authorization.go

// Code generated by oagen. DO NOT EDIT.

package workos

import (
	"context"
	"encoding/json"
	"fmt"
	"net/url"
)

// AuthorizationService handles Authorization operations.
type AuthorizationService struct {
	client *Client
}

// AuthorizationResourceTarget is one of:
//   - AuthorizationResourceTargetByID
//   - AuthorizationResourceTargetByExternalID
type AuthorizationResourceTarget interface {
	isAuthorizationResourceTarget()
	applyToBody(map[string]any)
}

type AuthorizationResourceTargetByID struct {
	ResourceID string
}

func (p AuthorizationResourceTargetByID) isAuthorizationResourceTarget() {}
func (p AuthorizationResourceTargetByID) applyToBody(m map[string]any) {
	m["resource_id"] = p.ResourceID
}

type AuthorizationResourceTargetByExternalID struct {
	ResourceExternalID string
	ResourceTypeSlug   string
}

func (p AuthorizationResourceTargetByExternalID) isAuthorizationResourceTarget() {}
func (p AuthorizationResourceTargetByExternalID) applyToBody(m map[string]any) {
	m["resource_external_id"] = p.ResourceExternalID
	m["resource_type_slug"] = p.ResourceTypeSlug
}

// AuthorizationParentResource is one of:
//   - AuthorizationParentResourceByID
//   - AuthorizationParentResourceByExternalID
type AuthorizationParentResource interface {
	isAuthorizationParentResource()
	applyToQuery(url.Values)
	applyToBody(map[string]any)
}

type AuthorizationParentResourceByID struct {
	ID string
}

func (p AuthorizationParentResourceByID) isAuthorizationParentResource() {}
func (p AuthorizationParentResourceByID) applyToQuery(v url.Values) {
	v.Set("parent_resource_id", p.ID)
}
func (p AuthorizationParentResourceByID) applyToBody(m map[string]any) {
	m["parent_resource_id"] = p.ID
}

type AuthorizationParentResourceByExternalID struct {
	TypeSlug   string
	ExternalID string
}

func (p AuthorizationParentResourceByExternalID) isAuthorizationParentResource() {}
func (p AuthorizationParentResourceByExternalID) applyToQuery(v url.Values) {
	v.Set("parent_resource_type_slug", p.TypeSlug)
	v.Set("parent_resource_external_id", p.ExternalID)
}
func (p AuthorizationParentResourceByExternalID) applyToBody(m map[string]any) {
	m["parent_resource_type_slug"] = p.TypeSlug
	m["parent_resource_external_id"] = p.ExternalID
}

// AuthorizationParent is one of:
//   - AuthorizationParentByID
//   - AuthorizationParentByExternalID
type AuthorizationParent interface {
	isAuthorizationParent()
	applyToQuery(url.Values)
}

type AuthorizationParentByID struct {
	ResourceID string
}

func (p AuthorizationParentByID) isAuthorizationParent() {}
func (p AuthorizationParentByID) applyToQuery(v url.Values) {
	v.Set("parent_resource_id", p.ResourceID)
}

type AuthorizationParentByExternalID struct {
	ResourceTypeSlug string
	ExternalID       string
}

func (p AuthorizationParentByExternalID) isAuthorizationParent() {}
func (p AuthorizationParentByExternalID) applyToQuery(v url.Values) {
	v.Set("parent_resource_type_slug", p.ResourceTypeSlug)
	v.Set("parent_external_id", p.ExternalID)
}

// AuthorizationCheckParams contains the parameters for Check.
type AuthorizationCheckParams struct {
	// PermissionSlug is the slug of the permission to check.
	PermissionSlug string `json:"permission_slug" url:"-"`
	// ResourceTarget identifies the resource target (required).
	ResourceTarget AuthorizationResourceTarget `url:"-" json:"-"`
}

// MarshalJSON implements json.Marshaler for AuthorizationCheckParams.
func (p AuthorizationCheckParams) MarshalJSON() ([]byte, error) {
	type Alias AuthorizationCheckParams
	data, err := json.Marshal(Alias(p))
	if err != nil {
		return nil, err
	}
	if p.ResourceTarget == nil {
		return data, nil
	}
	var m map[string]any
	if err := json.Unmarshal(data, &m); err != nil {
		return nil, err
	}
	if p.ResourceTarget != nil {
		p.ResourceTarget.applyToBody(m)
	}
	return json.Marshal(m)
}

