Skip to content

fix: Directory User Group Filter - #56

Merged
gjtorikian merged 3 commits into
workos:mainfrom
kyleVsteger:fix/list-group-users
Aug 7, 2026
Merged

fix: Directory User Group Filter#56
gjtorikian merged 3 commits into
workos:mainfrom
kyleVsteger:fix/list-group-users

Conversation

@kyleVsteger

Copy link
Copy Markdown
Contributor

Why am I opening this PR?

The official documentation for listing directory users by group calls out the ?directory=<directory_id>&group=<group_id> query parameters.

The emulator API incorrectly expects ?directory_id=<> ?group_id=<>.

Similarly, the list directory groups is documented with ?directory=<> and the emulator API expects ?directory_id=<>

@greptile-apps

greptile-apps Bot commented Aug 6, 2026

Copy link
Copy Markdown

Greptile Summary

The PR aligns list-filter query parameters with the documented WorkOS API and repairs the single-logout URL parameter contract.

  • Updates directory user and group filters and adds coverage for idp_id, email, and user membership.
  • Changes organization name filtering to the documented search parameter.
  • Makes generated single-logout URLs use the token parameter consumed by the redirect endpoint.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename Overview
src/workos/routes/directories.ts Aligns directory list parameter names and adds directory-user and group-membership filters with focused test coverage.
src/workos/routes/organizations.ts Replaces the incorrect organization name filter parameter with the documented search parameter.
src/workos/routes/sso.ts Makes the issued logout URL and redirect endpoint consistently use the token query parameter.

Reviews (2): Last reviewed commit: "fix(routes): align list query params wit..." | Re-trigger Greptile

@gjtorikian gjtorikian changed the title Fix: Directory User Group Filter fix: Directory User Group Filter Aug 7, 2026
Four list endpoints read query params the API does not define, so a
caller passing the documented name got a silently unfiltered list
rather than an error. That is the failure mode a fixture holding one
record cannot catch, which is how it survived having tests.

/sso/logout takes `token`. Only the Logout Authorize response body
names it `logout_token`, and that field is required there, so the
asymmetry is deliberate.

The new `idp_id` and `email` filters do not enforce the spec's
"requires the directory parameter" precondition: its 422 body is
generic, and inventing the message would mean fabricating a value the
emulator cannot know.
@gjtorikian

Copy link
Copy Markdown
Collaborator

thank you! caught a couple of other places in this PR where a similar fix was needed.

@gjtorikian
gjtorikian merged commit 0f2fd2d into workos:main Aug 7, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants