Skip to content

Commit 01e567d

Browse files
swaroopAkkineniWorkosswaroopAkkineniWorkos
authored
FGA_4: list/assign/remove role, remove roleAssginment (#570)
1 parent 87eb732 commit 01e567d

File tree

3 files changed

+635
-0
lines changed

3 files changed

+635
-0
lines changed

‎src/workos/authorization.py‎

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
from workos.types.authorization.resource_identifier import ResourceIdentifier
1515
from workos.types.authorization.authorization_resource import AuthorizationResource
1616
from workos.types.authorization.role import Role, RoleList
17+
from workos.types.authorization.role_assignment import RoleAssignment
1718
from workos.types.list_resource import (
1819
ListArgs,
1920
ListMetadata,
@@ -42,6 +43,7 @@ class _Unset(Enum):
4243
AUTHORIZATION_PERMISSIONS_PATH = "authorization/permissions"
4344
AUTHORIZATION_RESOURCES_PATH = "authorization/resources"
4445
AUTHORIZATION_ORGANIZATIONS_PATH = "authorization/organizations"
46+
AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH = "authorization/organization_memberships"
4547

4648

4749
class ResourceListFilters(ListArgs, total=False):
@@ -72,6 +74,15 @@ class ParentResourceByExternalId(TypedDict):
7274
_role_adapter: TypeAdapter[Role] = TypeAdapter(Role)
7375

7476

77+
class RoleAssignmentListFilters(ListArgs, total=False):
78+
organization_membership_id: str
79+
80+
81+
RoleAssignmentsListResource = WorkOSListResource[
82+
RoleAssignment, RoleAssignmentListFilters, ListMetadata
83+
]
84+
85+
7586
class PermissionListFilters(ListArgs, total=False):
7687
pass
7788

@@ -280,6 +291,38 @@ def check(
280291
resource: ResourceIdentifier,
281292
) -> SyncOrAsync[AccessCheckResponse]: ...
282293

294+
def assign_role(
295+
self,
296+
organization_membership_id: str,
297+
*,
298+
role_slug: str,
299+
resource_identifier: ResourceIdentifier,
300+
) -> SyncOrAsync[RoleAssignment]: ...
301+
302+
def remove_role(
303+
self,
304+
organization_membership_id: str,
305+
*,
306+
role_slug: str,
307+
resource_identifier: ResourceIdentifier,
308+
) -> SyncOrAsync[None]: ...
309+
310+
def remove_role_assignment(
311+
self,
312+
organization_membership_id: str,
313+
role_assignment_id: str,
314+
) -> SyncOrAsync[None]: ...
315+
316+
def list_role_assignments(
317+
self,
318+
*,
319+
organization_membership_id: str,
320+
limit: int = DEFAULT_LIST_RESPONSE_LIMIT,
321+
before: Optional[str] = None,
322+
after: Optional[str] = None,
323+
order: PaginationOrder = "desc",
324+
) -> SyncOrAsync[RoleAssignmentsListResource]: ...
325+
283326

284327
class Authorization(AuthorizationModule):
285328
_http_client: SyncHTTPClient
@@ -754,6 +797,89 @@ def check(
754797