// Check authorization
// Check if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug.
func (s *AuthorizationService) Check(ctx context.Context, organizationMembershipID string, params *AuthorizationCheckParams, opts ...RequestOption) (*AuthorizationCheck, error) {
	var result AuthorizationCheck
	_, err := s.client.request(ctx, "POST", fmt.Sprintf("/authorization/organization_memberships/%s/check", url.PathEscape(organizationMembershipID)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationListResourcesForMembershipParams contains the parameters for ListResourcesForMembership.
type AuthorizationListResourcesForMembershipParams struct {
	PaginationParams
	// PermissionSlug is the permission slug to filter by. Only child resources where the organization membership has this permission are returned.
	PermissionSlug string `url:"permission_slug" json:"-"`
	// ParentResource identifies the parent resource (required).
	ParentResource AuthorizationParentResource `url:"-" json:"-"`
}

// ListResourcesForMembership list resources for organization membership
// Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects can this user access in this workspace?"
// You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource.
func (s *AuthorizationService) ListResourcesForMembership(ctx context.Context, organizationMembershipID string, params *AuthorizationListResourcesForMembershipParams, opts ...RequestOption) *Iterator[AuthorizationResource] {
	query := url.Values{}
	if params.Before != nil {
		query.Set("before", *params.Before)
	}
	if params.After != nil {
		query.Set("after", *params.After)
	}
	if params.Limit != nil {
		query.Set("limit", fmt.Sprintf("%v", *params.Limit))
	}
	if params.Order != nil {
		query.Set("order", fmt.Sprintf("%v", *params.Order))
	}
	query.Set("permission_slug", params.PermissionSlug)
	if params.ParentResource != nil {
		params.ParentResource.applyToQuery(query)
	}
	return newIterator[AuthorizationResource](ctx, s.client, "GET", fmt.Sprintf("/authorization/organization_memberships/%s/resources", url.PathEscape(organizationMembershipID)), query, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationListEffectivePermissionsParams contains the parameters for ListEffectivePermissions.
type AuthorizationListEffectivePermissionsParams struct {
	PaginationParams
}

// ListEffectivePermissions for an organization membership on a resource
// Returns all permissions the organization membership effectively has on a resource, including permissions inherited through roles assigned to ancestor resources.
func (s *AuthorizationService) ListEffectivePermissions(ctx context.Context, organizationMembershipID string, resourceID string, params *AuthorizationListEffectivePermissionsParams, opts ...RequestOption) *Iterator[AuthorizationPermission] {
	return newIterator[AuthorizationPermission](ctx, s.client, "GET", fmt.Sprintf("/authorization/organization_memberships/%s/resources/%s/permissions", url.PathEscape(organizationMembershipID), url.PathEscape(resourceID)), params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationListEffectivePermissionsByExternalIDParams contains the parameters for ListEffectivePermissionsByExternalID.
type AuthorizationListEffectivePermissionsByExternalIDParams struct {
	PaginationParams
}

// ListEffectivePermissionsByExternalID list effective permissions for an organization membership on a resource by external ID
// Returns all permissions the organization membership effectively has on a resource identified by its external ID, including permissions inherited through roles assigned to ancestor resources.
func (s *AuthorizationService) ListEffectivePermissionsByExternalID(ctx context.Context, organizationMembershipID string, resourceTypeSlug string, externalID string, params *AuthorizationListEffectivePermissionsByExternalIDParams, opts ...RequestOption) *Iterator[AuthorizationPermission] {
	return newIterator[AuthorizationPermission](ctx, s.client, "GET", fmt.Sprintf("/authorization/organization_memberships/%s/resources/%s/%s/permissions", url.PathEscape(organizationMembershipID), url.PathEscape(resourceTypeSlug), url.PathEscape(externalID)), params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationListRoleAssignmentsParams contains the parameters for ListRoleAssignments.
type AuthorizationListRoleAssignmentsParams struct {
	PaginationParams
}

// ListRoleAssignments
// List all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource roles.
func (s *AuthorizationService) ListRoleAssignments(ctx context.Context, organizationMembershipID string, params *AuthorizationListRoleAssignmentsParams, opts ...RequestOption) *Iterator[UserRoleAssignment] {
	return newIterator[UserRoleAssignment](ctx, s.client, "GET", fmt.Sprintf("/authorization/organization_memberships/%s/role_assignments", url.PathEscape(organizationMembershipID)), params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationAssignRoleParams contains the parameters for AssignRole.
type AuthorizationAssignRoleParams struct {
	// RoleSlug is the slug of the role to assign.
	RoleSlug string `json:"role_slug" url:"-"`
	// ResourceTarget identifies the resource target (required).
	ResourceTarget AuthorizationResourceTarget `url:"-" json:"-"`
}

