Skip to content

feat(generated): regenerate from spec (12 changes)#501

Merged
gjtorikian merged 13 commits into
mainfrom
oagen/spec-update-0e1c039566c6e6c4061925ea050b1bf288163094
Jun 18, 2026
Merged

feat(generated): regenerate from spec (12 changes)#501
gjtorikian merged 13 commits into
mainfrom
oagen/spec-update-0e1c039566c6e6c4061925ea050b1bf288163094

Conversation

@workos-sdk-automation

@workos-sdk-automation workos-sdk-automation Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Summary

feat(organization_membership)!: Change response for UserManagementOrganizationMembership.list

  • Changed response for UserManagementOrganizationMembership.list.

feat(pipes)!: SDK surface change: Symbol "Pipes.create_data_integration_token" was removed

  • SDK surface change: Symbol "Pipes.create_data_integration_token" was removed.

feat(user_management)!: Change response for UserManagementInvitations.list

  • Changed response for UserManagementInvitations.list.

feat(widgets)!: SDK surface change: Symbol "WidgetSessionTokenResponse" was removed

  • SDK surface change: Symbol "WidgetSessionTokenResponse" was removed.

feat(authorization): Add authorization operations and models

  • Added model ReplaceGroupRoleAssignmentEntry.
  • Added model ReplaceGroupRoleAssignments.
  • Added model DeleteGroupRoleAssignmentsByCriteria.
  • Added endpoint POST /authorization/groups/{group_id}/role_assignments.
  • Added endpoint PUT /authorization/groups/{group_id}/role_assignments.
  • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments.
  • Added endpoint GET /authorization/groups/{group_id}/role_assignments/{role_assignment_id}.
  • Added endpoint DELETE /authorization/groups/{group_id}/role_assignments/{role_assignment_id}.

feat(client): Add client API surface

  • Added model ClientApiToken.
  • Added model ClientApiTokenResponse.
  • Added service Client.

feat(connect): Add Connect API surface

  • Added auth_method to ConnectedAccount.
  • Added api_key_last_4 to ConnectedAccount.
  • Added enum ConnectedAccountAuthMethod.

feat(groups): Add groups API surface

  • Added model CreateGroupRoleAssignment.
  • Added model GroupRoleAssignment.
  • Added model GroupRoleAssignmentList.
  • Added model GroupRoleAssignmentResource.

feat(organization_membership): Add organization membership API surface

  • Added model UserOrganizationMembershipList.
  • Added model UserOrganizationMembershipListListMetadata.

feat(pipes): Add Pipes API surface

  • Added model DataIntegrationCredentials.
  • Added model DataIntegrationConfigurationResponse.
  • Added model DataIntegrationConfigurationListResponse.
  • Added model ConfigureDataIntegrationBody.
  • Added auth_methods to DataIntegrationsListResponseData.
  • Added auth_method to DataIntegrationsListResponseDataConnectedAccount.
  • Added api_key_last_4 to DataIntegrationsListResponseDataConnectedAccount.
  • Added enum DataIntegrationCredentialsCredentialsType.
  • Added enum DataIntegrationsListResponseDataAuthMethods.
  • Added enum DataIntegrationsListResponseDataConnectedAccountAuthMethod.
  • Added service PipesProvider.

feat(user_management): Update user management API surface

  • Added model UserInviteList.
  • Added model UserInviteListListMetadata.
  • Made AuthorizationCodeSessionAuthenticateRequest.client_secret optional.
  • Made RefreshTokenSessionAuthenticateRequest.client_secret optional.

feat(widgets): Add widgets:pipes:manage to WidgetSessionTokenScopes

  • Added widgets:pipes:manage to WidgetSessionTokenScopes.

