feat: Add native group authorization

[SamyPesse]

Native AuthKit group role assignments are missing from the emulator, so apps using group permissions cannot exercise their authorization flows locally. This adds group assignment create/list/get/delete endpoints, role-and-resource criteria removal for group and direct grants, and the Node SDK's resource PATCH paths.

Checks, effective permissions, resource discovery, and assignment listings resolve current group memberships and resource ancestors through the existing stored roles and resources. Deleting members or groups revokes their derived grants; deleting roles, resources, or organizations cleans up group grants, including grants scoped to the organization itself. Derived role assignments use stable role_assignment_ IDs across membership and resource listings. No assignment webhooks or delayed reconciliation are simulated. Bulk group replacement and resource-type configuration remain outside this subset.

The supported-feature matrix and README describe the added behavior and limits. This is based on the latest upstream main and contains no request-budget changes from #133.

Validation:

• All 1,348 upstream tests pass, including four focused HTTP flows for group access/revocation, direct/group criteria removals, group deletion, and resource PATCH paths.
• Build, type checks, lint, formatting, Node compatibility smoke, and package validation pass.
• All 18 organization and group HTTP tests also pass against OpenKnowledge Compute's installed patched @workos/emulate@0.14.0; its nine changed authorization runtime/type files match this branch's build byte for byte.

API references: group role assignments and criteria removal.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge, with the previous member-removal issue fixed.

Summary

Adds native group role assignments and includes their grants in permission checks and assignment lists.

• Apps can assign, view, and remove roles for AuthKit groups.
• Group role grants give current members access to scoped resources.
• Callers can remove role grants by role and resource.
• Resource updates accept the Node SDK's PATCH paths.
• Deleting a group, role, or resource clears its group grants.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Membership[Organization membership] --> Links[Current group links]
  Links --> Group[Group]
  Group --> Grants[Group role assignments]
  Grants --> Roles[Stored roles and permissions]
  Grants --> Scope[Resource and its ancestors]
  Roles --> Checks[Permission checks and lists]
  Scope --> Checks

Loading

_{Reviews (6) · Last reviewed commit: "fix(seed): link a membership to a seeded..." · Reviewed by Greptile}

[gjtorikian]

thanks!