// MarshalJSON implements json.Marshaler for AuthorizationAssignRoleParams.
func (p AuthorizationAssignRoleParams) MarshalJSON() ([]byte, error) {
	type Alias AuthorizationAssignRoleParams
	data, err := json.Marshal(Alias(p))
	if err != nil {
		return nil, err
	}
	if p.ResourceTarget == nil {
		return data, nil
	}
	var m map[string]any
	if err := json.Unmarshal(data, &m); err != nil {
		return nil, err
	}
	if p.ResourceTarget != nil {
		p.ResourceTarget.applyToBody(m)
	}
	return json.Marshal(m)
}

// AssignRole assign a role
// Assign a role to an organization membership on a specific resource.
func (s *AuthorizationService) AssignRole(ctx context.Context, organizationMembershipID string, params *AuthorizationAssignRoleParams, opts ...RequestOption) (*UserRoleAssignment, error) {
	var result UserRoleAssignment
	_, err := s.client.request(ctx, "POST", fmt.Sprintf("/authorization/organization_memberships/%s/role_assignments", url.PathEscape(organizationMembershipID)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationRemoveRoleParams contains the parameters for RemoveRole.
type AuthorizationRemoveRoleParams struct {
	// RoleSlug is the slug of the role to remove.
	RoleSlug string `json:"role_slug" url:"-"`
	// ResourceTarget identifies the resource target (required).
	ResourceTarget AuthorizationResourceTarget `url:"-" json:"-"`
}

// MarshalJSON implements json.Marshaler for AuthorizationRemoveRoleParams.
func (p AuthorizationRemoveRoleParams) MarshalJSON() ([]byte, error) {
	type Alias AuthorizationRemoveRoleParams
	data, err := json.Marshal(Alias(p))
	if err != nil {
		return nil, err
	}
	if p.ResourceTarget == nil {
		return data, nil
	}
	var m map[string]any
	if err := json.Unmarshal(data, &m); err != nil {
		return nil, err
	}
	if p.ResourceTarget != nil {
		p.ResourceTarget.applyToBody(m)
	}
	return json.Marshal(m)
}

// RemoveRole remove a role assignment
// Remove a role assignment by role slug and resource.
func (s *AuthorizationService) RemoveRole(ctx context.Context, organizationMembershipID string, params *AuthorizationRemoveRoleParams, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/authorization/organization_memberships/%s/role_assignments", url.PathEscape(organizationMembershipID)), nil, params, nil, opts)
	return err
}

// RemoveRoleAssignment remove a role assignment by ID
// Remove a role assignment using its ID.
func (s *AuthorizationService) RemoveRoleAssignment(ctx context.Context, organizationMembershipID string, roleAssignmentID string, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/authorization/organization_memberships/%s/role_assignments/%s", url.PathEscape(organizationMembershipID), url.PathEscape(roleAssignmentID)), nil, nil, nil, opts)
	return err
}

// ListOrganizationRoles list custom roles
// Get a list of all roles that apply to an organization. This includes both environment roles and custom roles, returned in priority order.
func (s *AuthorizationService) ListOrganizationRoles(ctx context.Context, organizationID string, opts ...RequestOption) (*RoleList, error) {
	var result RoleList
	_, err := s.client.request(ctx, "GET", fmt.Sprintf("/authorization/organizations/%s/roles", url.PathEscape(organizationID)), nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationCreateOrganizationRoleParams contains the parameters for CreateOrganizationRole.
type AuthorizationCreateOrganizationRoleParams struct {
	// Slug is a unique identifier for the role within the organization. When provided, must begin with 'org-' and contain only lowercase letters, numbers, hyphens, and underscores. When omitted, a slug is auto-generated from the role name and a random suffix.
	Slug *string `json:"slug,omitempty" url:"-"`
	// Name is a descriptive name for the role.
	Name string `json:"name" url:"-"`
	// Description is an optional description of the role's purpose.
	Description *string `json:"description,omitempty" url:"-"`
	// ResourceTypeSlug is the slug of the resource type the role is scoped to.
	ResourceTypeSlug *string `json:"resource_type_slug,omitempty" url:"-"`
}

// CreateOrganizationRole create a custom role
// Create a new custom role for this organization.
func (s *AuthorizationService) CreateOrganizationRole(ctx context.Context, organizationID string, params *AuthorizationCreateOrganizationRoleParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "POST", fmt.Sprintf("/authorization/organizations/%s/roles", url.PathEscape(organizationID)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// GetOrganizationRole get a custom role
// Retrieve a role that applies to an organization by its slug. This can return either an environment role or a custom role.
func (s *AuthorizationService) GetOrganizationRole(ctx context.Context, organizationID string, slug string, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "GET", fmt.Sprintf("/authorization/organizations/%s/roles/%s", url.PathEscape(organizationID), url.PathEscape(slug)), nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationUpdateOrganizationRoleParams contains the parameters for UpdateOrganizationRole.
type AuthorizationUpdateOrganizationRoleParams struct {
	// Name is a descriptive name for the role.
	Name *string `json:"name,omitempty" url:"-"`
	// Description is an optional description of the role's purpose.
	Description *string `json:"description,omitempty" url:"-"`
}

