@workos/oagen-emitters 0.4.0 → 0.5.0

package/src/kotlin/tests.ts

@@ -12,7 +12,13 @@ import type {
 import { planOperation } from '@workos/oagen';
 import { apiClassName, packageSegment, resolveMethodName, ktStringLiteral, className, propertyName } from './naming.js';
 import { mapTypeRef } from './type-map.js';
-import { groupByMount, lookupResolved, buildResolvedLookup, buildHiddenParams } from '../shared/resolved-ops.js';
+import {
+  groupByMount,
+  lookupResolved,
+  buildResolvedLookup,
+  buildHiddenParams,
+  collectGroupedParamNames,
+} from '../shared/resolved-ops.js';
 import { isListWrapperModel, isListMetadataModel } from '../shared/model-utils.js';
 import { resolveWrapperParams } from '../shared/wrapper-utils.js';
 import { isHandwrittenOverride } from './overrides.js';
@@ -72,6 +78,8 @@ interface OpTest {
   requiredBodyPaths: string[];
   /** `name=value` pairs required on the query string — asserted via matchingRegex. */
   requiredQueryAssertions: { name: string; valueRegex: string }[];
+  /** Wire field names that must NOT appear as query params (e.g. password on POST). */
+  forbiddenQueryParams: string[];
   /** Assertions on response fields: { kotlinAccessor, expectedExpr }. */
   responseAssertions: { accessor: string; expectedExpr: string }[];
 }
@@ -148,7 +156,7 @@ function generateServiceTestClass(
   const verifyMethods = new Set<string>();
   for (const t of uniqueTests) {
     if (!t.canEmitHappyPath) continue;
-    if (t.requiredBodyPaths.length > 0 || t.requiredQueryAssertions.length > 0) {
+    if (t.requiredBodyPaths.length > 0 || t.requiredQueryAssertions.length > 0 || t.forbiddenQueryParams.length > 0) {
       verifyMethods.add(t.httpMethod);
     }
   }
@@ -160,8 +168,10 @@ function generateServiceTestClass(
   }
   const anyBody = uniqueTests.some((t) => t.canEmitHappyPath && t.requiredBodyPaths.length > 0);
   const anyQuery = uniqueTests.some((t) => t.canEmitHappyPath && t.requiredQueryAssertions.length > 0);
+  const anyForbidden = uniqueTests.some((t) => t.canEmitHappyPath && t.forbiddenQueryParams.length > 0);
   if (anyBody) imports.add('com.github.tomakehurst.wiremock.client.WireMock.matchingJsonPath');
   if (anyQuery) imports.add('com.github.tomakehurst.wiremock.client.WireMock.matching');
+  if (anyForbidden) imports.add('com.github.tomakehurst.wiremock.client.WireMock.absent');
   // assertEquals is needed when any test has response field assertions.
   if (uniqueTests.some((t) => t.canEmitHappyPath && t.responseAssertions.length > 0)) {
     imports.add('org.junit.jupiter.api.Assertions.assertEquals');
@@ -217,6 +227,7 @@ function buildOperationTest(
   if (!svc) return null;
   const method = resolveMethodName(op, svc, ctx);
   const plan = planOperation(op);
+  const mountPackage = packageSegment(resolved?.mountOn ?? svc.name);
 
   const hidden = buildHiddenParams(resolved);
 
@@ -229,8 +240,18 @@ function buildOperationTest(
 
   for (const _pp of op.pathParams) argParts.push(ktStringLiteral('sample-arg'));
 
-  const queryFields = op.queryParams.filter((p) => !hidden.has(p.name));
+  const groupedParamNames = collectGroupedParamNames(op);
+
+  const queryFields = op.queryParams.filter((p) => !hidden.has(p.name) && !groupedParamNames.has(p.name));
   const sortedQuery = [...queryFields].sort((a, b) => (a.required === b.required ? 0 : a.required ? -1 : 1));
+  const sharedQueryBodyParams = new Set<string>();
+  const bodyModel = resolveBodyModel(op, ctx);
+  for (const qp of queryFields) {
+    const matchingBodyField = bodyModel?.fields.find((field) => field.name === qp.name);
+    if (matchingBodyField && mapTypeRef(qp.type) === mapTypeRef(matchingBodyField.type)) {
+      sharedQueryBodyParams.add(qp.name);
+    }
+  }
   for (const qp of sortedQuery) {
     if (!qp.required) break;
     const val = synthValue(qp.type, ctx, imports);
@@ -242,14 +263,25 @@ function buildOperationTest(
     if (regex !== null) requiredQueryAssertions.push({ name: qp.name, valueRegex: regex });
   }
 
