resource memberships by swaroopAkkineniWorkos · Pull Request #1478 · workos/workos-node

swaroopAkkineniWorkos · 2026-02-11T18:35:04Z

linear: https://linear.app/workos/issue/ENT-4372/sdk-updates

I decided to break up the work for ENT-4372 into a smaller pr's that we can be easily reviewed and merge them into ENT-4372-base-authorization-branch. Then we can have one final merge that merges ENT-4372-base-authorization-branch into the main.

desc: the goal of this pr is to implement the following endpoints in the node sdk.

listResourcesForMembership() | GET /authorization/organization_memberships/{om_id}/resources
listMembershipsForResource() | GET /authorization/resources/{resource_id}/organization_memberships
listMembershipsForResourceByExternalId() | GET /authorization/organizations/{org_id}/resources/{type}/{external_id}/organization_memberships

listResourcesForMembership() ~ https://github.com/workos/workos/blob/main/packages/api/src/authorization/authorization.controller.ts#L221
listOrganizationMembershipsForResource() ~ https://github.com/workos/workos/blob/main/packages/api/src/authorization-resources/authorization-resources.controller.ts#L411
listOrganizationMembershipsForResourceByExternalId() ~ https://github.com/workos/workos/blob/main/packages/api/src/authorization-resources/authorization-resources-by-external-id.controller.ts#L135

linear · 2026-02-11T18:35:08Z

ENT-4372 SDK Updates

swaroopAkkineniWorkos · 2026-02-12T19:56:03Z

@greptile review plz

greptile-apps

_{12 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

swaroopAkkineniWorkos · 2026-02-12T20:11:43Z

@greptile re-review plz. Look at the api implementation linked in the description as part of your review. The sdk should implement calling them

greptile-apps · 2026-02-12T20:15:10Z

Greptile Overview

Greptile Summary

Implements three new endpoints for querying relationships between organization memberships and resources:

listResourcesForMembership() - retrieves resources accessible to a membership with a specific permission
listMembershipsForResource() - retrieves memberships that have access to a resource with a specific permission (by internal resource ID)
listMembershipsForResourceByExternalId() - same as above but using external resource identifiers

Key Implementation Details:

All methods follow existing SDK patterns for pagination, serialization, and deserialization
Proper TypeScript typing with separate response and deserialized interfaces
Union type used for listResourcesForMembership to support either internal ID or external ID for parent resource
Comprehensive test coverage including pagination, edge cases, and optional parameters
Authorization-specific AuthorizationOrganizationMembership type introduced to handle simplified membership data (without role information)

Code Quality:

Consistent with existing codebase patterns and conventions
No security concerns (no SQL, CORS, or logging of sensitive data)
Proper null coalescing for optional fields like customAttributes

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The implementation follows established SDK patterns precisely, includes comprehensive test coverage for all three new methods and their edge cases, and introduces no security concerns. The code is well-structured with proper TypeScript typing and consistent with the existing authorization module architecture.
No files require special attention

Important Files Changed

Filename	Overview
src/authorization/authorization.ts	Added three new list methods for querying resource-membership relationships. Implementation follows existing patterns correctly with proper serialization/deserialization.
src/authorization/authorization.spec.ts	Comprehensive test coverage for all three new methods including edge cases, pagination, and optional parameters.
src/authorization/interfaces/organization-membership-list.interface.ts	Defines authorization-specific organization membership types with proper response/deserialized pairs.
src/authorization/serializers/list-resources-for-membership-options.serializer.ts	Correctly serializes options to API format, handling union type with proper conditional logic.
src/authorization/serializers/list-memberships-for-resource-options.serializer.ts	Serializer shared between both membership query methods with proper optional field handling.

