feat: FGA_5 list_resources_for_membership, list_memberships_for_resource, list_memberships_for_resource_by_external_id by swaroopAkkineniWorkos · Pull Request #571 · workos/workos-python

swaroopAkkineniWorkos · 2026-02-20T21:42:39Z

…list_memberships_for_resource_by_external_id

Description

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

…list_memberships_for_resource_by_external_id

swaroopAkkineniWorkos · 2026-02-21T20:40:08Z

@greptile review

greptile-apps

_{5 files reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

swaroopAkkineniWorkos · 2026-02-23T16:44:06Z

@greptile re-review

greptile-apps

_{4 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

csrbarber

#556 (comment) is relevant to this PR

…fga-pr5

swaroopAkkineniWorkos · 2026-03-02T21:11:10Z

@greptile re-review plz

greptile-apps · 2026-03-02T21:18:41Z

Greptile Summary

This PR adds three new FGA methods to the Authorization and AsyncAuthorization classes — list_resources_for_membership, list_memberships_for_resource, and list_memberships_for_resource_by_external_id — along with the supporting types and test coverage. It also refactors the previously inline ParentResourceById/ParentResourceByExternalId TypedDicts into their own module (parent_resource_identifier.py).

Key changes:

list_resources_for_membership: fetches paginated resources accessible to a given organization membership under an optional parent resource, using partial() to bind the positional args for pagination continuation.
list_memberships_for_resource: fetches paginated memberships that have access to a resource by its internal ID.
list_memberships_for_resource_by_external_id: the same, but addressed via organization_id + resource_type_slug + external_id path params.
ParentResourceIdentifier types moved to a dedicated file and re-exported from the package __init__.
MockAuthorizationOrganizationMembershipList fixture added for the new membership-list tests.

Minor issues found:

An unused helper function _mock_membership in the test file should be cleaned up.
The mock_resources_list_two fixture in TestListResourcesForMembership uses the deprecated Pydantic v1 .dict() method; the adjacent fixture in TestListMembershipsForResource already uses .model_dump() correctly.

Confidence Score: 5/5

This PR is safe to merge; all new methods follow established patterns and no logic or security issues were found.
The implementation is consistent with the existing codebase patterns (partial-based pagination, separate sync/async classes, TypedDict filters). Both sync and async variants are implemented symmetrically. Test coverage is thorough across all three methods. The two flagged issues are minor style concerns in the test file only and do not affect runtime behaviour.
No files require special attention.

Important Files Changed

Filename	Overview
src/workos/authorization.py	Adds list_resources_for_membership, list_memberships_for_resource, and list_memberships_for_resource_by_external_id to both sync and async Authorization classes, using partial() correctly for pagination continuations. No logic issues found.
src/workos/types/authorization/init.py	Exports AuthorizationOrganizationMembership and ParentResourceIdentifier (along with its sub-types) — correct and consistent with existing patterns.
src/workos/types/authorization/parent_resource_identifier.py	Extracts ParentResourceById, ParentResourceByExternalId, and ParentResourceIdentifier Union into their own module; straightforward refactor of types previously inline in authorization.py.
tests/test_authorization_resource_memberships.py	Comprehensive test coverage for all three new methods and both parent-resource identifier variants; contains an unused _mock_membership helper and uses the deprecated .dict() serialization in one fixture.
tests/utils/fixtures/mock_organization_membership.py	Adds MockAuthorizationOrganizationMembershipList fixture with two pre-populated AuthorizationOrganizationMembership entries; correct use of model_dump().

Sequence Diagram

sequenceDiagram
    participant Caller
    participant Authorization
    participant HTTPClient
    participant WorkOSAPI

    Note over Caller,WorkOSAPI: list_resources_for_membership
    Caller->>Authorization: list_resources_for_membership(org_membership_id, permission_slug, parent_resource)
    Authorization->>HTTPClient: GET /authorization/organization_memberships/{id}/resources?permission_slug=...&parent_resource_id=...
    HTTPClient->>WorkOSAPI: HTTP GET
    WorkOSAPI-->>HTTPClient: paginated AuthorizationResource list
    HTTPClient-->>Authorization: response dict
    Authorization-->>Caller: WorkOSListResource[AuthorizationResource]