-  const bodyModel = resolveBodyModel(op, ctx);
+  // Parameter group args — emit as named args (they appear after optionals in the signature)
+  const groupParamNames = assignGroupParameterNames(op, hidden, queryFields, bodyModel, groupedParamNames);
+  for (const group of op.parameterGroups ?? []) {
+    const variant = group.variants[0];
+    const sealedName = sealedGroupName(group.name);
+    const variantName = className(variant.name);
+    const variantArgs = variant.parameters.map((_p) => ktStringLiteral('sample-arg')).join(', ');
+    imports.add(`com.workos.${mountPackage}.${sealedName}`);
+    argParts.push(`${groupParamNames.get(group.name)!} = ${sealedName}.${variantName}(${variantArgs})`);
+  }
+
   if (bodyModel) {
     // Body fields always pass; colliding names are renamed (e.g. slug →
     // bodySlug) by the resources emitter, so every required body field still
     // needs a test argument here.
-    const bodyFields = bodyModel.fields.filter((f) => !hidden.has(f.name));
+    const bodyFields = bodyModel.fields.filter((f) => !hidden.has(f.name) && !groupedParamNames.has(f.name));
     const sortedBody = [...bodyFields].sort((a, b) => (a.required === b.required ? 0 : a.required ? -1 : 1));
     for (const bf of sortedBody) {
+      if (sharedQueryBodyParams.has(bf.name)) continue;
       if (!bf.required) break;
       const val = synthValue(bf.type, ctx, imports);
       if (val === null) return null;
@@ -284,6 +316,20 @@ function buildOperationTest(
       ? buildResponseAssertions(plan2.responseModelName, ctx)
       : [];
 
+  // For POST/PUT/PATCH with parameter groups, collect all wire field names
+  // from the groups — these must NOT appear as query parameters.
+  const forbiddenQueryParams: string[] = [];
+  const httpUpper = op.httpMethod.toUpperCase();
+  if (['POST', 'PUT', 'PATCH'].includes(httpUpper) && (op.parameterGroups?.length ?? 0) > 0) {
+    for (const group of op.parameterGroups!) {
+      for (const variant of group.variants) {
+        for (const p of variant.parameters) {
+          if (!forbiddenQueryParams.includes(p.name)) forbiddenQueryParams.push(p.name);
+        }
+      }
+    }
+  }
+
   return {
     method,
     httpMethod: op.httpMethod.toLowerCase(),
@@ -295,10 +341,69 @@ function buildOperationTest(
     imports,
     requiredBodyPaths,
     requiredQueryAssertions,
+    forbiddenQueryParams,
     responseAssertions,
   };
 }
 
+function assignGroupParameterNames(
+  op: Operation,
+  hidden: Set<string>,
+  queryFields: Operation['queryParams'],
+  bodyModel: Model | null,
+  groupedParamNames: Set<string> = new Set(),
+): Map<string, string> {
+  const occupiedNames = new Set<string>();
+
+  for (const pp of op.pathParams) occupiedNames.add(propertyName(pp.name));
+  for (const qp of queryFields) occupiedNames.add(propertyName(qp.name));
+
+  for (const bf of bodyModel?.fields ?? []) {
+    if (hidden.has(bf.name) || groupedParamNames.has(bf.name)) continue;
+    const natural = propertyName(bf.name);
+    if (occupiedNames.has(natural)) {
+      occupiedNames.add(`body${natural.charAt(0).toUpperCase()}${natural.slice(1)}`);
+    } else {
+      occupiedNames.add(natural);
+    }
+  }
+
+  const names = new Map<string, string>();
+  for (const group of op.parameterGroups ?? []) {
+    const natural = propertyName(sealedGroupName(group.name));
+    const assigned = reserveUniqueGroupParameterName(natural, occupiedNames);
+    names.set(group.name, assigned);
+  }
+  return names;
+}
+
+function sealedGroupName(name: string): string {
+  const resolved = className(name);
+  if (resolved === 'Password') return 'CreateUserPassword';
+  if (resolved === 'Role') return 'CreateUserRole';
+  return resolved;
+}
+
+function reserveUniqueGroupParameterName(base: string, occupiedNames: Set<string>): string {
+  if (!occupiedNames.has(base)) {
+    occupiedNames.add(base);
+    return base;
+  }
+
+  const capitalized = `${base.charAt(0).toUpperCase()}${base.slice(1)}`;
+  const prefixed = `group${capitalized}`;
+  if (!occupiedNames.has(prefixed)) {
+    occupiedNames.add(prefixed);
+    return prefixed;
+  }
+
+  let index = 2;
+  while (occupiedNames.has(`${prefixed}${index}`)) index += 1;
+  const fallback = `${prefixed}${index}`;
+  occupiedNames.add(fallback);
+  return fallback;
+}
+
 /** True if the synthesized body value serializes to a concrete JSON scalar. */
 function isScalarBodyField(type: TypeRef): boolean {
   const inner = type.kind === 'nullable' ? type.inner : type;
@@ -383,6 +488,7 @@ function buildWrapperTest(op: Operation, wrapper: ResolvedWrapper, ctx: EmitterC
     imports,
     requiredBodyPaths: [],
     requiredQueryAssertions: [],
+    forbiddenQueryParams: [],
     responseAssertions,
   };
 }
@@ -643,7 +749,7 @@ function emitHappyPathTest(lines: string[], t: OpTest): void {
   // Verify the outbound request shape.  Body fields and query assertions
   // live on the `OpTest` and are only emitted when we know the synthesized
   // arguments produce a deterministic wire representation.
-  if (t.requiredBodyPaths.length > 0 || t.requiredQueryAssertions.length > 0) {
+  if (t.requiredBodyPaths.length > 0 || t.requiredQueryAssertions.length > 0 || t.forbiddenQueryParams.length > 0) {
     lines.push('    wireMockRule.verify(');
     lines.push(`      ${t.httpMethod}RequestedFor(urlPathMatching(${ktStringLiteral(t.pathForWireMock)}))`);
     for (const path of t.requiredBodyPaths) {
@@ -652,6 +758,10 @@ function emitHappyPathTest(lines: string[], t: OpTest): void {
     for (const qa of t.requiredQueryAssertions) {
       lines.push(`        .withQueryParam(${ktStringLiteral(qa.name)}, matching(${ktStringLiteral(qa.valueRegex)}))`);
     }
+    // Assert sensitive fields from parameter groups never leak into the URL.
+    for (const name of t.forbiddenQueryParams) {
+      lines.push(`        .withQueryParam(${ktStringLiteral(name)}, absent())`);
+    }
     lines.push('    )');
   }
   lines.push('  }');
@@ -874,9 +984,13 @@ function generateModelRoundTripTest(spec: ApiSpec, ctx: EmitterContext): Generat
   // models, arrays, maps, and literals — much broader than the old
   // primitives-only filter.
   const targets: { model: Model; json: string }[] = [];
+  const seenModelClassNames = new Set<string>();
   for (const m of spec.models) {
     if (isListWrapperModel(m) || isListMetadataModel(m)) continue;
     if (m.fields.length === 0) continue;
+    const cls = className(m.name);
+    if (seenModelClassNames.has(cls)) continue;
+    seenModelClassNames.add(cls);
     // Only include models where ALL fields are required AND all types are
     // round-trip safe (primitives, nullable, literals, simple arrays/maps).
     // Nested model/enum references break round-trip because Jackson

package/src/node/client.ts

@@ -1,7 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import type { ApiSpec, AuthScheme, EmitterContext, GeneratedFile, Service } from '@workos/oagen';
-import { collectReferencedNames } from '@workos/oagen';
+
 import { fileName, resolveServiceDir, servicePropertyName, resolveInterfaceName, wireInterfaceName } from './naming.js';
 import {
   docComment,
@@ -9,6 +9,7 @@ import {
   isServiceCoveredByExisting,
   isListMetadataModel,
   isListWrapperModel,
+  computeNonEventReachable,
 } from './utils.js';
 import { resolveResourceClassName } from './resources.js';
 