Sequence Diagram

sequenceDiagram
    participant Client as SDK Client
    participant SDK as Authorization Module
    participant API as WorkOS API

    Note over Client,API: listResourcesForMembership Flow
    Client->>SDK: listResourcesForMembership(organizationMembershipId, permissionSlug, parent...)
    SDK->>SDK: serializeListResourcesForMembershipOptions()
    SDK->>API: GET /authorization/organization_memberships/{om_id}/resources
    API-->>SDK: AuthorizationResourceListResponse
    SDK->>SDK: deserializeAuthorizationResource() for each item
    SDK-->>Client: AuthorizationResourceList

    Note over Client,API: listMembershipsForResource Flow
    Client->>SDK: listMembershipsForResource(resourceId, permissionSlug)
    SDK->>SDK: serializeListMembershipsForResourceOptions()
    SDK->>API: GET /authorization/resources/{resource_id}/organization_memberships
    API-->>SDK: AuthorizationOrganizationMembershipListResponse
    SDK->>SDK: deserializeAuthorizationOrganizationMembership() for each item
    SDK-->>Client: AuthorizationOrganizationMembershipList

    Note over Client,API: listMembershipsForResourceByExternalId Flow
    Client->>SDK: listMembershipsForResourceByExternalId(orgId, typeSlug, externalId, permissionSlug)
    SDK->>SDK: serializeListMembershipsForResourceOptions()
    SDK->>API: GET /authorization/organizations/{org_id}/resources/{type}/{external_id}/organization_memberships
    API-->>SDK: AuthorizationOrganizationMembershipListResponse
    SDK->>SDK: deserializeAuthorizationOrganizationMembership() for each item
    SDK-->>Client: AuthorizationOrganizationMembershipList

_{Last reviewed commit: 2eefd57}

greptile-apps

_{12 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

atainter · 2026-02-12T20:17:53Z

src/authorization/interfaces/organization-membership-list.interface.ts

+  };
+}
+
+export interface AuthorizationOrganizationMembership {


I think we already have types for organization membership because it's used with the organization memberships API. It uses the same JSON type so we should probably use the same interface.

atainter · 2026-02-12T23:52:36Z

src/authorization/interfaces/organization-membership-list.interface.ts

+
+export interface OrganizationMembershipList {
+  object: 'list';
+  data: OrganizationMembership[];


I think we'll need to create a base type because this interface includes a non-optional role field but it's not in the server response

https://github.com/workos/workos-node/blob/main/src/user-management/interfaces/organization-membership.interface.ts#L28

vs

https://github.com/workos/workos/blob/main/packages/api-json-models/src/rest-api/userland-user-organization-membership.ts#L8

swaroopAkkineniWorkos · 2026-02-13T13:14:11Z

src/authorization/authorization.ts

+  // test this
  async removeRole(options: RemoveRoleOptions): Promise<void> {
-    await this.workos.delete(
+    await this.workos.deleteWithBody(


changed to deleteWithBody because the delete role assignment API expects the identifying fields in the request body, and delete() doesn't send a body.

https://github.com/workos/workos/blob/1bf21e074e2cde476d83660ca41e05853fa081b8/packages/api/src/authorization/authorization-role-assignments.controller.ts#L205

atainter · 2026-02-13T14:25:01Z

src/authorization/serializers/authorization-organization-membership.serializer.ts

+  AuthorizationOrganizationMembershipResponse,
+} from '../interfaces/organization-membership-list.interface';
+
+export const deserializeAuthorizationOrganizationMembership = (


This should be in the userland package for base organization membership

atainter · 2026-02-13T14:25:21Z

src/authorization/interfaces/organization-membership-list.interface.ts

+}
+
+export interface AuthorizationOrganizationMembershipResponse extends BaseOrganizationMembershipResponse {
+  organization_name?: string;


I think we should remove this because authz doesn't use it

atainter · 2026-02-13T14:26:08Z

src/authorization/serializers/list-resources-for-membership-options.serializer.ts

+  options: ListResourcesForMembershipOptions,
+): SerializedListResourcesForMembershipOptions => ({
+  permission_slug: options.permissionSlug,
+  ...(options.limit !== undefined && { limit: options.limit }),


Is there a common helper for the pagination params?

