feat(authorization): add role assignment methods

[swaroopAkkineniWorkos]

linear: https://linear.app/workos/issue/ENT-4372/sdk-updates

I decided to break up the work for ENT-4372 into a smaller pr's that we can be easily reviewed and merge them into ENT-4372-base-authorization-branch. Then we can have one final merge that merges ENT-4372-base-authorization-branch into the main.

desc: the goal of this pr is to implement the following endpoints in the node sdk.

listRoleAssignments() | GET /authorization/organization_memberships/{om_id}/role_assignments
assignRole() | POST /authorization/organization_memberships/{om_id}/role_assignments
removeRole() | DELETE /authorization/organization_memberships/{om_id}/role_assignments
removeRoleAssignment() | DELETE /authorization/organization_memberships/{om_id}/role_assignments/{ra_id}

listRoleAssignments() ~ https://github.com/workos/workos/blob/1bf21e074e2cde476d83660ca41e05853fa081b8/packages/api/src/authorization/authorization-role-assignments.controller.ts#L83
assignRole() ~ https://github.com/workos/workos/blob/1bf21e074e2cde476d83660ca41e05853fa081b8/packages/api/src/authorization/authorization-role-assignments.controller.ts#L140
removeRole() ~ https://github.com/workos/workos/blob/1bf21e074e2cde476d83660ca41e05853fa081b8/packages/api/src/authorization/authorization-role-assignments.controller.ts#L205
removeRoleAssignment() ~ https://github.com/workos/workos/blob/1bf21e074e2cde476d83660ca41e05853fa081b8/packages/api/src/authorization/authorization-role-assignments.controller.ts#L264

[linear]

ENT-4372 SDK Updates

[swaroopAkkineniWorkos]

@greptile do a first pass review plz

[greptile-apps]

Greptile Overview

Greptile Summary

This PR implements four role assignment methods for the WorkOS Node SDK's authorization module: listRoleAssignments, assignRole, removeRole, and removeRoleAssignment. The implementation follows existing patterns in the codebase with proper serialization/deserialization, comprehensive test coverage, and support for both resource ID and external ID + type slug identification.

Key Changes:

• Added 4 new methods to the Authorization class following RESTful conventions
• Implemented proper serialization for camelCase (SDK) to snake_case (API) conversion
• Added comprehensive test suite covering pagination, both resource identification patterns, and edge cases
• Created well-structured TypeScript interfaces separating SDK and API response types
• Included test fixtures matching the expected API response format

Testing:
All methods have thorough test coverage including pagination parameters, both resource identification approaches (ID vs external ID + type slug), and proper verification that serialization only includes relevant fields.

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The implementation follows established patterns in the codebase, has comprehensive test coverage for all methods and edge cases, properly handles serialization/deserialization, and includes no security concerns or custom rule violations
• No files require special attention

Important Files Changed

Filename	Overview
src/authorization/authorization.ts	Added 4 new role assignment methods (listRoleAssignments, assignRole, removeRole, removeRoleAssignment) with proper error handling and serialization
src/authorization/authorization.spec.ts	Comprehensive test coverage for all 4 new methods, including pagination, resource ID vs external ID patterns, and edge cases
src/authorization/serializers/assign-role-options.serializer.ts	Properly serializes camelCase to snake_case with conditional inclusion of resource identification fields
src/authorization/serializers/remove-role-options.serializer.ts	Properly serializes camelCase to snake_case with conditional inclusion of resource identification fields
src/authorization/serializers/role-assignment.serializer.ts	Correctly deserializes API responses, converting snake_case to camelCase for the SDK interface
src/authorization/interfaces/role-assignment.interface.ts	Well-defined TypeScript interfaces for role assignments with proper separation of SDK and API response types

Sequence Diagram

sequenceDiagram
    participant Client
    participant SDK as Authorization SDK
    participant Serializer
    participant API as WorkOS API

    Note over Client,API: List Role Assignments
    Client->>SDK: listRoleAssignments(options)
    SDK->>API: GET /authorization/organization_memberships/{id}/role_assignments
    API-->>SDK: RoleAssignmentListResponse (snake_case)
    SDK->>Serializer: deserializeRoleAssignment()
    Serializer-->>SDK: RoleAssignment (camelCase)
    SDK-->>Client: RoleAssignmentList

    Note over Client,API: Assign Role
    Client->>SDK: assignRole(options)
    SDK->>Serializer: serializeAssignRoleOptions()
    Serializer-->>SDK: SerializedOptions (snake_case)
    SDK->>API: POST /authorization/organization_memberships/{id}/role_assignments
    API-->>SDK: RoleAssignmentResponse (snake_case)
    SDK->>Serializer: deserializeRoleAssignment()
    Serializer-->>SDK: RoleAssignment (camelCase)
    SDK-->>Client: RoleAssignment

    Note over Client,API: Remove Role (by resource)
    Client->>SDK: removeRole(options)
    SDK->>Serializer: serializeRemoveRoleOptions()
    Serializer-->>SDK: Query params (snake_case)
    SDK->>API: DELETE /authorization/organization_memberships/{id}/role_assignments?params
    API-->>SDK: 204 No Content
    SDK-->>Client: void

    Note over Client,API: Remove Role Assignment (by ID)
    Client->>SDK: removeRoleAssignment(options)
    SDK->>API: DELETE /authorization/organization_memberships/{id}/role_assignments/{ra_id}
    API-->>SDK: 204 No Content
    SDK-->>Client: void

Loading

[greptile-apps]

_{14 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

_{14 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[atainter]

I wonder if we should actually make resource argument this for all endpoints

resource: {id: string} | {external_id: string, type_slug: string}

Because we also have it for remove/assign role options

It could be a union of types

type ResourceOptions = {id: string} | {external_id: string, type_slug: string}[3:17 PM]export interface RemoveRoleOptions {
  organizationMembershipId: string;
  roleSlug: string;
  resource: ResourceOptions
}

[atainter]

Suggested change

// phase 3