@@ -186,12 +187,12 @@ function generateServiceBarrels(spec: ApiSpec, ctx: EmitterContext): GeneratedFi
   // Models -> service directories
   // Skip list wrapper and list metadata models — they use shared List<T>/ListMetadata
   // from common utils, so no per-resource interface file is generated.
-  // Also skip unreachable models — oagen only passes service-referenced models
-  // to generateModels, so unreachable models have no interface file to export.
-  const barrelReachable = collectReferencedNames(spec.services, spec.models);
+  // Also skip unreachable models — use the same non-event reachability as model
+  // generation so every barrel entry has a corresponding generated file.
+  const barrelReachable = computeNonEventReachable(spec.services, spec.models);
   for (const model of spec.models) {
     if (isListMetadataModel(model) || isListWrapperModel(model)) continue;
-    if (!barrelReachable.models.has(model.name)) continue;
+    if (!barrelReachable.has(model.name)) continue;
     const service = modelToService.get(model.name);
     const dirName = resolveDir(service);
     if (!dirExports.has(dirName)) {
@@ -265,12 +266,38 @@ function generateServiceBarrels(spec: ApiSpec, ctx: EmitterContext): GeneratedFi
       addBaselineExports(ctx.apiSurface.typeAliases);
       addBaselineExports(ctx.apiSurface.enums);
 
-      // Scan the target directory for interface files not captured by the
-      // api-surface (e.g., list wrappers, hand-written types).  Only add
-      // files whose exported symbols don't collide with symbols already
-      // claimed by another directory's barrel (TS2308 prevention).
+      // Preserve existing barrel entries: read the current barrel from the
+      // target directory and keep every `export * from './<stem>'` whose
+      // corresponding file still exists on disk.  This prevents dropping
+      // hand-written types (e.g., Factor in multi-factor-auth) when a
+      // generated model in the same file causes a symbol collision.
       if (ctx.targetDir) {
         const interfacesDir = path.join(ctx.targetDir, 'src', dirName, 'interfaces');
+        try {
+          const barrelPath = path.join(interfacesDir, 'index.ts');
+          const barrelContent = fs.readFileSync(barrelPath, 'utf-8');
+          for (const line of barrelContent.split('\n')) {
+            const match = line.match(/^export \* from '\.\/(.*?)';?$/);
+            if (!match) continue;
+            const stem = match[1];
+            const exportLine = `export * from './${stem}';`;
+            if (exportSet.has(exportLine)) continue;
+            // Verify the referenced file still exists
+            const filePath = path.join(interfacesDir, `${stem}.ts`);
+            try {
+              fs.accessSync(filePath);
+              exportSet.add(exportLine);
+            } catch {
+              // File no longer exists — don't preserve stale entry
+            }
+          }
+        } catch {
+          // No existing barrel — nothing to preserve
+        }
+
+        // Also scan for NEW interface files not in the existing barrel or
+        // apiSurface (e.g., list wrappers, hand-written types added after
+        // the last generation).
         const symbols = dirSymbols.get(dirName) ?? new Set<string>();
         try {
           for (const entry of fs.readdirSync(interfacesDir)) {
@@ -545,8 +572,8 @@ function generateBarrel(spec: ApiSpec, ctx: EmitterContext): GeneratedFile {
   // Filter to reachable models only: oagen's generateAllFiles passes only
   // service-referenced models to generateModels, so unreachable models
   // never get interface files.  Exporting them here would create broken imports.
-  const reachable = collectReferencedNames(spec.services, spec.models);
-  const unassignedModels = spec.models.filter((m) => !modelToService.has(m.name) && reachable.models.has(m.name));
+  const reachable = computeNonEventReachable(spec.services, spec.models);
+  const unassignedModels = spec.models.filter((m) => !modelToService.has(m.name) && reachable.has(m.name));
   const commonEnums = spec.enums.filter((e) => {
     const enumService = findEnumService(e.name, spec.services);
     return !enumService;

package/src/node/field-plan.ts

@@ -582,7 +582,6 @@ function emitAssignment(lhs: string, expr: string, accessExpr: string, guard: Gu
 interface SerializerContext {
   modelToService: Map<string, string>;
   resolveDir: (irService: string | undefined) => string;
-  useStringDates: boolean;
   dedup: Map<string, string>;
   skippedSerializeModels: Set<string>;
   ctx: EmitterContext;
@@ -614,31 +613,30 @@ export function buildSerializerImports(
     const depSerializerPath = `src/${depDir}/serializers/${fileName(dep)}.serializer.ts`;
     const depName = resolveInterfaceName(dep, sctx.ctx);
     const rel = relativeImport(serializerPath, depSerializerPath);
-    lines.push(`import { deserialize${depName}, serialize${depName} } from '${rel}';`);
+    // Check the canonical name for dedup'd models
+    const canon = sctx.dedup.get(dep);
+    const depSkipSerialize =
+      sctx.skippedSerializeModels.has(dep) || (canon != null && sctx.skippedSerializeModels.has(canon));
+    if (depSkipSerialize) {
+      lines.push(`import { deserialize${depName} } from '${rel}';`);
+    } else {
+      lines.push(`import { deserialize${depName}, serialize${depName} } from '${rel}';`);
+    }
   }
   lines.push('');
   return lines;
 }
 
