Skip to content

feat(authorization): align roles and permissions with the spec (PATCH, 409 conflicts, resource_type_slug) #97

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gjtorikian merged 21 commits into from
Sep 3, 2026
Merged

feat(authorization): align roles and permissions with the spec (PATCH, 409 conflicts, resource_type_slug) #97

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
1341dd4
fix(permissions): emit SDK-required response fields
workos-tars[bot] Sep 2, 2026
e84719d
fix(permissions): preserve resource type scope
workos-tars[bot] Sep 2, 2026
ffca24b
fix(seed): preserve permission resource type scope
workos-tars[bot] Sep 2, 2026
603654c
refactor(permissions): share the resource type default
gjtorikian Sep 3, 2026
8219fe1
chore: retry arm64 CI
workos-tars[bot] Sep 3, 2026
5cbb98c
ci: use IPv4 for arm64 container smoke test
workos-tars[bot] Sep 3, 2026
d3b13b3
Revert "ci: use IPv4 for arm64 container smoke test"
workos-tars[bot] Sep 3, 2026
1b211ef
ci: allow time for container key generation
workos-tars[bot] Sep 3, 2026
e638b8e
Revert "ci: allow time for container key generation"
workos-tars[bot] Sep 3, 2026
ddaaf30
chore(deps): bump @workos/openapi-spec from ^0.59.0 to ^0.80.0
gjtorikian Sep 3, 2026
29d2378
fix(permissions): serve PATCH and 409 slug conflicts
gjtorikian Sep 3, 2026
073fa56
test(permissions): table-drive invalid resource type cases
gjtorikian Sep 3, 2026
82e0f22
Merge remote-tracking branch 'origin/main' into fix/permission-respon…
gjtorikian Sep 3, 2026
2720cf1
fix(roles): serve PATCH and 409 slug conflicts
gjtorikian Sep 3, 2026
bcd2c90
fix(roles): set, add, and remove permissions per spec
gjtorikian Sep 3, 2026
d57d813
fix(supported): parse role helper routes from source
gjtorikian Sep 3, 2026
88efe11
feat(roles): scope roles to a resource type
gjtorikian Sep 3, 2026
77e521f
docs(supported): note that resource types are not modeled
gjtorikian Sep 3, 2026
c98eb50
refactor(authorization): share the resource type slug check
gjtorikian Sep 3, 2026
d0ef6ba
fix(roles): resolve every slug before replacing permissions
gjtorikian Sep 3, 2026
749ac1e
fix(roles): emit permission changes as production does
gjtorikian Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,12 +264,19 @@ roles:
- slug: admin
name: Admin
permissions: [posts:read, posts:write]
- slug: document-editor
name: Document Editor
permissions: [documents:read]
resource_type_slug: document # optional; defaults to organization