Triggered by workos/openapi-spec@0e1c039

BEGIN_COMMIT_OVERRIDE
feat(organization_membership): Change response for UserManagementOrganizationMembership.list (#501)
feat(pipes): SDK surface change: Symbol "Pipes.create_data_integration_token" was removed (#501)
feat(user_management): Change response for UserManagementInvitations.list (#501)
feat(widgets): SDK surface change: Symbol "WidgetSessionTokenResponse" was removed (#501)
feat(authorization): Add authorization operations and models (#501)
feat(client): Add client API surface (#501)
feat(connect): Add Connect API surface (#501)
feat(groups): Add groups API surface (#501)
feat(organization_membership): Add organization membership API surface (#501)
feat(pipes): Add Pipes API surface (#501)
feat(user_management): Update user management API surface (#501)
feat(widgets): Add widgets:pipes:manage to WidgetSessionTokenScopes (#501)
END_COMMIT_OVERRIDE

@workos-sdk-automation workos-sdk-automation Bot requested a review from a team as a code owner June 17, 2026 21:07
@workos-sdk-automation workos-sdk-automation Bot added the autogenerated Autogenerated code or content label Jun 17, 2026
@workos-sdk-automation workos-sdk-automation Bot requested a review from a team as a code owner June 17, 2026 21:07
@workos-sdk-automation workos-sdk-automation Bot requested a review from tribble June 17, 2026 21:07
@greptile-apps

greptile-apps Bot commented Jun 17, 2026

Copy link
Copy Markdown
Contributor

Greptile Summary

  • Regenerates the WorkOS Ruby SDK from the latest API spec.
  • Adds authorization group role assignment APIs and models.
  • Adds Client API token service and response models.
  • Adds Pipes provider configuration APIs and updates related Pipes/Connect models.
  • Updates user management, organization membership, widgets scopes, RBI files, and generated tests.

Confidence Score: 4/5

The generated SDK changes are mostly straightforward, but the Pipes provider request serialization needs attention before merge.

Focused validation confirmed the request body behavior for the identified API surface, while the rest of the changes are generated model/service additions with matching tests.

lib/workos/pipes_provider.rb

T-Rex T-Rex Logs

What T-Rex did

  • Ran a focused Minitest/WebMock repro to verify that scopes: nil is omitted from the serialized body when updating a data integration configuration.
  • Observed the authorization group role assignments flow change after the update, including availability of endpoints and parsed results, indicating the list and group role assignments models were exercised.
  • Created a client API token and confirmed the token response was parsed into WorkOS::ClientApiTokenResponse with organization_id and user_id.
  • Verified that get_access_token succeeds and that data integration configuration endpoints are called with expected body contents, while encountering a runtime parsing issue for api_key_last_4.
  • Checked user management lists and observed a head contract mismatch for the new endpoint-specific list model surface, while list struct access remains available.
  • Explored widgets groups models and confirmed the same runtime behavior; a script executed as part of the check reported results before and after, with the claimed removals not taking effect.

View all artifacts

T-Rex Ran code and verified through T-Rex

Comments Outside Diff (5)

  1. General comment

    P1 PipesProvider credentials response does not expose api_key_last_4

    • Bug
      • The head SDK successfully adds the PipesProvider service and sends the expected list/update requests, but a representative PipesProvider response containing credentials.api_key_last_4 cannot be read from the parsed SDK model. The runtime probe failed with NoMethodError: undefined method 'api_key_last_4' for #<WorkOS::DataIntegrationCredentials client_id="cid"> when reading the parsed list/update credentials object.
    • Cause
      • lib/workos/pipes_provider/data_integration_credentials.rb maps and exposes credentials_type, has_credentials, client_id, client_secret_last_four, and redirect_uri, but it does not include api_key_last_4 in HASH_ATTRS, attr_accessor, or initialization. This is inconsistent with the claimed new api_key_last_4 response surface.
    • Fix
      • Add api_key_last_4: :api_key_last_4 to HASH_ATTRS, include :api_key_last_4 in the accessors, initialize @api_key_last_4 = hash[:api_key_last_4], and update RBI/tests to exercise this field for PipesProvider credential responses.

