feat: fga adding base types and module registraiton

src/workos/fga.py

@@ -53,6 +53,8 @@ class WarrantQueryListResource(
     warnings: Optional[Sequence[FGAWarning]] = None
 
 
+# Deprecated: Use the Authorization module instead.
+# See: workos.authorization
 class FGAModule(Protocol):
     def get_resource(
         self, *, resource_type: str, resource_id: str

src/workos/types/authorization/__init__.py

@@ -1,14 +1,32 @@
+from workos.types.authorization.access_check_response import AccessCheckResponse
 from workos.types.authorization.environment_role import (
     EnvironmentRole,
     EnvironmentRoleList,
 )
+from workos.types.authorization.organization_membership import (
+    AuthorizationOrganizationMembership,
+)
 from workos.types.authorization.organization_role import (
     OrganizationRole,
     OrganizationRoleEvent,
     OrganizationRoleList,
 )
 from workos.types.authorization.permission import Permission
+from workos.types.authorization.parent_resource_identifier import (
+    ParentResourceIdentifier,
+)
+from workos.types.authorization.authorization_resource import AuthorizationResource
+from workos.types.authorization.resource_identifier import (
+    ResourceIdentifier,
+    ResourceIdentifierByExternalId,
+    ResourceIdentifierById,
+)
 from workos.types.authorization.role import (
     Role,
     RoleList,
 )
+from workos.types.authorization.role_assignment import (
+    RoleAssignment,
+    RoleAssignmentResource,
+    RoleAssignmentRole,
+)

src/workos/types/authorization/access_check_response.py

@@ -0,0 +1,5 @@
+from workos.types.workos_model import WorkOSModel
+
+
+class AccessCheckResponse(WorkOSModel):
+    authorized: bool

src/workos/types/authorization/assignment.py

@@ -0,0 +1,3 @@
+from typing import Literal
+
+Assignment = Literal["direct", "indirect"]

src/workos/types/authorization/authorization_resource.py

@@ -0,0 +1,18 @@
+from typing import Literal, Optional
+
+from workos.types.workos_model import WorkOSModel
+
+
+class AuthorizationResource(WorkOSModel):
+    """Representation of an Authorization Resource."""
+
+    object: Literal["authorization_resource"]
+    id: str
+    external_id: str
+    name: str
+    description: Optional[str] = None
+    resource_type_slug: str
+    organization_id: str
+    parent_resource_id: Optional[str] = None
+    created_at: str
+    updated_at: str

src/workos/types/authorization/organization_membership.py

@@ -0,0 +1,5 @@
+from workos.types.user_management.organization_membership import (
+    BaseOrganizationMembership,
+)
+
+AuthorizationOrganizationMembership = BaseOrganizationMembership

src/workos/types/authorization/parent_resource_identifier.py

@@ -0,0 +1,15 @@
+from typing import Union
+
+from typing_extensions import TypedDict
+
+
+class ParentResourceById(TypedDict):
+    parent_resource_id: str
+
+
+class ParentResourceByExternalId(TypedDict):
+    parent_resource_external_id: str
+    parent_resource_type_slug: str
+
+
+ParentResourceIdentifier = Union[ParentResourceById, ParentResourceByExternalId]

src/workos/types/authorization/resource_identifier.py

@@ -0,0 +1,15 @@
+from typing import Union
+
+from typing_extensions import TypedDict
+
+
+class ResourceIdentifierById(TypedDict):
+    resource_id: str
+
+
+class ResourceIdentifierByExternalId(TypedDict):
+    resource_external_id: str
+    resource_type_slug: str
+
+
+ResourceIdentifier = Union[ResourceIdentifierById, ResourceIdentifierByExternalId]

src/workos/types/authorization/role_assignment.py

@@ -0,0 +1,22 @@
+from typing import Literal
+
+from workos.types.workos_model import WorkOSModel
+
+
+class RoleAssignmentRole(WorkOSModel):
+    slug: str
+
+
+class RoleAssignmentResource(WorkOSModel):
+    id: str
+    external_id: str
+    resource_type_slug: str
+
+
+class RoleAssignment(WorkOSModel):
+    object: Literal["role_assignment"]
+    id: str
+    role: RoleAssignmentRole
+    resource: RoleAssignmentResource
+    created_at: str
+    updated_at: str

