feat: Add native group authorization

[SamyPesse]

Native AuthKit group role assignments are missing from the emulator, so apps using group permissions cannot exercise their authorization flows locally. This adds group assignment create/list/get/delete endpoints, role-and-resource criteria removal for group and direct grants, and the Node SDK's resource PATCH paths.

Checks, effective permissions, resource discovery, and assignment listings resolve current group memberships and resource ancestors through the existing stored roles and resources. Deleting members or groups revokes their derived grants; deleting roles, resources, or organizations cleans up group grants, including grants scoped to the organization itself. Derived role assignments use stable role_assignment_ IDs across membership and resource listings. No assignment webhooks or delayed reconciliation are simulated. Bulk group replacement and resource-type configuration remain outside this subset.

The supported-feature matrix and README describe the added behavior and limits. This is based on the latest upstream main and contains no request-budget changes from #133.

Validation:

• All 1,348 upstream tests pass, including four focused HTTP flows for group access/revocation, direct/group criteria removals, group deletion, and resource PATCH paths.
• Build, type checks, lint, formatting, Node compatibility smoke, and package validation pass.
• All 18 organization and group HTTP tests also pass against OpenKnowledge Compute's installed patched @workos/emulate@0.14.0; its nine changed authorization runtime/type files match this branch's build byte for byte.

API references: group role assignments and criteria removal.

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge; all three previous findings are addressed and no new blocking issue was found.

Summary

Adds native group role assignments, criteria-based grant removal, and resource updates through the Node SDK's PATCH paths.

• Group role grants now flow into current members’ authorization checks.
• Role grants can be removed by role and resource criteria.
• Resource details can be patched by ID or external identity.
• Deleting authorization records also clears their group grants.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Membership[Organization membership] --> Links[Current group memberships]
  Links --> Groups[Existing groups in the same organization]
  Groups --> Grants[Group role assignments]
  Grants --> Scope[Target resource and ancestors]
  Scope --> Permissions[Role permissions]
  Direct[Direct role assignments] --> Scope
  Permissions --> Check[Permission check]

Loading

_{Reviews (2) · Last reviewed commit: "Fix group authorization review findings" · Reviewed by Greptile}