feat: Add organization role support

[csrbarber]

Description

• Adds Organization Role support

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[X] Yes

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

[linear]

ENT-4798 workos-node

[greptile-apps]

Greptile Overview

Greptile Summary

Added organization role support to the Authorization module, mirroring the existing environment role functionality with organization-scoped operations.

• Implemented 8 new methods in Authorization class: createOrganizationRole, listOrganizationRoles, getOrganizationRole, updateOrganizationRole, deleteOrganizationRole, setOrganizationRolePermissions, addOrganizationRolePermission, and removeOrganizationRolePermission
• All methods follow the established pattern from environment roles with organization ID scoping
• Added complete type definitions with proper interfaces for options and responses
• Implemented serializers for snake_case to camelCase conversion
• listOrganizationRoles returns mixed Role types (both EnvironmentRole and OrganizationRole) using discriminated union via the type field
• Comprehensive test coverage added for all new methods with appropriate fixtures
• Follows existing codebase patterns and conventions consistently

Confidence Score: 5/5

• This PR is safe to merge with no identified risks
• The implementation follows established patterns from environment roles exactly, has comprehensive test coverage for all methods, uses proper TypeScript typing, and doesn't introduce any security concerns or violate custom rules
• No files require special attention

Important Files Changed

Filename	Overview
src/authorization/authorization.ts	Added 8 new methods for organization role CRUD operations and permission management, following existing environment role patterns
src/authorization/authorization.spec.ts	Added comprehensive test coverage for all 8 organization role methods with fixtures
src/authorization/interfaces/organization-role.interface.ts	Defined OrganizationRole interface matching EnvironmentRole structure with type discrimination
src/authorization/serializers/organization-role.serializer.ts	Implemented deserializers for Role and OrganizationRole with snake_case to camelCase conversion

Sequence Diagram

sequenceDiagram
    participant Client
    participant Authorization
    participant WorkOS API
    participant Serializer

    Note over Client,Serializer: Create Organization Role Flow
    Client->>Authorization: createOrganizationRole(orgId, options)
    Authorization->>Serializer: serializeCreateOrganizationRoleOptions(options)
    Serializer-->>Authorization: serialized options
    Authorization->>WorkOS API: POST /authorization/organizations/{orgId}/roles
    WorkOS API-->>Authorization: OrganizationRoleResponse
    Authorization->>Serializer: deserializeOrganizationRole(data)
    Serializer-->>Authorization: OrganizationRole
    Authorization-->>Client: OrganizationRole

    Note over Client,Serializer: List Organization Roles Flow
    Client->>Authorization: listOrganizationRoles(orgId, options?)
    Authorization->>WorkOS API: GET /authorization/organizations/{orgId}/roles
    WorkOS API-->>Authorization: ListOrganizationRolesResponse
    Authorization->>Serializer: deserializeRole() for each role
    Serializer-->>Authorization: Role[]
    Authorization-->>Client: RoleList (EnvironmentRole + OrganizationRole)

    Note over Client,Serializer: Permission Management Flow
    Client->>Authorization: addOrganizationRolePermission(orgId, slug, permSlug)
    Authorization->>WorkOS API: POST /authorization/organizations/{orgId}/roles/{slug}/permissions
    WorkOS API-->>Authorization: OrganizationRoleResponse
    Authorization->>Serializer: deserializeOrganizationRole(data)
    Serializer-->>Authorization: OrganizationRole with updated permissions
    Authorization-->>Client: OrganizationRole

Loading

[greptile-apps]

_{4 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

[mattgd]

Should we update the Role type to be a union of this and the EnvironmentRole type?

[mattgd]

Might be worth disambiguating all of these orgId/slug parameters with an object. Similar comment from other PR, so good with matching whatever decision you make there.