src/workos/types/list_resource.py

@@ -19,7 +19,12 @@
 from typing_extensions import Required, TypedDict
 from workos.types.api_keys import ApiKey
 from workos.types.audit_logs import AuditLogAction, AuditLogSchema
+from workos.types.authorization.organization_membership import (
+    AuthorizationOrganizationMembership,
+)
 from workos.types.authorization.permission import Permission
+from workos.types.authorization.authorization_resource import AuthorizationResource
+from workos.types.authorization.role_assignment import RoleAssignment
 from workos.types.directory_sync import (
     Directory,
     DirectoryGroup,
@@ -28,9 +33,9 @@
 from workos.types.events import Event
 from workos.types.feature_flags import FeatureFlag
 from workos.types.fga import (
-    Warrant,
-    AuthorizationResource,
+    AuthorizationResource as FGAAuthorizationResource,
     AuthorizationResourceType,
+    Warrant,
     WarrantQueryResult,
 )
 from workos.types.mfa import AuthenticationFactor
@@ -60,6 +65,9 @@
     OrganizationMembership,
     Permission,
     AuthorizationResource,
+    RoleAssignment,
+    AuthorizationOrganizationMembership,
+    FGAAuthorizationResource,
     AuthorizationResourceType,
     User,
     UserManagementSession,

src/workos/types/user_management/organization_membership.py

@@ -8,20 +8,23 @@
 OrganizationMembershipStatus = Literal["active", "inactive", "pending"]
 
 
+class BaseOrganizationMembership(WorkOSModel):
+    object: Literal["organization_membership"]
+    id: str
+    user_id: str
+    organization_id: str
+    status: LiteralOrUntyped[OrganizationMembershipStatus]
+    created_at: str
+    updated_at: str
+
+
 class OrganizationMembershipRole(TypedDict):
     slug: str
 
 
-class OrganizationMembership(WorkOSModel):
+class OrganizationMembership(BaseOrganizationMembership):
     """Representation of an WorkOS Organization Membership."""
 
-    object: Literal["organization_membership"]
-    id: str
-    user_id: str
-    organization_id: str
     role: OrganizationMembershipRole
     roles: Optional[Sequence[OrganizationMembershipRole]] = None
-    status: LiteralOrUntyped[OrganizationMembershipStatus]
     custom_attributes: Mapping[str, Any] = {}
-    created_at: str
-    updated_at: str

src/workos/utils/_base_http_client.py

@@ -123,6 +123,8 @@ def _prepare_request(
         json: JsonType = None,
         headers: HeadersType = None,
         exclude_default_auth_headers: bool = False,
+        force_include_body: bool = False,
+        exclude_none: bool = True,
     ) -> PreparedRequest:
         """Executes a request against the WorkOS API.
 
@@ -133,8 +135,9 @@ def _prepare_request(
             method Optional[str]: One of the supported methods as defined by the REQUEST_METHOD_X constants
             params Optional[dict]: Query params or body payload to be added to the request
             headers Optional[dict]: Custom headers to be added to the request
-            token Optional[str]: Bearer token
-
+            exclude_default_auth_headers (bool): If True, excludes default auth headers from the request
+            force_include_body (bool): If True, allows sending a body in a bodyless request (used for DELETE requests)
+            exclude_none (bool): If True (default), strips keys with None values from the JSON body so only defined fields are sent.
         Returns:
             dict: Response from WorkOS
         """
@@ -149,19 +152,19 @@ def _prepare_request(
             REQUEST_METHOD_GET,
         ]
 
-        if bodyless_http_method and json is not None:
+        if bodyless_http_method and json is not None and not force_include_body:
             raise ValueError(f"Cannot send a body with a {parsed_method} request")
 
         # Remove any parameters that are None
         if params is not None:
             params = {k: v for k, v in params.items() if v is not None}
 
         # Remove any body values that are None
-        if json is not None and isinstance(json, Mapping):
+        if exclude_none and json is not None and isinstance(json, Mapping):
             json = {k: v for k, v in json.items() if v is not None}
 
         # We'll spread these return values onto the HTTP client request method
-        if bodyless_http_method:
+        if bodyless_http_method and not force_include_body:
             return {
                 "method": parsed_method,
                 "url": url,

src/workos/utils/http_client.py

@@ -14,7 +14,7 @@
     ParamsType,
     ResponseJson,
 )
-from workos.utils.request_helper import REQUEST_METHOD_GET
+from workos.utils.request_helper import REQUEST_METHOD_DELETE, REQUEST_METHOD_GET
 
 
 class SyncHttpxClientWrapper(httpx.Client):
@@ -88,6 +88,7 @@ def request(
         json: JsonType = None,
         headers: HeadersType = None,
         exclude_default_auth_headers: bool = False,
+        exclude_none: bool = True,
     ) -> ResponseJson:
         """Executes a request against the WorkOS API.
 