    T-Rex Ran code and verified through T-Rex

  2. General comment

    P1 Head does not expose the claimed UserInviteList/UserOrganizationMembershipList runtime response models

    • Bug
      • The validation expected UserManagement#list_invitations and OrganizationMembershipService#list_organization_memberships to return new endpoint-specific list model classes (WorkOS::UserInviteList and WorkOS::UserOrganizationMembershipList) with list_metadata. On head, both constants are still undefined and both methods return the generic WorkOS::Types::ListStruct instead. Although list_metadata is available, code relying on the new named model classes or RBI/runtime parity will not see the advertised response surface.
    • Cause
      • The generated Ruby runtime methods in lib/workos/user_management.rb and lib/workos/organization_membership_service.rb still construct WorkOS::Types::ListStruct.from_response(...); no runtime classes for UserInviteList or UserOrganizationMembershipList are defined/loaded.
    • Fix
      • Add the runtime list model classes and update the two list methods to instantiate/return them, or update the claimed contract/RBI to continue documenting WorkOS::Types::ListStruct if that is the intended public surface.

    T-Rex Ran code and verified through T-Rex

  3. General comment

    P1 Head still exposes WidgetSessionTokenResponse despite claimed surface removal

    • Bug
      • The after runtime scenario reports class_available WorkOS::WidgetSessionTokenResponse=true. This contradicts the stated PR claim that head removes the WidgetSessionTokenResponse SDK surface.
    • Cause
      • The class remains loadable through the SDK surface in head; the generated file/export was not actually removed from the runtime-visible model surface, or the repository under validation does not contain the claimed removal.
    • Fix
      • Remove WorkOS::WidgetSessionTokenResponse from the generated source and any require/export paths if the intended SDK contract is to remove it, then rerun the model surface validation.

    T-Rex Ran code and verified through T-Rex

  4. General comment

    P1 Group role assignment list model cannot deserialize list metadata

    • Bug
      • Instantiating WorkOS::GroupRoleAssignmentList with representative list_metadata raises NameError: uninitialized constant WorkOS::ListMetadata, so the generated model cannot round-trip a normal list response shape.
    • Cause
      • lib/workos/authorization/group_role_assignment_list.rb references WorkOS::ListMetadata, but that constant is not available in the loaded SDK namespace for this model path.
    • Fix
      • Update the generated model to reference the correct list metadata class/namespace or add/load WorkOS::ListMetadata consistently with other list response models.

    T-Rex Ran code and verified through T-Rex

  5. General comment

    P1 CreateGroupRoleAssignment and GroupRoleAssignmentResource do not preserve representative fields

    • Bug
      • The after round-trip output shows CreateGroupRoleAssignment omits group_id from to_h and GroupRoleAssignmentResource does not preserve the fixture's type field, returning resource_type_slug=>nil instead. This fails the requested representative field preservation check for the new group role assignment models.
    • Cause
      • The generated accessors/serialization mappings for these models do not include group_id on create input and expect resource_type_slug rather than the representative type key for resources.
    • Fix
      • Confirm the intended API schema fields. If group_id and type are valid contract fields, regenerate/fix the model attributes and serializers to preserve them; otherwise update fixtures/tests and documentation to use the actual schema names.

    T-Rex Ran code and verified through T-Rex

Fix All in Devin Fix All in Claude Code

Prompt To Fix All With AI
Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
lib/workos/pipes_provider.rb:50-55
**Cannot send null scopes**

`scopes: nil` is documented as sending JSON `null` so the organization can inherit provider scopes, but this request body is compacted before serialization, and the base client compacts request bodies again. When callers pass `scopes: nil` to clear custom scopes, the `scopes` key is omitted instead, so the API cannot distinguish “leave scopes unchanged” from “reset scopes to inherited defaults.”

