@workos/oagen-emitters 0.11.0 → 0.12.0

package/src/rust/secret.ts

@@ -0,0 +1,59 @@
+/**
+ * Heuristics for spotting fields that hold secrets. The Rust emitter wraps
+ * such fields in `crate::SecretString` so their `Debug` representation does
+ * not accidentally leak the value.
+ *
+ * The list is intentionally conservative — only fields whose names strongly
+ * imply a credential or token are redacted. Generic names like `value` are
+ * skipped; the cost of a leaked secret is high enough that we'd rather miss
+ * the occasional secret than redact non-secret data and surprise users.
+ */
+const EXACT_NAMES = new Set<string>([
+  'password',
+  'new_password',
+  'old_password',
+  'password_hash',
+  'secret',
+  'client_secret',
+  'signing_secret',
+  'webhook_secret',
+  'token',
+  'access_token',
+  'refresh_token',
+  'id_token',
+  'session_token',
+  'authentication_token',
+  'pending_authentication_token',
+  'invitation_token',
+  'private_key',
+  'pem_private_key',
+  'data_key',
+  'encrypted_keys',
+  'encrypted_data_key',
+  'shared_secret',
+  'totp_secret',
+  'jwt',
+]);
+
+/** True when the field name strongly implies it holds a secret value. */
+export function isSensitiveFieldName(name: string): boolean {
+  const norm = name.toLowerCase().replace(/-/g, '_');
+  if (EXACT_NAMES.has(norm)) return true;
+  // Common suffix forms: `*_token`, `*_secret`, `*_password`, `*_api_key`.
+  if (/_password(_hash)?$/.test(norm)) return true;
+  if (norm.endsWith('_secret')) return true;
+  if (norm.endsWith('_token') && norm !== 'csrf_token' && norm !== 'request_token') return true;
+  return false;
+}
+
+/**
+ * If `rustType` is `String` or `Option<String>` and `fieldName` looks
+ * sensitive, return the redacted equivalent (`crate::SecretString` or
+ * `Option<crate::SecretString>`). Otherwise return `rustType` unchanged.
+ */
+export function applySecretRedaction(rustType: string, fieldName: string): string {
+  if (!isSensitiveFieldName(fieldName)) return rustType;
+  if (rustType === 'String') return 'crate::SecretString';
+  if (rustType === 'Option<String>') return 'Option<crate::SecretString>';
+  return rustType;
+}