 /** Build the set of field names where format conversion should be skipped. */
-export function buildSkipFormatFields(
-  model: Model,
-  useStringDates: boolean,
-  baselineDomain: BaselineInterface | undefined,
-): Set<string> {
+export function buildSkipFormatFields(model: Model, baselineDomain: BaselineInterface | undefined): Set<string> {
   const skipFormatFields = new Set<string>();
-  if (useStringDates) {
-    for (const field of model.fields) {
-      if (hasDateTimeConversion(field.type)) {
-        skipFormatFields.add(field.name);
-      }
-    }
-  }
   if (baselineDomain) {
     for (const field of model.fields) {
       if (skipFormatFields.has(field.name)) continue;
       const baselineField = baselineDomain.fields?.[fieldName(field.name)];
       if (baselineField && !baselineField.type.includes('Date') && hasFormatConversion(field.type)) {
+        // Always convert date-time fields to Date regardless of baseline
+        if (hasDateTimeConversion(field.type)) continue;
         skipFormatFields.add(field.name);
       }
     }

package/src/node/fixtures.ts

@@ -48,15 +48,51 @@ export function generateFixtures(
   const enumMap = new Map(spec.enums.map((e) => [e.name, e]));
   const files: { path: string; content: string }[] = [];
 
+  // Only generate fixtures for models reachable from non-event operations
+  const fixtureSeeds = new Set<string>();
+  for (const svc of spec.services) {
+    if (svc.name.toLowerCase() === 'events') continue;
+    for (const op of svc.operations) {
+      const collectFromRef = (t: import('@workos/oagen').TypeRef | undefined): void => {
+        if (!t) return;
+        if (t.kind === 'model') fixtureSeeds.add(t.name);
+        if (t.kind === 'array') collectFromRef(t.items);
+        if (t.kind === 'nullable') collectFromRef(t.inner);
+        if (t.kind === 'union') t.variants.forEach(collectFromRef);
+      };
+      collectFromRef(op.response);
+      collectFromRef(op.requestBody);
+      if (op.pagination?.itemType) collectFromRef(op.pagination.itemType);
+    }
+  }
+  const fixtureModelMap = new Map(spec.models.map((m: Model) => [m.name, m]));
+  const fixtureReachable = new Set<string>();
+  const fixtureQueue = [...fixtureSeeds];
+  while (fixtureQueue.length > 0) {
+    const name = fixtureQueue.pop()!;
+    if (fixtureReachable.has(name)) continue;
+    fixtureReachable.add(name);
+    const m = fixtureModelMap.get(name);
+    if (!m) continue;
+    for (const field of m.fields) {
+      const walk = (t: import('@workos/oagen').TypeRef): void => {
+        if (t.kind === 'model' && !fixtureReachable.has(t.name)) fixtureQueue.push(t.name);
+        if (t.kind === 'array') walk(t.items);
+        if (t.kind === 'nullable') walk(t.inner);
+        if (t.kind === 'union') t.variants.forEach(walk);
+      };
+      walk(field.type);
+    }
+  }
   const seenFixturePaths = new Set<string>();
   for (const model of spec.models) {
-    // Skip redundant list-metadata and list-wrapper models (handled by shared types)
+    if (!fixtureReachable.has(model.name)) continue;
     if (isListMetadataModel(model)) continue;
     if (isListWrapperModel(model)) continue;
 
     const service = modelToService.get(model.name);
     const dirName = resolveDir(service);
-    const fixturePath = `src/${dirName}/fixtures/${fileName(model.name)}.fixture.json`;
+    const fixturePath = `src/${dirName}/fixtures/${fileName(model.name)}.json`;
 
     // After noise suffix stripping, multiple models may resolve to the same
     // fixture path (e.g., OrganizationDto and Organization).  Skip duplicates.
@@ -94,7 +130,7 @@ export function generateFixtures(
             },
           };
           files.push({
-            path: `src/${serviceDir}/fixtures/list-${fileName(itemModel.name)}.fixture.json`,
+            path: `src/${serviceDir}/fixtures/list-${fileName(itemModel.name)}.json`,
             content: JSON.stringify(listFixture, null, 2),
           });
         }