FGA_BASE: adding base types and module registraiton by swaroopAkkineniWorkos · Pull Request #556 · workos/workos-python

swaroopAkkineniWorkos · 2026-02-19T19:02:30Z

Description

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

linear · 2026-02-19T19:02:34Z

ENT-5224 Update Python sdk for fga

swaroopAkkineniWorkos · 2026-02-21T20:39:46Z

@greptile review

greptile-apps · 2026-02-21T20:43:30Z

Greptile Summary

Added foundational types and HTTP client support for the FGA (Fine-Grained Authorization) base module. This PR introduces four new authorization type models (Resource, RoleAssignment, AccessEvaluation, and AuthorizationOrganizationMembership) that properly integrate with the existing type system. The PR also refactored OrganizationMembershipStatus into a shared file to avoid duplication between user management and authorization modules.

Key changes:

Added new authorization type models with proper Pydantic validation
Implemented delete_with_body() method for both sync and async HTTP clients to support DELETE requests with JSON payloads
Added comprehensive test coverage for all new types and HTTP client methods
Properly registered new types in the ListableResource TypeVar for pagination support

Confidence Score: 5/5

Safe to merge with no issues identified
All changes are well-structured type definitions and HTTP client enhancements with comprehensive test coverage. No security concerns, proper type safety, and follows existing patterns in the codebase
No files require special attention

Important Files Changed

Filename	Overview
src/workos/types/authorization/access_evaluation.py	Added AccessEvaluation model with authorized boolean field
src/workos/types/authorization/organization_membership.py	Added AuthorizationOrganizationMembership model that imports shared OrganizationMembershipStatus type
src/workos/types/authorization/resource.py	Added Resource model for authorization resources with proper optional fields
src/workos/types/authorization/role_assignment.py	Added RoleAssignment model with nested RoleAssignmentRole and RoleAssignmentResource models
src/workos/types/user_management/organization_membership_status.py	Created new file with shared OrganizationMembershipStatus type definition
src/workos/utils/_base_http_client.py	Added force_include_body parameter to support DELETE requests with JSON body
src/workos/utils/http_client.py	Added delete_with_body method to both sync and async HTTP clients

Class Diagram

%%{init: {'theme': 'neutral'}}%%
classDiagram
    class WorkOSModel {
        <<BaseModel>>
    }
    
    class Resource {
        +string object
        +string id
        +string external_id
        +string name
        +Optional~string~ description
        +string resource_type_slug
        +string organization_id
        +Optional~string~ parent_resource_id
        +string created_at
        +string updated_at
    }
    
    class RoleAssignment {
        +string object
        +string id
        +RoleAssignmentRole role
        +RoleAssignmentResource resource
        +string created_at
        +string updated_at
    }
    
    class RoleAssignmentRole {
        +string slug
    }
    
    class RoleAssignmentResource {
        +string id
        +string external_id
        +string resource_type_slug
    }
    
    class AccessEvaluation {
        +bool authorized
    }
    
    class AuthorizationOrganizationMembership {
        +string object
        +string id
        +string user_id
        +string organization_id
        +string organization_name
        +OrganizationMembershipStatus status
        +Optional~Mapping~ custom_attributes
        +string created_at
        +string updated_at
    }
    
    WorkOSModel <|-- Resource
    WorkOSModel <|-- RoleAssignment
    WorkOSModel <|-- RoleAssignmentRole
    WorkOSModel <|-- RoleAssignmentResource
    WorkOSModel <|-- AccessEvaluation
    WorkOSModel <|-- AuthorizationOrganizationMembership
    
    RoleAssignment --> RoleAssignmentRole
    RoleAssignment --> RoleAssignmentResource

_{Last reviewed commit: a5823c6}

greptile-apps

_{13 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-21T20:43:34Z

src/workos/types/authorization/organization_membership.py

+from workos.types.workos_model import WorkOSModel
+from workos.typing.literals import LiteralOrUntyped
+
+OrganizationMembershipStatus = Literal["active", "inactive", "pending"]


Duplicated OrganizationMembershipStatus literal

This exact same Literal["active", "inactive", "pending"] type alias is already defined in src/workos/types/user_management/organization_membership.py:7. Consider importing from a shared location or re-exporting from one module to the other to avoid the definitions drifting apart over time.

Just pushed up a change where I moved "OrganizationMembershipStatus" to it's own file to be imported

greptile-apps

_{17 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

swaroopAkkineniWorkos · 2026-02-24T20:49:03Z

Change branch name before merging

csrbarber · 2026-02-24T21:17:03Z

src/workos/utils/_base_http_client.py

        headers: HeadersType = None,
        exclude_default_auth_headers: bool = False,
+        force_include_body: bool = False,
+        exclude_none: bool = True,


Should we add docstring for this argument?

src/workos/authorization.py

csrbarber · 2026-02-24T21:28:50Z

src/workos/authorization.py

+        if cascade_delete is not None:
+            await self._http_client.delete_with_body(
+                f"{AUTHORIZATION_RESOURCES_PATH}/{resource_id}",
+                json={"cascade_delete": cascade_delete},


This adds cascade_delete to the body, but I believe it should be passed as a query param instead. Which is what delete_resource_by_external_id does here

csrbarber · 2026-02-24T21:37:33Z

src/workos/authorization.py

+        if description is not None:
+            json["description"] = description


Does description here need the same treatment as in update_resource?

