feat: update authorization module for fga

[swaroopAkkineniWorkos]

adding in new fga api's

getResource() - GET /authorization/resources/{resource_id}
createResource() - POST /authorization/resources
updateResource() - PATCH /authorization/resources/{resource_id}
deleteResource() - DELETE /authorization/resources/{resource_id}
listResources() - GET /authorization/resources?organization_id={org_id}

check() - POST /authorization/organization_memberships/{om_id}/check

getResourceByExternalId() - GET /authorization/organizations/{org_id}/resources/{type}/{external_id}
updateResourceByExternalId() - PATCH /authorization/organizations/{org_id}/resources/{type}/{external_id}
deleteResourceByExternalId() - DELETE /authorization/organizations/{org_id}/resources/{type}/{external_id}

listRoleAssignments() - GET /authorization/organization_memberships/{om_id}/role_assignments
assignRole() - POST /authorization/organization_memberships/{om_id}/role_assignments
removeRole() - DELETE /authorization/organization_memberships/{om_id}/role_assignments
removeRoleAssignment() - DELETE /authorization/organization_memberships/{om_id}/role_assignments/{ra_id}

listResourcesForMembership() - GET /authorization/organization_memberships/{om_id}/resources
listMembershipsForResource() - GET /authorization/resources/{resource_id}/organization_memberships
listMembershipsForResourceByExternalId() - GET /authorization/organizations/{org_id}/resources/{type}/{external_id}/organization_memberships

Corresponding stacked pr that were approved:
#556
#563
#569
#568
#570
#571

[linear]

ENT-5224 Update Python sdk for fga

[swaroopAkkineniWorkos]

@greptile re-review plz

[greptile-apps]

Greptile Summary

This PR adds 15 new FGA (Fine-Grained Authorization) API methods to the Authorization module, covering full CRUD for resources, access checks, role assignment management, and membership listing — in both sync (Authorization) and async (AsyncAuthorization) variants. It also introduces a delete_with_body helper and an exclude_none flag to the HTTP client layer to support the PATCH and DELETE-with-body semantics required by the new endpoints.

Key changes:

• New API methods: get_resource, create_resource, update_resource, delete_resource, list_resources, get/update/delete_resource_by_external_id, check, assign_role, remove_role, remove_role_assignment, list_role_assignments, list_resources_for_membership, list_memberships_for_resource, list_memberships_for_resource_by_external_id
• HTTP client: delete_with_body enables DELETE requests with a JSON body (used by remove_role); exclude_none=False allows explicit null values in PATCH payloads (used for clearing a resource description)
• Type system: New models AuthorizationResource, RoleAssignment, AccessCheckResponse, ResourceIdentifier, ParentResourceIdentifier; OrganizationMembership refactored to inherit from a new BaseOrganizationMembership for reuse in the authorization context
• FGAModule deprecation: Marked with a plain comment pointing to the new Authorization module — consider upgrading to a docstring or DeprecationWarning for better visibility
• Private _Unset in Protocol: The sentinel type _Unset is private but appears in the public AuthorizationModule Protocol signatures, making it difficult for consumers to fully type-annotate usage
• Pagination inconsistency: list_role_assignments stores organization_membership_id in list_params (working correctly but different from the partial-based approach used by every other new paginated method)
• Test coverage is thorough across sync/async paths for all new endpoints

Confidence Score: 4/5

• Safe to merge — no functional bugs found. Issues are limited to API design style concerns and deprecation visibility.
• The implementation is logically correct across all 15 new methods in both sync and async variants. Pagination works correctly for all new list methods, the HTTP client changes are backward compatible, and the type refactor for OrganizationMembership is non-breaking. The score is 4 rather than 5 due to three style issues: the private _Unset type leaking into the public Protocol signature, the inconsistent pagination pattern in list_role_assignments (using dict storage instead of partial), and the plain-comment deprecation for FGAModule which won't be surfaced to users. None of these cause a runtime bug but all affect long-term maintainability, API consistency, and end-user experience.
• Primary attention on src/workos/authorization.py for the three style issues: _Unset type exposure, list_role_assignments pagination pattern inconsistency, and FGAModule deprecation visibility in src/workos/fga.py.

_{Last reviewed commit: 2c1e44a}

[greptile-apps]

Deprecation notice is a plain comment, not visible to IDEs

The deprecation for FGAModule is expressed as a plain # comment at line 56:

# Deprecated: Use the Authorization module instead.
class FGAModule(Protocol):

IDEs, linters, and static analysis tools will not surface this notice when callers use this class. Consider upgrading to a docstring-based deprecation or DeprecationWarning so downstream consumers receive clear visibility:

class FGAModule(Protocol):
    """
    .. deprecated::
        Use :class:`workos.authorization.AuthorizationModule` instead.
    """

Or, for runtime warnings on instantiation, add a deprecation handler in a __init_subclass__ hook.