// UpdateOrganizationRole update a custom role
// Update an existing custom role. Only the fields provided in the request body will be updated.
func (s *AuthorizationService) UpdateOrganizationRole(ctx context.Context, organizationID string, slug string, params *AuthorizationUpdateOrganizationRoleParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "PATCH", fmt.Sprintf("/authorization/organizations/%s/roles/%s", url.PathEscape(organizationID), url.PathEscape(slug)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// DeleteOrganizationRole delete a custom role
// Delete an existing custom role.
func (s *AuthorizationService) DeleteOrganizationRole(ctx context.Context, organizationID string, slug string, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/authorization/organizations/%s/roles/%s", url.PathEscape(organizationID), url.PathEscape(slug)), nil, nil, nil, opts)
	return err
}

// AuthorizationAddOrganizationRolePermissionParams contains the parameters for AddOrganizationRolePermission.
type AuthorizationAddOrganizationRolePermissionParams struct {
	// Slug is the slug of the permission to add to the role.
	Slug string `json:"slug" url:"-"`
}

// AddOrganizationRolePermission add a permission to a custom role
// Add a single permission to a custom role. If the permission is already assigned to the role, this operation has no effect.
func (s *AuthorizationService) AddOrganizationRolePermission(ctx context.Context, organizationID string, slug string, params *AuthorizationAddOrganizationRolePermissionParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "POST", fmt.Sprintf("/authorization/organizations/%s/roles/%s/permissions", url.PathEscape(organizationID), url.PathEscape(slug)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationSetOrganizationRolePermissionsParams contains the parameters for SetOrganizationRolePermissions.
type AuthorizationSetOrganizationRolePermissionsParams struct {
	// Permissions is the permission slugs to assign to the role.
	Permissions []string `json:"permissions" url:"-"`
}

// SetOrganizationRolePermissions set permissions for a custom role
// Replace all permissions on a custom role with the provided list.
func (s *AuthorizationService) SetOrganizationRolePermissions(ctx context.Context, organizationID string, slug string, params *AuthorizationSetOrganizationRolePermissionsParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "PUT", fmt.Sprintf("/authorization/organizations/%s/roles/%s/permissions", url.PathEscape(organizationID), url.PathEscape(slug)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// RemoveOrganizationRolePermission remove a permission from a custom role
// Remove a single permission from a custom role by its slug.
func (s *AuthorizationService) RemoveOrganizationRolePermission(ctx context.Context, organizationID string, slug string, permissionSlug string, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/authorization/organizations/%s/roles/%s/permissions/%s", url.PathEscape(organizationID), url.PathEscape(slug), url.PathEscape(permissionSlug)), nil, nil, nil, opts)
	return err
}

// GetResourceByExternalID get a resource by external ID
// Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details.
func (s *AuthorizationService) GetResourceByExternalID(ctx context.Context, organizationID string, resourceTypeSlug string, externalID string, opts ...RequestOption) (*AuthorizationResource, error) {
	var result AuthorizationResource
	_, err := s.client.request(ctx, "GET", fmt.Sprintf("/authorization/organizations/%s/resources/%s/%s", url.PathEscape(organizationID), url.PathEscape(resourceTypeSlug), url.PathEscape(externalID)), nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationUpdateResourceByExternalIDParams contains the parameters for UpdateResourceByExternalID.
type AuthorizationUpdateResourceByExternalIDParams struct {
	// Name is a display name for the resource.
	Name *string `json:"name,omitempty" url:"-"`
	// Description is an optional description of the resource.
	Description *string `json:"description,omitempty" url:"-"`
	// ParentResource optionally identifies the parent resource.
	ParentResource AuthorizationParentResource `url:"-" json:"-"`
}

// MarshalJSON implements json.Marshaler for AuthorizationUpdateResourceByExternalIDParams.
func (p AuthorizationUpdateResourceByExternalIDParams) MarshalJSON() ([]byte, error) {
	type Alias AuthorizationUpdateResourceByExternalIDParams
	data, err := json.Marshal(Alias(p))
	if err != nil {
		return nil, err
	}
	if p.ParentResource == nil {
		return data, nil
	}
	var m map[string]any
	if err := json.Unmarshal(data, &m); err != nil {
		return nil, err
	}
	if p.ParentResource != nil {
		p.ParentResource.applyToBody(m)
	}
	return json.Marshal(m)
}