    Note over Caller,WorkOSAPI: list_memberships_for_resource
    Caller->>Authorization: list_memberships_for_resource(resource_id, permission_slug, assignment?)
    Authorization->>HTTPClient: GET /authorization/resources/{id}/organization_memberships?permission_slug=...
    HTTPClient->>WorkOSAPI: HTTP GET
    WorkOSAPI-->>HTTPClient: paginated OrganizationMembership list
    HTTPClient-->>Authorization: response dict
    Authorization-->>Caller: WorkOSListResource[AuthorizationOrganizationMembership]

    Note over Caller,WorkOSAPI: list_memberships_for_resource_by_external_id
    Caller->>Authorization: list_memberships_for_resource_by_external_id(org_id, resource_type_slug, external_id, permission_slug)
    Authorization->>HTTPClient: GET /authorization/organizations/{org_id}/resources/{type}/{ext_id}/organization_memberships
    HTTPClient->>WorkOSAPI: HTTP GET
    WorkOSAPI-->>HTTPClient: paginated OrganizationMembership list
    HTTPClient-->>Authorization: response dict
    Authorization-->>Caller: WorkOSListResource[AuthorizationOrganizationMembership]

_{Last reviewed commit: a973327}

greptile-apps · 2026-03-02T21:18:45Z

tests/test_authorization_resource_memberships.py

+def _mock_membership(
+    membership_id: str = "om_01ABC",
+    user_id: str = "user_123",
+    organization_id: str = "org_456",
+    organization_name: str = "Acme Inc",
+    status: str = "active",
+) -> dict:
+    return {
+        "object": "organization_membership",
+        "id": membership_id,
+        "user_id": user_id,
+        "organization_id": organization_id,
+        "organization_name": organization_name,
+        "status": status,
+        "custom_attributes": None,
+        "created_at": "2024-01-01T00:00:00Z",
+        "updated_at": "2024-01-01T00:00:00Z",
+    }


Unused helper function

The _mock_membership function is defined but never called anywhere in the test file. The tests instead rely on MockAuthorizationOrganizationMembershipList directly via the mock_memberships_list_two fixture. This dead code should either be removed or used in a test case.

Suggested change

def _mock_membership(

membership_id: str = "om_01ABC",

user_id: str = "user_123",

organization_id: str = "org_456",

organization_name: str = "Acme Inc",

status: str = "active",

) -> dict:

return {

"object": "organization_membership",

"id": membership_id,

"user_id": user_id,

"organization_id": organization_id,

"organization_name": organization_name,

"status": status,

"custom_attributes": None,

"created_at": "2024-01-01T00:00:00Z",

"updated_at": "2024-01-01T00:00:00Z",

}

(Remove lines 16–33 entirely)

is it expected that this is not used?

No, it's not expected - this is genuinely unused code. After reviewing the full test file, all tests rely on the mock_memberships_list_two fixture which returns MockAuthorizationOrganizationMembershipList().model_dump(). The _mock_membership helper function is never called anywhere.

Looking at similar test files in the codebase (like test_authorization_resource.py), they follow the same pattern: using fixture-based mock objects from classes like MockAuthorizationResource() rather than helper functions. The _mock_membership function appears to be leftover code that was either never used or replaced by the fixture approach.

You should remove it.

greptile-apps · 2026-03-02T21:18:46Z

tests/test_authorization_resource_memberships.py

+
+    @pytest.fixture
+    def mock_resources_list_two(self):
+        return MockAuthorizationResourceList().dict()


Deprecated .dict() instead of .model_dump()

.dict() is a Pydantic v1 alias and is deprecated in Pydantic v2. The sibling fixture in TestListMembershipsForResource already uses .model_dump() correctly (line 446). Use .model_dump() here for consistency and to avoid deprecation warnings.

Suggested change

return MockAuthorizationResourceList().dict()

return MockAuthorizationResourceList().model_dump()

seems valid

atainter

Few minor things

atainter · 2026-03-03T21:30:49Z

src/workos/authorization.py

-    parent_resource_type_slug: str
+class AuthorizationOrganizationMembershipListFilters(ListArgs, total=False):
+    permission_slug: str
+    assignment: Optional[Literal["direct", "indirect"]]


Might be worth making assignment a type since we'll most likely add it to the list resources for membership endpoint soon.

