feat: Add source to role assignments to distinguish group grants

[csrbarber]

Summary

Adds Node support for workos/workos#63214, which adds a source object to UserRoleAssignment REST responses.

RoleAssignment now carries a source with a type ("direct" | "group") and a nullable groupRoleAssignmentId, letting callers distinguish directly-assigned roles from those derived from a group role assignment.

Changes

• New RoleAssignmentSource / RoleAssignmentSourceResponse interfaces; source added to RoleAssignment and RoleAssignmentResponse
• Serializer maps group_role_assignment_id → groupRoleAssignmentId
• Fixtures + tests updated; added coverage for the group-derived case

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR adds role assignment source metadata to authorization responses. The main changes are:

• New direct/group source interfaces for role assignments.
• CamelCase serialization for group_role_assignment_id.
• Updated role assignment fixtures and tests for direct and group-derived grants.

Confidence Score: 4/5

The new role-assignment serializer path can throw when existing API responses or mocks omit the added source field.

• The positive direct/group source serialization behavior is implemented for responses that include the new object.
• The compatibility path for responses without source still needs attention because it can fail before returning otherwise valid role assignment data.

src/authorization/serializers/role-assignment.serializer.ts

T-Rex Logs

What T-Rex did

• The team captured the base serializer behavior using a local mocked 200 OK response, noting that the deserialized output omits the source and Contract delivered is false.
• The team captured the PR-head serializer execution with npx tsx, recording that the deserialized direct source is { type: direct, groupRoleAssignmentId: null }, the group source is { type: group, groupRoleAssignmentId: group_role_assignment_123 }, and Contract delivered is true.

_{Ran code and verified through T-Rex}

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
src/authorization/serializers/role-assignment.serializer.ts:18-21
**Missing Source Crashes Deserialization**

When a role assignment response from an older API server, rollback, or existing mock omits the new `source` object, this path reads `response.source.type` and throws before returning the assignment. That makes otherwise valid role assignment list and assign calls fail during deserialization.

```suggestion
  source: response.source
    ? {
        type: response.source.type,
        groupRoleAssignmentId: response.source.group_role_assignment_id,
      }
    : {
        type: 'direct',
        groupRoleAssignmentId: null,
      },
```

_{Reviews (1): Last reviewed commit: "feat: Add source to role assignments to ..." | Re-trigger Greptile}