceByExternalId() | GET /authorization/organizations/{org_id}/resources/{type}/{external_id}/organization_memberships ```

Authorization Resources endpoints for Internal ID

310eeb1

swaroopAkkineniWorkos force-pushed the ENT-4372-Internal-ID branch from a1466df to 60dff4c Compare February 9, 2026 22:03

lol

685643c

swaroopAkkineniWorkos force-pushed the ENT-4372-Internal-ID branch from 04b9596 to 685643c Compare February 9, 2026 22:43

swaroopAkkineniWorkos added 10 commits February 9, 2026 12:44

Merge branch 'main' into ENT-4372-Internal-ID

107fc6c

lol

ea2628e

lol

543b121

moar

c2734e8

lol

5037673

lol

ca6f2d1

lol

dfdd37d

lol

43a0765

pretty

b61be8a

moar

0b65b75

remove

9281d60

greptile-apps bot reviewed Feb 9, 2026

View reviewed changes

src/authorization/serializers/update-authorization-resource-options.serializer.ts Outdated Show resolved Hide resolved

src/authorization/serializers/create-authorization-resource-options.serializer.ts Show resolved Hide resolved

workos deleted a comment from greptile-apps bot Feb 10, 2026

swaroopAkkineniWorkos added 3 commits February 10, 2026 04:50

moar

24f6758

moar

ea41192

moar

6fb444c

workos deleted a comment from greptile-apps bot Feb 10, 2026

swaroopAkkineniWorkos added 2 commits February 10, 2026 05:57

moar

5689bee

Merge branch 'main' into ENT-4372-Internal-ID

1cb2d25

swaroopAkkineniWorkos changed the base branch from main to ENT-4372-base-authorization-branch February 10, 2026 15:58

swaroopAkkineniWorkos requested a review from atainter February 10, 2026 16:03

swaroopAkkineniWorkos requested review from csrbarber and mattgd February 10, 2026 16:03

swaroopAkkineniWorkos marked this pull request as ready for review February 10, 2026 16:04

swaroopAkkineniWorkos requested a review from a team as a code owner February 10, 2026 16:04

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

atainter approved these changes Feb 11, 2026

View reviewed changes

swaroopAkkineniWorkos added 3 commits February 11, 2026 04:00

review

db6530c

moar

18c7085

lol

4b1ae93

swaroopAkkineniWorkos merged commit a54e1e1 into ENT-4372-base-authorization-branch Feb 11, 2026
8 checks passed

swaroopAkkineniWorkos deleted the ENT-4372-Internal-ID branch February 11, 2026 19:12

swaroopAkkineniWorkos mentioned this pull request Feb 11, 2026

Authorization Resources endpoints for Internal ID (#1471) #1479

Merged

Conversation

swaroopAkkineniWorkos commented Feb 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear bot commented Feb 9, 2026

Uh oh!

swaroopAkkineniWorkos commented Feb 9, 2026

Uh oh!

swaroopAkkineniWorkos commented Feb 9, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot commented Feb 9, 2026

Uh oh!

swaroopAkkineniWorkos commented Feb 10, 2026

Uh oh!

swaroopAkkineniWorkos commented Feb 10, 2026

Uh oh!

greptile-apps bot commented Feb 10, 2026

Greptile Overview

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos Feb 10, 2026

Choose a reason for hiding this comment

Uh oh!

atainter left a comment

Choose a reason for hiding this comment

Uh oh!

atainter Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

swaroopAkkineniWorkos commented Feb 9, 2026 •

edited

Loading