package/src/rust/tests.ts

@@ -0,0 +1,298 @@
+import type {
+  ApiSpec,
+  EmitterContext,
+  Enum,
+  GeneratedFile,
+  Model,
+  Operation,
+  ResolvedOperation,
+  ResolvedWrapper,
+  TypeRef,
+} from '@workos/oagen';
+import { methodName, moduleName, typeName } from './naming.js';
+import { groupByMount } from '../shared/resolved-ops.js';
+import { exampleFor, generateFixtures } from './fixtures.js';
+import { resolveWrapperParams } from '../shared/wrapper-utils.js';
+
+/**
+ * Generate integration tests under `tests/`. Each mount group gets one
+ * `tests/{mount}_test.rs` file. Generated tests construct params, mock the
+ * expected request, then call the SDK method and assert the request was sent
+ * (`Mock::expect(1)`). JSON fixtures are emitted alongside.
+ */
+export function generateTests(spec: ApiSpec, ctx: EmitterContext): GeneratedFile[] {
+  const files: GeneratedFile[] = [];
+
+  files.push(...generateFixtures(spec));
+
+  files.push({
+    path: 'tests/common/mod.rs',
+    content: renderCommon(ctx),
+    overwriteExisting: true,
+  });
+
+  const groups = groupByMount(ctx);
+  const modelMap = new Map(spec.models.map((m) => [m.name, m]));
+  const enumMap = new Map(spec.enums.map((e) => [e.name, e]));
+
+  for (const [mountName, group] of groups) {
+    if (group.operations.length === 0) continue;
+    files.push({
+      path: `tests/${moduleName(mountName)}_test.rs`,
+      content: renderMountTest(mountName, group.resolvedOps, ctx, modelMap, enumMap),
+      overwriteExisting: true,
+    });
+  }
+
+  return files;
+}
+
+function renderCommon(ctx: EmitterContext): string {
+  const crate = crateName(ctx);
+  const imports = [
+    { path: 'wiremock::MockServer', sort: 'wiremock::MockServer' },
+    { path: `${crate}::Client`, sort: `${crate}::Client` },
+  ].sort((a, b) => a.sort.localeCompare(b.sort));
+
+  const useLines = imports.map((i) => `use ${i.path};`).join('\n');
+
+  return `#![allow(dead_code)]
+
+${useLines}
+
+pub async fn test_client(server: &MockServer) -> Client {
+    Client::builder()
+        .api_key("test_api_key")
+        .base_url(server.uri())
+        .max_retries(0)
+        .build()
+}
+`;
+}
+
+function renderMountTest(
+  mountName: string,
+  resolvedOps: ResolvedOperation[],
+  ctx: EmitterContext,
+  modelMap: Map<string, Model>,
+  enumMap: Map<string, Enum>,
+): string {
+  const accessor = moduleName(mountName);
+  const crate = crateName(ctx);
+  const lines: string[] = [];
+  lines.push('mod common;');
+  lines.push('');
+  lines.push('use wiremock::matchers::{method, path as path_matcher};');
+  lines.push('use wiremock::{Mock, MockServer, ResponseTemplate};');
+  lines.push('');
+
+  const seen = new Set<string>();
+
+  for (const r of resolvedOps) {
+    const op = r.operation;
+    if ((r.wrappers?.length ?? 0) > 0) {
+      for (const w of r.wrappers!) {
+        const m = methodName(w.name);
+        if (seen.has(m)) continue;
+        seen.add(m);
+        lines.push(...renderWrapperTest(op, w, ctx, accessor, crate, modelMap, enumMap));
+        lines.push('');
+      }
+      continue;
+    }
+    const m = methodName(r.methodName);
+    if (seen.has(m)) continue;
+    seen.add(m);
+    lines.push(...renderRegularTest(op, r, accessor, crate, modelMap, enumMap));
+    lines.push('');
+  }
+
+  // Trim a trailing blank line.
+  while (lines.length > 0 && lines[lines.length - 1] === '') lines.pop();
+
+  return lines.join('\n') + '\n';
+}
+
+/** Test for a non-wrapper operation. */
+function renderRegularTest(
+  op: Operation,
+  resolved: ResolvedOperation,
+  accessor: string,
+  crate: string,
+  modelMap: Map<string, Model>,
+  enumMap: Map<string, Enum>,
+): string[] {
+  const m = methodName(resolved.methodName);
+  const literalPath = op.path.replace(/\{[^}]+\}/g, 'test_id');
+  const httpMethod = op.httpMethod.toUpperCase();
+  const responseExpr = responseBodyExpr(op.response, modelMap, enumMap);
+
+  const hidden = new Set<string>([...Object.keys(resolved.defaults ?? {}), ...(resolved.inferFromClient ?? [])]);