Also referenced a few places so we won't have to redeclare the literals

atainter · 2026-03-03T21:34:51Z

tests/test_authorization_resource_memberships.py

+def _mock_membership(
+    membership_id: str = "om_01ABC",
+    user_id: str = "user_123",
+    organization_id: str = "org_456",
+    organization_name: str = "Acme Inc",
+    status: str = "active",
+) -> dict:
+    return {
+        "object": "organization_membership",
+        "id": membership_id,
+        "user_id": user_id,
+        "organization_id": organization_id,
+        "organization_name": organization_name,
+        "status": status,
+        "custom_attributes": None,
+        "created_at": "2024-01-01T00:00:00Z",
+        "updated_at": "2024-01-01T00:00:00Z",
+    }


is it expected that this is not used?

atainter · 2026-03-03T21:35:03Z

tests/test_authorization_resource_memberships.py

+
+    @pytest.fixture
+    def mock_resources_list_two(self):
+        return MockAuthorizationResourceList().dict()


seems valid

atainter · 2026-03-03T21:36:59Z

tests/test_authorization_resource_memberships.py

+
+        assert response.object == "list"
+        assert len(response.data) == 2
+        assert response.data[0].id == "om_01ABC"


worth checking all other fields are deserialized on these happy path tests?

FGA_5: list_resources_for_membership, list_memberships_for_resource, …

f3c6575

…list_memberships_for_resource_by_external_id

greptile-apps bot reviewed Feb 21, 2026

View reviewed changes

swaroopAkkineniWorkos added 4 commits February 23, 2026 05:47

lol

43bae56

minor nit

d66d6ec

refactor

9149f71

moar

e9a6975

workos deleted a comment from greptile-apps bot Feb 23, 2026

greptile-apps bot reviewed Feb 23, 2026

View reviewed changes

swaroopAkkineniWorkos marked this pull request as ready for review February 23, 2026 17:52

swaroopAkkineniWorkos requested a review from a team as a code owner February 23, 2026 17:52

swaroopAkkineniWorkos requested review from atainter and gjtorikian and removed request for a team February 23, 2026 17:52

csrbarber reviewed Feb 25, 2026

View reviewed changes

swaroopAkkineniWorkos added 4 commits March 2, 2026 07:58

enough

4a949d6

lol

700d915

Merge branch 'ENT-5224-python-sdk-for-fga-worktree-fuck-around' into …

3412ff0

…fga-pr5

final

e4c8031

workos deleted a comment from greptile-apps bot Mar 2, 2026

swaroopAkkineniWorkos added 4 commits March 2, 2026 11:11

final

47e2c77

lol

7453f18

lol

adcafb5

lol

a973327

greptile-apps bot reviewed Mar 2, 2026

View reviewed changes

csrbarber approved these changes Mar 3, 2026

View reviewed changes

atainter approved these changes Mar 3, 2026

View reviewed changes

feedback

c604ff2

swaroopAkkineniWorkos changed the title ~~FGA_5: list_resources_for_membership, list_memberships_for_resource, list_memberships_for_resource_by_external_id~~ feat: FGA_5 list_resources_for_membership, list_memberships_for_resource, list_memberships_for_resource_by_external_id Mar 4, 2026

swaroopAkkineniWorkos added 2 commits March 4, 2026 06:20

merge conflcits

b3c924c

lint

30876c9

swaroopAkkineniWorkos merged commit 08f1c84 into ENT-5224-python-sdk-for-fga-worktree-fuck-around Mar 4, 2026
11 checks passed

swaroopAkkineniWorkos deleted the fga-pr5 branch March 4, 2026 16:31

	return MockAuthorizationResourceList().dict()
	return MockAuthorizationResourceList().model_dump()

Conversation

swaroopAkkineniWorkos commented Feb 20, 2026

Description

Documentation

Uh oh!

swaroopAkkineniWorkos commented Feb 21, 2026

Uh oh!

greptile-apps bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos commented Feb 23, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

csrbarber left a comment

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos commented Mar 2, 2026

Uh oh!

greptile-apps bot commented Mar 2, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Mar 2, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

atainter left a comment

Choose a reason for hiding this comment

Uh oh!

atainter Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

greptile-apps bot left a comment •

edited

Loading