Merge branch 'main' into add-api-keys-support

Author: gjtorikian

.github/workflows/ci.yml

@@ -19,7 +19,7 @@ jobs:
       matrix:
         python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - uses: astral-sh/setup-uv@v7
         with:
           python-version: ${{ matrix.python }}
@@ -49,7 +49,7 @@ jobs:
       matrix:
         python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - uses: astral-sh/setup-uv@v7
         with:
           python-version: ${{ matrix.python }}

.github/workflows/coana-analysis.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Run Coana CLI
         id: coana-cli

.github/workflows/coana-guardrail.yml

@@ -8,7 +8,7 @@ jobs:
 
     steps:
       - name: Checkout the ${{github.base_ref}} branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: ${{github.base_ref}} # checkout the base branch (usually master/main).
 
@@ -21,10 +21,10 @@ jobs:
         run: |
           echo "all_changed_files=$(git diff --name-only ${{ github.base_ref }} ${{ github.head_ref }} | tr '\n' ' ')" >> $GITHUB_OUTPUT
 
-      - name: Use Node.js 20.x
+      - name: Use Node.js 24.x
         uses: actions/setup-node@v4
         with:
-          node-version: 20.x
+          node-version: 24.x
 
       - name: Run Coana on the ${{github.base_ref}} branch
         run: |
@@ -44,7 +44,7 @@ jobs:
         run: sudo chown -R $USER:$USER .
 
       - name: Checkout the current branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           clean: true
 

.github/workflows/release.yml

@@ -25,7 +25,7 @@ jobs:
           private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ steps.generate-token.outputs.token }}
 
@@ -52,7 +52,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install uv
         uses: astral-sh/setup-uv@v6
       - name: Build

.github/workflows/version-bump.yml

@@ -27,7 +27,7 @@ jobs:
           private-key: ${{ secrets.SDK_BOT_PRIVATE_KEY }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           token: ${{ steps.generate-token.outputs.token }}
 

src/workos/types/events/__init__.py

@@ -1,5 +1,6 @@
 from .authentication_payload import *
 from .connection_payload_with_legacy_fields import *
+from .connection_saml_certificate_payload import *
 from .directory_group_membership_payload import *
 from .directory_group_with_previous_attributes import *
 from .directory_payload import *
@@ -8,6 +9,9 @@
 from .event_model import *
 from .event_type import *
 from .event import *
+from .flag_payload import *
 from .organization_domain_verification_failed_payload import *
+from .organization_role_payload import *
+from .permission_payload import *
 from .previous_attributes import *
 from .session_payload import *

src/workos/types/events/authentication_payload.py

@@ -29,6 +29,10 @@ class AuthenticationEmailVerificationSucceededPayload(AuthenticationResultSuccee
     user_id: str
 
 
+class AuthenticationEmailVerificationFailedPayload(AuthenticationResultFailed):
+    type: Literal["email_verification"]
+
+
 class AuthenticationMagicAuthFailedPayload(AuthenticationResultFailed):
     type: Literal["magic_auth"]
 
@@ -43,6 +47,10 @@ class AuthenticationMfaSucceededPayload(AuthenticationResultSucceeded):
     user_id: Optional[str] = None
 
 
+class AuthenticationMfaFailedPayload(AuthenticationResultFailed):
+    type: Literal["mfa"]
+
+
 class AuthenticationOauthFailedPayload(AuthenticationResultFailed):
     type: Literal["oauth"]
 
@@ -52,6 +60,15 @@ class AuthenticationOauthSucceededPayload(AuthenticationResultSucceeded):
     user_id: Optional[str] = None
 
 
+class AuthenticationPasskeyFailedPayload(AuthenticationResultFailed):
+    type: Literal["passkey"]
+
+
+class AuthenticationPasskeySucceededPayload(AuthenticationResultSucceeded):
+    type: Literal["passkey"]
+    user_id: str
+
+
 class AuthenticationPasswordFailedPayload(AuthenticationResultFailed):
     type: Literal["password"]
 
@@ -61,10 +78,27 @@ class AuthenticationPasswordSucceededPayload(AuthenticationResultSucceeded):
     user_id: str
 
 
+class AuthenticationSsoData(WorkOSModel):
+    connection_id: Optional[str] = None
+    organization_id: Optional[str] = None
+    session_id: Optional[str] = None
+
+
 class AuthenticationSsoFailedPayload(AuthenticationResultFailed):
     type: Literal["sso"]
+    sso: AuthenticationSsoData
 
 
 class AuthenticationSsoSucceededPayload(AuthenticationResultSucceeded):
     type: Literal["sso"]
     user_id: Optional[str] = None
+    sso: AuthenticationSsoData
+
+
+class AuthenticationRadarRiskDetectedPayload(AuthenticationResultCommon):
+    auth_method: str
+    action: str
+    control: Optional[str] = None
+    blocklist_type: Optional[str] = None
+    user_id: str
+    email: str

src/workos/types/events/connection_saml_certificate_payload.py

@@ -0,0 +1,30 @@
+from typing import Literal, Optional
+from workos.types.workos_model import WorkOSModel
+
+SamlCertificateType = Literal["ResponseSigning", "RequestSigning", "ResponseEncryption"]
+
+
+class SamlCertificateConnection(WorkOSModel):
+    id: str
+    organization_id: Optional[str] = None
+
+
+class SamlCertificate(WorkOSModel):
+    certificate_type: SamlCertificateType
+    expiry_date: str
+
+
+class SamlCertificateWithExpiry(SamlCertificate):
+    is_expired: bool
+
+
+class ConnectionSamlCertificateRenewedPayload(WorkOSModel):
+    connection: SamlCertificateConnection
+    certificate: SamlCertificate
+    renewed_at: str
+
+
+class ConnectionSamlCertificateRenewalRequiredPayload(WorkOSModel):
+    connection: SamlCertificateConnection
+    certificate: SamlCertificateWithExpiry
+    days_until_expiry: int