feat!: Generate SSO from OpenAPI spec

.oagen-manifest.json

@@ -1,7 +1,7 @@
 {
   "version": 2,
   "language": "node",
-  "generatedAt": "2026-06-01T17:59:24.986Z",
+  "generatedAt": "2026-06-18T17:09:23.986Z",
   "files": [
     "src/api-keys/interfaces/create-validation-options.interface.ts",
     "src/api-keys/interfaces/delete-api-key-options.interface.ts",
@@ -116,6 +116,56 @@
     "src/radar/serializers/radar-standalone-response.serializer.ts",
     "src/radar/serializers/radar-standalone-update-radar-attempt-request.serializer.ts",
     "src/radar/serializers/radar-standalone-update-radar-list-request.serializer.ts",
+    "src/sso/fixtures/connection-domain.json",
+    "src/sso/fixtures/connection-option.json",
+    "src/sso/fixtures/connection.json",
+    "src/sso/fixtures/list-connection.json",
+    "src/sso/fixtures/profile.json",
+    "src/sso/fixtures/slim-role.json",
+    "src/sso/fixtures/sso-authorize-url-response.json",
+    "src/sso/fixtures/sso-logout-authorize-request.json",
+    "src/sso/fixtures/sso-logout-authorize-response.json",
+    "src/sso/fixtures/sso-token-response-oauth-token.json",
+    "src/sso/fixtures/sso-token-response.json",
+    "src/sso/fixtures/token-query.json",
+    "src/sso/interfaces/authorize-logout-options.interface.ts",
+    "src/sso/interfaces/connection-domain.interface.ts",
+    "src/sso/interfaces/connection-option.interface.ts",
+    "src/sso/interfaces/connection-state.interface.ts",
+    "src/sso/interfaces/connection-status.interface.ts",
+    "src/sso/interfaces/connection-type.interface.ts",
+    "src/sso/interfaces/connection.interface.ts",
+    "src/sso/interfaces/connections-connection-type.interface.ts",
+    "src/sso/interfaces/delete-connection-options.interface.ts",
+    "src/sso/interfaces/get-authorization-url-options.interface.ts",
+    "src/sso/interfaces/get-connection-options.interface.ts",
+    "src/sso/interfaces/get-logout-url-options.interface.ts",
+    "src/sso/interfaces/index.ts",
+    "src/sso/interfaces/profile-connection-type.interface.ts",
+    "src/sso/interfaces/profile.interface.ts",
+    "src/sso/interfaces/slim-role.interface.ts",
+    "src/sso/interfaces/sso-authorize-url-response.interface.ts",
+    "src/sso/interfaces/sso-logout-authorize-request.interface.ts",
+    "src/sso/interfaces/sso-logout-authorize-response.interface.ts",
+    "src/sso/interfaces/sso-provider.interface.ts",
+    "src/sso/interfaces/sso-token-response-oauth-token.interface.ts",
+    "src/sso/interfaces/sso-token-response.interface.ts",
+    "src/sso/interfaces/token-query.interface.ts",
+    "src/sso/serializers.spec.ts",
+    "src/sso/serializers/connection-domain.serializer.ts",
+    "src/sso/serializers/connection-option.serializer.ts",
+    "src/sso/serializers/connection.serializer.ts",
+    "src/sso/serializers/index.ts",
+    "src/sso/serializers/profile.serializer.ts",
+    "src/sso/serializers/slim-role.serializer.ts",
+    "src/sso/serializers/sso-authorize-url-response.serializer.ts",
+    "src/sso/serializers/sso-logout-authorize-request.serializer.ts",
+    "src/sso/serializers/sso-logout-authorize-response.serializer.ts",
+    "src/sso/serializers/sso-token-response-oauth-token.serializer.ts",
+    "src/sso/serializers/sso-token-response.serializer.ts",
+    "src/sso/serializers/token-query.serializer.ts",
+    "src/sso/sso.spec.ts",
+    "src/sso/sso.ts",
     "src/vault/fixtures/actor.json",
     "src/vault/fixtures/create-data-key-request.json",
     "src/vault/fixtures/create-data-key-response.json",

