feat(generated): Add Groups API and organization membership groups support

[workos-sdk-automation]

Summary

• New GroupService: Added full Groups API support with methods to create, list, get, update, and delete groups within organizations
  • New methods: ListOrganizationGroups(), CreateOrganizationGroup(), GetOrganizationGroup(), UpdateOrganizationGroup(), DeleteOrganizationGroup()
  • New methods for group memberships: ListOrganizationMemberships(), CreateOrganizationMembership(), DeleteOrganizationMembership()
• New Group model: Added Group struct with ID, name, description, organization_id, created_at, and updated_at fields
• New UserManagementOrganizationMembershipGroupService: Added ListOrganizationMembershipGroups() to list groups for an organization membership
• Enhanced method naming: Renamed authorization methods for clarity (e.g., ListOrganizationMembershipResources → ListResourcesForMembership, DeleteOrganizationMembershipRoleAssignment → RemoveRoleAssignment)
• New models and enums: Added WaitlistUser, WaitlistUserState enum, CreateGroup, CreateGroupMembership, DomainVerificationIntentOptions
• Extended SSO provider support: Added new OAuth providers (Bitbucket, GitLab, Intuit, LinkedIn, Salesforce, Slack, Vercel, Xero) to SSOProvider enum

Triggered by workos/openapi-spec@36f2763

[greptile-apps]

Greptile Summary

This generated PR adds a full GroupService (CRUD for organization groups + membership management), a UserManagementOrganizationMembershipGroupService for listing groups per membership, renames several AuthorizationService methods for clarity, and extends enums with new SSO providers and model types.

• testdata/list_user_organization_membership_base_list_data.json was dropped from .oagen-manifest.json but both the regenerated authorization_test.go and the new groups_test.go still reference it at runtime — if oagen uses the manifest for cleanup this file will be deleted on the next generation run, breaking multiple tests.

Confidence Score: 4/5

Safe to merge with the manifest inconsistency addressed; the fixture file exists today so no tests are broken in the current state.

One P1 finding: the manifest removal of testdata/list_user_organization_membership_base_list_data.json diverges from what the generated test files actually read. Tests pass today because the file still exists, but the next oagen run could delete it. All new service code is well-structured and follows established patterns.

.oagen-manifest.json and groups_test.go warrant a second look for the fixture tracking inconsistency.

Important Files Changed

Filename	Overview
groups.go	New GroupService with full CRUD for organization groups and group membership management; URL escaping applied consistently, return types and error handling follow established patterns.
groups_test.go	Tests for GroupService; mutating operations reuse testdata/group.json instead of the newly added purpose-built fixtures, and the ListOrganizationMemberships test references a fixture removed from the manifest.
.oagen-manifest.json	Manifest updated to v2 with new operations map and new file entries; testdata/list_user_organization_membership_base_list_data.json was removed from the files list while generated tests still reference it.
authorization.go	Methods renamed for clarity (ListOrganizationMembershipResources → ListResourcesForMembership, DeleteOrganizationMembershipRoleAssignment → RemoveRoleAssignment); logic and URL construction are correct.
user_management_organization_membership_groups.go	New service exposing ListOrganizationMembershipGroups via /user_management/organization_memberships/{omId}/groups; correct iterator pattern and URL escaping.
workos.go	Client wires GroupService and UserManagementOrganizationMembershipGroupService correctly; accessor methods follow established naming patterns.
authorization_test.go	Regenerated test file covering the renamed authorization methods; references testdata/list_user_organization_membership_base_list_data.json which still exists on disk but was dropped from the manifest.
admin_portal.go	Breaking rename of AdminEmails/admin_emails → ItContactEmails/it_contact_emails in AdminPortalGenerateLinkParams; callers must update field name after upgrading.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant GroupService
    participant UserMgmtOMGroupService
    participant WorkOS API

    Caller->>GroupService: ListOrganizationGroups(orgID, params)
    GroupService->>WorkOS API: GET /organizations/{orgID}/groups
    WorkOS API-->>GroupService: Iterator[Group]
    GroupService-->>Caller: Iterator[Group]

    Caller->>GroupService: CreateOrganizationGroup(orgID, params)
    GroupService->>WorkOS API: POST /organizations/{orgID}/groups
    WorkOS API-->>GroupService: Group
    GroupService-->>Caller: *Group

    Caller->>GroupService: CreateOrganizationMembership(orgID, groupID, params)
    GroupService->>WorkOS API: POST /organizations/{orgID}/groups/{groupID}/organization-memberships
    WorkOS API-->>GroupService: Group
    GroupService-->>Caller: *Group

    Caller->>GroupService: DeleteOrganizationMembership(orgID, groupID, omID)
    GroupService->>WorkOS API: DELETE /organizations/{orgID}/groups/{groupID}/organization-memberships/{omID}
    WorkOS API-->>GroupService: 204 No Content
    GroupService-->>Caller: error

    Caller->>UserMgmtOMGroupService: ListOrganizationMembershipGroups(omID, params)
    UserMgmtOMGroupService->>WorkOS API: GET /user_management/organization_memberships/{omID}/groups
    WorkOS API-->>UserMgmtOMGroupService: Iterator[Group]
    UserMgmtOMGroupService-->>Caller: Iterator[Group]

Loading

Comments Outside Diff (1)

1. .oagen-manifest.json, line 58 (link)

   Fixture removed from manifest but still referenced by generated tests

   testdata/list_user_organization_membership_base_list_data.json was removed from the "files" array in this manifest, but both the regenerated authorization_test.go and the new groups_test.go still read that file at runtime. If oagen uses the manifest to decide which files to delete during a future regeneration cycle, the fixture will be removed and those tests will start failing with a "file not found" error. The file should remain in the manifest as long as any generated test references it.

_{Reviews (2): Last reviewed commit: "fix cross-domain aliases" | Re-trigger Greptile}

[greptile-apps]

Breaking rename of AdminEmails → ItContactEmails

The field AdminEmails (JSON: admin_emails) has been renamed to ItContactEmails (JSON: it_contact_emails) in AdminPortalGenerateLinkParams. Any existing caller that sets AdminEmails will get a compile error after upgrading. The same rename appears in the GenerateLink model in models.go. While this is generated code following the OpenAPI spec, a changelog note or deprecation period is worth considering to give consumers time to migrate.

[greptile-apps]

Required field left empty in CreateOrganizationMembership test

GroupsCreateOrganizationMembershipParams.OrganizationMembershipID is a required string field with no omitempty tag, but the test constructs the params as &workos.GroupsCreateOrganizationMembershipParams{} (zero value), so an empty organization_membership_id is sent in the request body. The mock server accepts any body, so the test passes, but it never exercises the actual required-field serialization path. Setting a non-empty ID (e.g. "om_test123") would make the test more representative.