fix: replace parameter-group hashes with typed variant classes

[gjtorikian]

Summary

Fixes a TypeError: no implicit conversion of Symbol into Integer that any caller hits when passing password: to UserManagement#create_user or #update_user. The generated method advertised password: as a flat String kwarg and ran a hash dispatcher (password[:type]) on it. The String/Hash collision was a fluke of the spec — password happens to be both the group name and one of its variant leaf params — but it bypassed the SDK before the request reached the wire.

Each x-mutually-exclusive-(body|parameter)-groups group now emits a typed variant class per variant under lib/workos/, with matching Sorbet sigs in rbi/workos/. Method signatures take T.any(VariantA, VariantB) and dispatch on class identity instead of a :type symbol. This brings the Ruby SDK in line with how Python, Kotlin, .NET, and PHP already expose these groups.

Breaking changes

Callers that passed a hash with a :type discriminator must instantiate the variant class:

# Before
client.user_management.create_user(
  email: "…",
  password: { type: "plaintext", password: "hunter2" },
)
client.authorization.check(
  organization_membership_id: "om_x", permission_slug: "p",
  resource_target: { type: "by_id", resource_id: "r_1" },
)

# After
client.user_management.create_user(
  email: "…",
  password: WorkOS::PasswordPlaintext.new(password: "hunter2"),
)
client.authorization.check(
  organization_membership_id: "om_x", permission_slug: "p",
  resource_target: WorkOS::ResourceTargetById.new(resource_id: "r_1"),
)

Callers that passed variant leaf params as flat kwargs (e.g. resource_id:, parent_resource_id:, password_hash:) must move them into the variant constructor. Those kwargs were silent dead weight for required groups, and let optional-group calls violate the spec's mutual-exclusivity contract.

Generated changes

• 16 new files under lib/workos/ and rbi/workos/ for the eight variant classes (PasswordPlaintext, PasswordHashed, ResourceTargetById, ResourceTargetByExternalId, ParentResourceById, ParentResourceByExternalId, ParentById, ParentByExternalId, RoleSingle, RoleMultiple).
• Dispatchers in lib/workos/{user_management,authorization}.rb rewritten to case prop when WorkOS::VariantClass.
• .rbi sigs use T.any(...) instead of the previous T::Hash[Symbol, T.untyped].
• test/workos/test_authorization.rb regenerated to call the variant constructors.

The corresponding emitter changes live in oagen-emitters (separate PR).

Test plan

• bundle exec rake test — 858 runs / 4383 assertions / 0 failures
• Sorbet typecheck under the gem set used in CI
• Confirm Mentimeter's reproducer no longer raises after upgrading

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR replaces hash-based discriminated union parameters (e.g. password: { type: "plaintext", password: "hunter2" }) with typed Data.define variant classes across UserManagement and Authorization, fixing a real TypeError hit when callers passed a String to password:. Sixteen new variant classes are emitted (PasswordPlaintext, PasswordHashed, RoleSingle, RoleMultiple, plus six authorization resource/parent variants), with matching Sorbet rbi types using T.any(...). The previously-flagged P1 — update_organization_membership sending a PUT with no body — is correctly fixed in this revision (body: body is now passed to @client.request).

Confidence Score: 5/5

Safe to merge — the core TypeError fix is correct, all variant dispatch paths are well-tested, and the previously-flagged body-missing P1 in update_organization_membership is resolved in this revision.

No P0 or P1 findings remain in the HEAD code. The previously noted update_organization_membership body-drop bug is fixed. All case statements have an else guard that raises ArgumentError. Sorbet sigs are consistent with the Ruby implementations. Tests cover both variants for every new parameter group.

No files require special attention.

Important Files Changed

Filename	Overview
lib/workos/user_management.rb	Replaces flat password:, password_hash:, password_hash_type:, role_slug:, and role_slugs: kwargs with typed PasswordPlaintext, PasswordHashed, RoleSingle, and RoleMultiple Data classes; update_organization_membership correctly passes body: body to the PUT request.
lib/workos/authorization.rb	Six new variant classes added for resource-target and parent-resource groups; all dispatch branches cover both variants and raise ArgumentError on unknown types; remove_role correctly places resource fields in query params while assign_role uses the body.
rbi/workos/user_management.rbi	Sorbet sigs updated to T.any(PasswordPlaintext, PasswordHashed) and T.nilable(T.any(RoleSingle, RoleMultiple)); getter sigs for password are correctly non-nilable (String) at the type level.
rbi/workos/authorization.rbi	All six inner variant classes added with correct sig blocks; optional parent_resource: and parent: are T.nilable(T.any(...)), required parent_resource: and resource_target: are non-nilable — consistent with the Ruby implementation.
test/workos/test_user_management.rb	Tests now instantiate variant classes and verify the exact body fields sent for each variant, covering both PasswordPlaintext/PasswordHashed and RoleSingle/RoleMultiple for create and update paths.
test/workos/test_authorization.rb	Regenerated to pass typed variant instances; adds second-variant tests for all eight groups and uses hash_including body assertions.

Class Diagram

%%{init: {'theme': 'neutral'}}%%
classDiagram
    class PasswordPlaintext {
        +String password
    }
    class PasswordHashed {
        +String password_hash
        +String password_hash_type
    }
    class RoleSingle {
        +String role_slug
    }
    class RoleMultiple {
        +Array~String~ role_slugs
    }
    class ResourceTargetById {
        +String resource_id
    }
    class ResourceTargetByExternalId {
        +String resource_external_id
        +String resource_type_slug
    }
    class ParentResourceById {
        +String parent_resource_id
    }
    class ParentResourceByExternalId {
        +String parent_resource_type_slug
        +String parent_resource_external_id
    }
    class ParentById {
        +String parent_resource_id
    }
    class ParentByExternalId {
        +String parent_resource_type_slug
        +String parent_external_id
    }

Loading

_{Reviews (6): Last reviewed commit: "fix(ruby): regenerate test stubs with re..." | Re-trigger Greptile}

[gjtorikian]

@greptile review

[gjtorikian]

@greptile review