+  const visibleQuery = op.queryParams.filter((p) => !hidden.has(p.name));
+  const visibleHeader = op.headerParams.filter((p) => !hidden.has(p.name));
+  const visibleParams = [...visibleQuery, ...visibleHeader];
+  const requiredParams = visibleParams.filter((p) => p.required);
+  const hasBody = op.requestBody !== undefined;
+  const bodyRequired = hasBody && op.requestBody!.kind !== 'nullable';
+  const emptyParams = !hasBody && visibleParams.length === 0;
+
+  const callArgs: string[] = [];
+  for (const _ of op.pathParams) callArgs.push('"test_id"');
+
+  if (!emptyParams) {
+    const paramsType = `${crate}::${accessor}::${typeName(resolved.methodName)}Params`;
+    if (requiredParams.length === 0 && !bodyRequired) {
+      callArgs.push(`${paramsType}::default()`);
+    } else {
+      const ctorArgs: string[] = [];
+      for (const p of requiredParams) {
+        ctorArgs.push(stubExpr(p.type, p.name, modelMap, enumMap));
+      }
+      if (hasBody) {
+        if (bodyRequired) {
+          ctorArgs.push(stubExpr(op.requestBody!, 'body', modelMap, enumMap));
+        }
+      }
+      callArgs.push(`${paramsType}::new(${ctorArgs.join(', ')})`);
+    }
+  }
+
+  const lines: string[] = [];
+  lines.push('#[tokio::test]');
+  lines.push(`async fn ${accessor}_${m}_round_trip() {`);
+  lines.push('    let server = MockServer::start().await;');
+  lines.push(`    Mock::given(method(${JSON.stringify(httpMethod)}))`);
+  lines.push(`        .and(path_matcher(${JSON.stringify(literalPath)}))`);
+  lines.push(`        .respond_with(ResponseTemplate::new(200).set_body_string(${responseExpr}))`);
+  lines.push('        .expect(1)');
+  lines.push('        .mount(&server)');
+  lines.push('        .await;');
+  lines.push('    let client = common::test_client(&server).await;');
+  lines.push(`    let _ = client.${accessor}().${m}(${callArgs.join(', ')}).await;`);
+  // wiremock asserts on drop that the `.expect(1)` mock was matched once;
+  // mismatched method/path produces a panic at end-of-test. We deliberately
+  // ignore the deserialised response: stub fixtures cover the common path
+  // (typed model deserialisation), but discriminated-union responses can't
+  // always be reproduced from a generated fixture without bespoke schema
+  // awareness, so a strict `is_ok()` would over-trigger.
+  lines.push('}');
+  return lines;
+}
+
+/** Test for a wrapper-method operation. */
+function renderWrapperTest(
+  op: Operation,
+  wrapper: ResolvedWrapper,
+  ctx: EmitterContext,
+  accessor: string,
+  crate: string,
+  modelMap: Map<string, Model>,
+  enumMap: Map<string, Enum>,
+): string[] {
+  const m = methodName(wrapper.name);
+  const literalPath = op.path.replace(/\{[^}]+\}/g, 'test_id');
+  const httpMethod = op.httpMethod.toUpperCase();
+  // Wrapper response is the wrapper's responseModelName (or the operation's
+  // declared response when none is overridden).
+  const responseExpr = wrapper.responseModelName
+    ? responseBodyExpr({ kind: 'model', name: wrapper.responseModelName }, modelMap, enumMap)
+    : responseBodyExpr(op.response, modelMap, enumMap);
+
+  const params = resolveWrapperParams(wrapper, ctx);
+  const callArgs: string[] = [];
+  for (const _ of op.pathParams) callArgs.push('"test_id"');
+
+  const paramsType = `${crate}::${accessor}::${typeName(wrapper.name)}Params`;
+  const requiredParams = params.filter((rp) => !rp.isOptional);
+
+  if (requiredParams.length === 0) {
+    callArgs.push(`${paramsType}::default()`);
+  } else {
+    const ctorArgs = requiredParams.map((rp) => {
+      if (!rp.field) return `"stub_${rp.paramName}".to_string()`;
+      return stubExpr(rp.field.type, rp.paramName, modelMap, enumMap);
+    });
+    callArgs.push(`${paramsType}::new(${ctorArgs.join(', ')})`);
+  }
+
+  const lines: string[] = [];
+  lines.push('#[tokio::test]');
+  lines.push(`async fn ${accessor}_${m}_round_trip() {`);
+  lines.push('    let server = MockServer::start().await;');