// UpdateResourceByExternalID update a resource by external ID
// Update an existing authorization resource using its external ID.
func (s *AuthorizationService) UpdateResourceByExternalID(ctx context.Context, organizationID string, resourceTypeSlug string, externalID string, params *AuthorizationUpdateResourceByExternalIDParams, opts ...RequestOption) (*AuthorizationResource, error) {
	var result AuthorizationResource
	_, err := s.client.request(ctx, "PATCH", fmt.Sprintf("/authorization/organizations/%s/resources/%s/%s", url.PathEscape(organizationID), url.PathEscape(resourceTypeSlug), url.PathEscape(externalID)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationDeleteResourceByExternalIDParams contains the parameters for DeleteResourceByExternalID.
type AuthorizationDeleteResourceByExternalIDParams struct {
	// CascadeDelete is if true, deletes all descendant resources and role assignments. If not set and the resource has children or assignments, the request will fail.
	// Defaults to false.
	CascadeDelete *bool `url:"cascade_delete,omitempty" json:"-"`
}

// DeleteResourceByExternalID delete an authorization resource by external ID
// Delete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources.
func (s *AuthorizationService) DeleteResourceByExternalID(ctx context.Context, organizationID string, resourceTypeSlug string, externalID string, params *AuthorizationDeleteResourceByExternalIDParams, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/authorization/organizations/%s/resources/%s/%s", url.PathEscape(organizationID), url.PathEscape(resourceTypeSlug), url.PathEscape(externalID)), params, nil, nil, opts)
	return err
}

// AuthorizationListMembershipsForResourceByExternalIDParams contains the parameters for ListMembershipsForResourceByExternalID.
type AuthorizationListMembershipsForResourceByExternalIDParams struct {
	PaginationParams
	// PermissionSlug is the permission slug to filter by. Only users with this permission on the resource are returned.
	PermissionSlug string `url:"permission_slug" json:"-"`
	// Assignment is filter by assignment type. Use "direct" for direct assignments only, or "indirect" to include inherited assignments.
	Assignment *AuthorizationAssignment `url:"assignment,omitempty" json:"-"`
}

// ListMembershipsForResourceByExternalID list memberships for a resource by external ID
// Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID.
func (s *AuthorizationService) ListMembershipsForResourceByExternalID(ctx context.Context, organizationID string, resourceTypeSlug string, externalID string, params *AuthorizationListMembershipsForResourceByExternalIDParams, opts ...RequestOption) *Iterator[UserOrganizationMembershipBaseListData] {
	return newIterator[UserOrganizationMembershipBaseListData](ctx, s.client, "GET", fmt.Sprintf("/authorization/organizations/%s/resources/%s/%s/organization_memberships", url.PathEscape(organizationID), url.PathEscape(resourceTypeSlug), url.PathEscape(externalID)), params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationListRoleAssignmentsForResourceByExternalIDParams contains the parameters for ListRoleAssignmentsForResourceByExternalID.
type AuthorizationListRoleAssignmentsForResourceByExternalIDParams struct {
	PaginationParams
}

// ListRoleAssignmentsForResourceByExternalID list role assignments for a resource by external ID
// List all role assignments granted on a resource, identified by its external ID. Each assignment includes the organization membership it was granted to.
func (s *AuthorizationService) ListRoleAssignmentsForResourceByExternalID(ctx context.Context, organizationID string, resourceTypeSlug string, externalID string, params *AuthorizationListRoleAssignmentsForResourceByExternalIDParams, opts ...RequestOption) *Iterator[UserRoleAssignment] {
	return newIterator[UserRoleAssignment](ctx, s.client, "GET", fmt.Sprintf("/authorization/organizations/%s/resources/%s/%s/role_assignments", url.PathEscape(organizationID), url.PathEscape(resourceTypeSlug), url.PathEscape(externalID)), params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationListResourcesParams contains the parameters for ListResources.
type AuthorizationListResourcesParams struct {
	PaginationParams
	// OrganizationID is filter resources by organization ID.
	OrganizationID *string `url:"organization_id,omitempty" json:"-"`
	// ResourceTypeSlug is filter resources by resource type slug.
	ResourceTypeSlug *string `url:"resource_type_slug,omitempty" json:"-"`
	// ResourceExternalID is filter resources by external ID.
	ResourceExternalID *string `url:"resource_external_id,omitempty" json:"-"`
	// Search is search resources by name.
	Search *string `url:"search,omitempty" json:"-"`
	// Parent optionally identifies the parent.
	Parent AuthorizationParent `url:"-" json:"-"`
}