src/events/events.spec.ts

@@ -66,8 +66,8 @@ describe('Event', () => {
       type: ConnectionType.OktaSAML,
       state: 'active',
       domains: [],
-      createdAt: '2020-05-06 04:21:48.649164',
-      updatedAt: '2020-05-06 04:21:48.649164',
+      createdAt: new Date('2020-05-06 04:21:48.649164'),
+      updatedAt: new Date('2020-05-06 04:21:48.649164'),
     },
   };
 

src/sso/fixtures/connection-domain.json

@@ -0,0 +1,5 @@
+{
+  "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A",
+  "object": "connection_domain",
+  "domain": "foo-corp.com"
+}

src/sso/fixtures/connection-option.json

@@ -0,0 +1,3 @@
+{
+  "signing_cert": null
+}

src/sso/fixtures/connection.json

@@ -0,0 +1,21 @@
+{
+  "object": "connection",
+  "id": "conn_01E4ZCR3C56J083X43JQXF3JK5",
+  "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
+  "connection_type": "OktaSAML",
+  "name": "Foo Corp",
+  "state": "active",
+  "status": "linked",
+  "domains": [
+    {
+      "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A",
+      "object": "connection_domain",
+      "domain": "foo-corp.com"
+    }
+  ],
+  "options": {
+    "signing_cert": null
+  },
+  "created_at": "2026-01-15T12:00:00.000Z",
+  "updated_at": "2026-01-15T12:00:00.000Z"
+}

src/sso/fixtures/list-connection.json

@@ -0,0 +1,29 @@
+{
+  "data": [
+    {
+      "object": "connection",
+      "id": "conn_01E4ZCR3C56J083X43JQXF3JK5",
+      "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY",
+      "connection_type": "OktaSAML",
+      "name": "Foo Corp",
+      "state": "active",
+      "status": "linked",
+      "domains": [
+        {
+          "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A",
+          "object": "connection_domain",
+          "domain": "foo-corp.com"
+        }
+      ],
+      "options": {
+        "signing_cert": null
+      },
+      "created_at": "2026-01-15T12:00:00.000Z",
+      "updated_at": "2026-01-15T12:00:00.000Z"
+    }
+  ],
+  "list_metadata": {
+    "before": null,
+    "after": null
+  }
+}

src/sso/fixtures/profile.json

@@ -0,0 +1,27 @@
+{
+  "object": "profile",
+  "id": "prof_01DMC79VCBZ0NY2099737PSVF1",
+  "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3",
+  "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5",
+  "connection_type": "OktaSAML",
+  "idp_id": "103456789012345678901",
+  "email": "todd@example.com",
+  "first_name": "Todd",
+  "last_name": "Rundgren",
+  "name": "Todd Rundgren",
+  "role": {
+    "slug": "admin"
+  },
+  "roles": [
+    {
+      "slug": "admin"
+    }
+  ],
+  "groups": ["Engineering", "Admins"],
+  "custom_attributes": {
+    "key": {}
+  },
+  "raw_attributes": {
+    "key": {}
+  }
+}

src/sso/fixtures/slim-role.json

@@ -0,0 +1,3 @@
+{
+  "slug": "admin"
+}

src/sso/fixtures/sso-authorize-url-response.json

@@ -0,0 +1,3 @@
+{
+  "url": "https://accounts.google.com/o/oauth2/v2/auth?client_id=example&redirect_uri=https%3A%2F%2Fapi.workos.com%2Fsso%2Fcallback&response_type=code&scope=openid%20profile%20email"
+}

src/sso/fixtures/sso-logout-authorize-request.json

@@ -0,0 +1,3 @@
+{
+  "profile_id": "prof_01HXYZ123456789ABCDEFGHIJ"
+}

src/sso/fixtures/sso-logout-authorize-response.json

@@ -0,0 +1,4 @@
+{
+  "logout_url": "https://auth.workos.com/sso/logout?token=eyJhbGciOiJSUzI1NiJ9",
+  "logout_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJwcm9maWxlX2lkIjoicHJvZl8wMUdXUTFHMEgyRk02QVNFRjBIUzEzSENXOS0zMDRrZzAzZyIsImV4cCI6IjE1MTYyMzkwMjIifQ.Wru9Qlnf5DpohtGCKhZU4cVOd3zpiu7QQ-XEX--5A_4"
+}