csrbarber · 2026-02-24T21:41:47Z

tests/test_authorization_resource_crud.py

+
+    # --- create_resource ---
+
+    def test_create_resource_required_fields_only(


Should we update this test since parent isn't a required field?

csrbarber · 2026-02-24T21:58:24Z

src/workos/types/authorization/organization_membership.py

+    id: str
+    user_id: str
+    organization_id: str
+    organization_name: str


It looks like we don't include organization_name in the responses where this gets used. For instance listOrganizationMembershipsForResource calls serializeBase, which doesn't include organization_name.

atainter · 2026-02-25T17:44:50Z

src/workos/types/authorization/access_evaluation.py

+from workos.types.workos_model import WorkOSModel
+
+
+class AccessEvaluation(WorkOSModel):


Why not just call this a CheckResponse?

atainter · 2026-02-25T17:47:32Z

src/workos/types/authorization/organization_membership.py

+from workos.typing.literals import LiteralOrUntyped
+
+
+class AuthorizationOrganizationMembership(WorkOSModel):


Is there a type in the organization memberships package that we can reuse?

For instance create a base type like we did for the node package

atainter · 2026-02-25T17:48:17Z

src/workos/types/authorization/organization_membership.py

+    organization_id: str
+    organization_name: str
+    status: LiteralOrUntyped[OrganizationMembershipStatus]
+    custom_attributes: Optional[Mapping[str, Any]] = None


authz doesn't return custom attributes

i included it because it's on the UserlandUserOrganizationMembershipBase object that gets returned here https://github.com/workos/workos/blob/61dd6210464228608b3f0013993ed6279051fa73/packages/api/src/authorization-resources/authorization-resources.controller.ts#L432

will remove

atainter · 2026-02-25T17:49:14Z

src/workos/types/user_management/organization_membership_status.py

@@ -0,0 +1,3 @@
+from typing import Literal
+
+OrganizationMembershipStatus = Literal["active", "inactive", "pending"]


It's risky to duplicate this if it already exists in another package. Could drift from the other types.

I actually broke it out out organization_membership.py into it's own file so it could be imported as the single source of truth

atainter · 2026-02-25T17:51:11Z

src/workos/authorization.py

+        if cascade_delete is not None:
+            self._http_client.delete_with_body(
+                f"{AUTHORIZATION_RESOURCES_PATH}/{resource_id}",
+                json={"cascade_delete": cascade_delete},


Could be wrong, but isn't this a url param?

adding base types and module registraiton

ab35617

swaroopAkkineniWorkos added 3 commits February 19, 2026 11:00

moar

5f6892d

lol

0bc40fb

lol

526eb7d

swaroopAkkineniWorkos changed the title ~~adding base types and module registraiton~~ FGA_BASE: adding base types and module registraiton Feb 20, 2026

greptile-apps bot reviewed Feb 21, 2026

View reviewed changes

swaroopAkkineniWorkos added 3 commits February 23, 2026 04:38

nits for re-dupe OrganizationMembershipStatus

13dad51

Format

ff239c7

adding AUTHORIZATION_RESOURCES_PATH to base

a5823c6

swaroopAkkineniWorkos marked this pull request as ready for review February 23, 2026 17:52

swaroopAkkineniWorkos requested a review from a team as a code owner February 23, 2026 17:52

swaroopAkkineniWorkos requested review from atainter, csrbarber and tribble February 23, 2026 17:52

greptile-apps bot reviewed Feb 23, 2026

View reviewed changes

FGA_1: create/delete/get/update resource (#563)

8dd434f

FGA_2: listResources(), get/update/delete resource_by_external_id (#569)

fe59018

csrbarber reviewed Feb 24, 2026

View reviewed changes

FGA_3: check() (#568)

a50f5d5

csrbarber reviewed Feb 24, 2026

View reviewed changes

src/workos/authorization.py Show resolved Hide resolved

csrbarber reviewed Feb 24, 2026

View reviewed changes

swaroopAkkineniWorkos added 2 commits February 24, 2026 12:52

remove organization_name for list

3eca552

casade

fa170f0

lol

035f1c3

csrbarber mentioned this pull request Feb 25, 2026

FGA_5: list_resources_for_membership, list_memberships_for_resource, list_memberships_for_resource_by_external_id #571

Open

atainter reviewed Feb 25, 2026

View reviewed changes

swaroopAkkineniWorkos added 7 commits February 25, 2026 10:49

moar

8fbbc5f

Create

7342ad4

test update

3f25161

break outp

dfca291

lol

5f72f0d

moar

a7c6d28

moar

0111cde

		if description is not None:
		json["description"] = description


		# --- create_resource ---

		def test_create_resource_required_fields_only(

		from workos.types.workos_model import WorkOSModel


		class AccessEvaluation(WorkOSModel):

		from workos.typing.literals import LiteralOrUntyped


		class AuthorizationOrganizationMembership(WorkOSModel):

		@@ -0,0 +1,3 @@
		from typing import Literal

		OrganizationMembershipStatus = Literal["active", "inactive", "pending"]

Conversation

swaroopAkkineniWorkos commented Feb 19, 2026

Description

Documentation

Uh oh!

linear bot commented Feb 19, 2026

Uh oh!

swaroopAkkineniWorkos commented Feb 21, 2026

Uh oh!

greptile-apps bot commented Feb 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Class Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos commented Feb 24, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

greptile-apps bot commented Feb 21, 2026 •

edited

Loading