+  lines.push(`    Mock::given(method(${JSON.stringify(httpMethod)}))`);
+  lines.push(`        .and(path_matcher(${JSON.stringify(literalPath)}))`);
+  lines.push(`        .respond_with(ResponseTemplate::new(200).set_body_string(${responseExpr}))`);
+  lines.push('        .expect(1)');
+  lines.push('        .mount(&server)');
+  lines.push('        .await;');
+  lines.push('    let client = common::test_client(&server).await;');
+  lines.push(`    let _ = client.${accessor}().${m}(${callArgs.join(', ')}).await;`);
+  // Drop assertion on `Mock::expect(1)` validates path/method.
+  lines.push('}');
+  return lines;
+}
+
+/** Rust string-expression for the mock response body. */
+function responseBodyExpr(ref: TypeRef | undefined, modelMap: Map<string, Model>, enumMap: Map<string, Enum>): string {
+  if (!ref) return JSON.stringify('{}');
+  if (ref.kind === 'primitive' && ref.type === 'unknown') return JSON.stringify('{}');
+  if (ref.kind === 'model') {
+    const m = modelMap.get(ref.name);
+    if (!m || m.fields.length === 0 || m.fields.every((f) => !f.required)) {
+      return JSON.stringify('{}');
+    }
+    return modelFixtureExpr(ref.name);
+  }
+  if (ref.kind === 'nullable') return responseBodyExpr(ref.inner, modelMap, enumMap);
+  // For arrays/primitives/maps/enums/literals/unions, synthesise inline JSON.
+  const example = exampleFor(ref, modelMap, enumMap, new Set(), 'value');
+  return JSON.stringify(JSON.stringify(example));
+}
+
+/** `include_str!("fixtures/<snake>.json")` for a model name. */
+function modelFixtureExpr(name: string): string {
+  return `include_str!(${JSON.stringify(`fixtures/${moduleName(name)}.json`)})`;
+}
+
+/**
+ * Rust expression for an instance of `type` that satisfies its declared shape.
+ * Used to construct required constructor arguments at test-build time.
+ *
+ * For models we deserialize a JSON fixture; for everything else we synthesise
+ * a small example with `serde_json::from_str`. `String` is the one exception:
+ * the generator's `new(...)` constructor takes `impl Into<String>`, so we
+ * pass a string literal directly to keep type inference happy.
+ */
+function stubExpr(ref: TypeRef, hint: string, modelMap: Map<string, Model>, enumMap: Map<string, Enum>): string {
+  // Strings: emit `"stub_x".to_string()`. Works in struct-literal contexts
+  // (which need `String`) as well as `new(...)` constructors that take
+  // `impl Into<String>`. Avoiding `from_str` keeps type inference simple.
+  if (ref.kind === 'primitive' && ref.type === 'string') {
+    return `${JSON.stringify(`stub_${hint}`)}.to_string()`;
+  }
+  if (ref.kind === 'nullable') return stubExpr(ref.inner, hint, modelMap, enumMap);
+  if (ref.kind === 'model') {
+    // Fixture generator skips models with no required fields; fall back to
+    // an inline `{}` so the test still compiles.
+    const m = modelMap.get(ref.name);
+    if (!m || m.fields.length === 0 || m.fields.every((f) => !f.required)) {
+      return `serde_json::from_str("{}").expect("parse stub for ${ref.name}")`;
+    }
+    return `serde_json::from_str(${modelFixtureExpr(ref.name)}).expect("parse fixture for ${ref.name}")`;
+  }
+  // For other shapes, JSON-serialise an example value and deserialise at
+  // runtime. The generator's constructors fully specify each parameter type,
+  // so type inference flows from the constructor signature back into
+  // `serde_json::from_str`.
+  const example = exampleFor(ref, modelMap, enumMap, new Set(), hint);
+  const json = JSON.stringify(example);
+  return `serde_json::from_str(${JSON.stringify(json)}).expect("parse stub")`;
+}
+
+function crateName(ctx: EmitterContext): string {
+  // Cargo crate names are conventionally lowercase with no separators (e.g.
+  // `workos`). The IR's snake-cased namespace ("work_os") inserts an
+  // underscore around the "os" acronym, so derive from `namespacePascal` —
+  // the verbatim user-supplied namespace — and lowercase it.
+  return ctx.namespacePascal.toLowerCase().replace(/[^a-z0-9]/g, '');
+}