// ListResources
// Get a paginated list of authorization resources.
func (s *AuthorizationService) ListResources(ctx context.Context, params *AuthorizationListResourcesParams, opts ...RequestOption) *Iterator[AuthorizationResource] {
	query := url.Values{}
	if params.Before != nil {
		query.Set("before", *params.Before)
	}
	if params.After != nil {
		query.Set("after", *params.After)
	}
	if params.Limit != nil {
		query.Set("limit", fmt.Sprintf("%v", *params.Limit))
	}
	if params.Order != nil {
		query.Set("order", fmt.Sprintf("%v", *params.Order))
	}
	if params.OrganizationID != nil {
		query.Set("organization_id", *params.OrganizationID)
	}
	if params.ResourceTypeSlug != nil {
		query.Set("resource_type_slug", *params.ResourceTypeSlug)
	}
	if params.ResourceExternalID != nil {
		query.Set("resource_external_id", *params.ResourceExternalID)
	}
	if params.Search != nil {
		query.Set("search", *params.Search)
	}
	if params.Parent != nil {
		params.Parent.applyToQuery(query)
	}
	return newIterator[AuthorizationResource](ctx, s.client, "GET", "/authorization/resources", query, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationCreateResourceParams contains the parameters for CreateResource.
type AuthorizationCreateResourceParams struct {
	// ExternalID is an external identifier for the resource.
	ExternalID string `json:"external_id" url:"-"`
	// Name is a display name for the resource.
	Name string `json:"name" url:"-"`
	// Description is an optional description of the resource.
	Description *string `json:"description,omitempty" url:"-"`
	// ResourceTypeSlug is the slug of the resource type.
	ResourceTypeSlug string `json:"resource_type_slug" url:"-"`
	// OrganizationID is the ID of the organization this resource belongs to.
	OrganizationID string `json:"organization_id" url:"-"`
	// ParentResource optionally identifies the parent resource.
	ParentResource AuthorizationParentResource `url:"-" json:"-"`
}

// MarshalJSON implements json.Marshaler for AuthorizationCreateResourceParams.
func (p AuthorizationCreateResourceParams) MarshalJSON() ([]byte, error) {
	type Alias AuthorizationCreateResourceParams
	data, err := json.Marshal(Alias(p))
	if err != nil {
		return nil, err
	}
	if p.ParentResource == nil {
		return data, nil
	}
	var m map[string]any
	if err := json.Unmarshal(data, &m); err != nil {
		return nil, err
	}
	if p.ParentResource != nil {
		p.ParentResource.applyToBody(m)
	}
	return json.Marshal(m)
}

// CreateResource create an authorization resource
// Create a new authorization resource.
func (s *AuthorizationService) CreateResource(ctx context.Context, params *AuthorizationCreateResourceParams, opts ...RequestOption) (*AuthorizationResource, error) {
	var result AuthorizationResource
	_, err := s.client.request(ctx, "POST", "/authorization/resources", nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// GetResource get a resource
// Retrieve the details of an authorization resource by its ID.
func (s *AuthorizationService) GetResource(ctx context.Context, resourceID string, opts ...RequestOption) (*AuthorizationResource, error) {
	var result AuthorizationResource
	_, err := s.client.request(ctx, "GET", fmt.Sprintf("/authorization/resources/%s", url.PathEscape(resourceID)), nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationUpdateResourceParams contains the parameters for UpdateResource.
type AuthorizationUpdateResourceParams struct {
	// Name is a display name for the resource.
	Name *string `json:"name,omitempty" url:"-"`
	// Description is an optional description of the resource.
	Description *string `json:"description,omitempty" url:"-"`
	// ParentResource optionally identifies the parent resource.
	ParentResource AuthorizationParentResource `url:"-" json:"-"`
}

// MarshalJSON implements json.Marshaler for AuthorizationUpdateResourceParams.
func (p AuthorizationUpdateResourceParams) MarshalJSON() ([]byte, error) {
	type Alias AuthorizationUpdateResourceParams
	data, err := json.Marshal(Alias(p))
	if err != nil {
		return nil, err
	}
	if p.ParentResource == nil {
		return data, nil
	}
	var m map[string]any
	if err := json.Unmarshal(data, &m); err != nil {
		return nil, err
	}
	if p.ParentResource != nil {
		p.ParentResource.applyToBody(m)
	}
	return json.Marshal(m)
}