Reviews (2): Last reviewed commit: "Update changelog" | Re-trigger Greptile

Comment on lines 4 to 5

module WorkOS

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Type alias changes class.name and class identity

WidgetSessionTokenResponse = ClientApiTokenResponse makes the constant a true alias — WorkOS::WidgetSessionTokenResponse.new(...).class returns WorkOS::ClientApiTokenResponse, not WorkOS::WidgetSessionTokenResponse. Any caller doing result.class.name, result.is_a?(WorkOS::WidgetSessionTokenResponse), or pattern-matching on the class will silently get different results. The same applies to UserRoleAssignmentResource = GroupRoleAssignmentResource in authorization/user_role_assignment_resource.rb. These are documented breaking changes, but the impact goes slightly beyond "symbol removed" since the constant remains accessible and appears to work, masking the identity shift.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Comment on lines +1 to +25
# frozen_string_literal: true

# This file is auto-generated by oagen. Do not edit.

module WorkOS
class GroupRoleAssignmentList < WorkOS::Types::BaseModel
HASH_ATTRS = {
object: :object,
data: :data,
list_metadata: :list_metadata
}.freeze

attr_accessor \
:object,
:data,
:list_metadata

def initialize(json)
hash = self.class.normalize(json)
@object = hash[:object]
@data = (hash[:data] || []).map { |item| item ? WorkOS::GroupRoleAssignment.new(item) : nil }
@list_metadata = hash[:list_metadata] ? WorkOS::ListMetadata.new(hash[:list_metadata]) : nil
end
end
end

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 GroupRoleAssignmentList model is never instantiated by the service layer

list_group_role_assignments returns a WorkOS::Types::ListStruct built via ListStruct.from_response, not a GroupRoleAssignmentList. The model class is defined and has a round-trip test but is unreachable from any service method. If it is intentionally a schema reference type (matching the raw API shape), a comment to that effect would help; otherwise it is dead code.

@gjtorikian gjtorikian changed the title feat(generated)!: regenerate from spec (12 changes) feat(generated): regenerate from spec (12 changes) Jun 18, 2026
@gjtorikian gjtorikian merged commit 26e75f7 into main Jun 18, 2026
9 checks passed
@gjtorikian gjtorikian deleted the oagen/spec-update-0e1c039566c6e6c4061925ea050b1bf288163094 branch June 18, 2026 15:14
Comment on lines +50 to +55
body = {
"enabled" => enabled,
"scopes" => scopes,
"client_id" => client_id,
"client_secret" => client_secret
}.compact

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Cannot send null scopes

scopes: nil is documented as sending JSON null so the organization can inherit provider scopes, but this request body is compacted before serialization, and the base client compacts request bodies again. When callers pass scopes: nil to clear custom scopes, the scopes key is omitted instead, so the API cannot distinguish “leave scopes unchanged” from “reset scopes to inherited defaults.”

Artifacts

Repro: focused Minitest WebMock script for scopes nil serialization

  • Contains supporting evidence from the run (text/x-ruby; charset=utf-8).

Repro: verbose test output showing omitted scopes key and failing assertion

  • Keeps the command output available without making the summary code-heavy.

View artifacts

T-Rex Ran code and verified through T-Rex

Prompt To Fix With AI
This is a comment left during a code review.
Path: lib/workos/pipes_provider.rb
Line: 50-55

Comment:
**Cannot send null scopes**

`scopes: nil` is documented as sending JSON `null` so the organization can inherit provider scopes, but this request body is compacted before serialization, and the base client compacts request bodies again. When callers pass `scopes: nil` to clear custom scopes, the `scopes` key is omitted instead, so the API cannot distinguish “leave scopes unchanged” from “reset scopes to inherited defaults.”

How can I resolve this? If you propose a fix, please make it concise.

Fix in Devin Fix in Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

autogenerated Autogenerated code or content

Development

Successfully merging this pull request may close these issues.

2 participants