feat: rest + grpc for orgs, SSO, SCIM, webauthn; full protocol coverage - #10
Merged
Conversation
33 operations were graphql-only because the server had no RPC for them. Server 2.4.0 (authorizer #739) added the proto RPCs and REST bindings for organizations, org members, org domains, org OIDC/SAML connections, SCIM endpoints, WebAuthn ceremonies and TOTP setup, so their MethodSpecs move from GQL_ONLY to all three protocols. A further 5 -- admin_logout, admin_session, admin_meta, fga_get_model and fga_reset -- were rest+grpc-only despite each having a GraphQL op on the server; the SDK simply carried no query for them. That leaves admin_signup, update_env and generate_jwt_keys graphql-only, the only admin operations with no proto RPC. The response unwrap differs per endpoint and is the easy thing to get wrong, so each is pinned by a live test running over every protocol: a single nested payload is unwrapped (organization, org_member, org_domain, challenge, org_oidc_connection, org_saml_connection, scim_endpoint, webauthn_credentials) while flat messages are read whole -- paginated lists, and the SCIM create/rotate pair carrying endpoint plus one-time token, where unwrapping either field would drop the other. No reader was added for _env: like _update_env, its resolver is a tombstone returning "deprecated. please configure env via cli args". Requires authorizer-proto 0.2.0rc0. CI now runs against 2.4.0-rc.13.
lakhansamani
force-pushed
the
feat/rest-grpc-parity-2.4.0
branch
from
August 2, 2026 05:03
3af3734 to
57d5a37
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings the SDK to full protocol coverage against server 2.4.0.
What changed
33 operations that were graphql-only gained proto RPCs and REST bindings in authorizer #739 — organizations, org members, org domains, org OIDC/SAML connections, SCIM endpoints, WebAuthn ceremonies and TOTP setup. Their
MethodSpecs move fromGQL_ONLYto all three protocols.A further 5 —
admin_logout,admin_session,admin_meta,fga_get_model,fga_reset— were rest+grpc-only even though each has a GraphQL op on the server; the SDK simply carried no query for them. They now span all three too.That leaves
admin_signup,update_envandgenerate_jwt_keysgraphql-only. They are the only admin operations with no proto RPC, so this is full coverage.Response unwrapping
The unwrap differs per endpoint and is the easy thing to get wrong. A single nested payload is unwrapped (
organization,org_member,org_domain,challenge,org_oidc_connection,org_saml_connection,scim_endpoint,webauthn_credentials); flat messages are read whole — paginated lists, and the SCIM create/rotate pair carrying endpoint plus one-time token, where unwrapping either field would drop the other.Each is pinned by a live test running over every protocol. Mutation-tested: setting
create_organization's unwrap toNonefails rest and grpc while graphql still passes.Not added
No reader for
_env. Like_update_env, its resolver is a tombstone returningdeprecated. please configure env via cli args— v2 configures everything through CLI flags. I built it, found this live, and reverted it.Verification
201 tests pass, including 21 new live tests (7 scenarios × 3 protocols) against a real 2.4.0 server. ruff and mypy clean.
Requires authorizer-proto 0.2.0rc0 (released).