@@ -98,6 +99,7 @@ def request(
             method (str): One of the supported methods as defined by the REQUEST_METHOD_X constants
             params (ParamsType): Query params to be added to the request
             json (JsonType): Body payload to be added to the request
+            exclude_none (bool): If True, removes None values from the JSON body
 
         Returns:
             ResponseJson: Response from WorkOS
@@ -109,6 +111,28 @@ def request(
             json=json,
             headers=headers,
             exclude_default_auth_headers=exclude_default_auth_headers,
+            exclude_none=exclude_none,
+        )
+        response = self._client.request(**prepared_request_parameters)
+        return self._handle_response(response)
+
+    def delete_with_body(
+        self,
+        path: str,
+        json: JsonType = None,
+        params: ParamsType = None,
+        headers: HeadersType = None,
+        exclude_default_auth_headers: bool = False,
+    ) -> ResponseJson:
+        """Executes a DELETE request with a JSON body against the WorkOS API."""
+        prepared_request_parameters = self._prepare_request(
+            path=path,
+            method=REQUEST_METHOD_DELETE,
+            json=json,
+            params=params,
+            headers=headers,
+            exclude_default_auth_headers=exclude_default_auth_headers,
+            force_include_body=True,
         )
         response = self._client.request(**prepared_request_parameters)
         return self._handle_response(response)
@@ -185,6 +209,7 @@ async def request(
         json: JsonType = None,
         headers: HeadersType = None,
         exclude_default_auth_headers: bool = False,
+        exclude_none: bool = True,
     ) -> ResponseJson:
         """Executes a request against the WorkOS API.
 
@@ -195,6 +220,7 @@ async def request(
             method (str): One of the supported methods as defined by the REQUEST_METHOD_X constants
             params (ParamsType): Query params to be added to the request
             json (JsonType): Body payload to be added to the request
+            exclude_none (bool): If True, removes None values from the JSON body
 
         Returns:
             ResponseJson: Response from WorkOS
@@ -206,6 +232,28 @@ async def request(
             json=json,
             headers=headers,
             exclude_default_auth_headers=exclude_default_auth_headers,
+            exclude_none=exclude_none,
+        )
+        response = await self._client.request(**prepared_request_parameters)
+        return self._handle_response(response)
+
+    async def delete_with_body(
+        self,
+        path: str,
+        json: JsonType = None,
+        params: ParamsType = None,
+        headers: HeadersType = None,
+        exclude_default_auth_headers: bool = False,
+    ) -> ResponseJson:
+        """Executes a DELETE request with a JSON body against the WorkOS API."""
+        prepared_request_parameters = self._prepare_request(
+            path=path,
+            method=REQUEST_METHOD_DELETE,
+            json=json,
+            params=params,
+            headers=headers,
+            exclude_default_auth_headers=exclude_default_auth_headers,
+            force_include_body=True,
         )
         response = await self._client.request(**prepared_request_parameters)
         return self._handle_response(response)

tests/test_async_http_client.py

@@ -313,6 +313,7 @@ async def test_request_removes_none_parameter_values(
             method="get",
             params={"organization_id": None, "test": "value"},
         )
+
         assert request_kwargs["params"] == {"test": "value"}
 
     async def test_request_removes_none_json_values(
@@ -325,4 +326,43 @@ async def test_request_removes_none_json_values(
             method="post",
             json={"organization_id": None, "test": "value"},
         )
+
+        assert request_kwargs["url"].endswith("/test")
         assert request_kwargs["json"] == {"test": "value"}
+
+    async def test_delete_with_body_sends_json(
+        self, capture_and_mock_http_client_request
+    ):
+        request_kwargs = capture_and_mock_http_client_request(self.http_client, {}, 200)
+
+        await self.http_client.delete_with_body(
+            path="/test",
+            json={"obj": "json"},
+        )
+
+        assert request_kwargs["method"] == "delete"
+        assert request_kwargs["json"] == {"obj": "json"}
+
+    async def test_delete_with_body_sends_params(
+        self, capture_and_mock_http_client_request
+    ):
+        request_kwargs = capture_and_mock_http_client_request(self.http_client, {}, 200)
+
+        await self.http_client.delete_with_body(
+            path="/test",
+            json={"obj1": "json"},
+            params={"obj2": "params"},
+        )
+
+        assert request_kwargs["json"] == {"obj1": "json"}
+        assert request_kwargs["params"] == {"obj2": "params"}
+
+    async def test_delete_without_body_raises_value_error(self):
+        with pytest.raises(
+            ValueError, match="Cannot send a body with a delete request"
+        ):
+            await self.http_client.request(
+                path="/test",
+                method="delete",
+                json={"should": "fail"},
+            )