// UpdateResource update a resource
// Update an existing authorization resource.
func (s *AuthorizationService) UpdateResource(ctx context.Context, resourceID string, params *AuthorizationUpdateResourceParams, opts ...RequestOption) (*AuthorizationResource, error) {
	var result AuthorizationResource
	_, err := s.client.request(ctx, "PATCH", fmt.Sprintf("/authorization/resources/%s", url.PathEscape(resourceID)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationDeleteResourceParams contains the parameters for DeleteResource.
type AuthorizationDeleteResourceParams struct {
	// CascadeDelete is if true, deletes all descendant resources and role assignments. If not set and the resource has children or assignments, the request will fail.
	// Defaults to false.
	CascadeDelete *bool `url:"cascade_delete,omitempty" json:"-"`
}

// DeleteResource delete an authorization resource
// Delete an authorization resource and all its descendants.
func (s *AuthorizationService) DeleteResource(ctx context.Context, resourceID string, params *AuthorizationDeleteResourceParams, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/authorization/resources/%s", url.PathEscape(resourceID)), params, nil, nil, opts)
	return err
}

// AuthorizationListMembershipsForResourceParams contains the parameters for ListMembershipsForResource.
type AuthorizationListMembershipsForResourceParams struct {
	PaginationParams
	// PermissionSlug is the permission slug to filter by. Only users with this permission on the resource are returned.
	PermissionSlug string `url:"permission_slug" json:"-"`
	// Assignment is filter by assignment type. Use `direct` for direct assignments only, or `indirect` to include inherited assignments.
	Assignment *AuthorizationAssignment `url:"assignment,omitempty" json:"-"`
}

// ListMembershipsForResource list organization memberships for resource
// Returns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?".
func (s *AuthorizationService) ListMembershipsForResource(ctx context.Context, resourceID string, params *AuthorizationListMembershipsForResourceParams, opts ...RequestOption) *Iterator[UserOrganizationMembershipBaseListData] {
	return newIterator[UserOrganizationMembershipBaseListData](ctx, s.client, "GET", fmt.Sprintf("/authorization/resources/%s/organization_memberships", url.PathEscape(resourceID)), params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationListRoleAssignmentsForResourceParams contains the parameters for ListRoleAssignmentsForResource.
type AuthorizationListRoleAssignmentsForResourceParams struct {
	PaginationParams
}

// ListRoleAssignmentsForResource list role assignments for a resource
// List all role assignments granted on a specific resource instance. Each assignment includes the organization membership it was granted to.
func (s *AuthorizationService) ListRoleAssignmentsForResource(ctx context.Context, resourceID string, params *AuthorizationListRoleAssignmentsForResourceParams, opts ...RequestOption) *Iterator[UserRoleAssignment] {
	return newIterator[UserRoleAssignment](ctx, s.client, "GET", fmt.Sprintf("/authorization/resources/%s/role_assignments", url.PathEscape(resourceID)), params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// ListEnvironmentRoles
// List all environment roles in priority order.
func (s *AuthorizationService) ListEnvironmentRoles(ctx context.Context, opts ...RequestOption) (*RoleList, error) {
	var result RoleList
	_, err := s.client.request(ctx, "GET", "/authorization/roles", nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationCreateEnvironmentRoleParams contains the parameters for CreateEnvironmentRole.
type AuthorizationCreateEnvironmentRoleParams struct {
	// Slug is a unique slug for the role.
	Slug string `json:"slug" url:"-"`
	// Name is a descriptive name for the role.
	Name string `json:"name" url:"-"`
	// Description is an optional description of the role.
	Description *string `json:"description,omitempty" url:"-"`
	// ResourceTypeSlug is the slug of the resource type the role is scoped to.
	ResourceTypeSlug *string `json:"resource_type_slug,omitempty" url:"-"`
}

// CreateEnvironmentRole create an environment role
// Create a new environment role.
func (s *AuthorizationService) CreateEnvironmentRole(ctx context.Context, params *AuthorizationCreateEnvironmentRoleParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "POST", "/authorization/roles", nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// GetEnvironmentRole get an environment role
// Get an environment role by its slug.
func (s *AuthorizationService) GetEnvironmentRole(ctx context.Context, slug string, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "GET", fmt.Sprintf("/authorization/roles/%s", url.PathEscape(slug)), nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationUpdateEnvironmentRoleParams contains the parameters for UpdateEnvironmentRole.
type AuthorizationUpdateEnvironmentRoleParams struct {
	// Name is a descriptive name for the role.
	Name *string `json:"name,omitempty" url:"-"`
	// Description is an optional description of the role.
	Description *string `json:"description,omitempty" url:"-"`
}

// UpdateEnvironmentRole update an environment role
// Update an existing environment role.
func (s *AuthorizationService) UpdateEnvironmentRole(ctx context.Context, slug string, params *AuthorizationUpdateEnvironmentRoleParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "PATCH", fmt.Sprintf("/authorization/roles/%s", url.PathEscape(slug)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationAddEnvironmentRolePermissionParams contains the parameters for AddEnvironmentRolePermission.
type AuthorizationAddEnvironmentRolePermissionParams struct {
	// Slug is the slug of the permission to add to the role.
	Slug string `json:"slug" url:"-"`
}

