Add permission and organization role support (#548)

* Add authorization permissions support

Introduce the authorization module with CRUD operations for permissions
including create, list (paginated), get, update (PATCH), and delete.
Register the module on both sync and async clients.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add authorization organization roles support (#549)

* Add authorization organization roles support

Add CRUD operations for organization roles including create, list, get,
update, set/add/remove permissions on the authorization module.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* format

* Add authorization environment roles support (#550)

* Add authorization environment roles support

Add CRUD operations for environment roles including create, list, get,
update, set/add permissions on the authorization module.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Use Role union type for list/get organization role endpoints

The list and get organization role endpoints can return both
EnvironmentRole and OrganizationRole types. This aligns the
Python SDK return types with the Node SDK.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add authorization event and webhook types (#551)

* Add authorization event and webhook types

Add event and webhook types for organization_role (created, updated,
deleted) and permission (created, updated, deleted) to support
authorization-related event streaming and webhook delivery.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Distinct type for organization role events

* mypy

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

* Remove aliasing, format

* Format, types

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: csrbarber

src/workos/_base_client.py

@@ -5,6 +5,7 @@
 from workos._client_configuration import ClientConfiguration
 from workos.api_keys import ApiKeysModule
 from workos.audit_logs import AuditLogsModule
+from workos.authorization import AuthorizationModule
 from workos.directory_sync import DirectorySyncModule
 from workos.events import EventsModule
 from workos.fga import FGAModule
@@ -74,6 +75,10 @@ def __init__(
     @abstractmethod
     def api_keys(self) -> ApiKeysModule: ...
 
+    @property
+    @abstractmethod
+    def authorization(self) -> AuthorizationModule: ...
+
     @property
     @abstractmethod
     def audit_logs(self) -> AuditLogsModule: ...

src/workos/async_client.py

@@ -3,6 +3,7 @@
 from workos._base_client import BaseClient
 from workos.api_keys import AsyncApiKeys
 from workos.audit_logs import AsyncAuditLogs
+from workos.authorization import AsyncAuthorization
 from workos.directory_sync import AsyncDirectorySync
 from workos.events import AsyncEvents
 from workos.fga import FGAModule
@@ -55,6 +56,12 @@ def api_keys(self) -> AsyncApiKeys:
             self._api_keys = AsyncApiKeys(self._http_client)
         return self._api_keys
 
+    @property
+    def authorization(self) -> AsyncAuthorization:
+        if not getattr(self, "_authorization", None):
+            self._authorization = AsyncAuthorization(self._http_client)
+        return self._authorization
+
     @property
     def sso(self) -> AsyncSSO:
         if not getattr(self, "_sso", None):