atainter · 2026-02-13T14:27:16Z

src/user-management/interfaces/organization-membership.interface.ts

+}
+
+export interface OrganizationMembershipResponse extends BaseOrganizationMembershipResponse {
+  organization_name: string;


this should be in the base

Adding these endpoints to the sdk #1471 ``` getResource() ~ GET /authorization/resources/{resource_id} createResource() ~ POST /authorization/resources updateResource() ~ PATCH /authorization/resources/{resource_id} deleteResource() ~ DELETE /authorization/resources/{resource_id} ``` #1473 ``` check() | POST /authorization/organization_memberships/{om_id}/check ``` #1472 ``` listResources() | GET /authorization/organizations/{org_id}/resources getResourceByExternalId() | GET /authorization/organizations/{org_id}/resources/{type}/{external_id} updateResourceByExternalId() | PATCH /authorization/organizations/{org_id}/resources/{type}/{external_id} deleteResourceByExternalId() | DELETE /authorization/organizations/{org_id}/resources/{type}/{external_id} ``` #1474 ``` listRoleAssignments() | GET /authorization/organization_memberships/{om_id}/role_assignments assignRole() | POST /authorization/organization_memberships/{om_id}/role_assignments removeRole() | DELETE /authorization/organization_memberships/{om_id}/role_assignments removeRoleAssignment() | DELETE /authorization/organization_memberships/{om_id}/role_assignments/{ra_id} ``` #1478 ``` listResourcesForMembership() | GET /authorization/organization_memberships/{om_id}/resources listMembershipsForResource() | GET /authorization/resources/{resource_id}/organization_memberships listMembershipsForResourceByExternalId() | GET /authorization/organizations/{org_id}/resources/{type}/{external_id}/organization_memberships ```

Base automatically changed from ENT-4372-Internal-ID to ENT-4372-base-authorization-branch February 11, 2026 19:12

swaroopAkkineniWorkos mentioned this pull request Feb 11, 2026

Authorization Resources endpoints for Internal ID (#1471) #1479

Merged

init

1740ace

swaroopAkkineniWorkos force-pushed the ENT-4372-list-memberships-for-resource branch from 7e6cf0e to 1740ace Compare February 12, 2026 16:56

swaroopAkkineniWorkos added 6 commits February 12, 2026 07:02

nits/paginationOptions

01c6dc3

cleanup

3d237c7

moar

4329e8e

nits

401eb0b

moar

ee207f5

moar

2eefd57

greptile-apps bot reviewed Feb 12, 2026

View reviewed changes

workos deleted a comment from greptile-apps bot Feb 12, 2026

swaroopAkkineniWorkos marked this pull request as ready for review February 12, 2026 20:12

swaroopAkkineniWorkos requested a review from a team as a code owner February 12, 2026 20:12

swaroopAkkineniWorkos requested review from atainter, csrbarber and hadihallak and removed request for a team February 12, 2026 20:12

greptile-apps bot reviewed Feb 12, 2026

View reviewed changes

atainter reviewed Feb 12, 2026

View reviewed changes

swaroopAkkineniWorkos added 3 commits February 12, 2026 11:14

lol

cf98fb5

moar

f95f56d

lol

d1397ba

atainter requested changes Feb 12, 2026

View reviewed changes

testing fixes for deleterole

3fa5ea0

testing fixes for deleterole

65f2a6f

swaroopAkkineniWorkos commented Feb 13, 2026

View reviewed changes

swaroopAkkineniWorkos added 2 commits February 13, 2026 03:19

lol

54987e2

ENT-4372-review (#1482)

98a8d3c

atainter approved these changes Feb 13, 2026

View reviewed changes

swaroopAkkineniWorkos added 3 commits February 13, 2026 04:40

review

41bf1a8

deprecation comment and moving serializers around

cd6385a

deprecation comment and moving serializers around

9733533

swaroopAkkineniWorkos merged commit bfc197d into ENT-4372-base-authorization-branch Feb 13, 2026
8 checks passed

swaroopAkkineniWorkos deleted the ENT-4372-list-memberships-for-resource branch February 13, 2026 15:12

Conversation

swaroopAkkineniWorkos commented Feb 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear bot commented Feb 11, 2026

Uh oh!

swaroopAkkineniWorkos commented Feb 12, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos commented Feb 12, 2026

Uh oh!

greptile-apps bot commented Feb 12, 2026

Greptile Overview

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

atainter Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 12, 2026

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 13, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

swaroopAkkineniWorkos commented Feb 11, 2026 •

edited

Loading