// AddEnvironmentRolePermission add a permission to an environment role
// Add a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect.
func (s *AuthorizationService) AddEnvironmentRolePermission(ctx context.Context, slug string, params *AuthorizationAddEnvironmentRolePermissionParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "POST", fmt.Sprintf("/authorization/roles/%s/permissions", url.PathEscape(slug)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationSetEnvironmentRolePermissionsParams contains the parameters for SetEnvironmentRolePermissions.
type AuthorizationSetEnvironmentRolePermissionsParams struct {
	// Permissions is the permission slugs to assign to the role.
	Permissions []string `json:"permissions" url:"-"`
}

// SetEnvironmentRolePermissions set permissions for an environment role
// Replace all permissions on an environment role with the provided list.
func (s *AuthorizationService) SetEnvironmentRolePermissions(ctx context.Context, slug string, params *AuthorizationSetEnvironmentRolePermissionsParams, opts ...RequestOption) (*Role, error) {
	var result Role
	_, err := s.client.request(ctx, "PUT", fmt.Sprintf("/authorization/roles/%s/permissions", url.PathEscape(slug)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationListPermissionsParams contains the parameters for ListPermissions.
type AuthorizationListPermissionsParams struct {
	PaginationParams
}

// ListPermissions
// Get a list of all permissions in your WorkOS environment.
func (s *AuthorizationService) ListPermissions(ctx context.Context, params *AuthorizationListPermissionsParams, opts ...RequestOption) *Iterator[AuthorizationPermission] {
	return newIterator[AuthorizationPermission](ctx, s.client, "GET", "/authorization/permissions", params, "after", "data", opts, map[string]string{"limit": "10", "order": "desc"})
}

// AuthorizationCreatePermissionParams contains the parameters for CreatePermission.
type AuthorizationCreatePermissionParams struct {
	// Slug is a unique key to reference the permission. Must be lowercase and contain only letters, numbers, hyphens, underscores, colons, periods, and asterisks.
	Slug string `json:"slug" url:"-"`
	// Name is a descriptive name for the Permission.
	Name string `json:"name" url:"-"`
	// Description is an optional description of the Permission.
	Description *string `json:"description,omitempty" url:"-"`
	// ResourceTypeSlug is the slug of the resource type this permission is scoped to.
	ResourceTypeSlug *string `json:"resource_type_slug,omitempty" url:"-"`
}

// CreatePermission create a permission
// Create a new permission in your WorkOS environment. The permission can then be assigned to environment roles and custom roles.
func (s *AuthorizationService) CreatePermission(ctx context.Context, params *AuthorizationCreatePermissionParams, opts ...RequestOption) (*Permission, error) {
	var result Permission
	_, err := s.client.request(ctx, "POST", "/authorization/permissions", nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// GetPermission get a permission
// Retrieve a permission by its unique slug.
func (s *AuthorizationService) GetPermission(ctx context.Context, slug string, opts ...RequestOption) (*AuthorizationPermission, error) {
	var result AuthorizationPermission
	_, err := s.client.request(ctx, "GET", fmt.Sprintf("/authorization/permissions/%s", url.PathEscape(slug)), nil, nil, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// AuthorizationUpdatePermissionParams contains the parameters for UpdatePermission.
type AuthorizationUpdatePermissionParams struct {
	// Name is a descriptive name for the Permission.
	Name *string `json:"name,omitempty" url:"-"`
	// Description is an optional description of the Permission.
	Description *string `json:"description,omitempty" url:"-"`
}

// UpdatePermission update a permission
// Update an existing permission. Only the fields provided in the request body will be updated.
func (s *AuthorizationService) UpdatePermission(ctx context.Context, slug string, params *AuthorizationUpdatePermissionParams, opts ...RequestOption) (*AuthorizationPermission, error) {
	var result AuthorizationPermission
	_, err := s.client.request(ctx, "PATCH", fmt.Sprintf("/authorization/permissions/%s", url.PathEscape(slug)), nil, params, &result, opts)
	if err != nil {
		return nil, err
	}
	return &result, nil
}

// DeletePermission delete a permission
// Delete an existing permission. System permissions cannot be deleted.
func (s *AuthorizationService) DeletePermission(ctx context.Context, slug string, opts ...RequestOption) error {
	_, err := s.client.request(ctx, "DELETE", fmt.Sprintf("/authorization/permissions/%s", url.PathEscape(slug)), nil, nil, nil, opts)
	return err
}