package/src/rust/type-map.ts

@@ -0,0 +1,225 @@
+import type { TypeRef, UnionType } from '@workos/oagen';
+import { typeName } from './naming.js';
+
+/**
+ * Lightweight registry that synthesises a named Rust enum for every IR union
+ * encountered in field positions. Models reference the synthesised name; the
+ * generator emits the enum bodies into a separate module so the crate stays
+ * self-contained.
+ */
+export class UnionRegistry {
+  private byKey = new Map<
+    string,
+    { name: string; tag?: string; arms: { name: string; type: string; rename?: string }[] }
+  >();
+  private hintCounts = new Map<string, number>();
+
+  /** Total number of registered unions (used by callers to skip emit). */
+  size(): number {
+    return this.byKey.size;
+  }
+
+  /** Drop all collected unions. Call at the start of every emit run. */
+  reset(): void {
+    this.byKey.clear();
+    this.hintCounts.clear();
+  }
+
+  /**
+   * Register a union and return the Rust type name to reference.  Unions with
+   * identical structure (same variants + discriminator) are deduplicated.
+   */
+  register(union: UnionType, hint: string): string {
+    const variants = arms(union);
+
+    // Apply discriminator mapping (`{spec-value: '#/components/schemas/Foo'}`)
+    // as `#[serde(rename = "spec-value")]` on the matching variant. Without
+    // this, serde's tagged-union deserialization expects the discriminator
+    // value to literally equal the Rust variant name, which it never does
+    // when the OAS uses snake/kebab-case spec-side keys.
+    const mapping = union.discriminator?.mapping ?? {};
+    const inverseMapping = new Map<string, string>();
+    for (const [specKey, ref] of Object.entries(mapping)) {
+      const schemaName = ref.replace(/^#\/components\/schemas\//, '');
+      // Last value wins — matches spec semantics where the final mapping for
+      // a schema is canonical.
+      inverseMapping.set(typeName(schemaName), specKey);
+    }
+    const armsWithRename: { name: string; type: string; rename?: string }[] = variants.map((v) => {
+      const rename = inverseMapping.get(v.name);
+      return rename !== undefined ? { ...v, rename } : v;
+    });
+
+    const key = JSON.stringify({
+      variants: armsWithRename.map((v) => ({ type: v.type, rename: v.rename ?? null })),
+      discriminator: union.discriminator?.property ?? null,
+      mapping: union.discriminator?.mapping ?? null,
+    });
+    const existing = this.byKey.get(key);
+    if (existing) return existing.name;
+
+    const name = this.uniqueName(`${typeName(hint)}OneOf`);
+    this.byKey.set(key, {
+      name,
+      tag: union.discriminator?.property,
+      arms: armsWithRename,
+    });
+    return name;
+  }
+
+  /**
+   * Render every registered union as a Rust source file (including a leading
+   * `use serde::...;` line).
+   */
+  render(): string {
+    if (this.byKey.size === 0) return '';
+    const blocks: string[] = [];
+    blocks.push('#[allow(unused_imports)]');
+    blocks.push('use super::*;');
+    blocks.push('#[allow(unused_imports)]');
+    blocks.push('use crate::enums::*;');
+    blocks.push('use serde::{Deserialize, Serialize};');
+    blocks.push('');
+
+    for (const u of this.byKey.values()) {
+      blocks.push('#[derive(Debug, Clone, Serialize, Deserialize)]');
+      if (u.tag) {
+        blocks.push(`#[serde(tag = ${JSON.stringify(u.tag)})]`);
+      } else {
+        blocks.push('#[serde(untagged)]');
+      }
+      blocks.push(`pub enum ${u.name} {`);
+      for (const a of u.arms) {
+        if (a.rename !== undefined) {
+          blocks.push(`    #[serde(rename = ${JSON.stringify(a.rename)})]`);
+        }
+        const single = `    ${a.name}(${a.type}),`;
+        if (single.length <= 100) {
+          blocks.push(single);
+        } else {
+          // Match rustfmt's break-shape for over-long tuple variants:
+          //   Variant(
+          //       LongType,
+          //   ),
+          blocks.push(`    ${a.name}(`);
+          blocks.push(`        ${a.type},`);