permissions:
- slug: posts:read
name: Read Posts
- slug: posts:write
name: Write Posts
- slug: documents:read
name: Read Documents
resource_type_slug: document # optional; defaults to organization
```

### Pinning organization and user ids
Expand Down
13 changes: 7 additions & 6 deletions SUPPORTED.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@

# Supported Features

The emulator implements **160 of 212** endpoints in the WorkOS OpenAPI spec (`@workos/openapi-spec@0.59.0`) (**75.5%**).
The emulator implements **166 of 250** endpoints in the WorkOS OpenAPI spec (`@workos/openapi-spec@0.80.0`) (**66.4%**).

Endpoint coverage says whether a route exists, not whether a
feature is usable; for example, Directory Sync implements every endpoint the spec defines for it and is
Expand All @@ -19,16 +19,16 @@ answers "can I actually emulate this?".

| Feature | Read | Write | Set up | Notes |
| ------------------------ | -------- | -------- | ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Organizations | ✅ 5/5 | ✅ 6/6 | ✅ seed `organizations` | |
| User Management | ✅ 8/8 | ⚠️ 7/9 | ✅ seed `users` | Email-change confirm/send endpoints are not implemented. |
| Organizations | ⚠️ 5/6 | ⚠️ 6/10 | ✅ seed `organizations` | IT contact endpoints are not implemented. |
| User Management | ⚠️ 8/11 | ⚠️ 7/13 | ✅ seed `users` | Email-change confirm/send and waitlist endpoints are not implemented. |
| Authentication | ⚠️ 3/4 | ⚠️ 4/5 | ⚠️ API only | All grant types are hand-written rather than generated from the spec. Refresh tokens always rotate, which is stricter than production. |
| Organization Memberships | ✅ 3/3 | ✅ 5/5 | ✅ seed `memberships` | Seeded via `memberships` nested under an organization. |
| Groups | ✅ 3/3 | ✅ 5/5 | ✅ seed `groups` | Seeded via `groups` nested under an organization. Members reference a seeded membership by email. |
| Invitations | ✅ 3/3 | ✅ 4/4 | ✅ seed `invitations` | |
| SSO | ✅ 5/5 | ✅ 3/3 | ✅ seed `connections` | Seeded connections carry `profiles`, which drive the SSO login flow. |
| SSO | ⚠️ 5/8 | ⚠️ 4/11 | ✅ seed `connections` | Seeded connections carry `profiles`, which drive the SSO login flow. |
| Directory Sync | ✅ 6/6 | ✅ 1/1 | ❌ none | Read-only. Every spec endpoint is implemented and all `dsync.*` events are wired, but nothing can create a directory: there is no POST route and no seed key. Node callers can insert directly via `getWorkOSStore(emulator.store)`, which does emit the events. `dsync.group.user_added` / `user_removed` are never emitted — there is no group membership mutation surface. |
| Multi-Factor Auth | ✅ 2/2 | ✅ 5/5 | ⚠️ API only | TOTP codes are accepted without verifying the shared secret. |
| FGA / Authorization | ⚠️ 15/19 | ⚠️ 13/26 | ✅ seed `roles`, `permissions` | Checks and effective-permission listings honor resource-scoped role assignments and ancestor inheritance (`parent_resource_id`); group role assignments are not implemented. |
| FGA / Authorization | ⚠️ 15/19 | ⚠️ 18/26 | ✅ seed `roles`, `permissions` | Checks and effective-permission listings honor resource-scoped role assignments and ancestor inheritance (`parent_resource_id`); group role assignments are not implemented. Resource types are not modeled: any `resource_type_slug` is accepted on roles and permissions, and permission scopes are not checked against the role scope. |
| Audit Logs | ⚠️ 3/4 | ⚠️ 3/4 | ⚠️ API only | Events are stored and queryable. Export generation is not implemented. |
| Vault | ✅ 5/5 | ⚠️ 3/6 | ⚠️ API only | Object CRUD is implemented; data-key encryption endpoints are not. |
| Feature Flags | ✅ 4/4 | ✅ 4/4 | ✅ seed `featureFlags` | Every spec endpoint is implemented at its documented verb; the emulator additionally accepts `POST` on enable/disable and `PUT` on target creation as aliases, which production rejects. Flags resolve into the `feature_flags` access-token claim, the per-user and per-organization list endpoints, and `GET /sdk/feature-flags` — the Node SDK runtime client's polling endpoint, which the spec does not define. Production has no create-flag endpoint, so flags come from the `featureFlags` seed key. |
Expand All @@ -42,7 +42,8 @@ answers "can I actually emulate this?".
| Admin Portal | — | ✅ 1/1 | ⚠️ API only | Generates a portal link; the portal itself is not served. |
| Widgets | — | ✅ 1/1 | ⚠️ API only | Mints widget tokens and serves the private `/_widgets/ApiKeys/*` routes the org-scope `<ApiKeys>` widget calls; that surface is outside the public spec, so it is not counted here. Other widgets and `scope="user"` API keys are not implemented. |
| Radar | — | ⚠️ 1/4 | ⚠️ API only | Attempt listing only; no risk signals are computed. |
| Agents | ❌ 0/1 | ❌ 0/2 | ❌ none | Not implemented. |
| Agents | ❌ 0/7 | ❌ 0/9 | ❌ none | Not implemented. |
| Platform Teams | ❌ 0/1 | ❌ 0/1 | ❌ none | Not implemented. |

## How this file is generated

Expand Down
4 changes: 2 additions & 2 deletions bun.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@
"@types/bun": "^1.3.14",
"@types/node": "~22.19.7",
"@types/semver": "^7.7.1",
"@workos/openapi-spec": "^0.59.0",
"@workos/openapi-spec": "^0.80.0",
"husky": "^9.1.7",
"oxfmt": "^0.62.0",
"oxlint": "^1.77.0",
Expand Down
Loading
Loading