src/sso/fixtures/sso-token-response-oauth-token.json

@@ -0,0 +1,7 @@
+{
+  "provider": "GoogleOAuth",
+  "refresh_token": "1//04g...",
+  "access_token": "ya29.a0ARrdaM...",
+  "expires_at": 1735141800,
+  "scopes": ["profile", "email", "openid"]
+}

src/sso/fixtures/sso-token-response.json

@@ -0,0 +1,39 @@
+{
+  "token_type": "Bearer",
+  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzby...",
+  "expires_in": 600,
+  "profile": {
+    "object": "profile",
+    "id": "prof_01DMC79VCBZ0NY2099737PSVF1",
+    "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3",
+    "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5",
+    "connection_type": "OktaSAML",
+    "idp_id": "103456789012345678901",
+    "email": "todd@example.com",
+    "first_name": "Todd",
+    "last_name": "Rundgren",
+    "name": "Todd Rundgren",
+    "role": {
+      "slug": "admin"
+    },
+    "roles": [
+      {
+        "slug": "admin"
+      }
+    ],
+    "groups": ["Engineering", "Admins"],
+    "custom_attributes": {
+      "key": {}
+    },
+    "raw_attributes": {
+      "key": {}
+    }
+  },
+  "oauth_tokens": {
+    "provider": "GoogleOAuth",
+    "refresh_token": "1//04g...",
+    "access_token": "ya29.a0ARrdaM...",
+    "expires_at": 1735141800,
+    "scopes": ["profile", "email", "openid"]
+  }
+}

src/sso/fixtures/token-query.json

@@ -0,0 +1,6 @@
+{
+  "client_id": "client_01HZBC6N1EB1ZY7KG32X",
+  "client_secret": "sk_example_123456789",
+  "code": "authorization_code_value",
+  "grant_type": "authorization_code"
+}

src/sso/interfaces/authorize-logout-options.interface.ts

@@ -0,0 +1,6 @@
+// This file is auto-generated by oagen. Do not edit.
+
+export interface AuthorizeLogoutOptions {
+  /** The unique ID of the profile to log out. */
+  profileId: string;
+}

src/sso/interfaces/connection-domain.interface.ts

@@ -0,0 +1,16 @@
+// This file is auto-generated by oagen. Do not edit.
+
+export interface ConnectionDomain {
+  /** Unique identifier for the Connection Domain. */
+  id: string;
+  /** Distinguishes the Connection Domain object. */
+  object: 'connection_domain';
+  /** The domain value. */
+  domain: string;
+}
+
+export interface ConnectionDomainResponse {
+  id: string;
+  object: 'connection_domain';
+  domain: string;
+}

src/sso/interfaces/connection-option.interface.ts

@@ -0,0 +1,11 @@
+// This file is auto-generated by oagen. Do not edit.
+
+/** Configuration options for SAML connections. Only present for SAML connection types. */
+export interface ConnectionOption {
+  /** The signing certificate of the SAML connection. */
+  signingCert: string | null;
+}
+
+export interface ConnectionOptionResponse {
+  signing_cert: string | null;
+}

src/sso/interfaces/connection-state.interface.ts

@@ -0,0 +1,13 @@
+// This file is auto-generated by oagen. Do not edit.
+
+export const ConnectionState = {
+  RequiresType: 'requires_type',
+  Draft: 'draft',
+  Active: 'active',
+  Validating: 'validating',
+  Inactive: 'inactive',
+  Deleting: 'deleting',
+} as const;
+
+export type ConnectionState =
+  (typeof ConnectionState)[keyof typeof ConnectionState];

src/sso/interfaces/connection-status.interface.ts

@@ -0,0 +1,9 @@
+// This file is auto-generated by oagen. Do not edit.
+
+export const ConnectionStatus = {
+  Linked: 'linked',
+  Unlinked: 'unlinked',
+} as const;
+
+export type ConnectionStatus =
+  (typeof ConnectionStatus)[keyof typeof ConnectionStatus];