+          blocks.push('    ),');
+        }
+      }
+      blocks.push('}');
+      blocks.push('');
+    }
+
+    return blocks.join('\n').replace(/\n+$/g, '\n');
+  }
+
+  private uniqueName(base: string): string {
+    const taken = new Set(Array.from(this.byKey.values()).map((u) => u.name));
+    if (!taken.has(base)) return base;
+    const n = (this.hintCounts.get(base) ?? 1) + 1;
+    this.hintCounts.set(base, n);
+    return `${base}${n}`;
+  }
+}
+
+/**
+ * Map an IR `TypeRef` to a Rust type expression (e.g., `String`, `Vec<u32>`,
+ * `Option<HashMap<String, serde_json::Value>>`).
+ *
+ * The caller decides whether to wrap the result in `Option<...>` based on the
+ * field's `required` flag — `mapTypeRef` itself only emits `Option` for the
+ * `nullable` IR variant.
+ *
+ * When `ctx.registry` is supplied, encountered unions are registered as
+ * synthesised Rust enums (using `ctx.hint` to name the generated type); when
+ * no registry is provided, unions degrade to `serde_json::Value`.
+ */
+export function mapTypeRef(ref: TypeRef, ctx?: { hint?: string; registry?: UnionRegistry }): string {
+  switch (ref.kind) {
+    case 'primitive':
+      return primitiveType(ref.type, ref.format);
+    case 'array':
+      return `Vec<${mapTypeRef(ref.items, ctx)}>`;
+    case 'model':
+      return typeName(ref.name);
+    case 'enum':
+      return typeName(ref.name);
+    case 'nullable':
+      return `Option<${mapTypeRef(ref.inner, ctx)}>`;
+    case 'literal':
+      return literalType(ref.value);
+    case 'map':
+      return `std::collections::HashMap<String, ${mapTypeRef(ref.valueType, ctx)}>`;
+    case 'union': {
+      const variants = ref.variants;
+      const mapped = variants.map((v) => mapTypeRef(v, ctx));
+      const unique = Array.from(new Set(mapped));
+      if (unique.length === 1) return unique[0]!;
+      if (ctx?.registry && ctx.hint) {
+        return ctx.registry.register(ref, ctx.hint);
+      }
+      return 'serde_json::Value';
+    }
+  }
+}
+
+/** Variants for the registry: each gets a Rust variant name + a payload type. */
+function arms(union: UnionType): { name: string; type: string }[] {
+  const seen = new Set<string>();
+  const out: { name: string; type: string }[] = [];
+  for (const v of union.variants) {
+    const t = mapTypeRef(v); // No registry — variants must already be named.
+    const armName = variantArmName(v, t);
+    let unique = armName;
+    let n = 1;
+    while (seen.has(unique)) {
+      n += 1;
+      unique = `${armName}${n}`;
+    }
+    seen.add(unique);
+    out.push({ name: unique, type: t });
+  }
+  return out;
+}
+
+function variantArmName(ref: TypeRef, mappedType: string): string {
+  if (ref.kind === 'model' || ref.kind === 'enum') return typeName(ref.name);
+  // Strip generics for arm naming and PascalCase.
+  const base = mappedType.replace(/[<>:,\s]/g, '');
+  return typeName(base);
+}
+
+/**
+ * Wrap a type in `Option<...>` if not already optional. Used for non-required
+ * fields where the IR did not produce a `nullable` wrapper.
+ */
+export function makeOptional(rustType: string): string {
+  if (rustType.startsWith('Option<')) return rustType;
+  return `Option<${rustType}>`;
+}
+
+function primitiveType(type: 'string' | 'integer' | 'number' | 'boolean' | 'unknown', format?: string): string {
+  switch (type) {
+    case 'string':
+      if (format === 'binary') return 'Vec<u8>';
+      return 'String';
+    case 'integer':
+      if (format === 'int32') return 'i32';
+      return 'i64';
+    case 'number':
+      if (format === 'float') return 'f32';
+      return 'f64';
+    case 'boolean':
+      return 'bool';
+    case 'unknown':
+      return 'serde_json::Value';
+  }
+}
+
+function literalType(value: string | number | boolean | null): string {
+  if (value === null) return 'serde_json::Value';
+  if (typeof value === 'string') return 'String';
+  if (typeof value === 'number') return Number.isInteger(value) ? 'i64' : 'f64';
+  if (typeof value === 'boolean') return 'bool';
+  return 'serde_json::Value';
+}