755798
return AccessCheckResponse.model_validate(response)
756799

800+
# Role Assignments
801+
802+
def assign_role(
803+
self,
804+
organization_membership_id: str,
805+
*,
806+
role_slug: str,
807+
resource_identifier: ResourceIdentifier,
808+
) -> RoleAssignment:
809+
json: Dict[str, Any] = {"role_slug": role_slug}
810+
json.update(resource_identifier)
811+
812+
response = self._http_client.request(
813+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments",
814+
method=REQUEST_METHOD_POST,
815+
json=json,
816+
)
817+
818+
return RoleAssignment.model_validate(response)
819+
820+
def remove_role(
821+
self,
822+
organization_membership_id: str,
823+
*,
824+
role_slug: str,
825+
resource_identifier: ResourceIdentifier,
826+
) -> None:
827+
json: Dict[str, Any] = {"role_slug": role_slug}
828+
json.update(resource_identifier)
829+
830+
self._http_client.delete_with_body(
831+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments",
832+
json=json,
833+
)
834+
835+
def remove_role_assignment(
836+
self,
837+
organization_membership_id: str,
838+
role_assignment_id: str,
839+
) -> None:
840+
self._http_client.request(
841+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments/{role_assignment_id}",
842+
method=REQUEST_METHOD_DELETE,
843+
)
844+
845+
def list_role_assignments(
846+
self,
847+
*,
848+
organization_membership_id: str,
849+
limit: int = DEFAULT_LIST_RESPONSE_LIMIT,
850+
before: Optional[str] = None,
851+
after: Optional[str] = None,
852+
order: PaginationOrder = "desc",
853+
) -> RoleAssignmentsListResource:
854+
list_params: RoleAssignmentListFilters = {
855+
"organization_membership_id": organization_membership_id,
856+
"limit": limit,
857+
"before": before,
858+
"after": after,
859+
"order": order,
860+
}
861+
862+
query_params: ListArgs = {
863+
"limit": limit,
864+
"before": before,
865+
"after": after,
866+
"order": order,
867+
}
868+
869+
response = self._http_client.request(
870+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments",
871+
method=REQUEST_METHOD_GET,
872+
params=query_params,
873+
)
874+
875+
return WorkOSListResource[
876+
RoleAssignment, RoleAssignmentListFilters, ListMetadata
877+
](
878+
list_method=self.list_role_assignments,
879+
list_args=list_params,
880+
**ListPage[RoleAssignment](**response).model_dump(),
881+
)
882+
757883

758884
class AsyncAuthorization(AuthorizationModule):
759885
_http_client: AsyncHTTPClient
@@ -1229,3 +1355,86 @@ async def check(
12291355
)
12301356

12311357
return AccessCheckResponse.model_validate(response)
1358+
1359+
# Role Assignments
1360+
1361+
async def assign_role(
1362+
self,
1363+
organization_membership_id: str,
1364+
*,
1365+
role_slug: str,
1366+
resource_identifier: ResourceIdentifier,
1367+
) -> RoleAssignment:
1368+
json: Dict[str, Any] = {"role_slug": role_slug}
1369+
json.update(resource_identifier)
1370+
1371+
response = await self._http_client.request(
1372+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments",
1373+
method=REQUEST_METHOD_POST,
1374+
json=json,
1375+
)
1376+
1377+
return RoleAssignment.model_validate(response)
1378+
1379+
async def remove_role(
1380+
self,
1381+
organization_membership_id: str,
1382+
*,
1383+
role_slug: str,
1384+
resource_identifier: ResourceIdentifier,
1385+
) -> None:
1386+
json: Dict[str, Any] = {"role_slug": role_slug}
1387+
json.update(resource_identifier)
1388+
1389+
await self._http_client.delete_with_body(
1390+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments",
1391+
json=json,
1392+
)
1393+
1394+
async def remove_role_assignment(
1395+
self,
1396+
organization_membership_id: str,
1397+
role_assignment_id: str,
1398+
) -> None:
1399+
await self._http_client.request(
1400+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments/{role_assignment_id}",
1401+
method=REQUEST_METHOD_DELETE,
1402+
)
1403+
1404+
async def list_role_assignments(
1405+
self,
1406+
*,
1407+
organization_membership_id: str,
1408+
limit: int = DEFAULT_LIST_RESPONSE_LIMIT,
1409+
before: Optional[str] = None,
1410+
after: Optional[str] = None,
1411+
order: PaginationOrder = "desc",
1412+
) -> RoleAssignmentsListResource:
1413+
list_params: RoleAssignmentListFilters = {
1414+
"organization_membership_id": organization_membership_id,
1415+
"limit": limit,
1416+
"before": before,
1417+
"after": after,
1418+
"order": order,
1419+
}
1420+
1421+
query_params: ListArgs = {
1422+
"limit": limit,
1423+
"before": before,
1424+
"after": after,
1425+
"order": order,
1426+
}
1427+
1428+
response = await self._http_client.request(
1429+
f"{AUTHORIZATION_ORGANIZATION_MEMBERSHIPS_PATH}/{organization_membership_id}/role_assignments",
1430+
method=REQUEST_METHOD_GET,
1431+
params=query_params,
1432+
)
1433+
1434+
return WorkOSListResource[
1435+
RoleAssignment, RoleAssignmentListFilters, ListMetadata
1436+
](
1437+
list_method=self.list_role_assignments,
1438+
list_args=list_params,
1439+
**ListPage[RoleAssignment](**response).model_dump(),
1440+
)

0 commit comments

Comments
 (0)