package/test/entrypoint.test.ts

@@ -60,6 +60,7 @@ describe('public entrypoint (@workos/oagen-emitters)', () => {
       mod.dotnetEmitter,
       mod.kotlinEmitter,
       mod.rubyEmitter,
+      mod.rustEmitter,
     ];
     for (const emitter of directEmitters) {
       expect(pluginLanguages).toContain(emitter.language);

package/test/plugin.test.ts

@@ -11,7 +11,8 @@ describe('workosEmittersPlugin', () => {
     expect(languages).toContain('dotnet');
     expect(languages).toContain('kotlin');
     expect(languages).toContain('ruby');
-    expect(languages).toHaveLength(7);
+    expect(languages).toContain('rust');
+    expect(languages).toHaveLength(8);
   });
 
   it('exports extractors for all supported languages', () => {

package/test/python/resources.test.ts

@@ -83,8 +83,8 @@ describe('generateResources', () => {
     // GET method with path param
     expect(content).toContain('def get_organization(');
     expect(content).toContain('id: str,');
-    expect(content).toContain(`f"organizations/{quote(str(id), safe='')}"`);
-    expect(content).toContain('from urllib.parse import quote');
+    expect(content).toContain(`("organizations", str(id))`);
+    expect(content).not.toContain('from urllib.parse import quote');
     expect(content).toContain('model=Organization');
     // Public request methods (no underscore prefix)
     expect(content).toContain('self._client.request(');

package/test/rust/client.test.ts

@@ -0,0 +1,62 @@
+import { describe, it, expect } from 'vitest';
+import type { EmitterContext, ApiSpec, Model } from '@workos/oagen';
+import { defaultSdkBehavior } from '@workos/oagen';
+import { generateClient } from '../../src/rust/client.js';
+import { generateModels } from '../../src/rust/models.js';
+import { UnionRegistry } from '../../src/rust/type-map.js';
+
+function makeCtx(spec: ApiSpec): EmitterContext {
+  return { namespace: 'workos', namespacePascal: 'WorkOS', spec };
+}
+
+const emptySpec: ApiSpec = {
+  name: 'Test',
+  version: '1.0.0',
+  baseUrl: '',
+  services: [],
+  models: [],
+  enums: [],
+  sdk: defaultSdkBehavior(),
+};
+
+describe('rust/client', () => {
+  it('emits the unions module and an empty resources_api shell when there are no mount targets', () => {
+    const files = generateClient(emptySpec, makeCtx(emptySpec), new UnionRegistry());
+    expect(files.map((f) => f.path).sort()).toEqual(['src/models/_unions.rs', 'src/resources_api.rs']);
+    const unions = files.find((f) => f.path === 'src/models/_unions.rs')!;
+    expect(unions.content).toContain('No oneOf-style unions registered');
+    const api = files.find((f) => f.path === 'src/resources_api.rs')!;
+    expect(api.content).toContain('impl Client {');
+  });
+
+  it('renders unions registered earlier in the emit run', () => {
+    const registry = new UnionRegistry();
+    const models: Model[] = [
+      {
+        name: 'Event',
+        fields: [
+          {
+            name: 'payload',
+            type: {
+              kind: 'union',
+              variants: [
+                { kind: 'model', name: 'UserCreated' },
+                { kind: 'model', name: 'UserDeleted' },
+              ],
+              discriminator: {
+                property: 'event',
+                mapping: { 'user.created': 'UserCreated', 'user.deleted': 'UserDeleted' },
+              },
+            },
+            required: true,
+          },
+        ],
+      },
+    ];
+    generateModels(models, makeCtx(emptySpec), registry);
+    const files = generateClient(emptySpec, makeCtx(emptySpec), registry);
+    const unions = files.find((f) => f.path === 'src/models/_unions.rs')!;
+    expect(unions.content).toContain('#[serde(tag = "event")]');
+    expect(unions.content).toContain('pub enum EventPayloadOneOf {');
+  });
+});