feat: add get_profile_and_token_from_id_token for OIDC ID token exchange (4.16.0 backport) - #714
Conversation
Sorry, something went wrong.
Backport for customers on the 4.x line who need the /sso/token token-exchange grant (native MSAL / Entra ID token exchange). Adds a new additive SSO method that posts the token-exchange grant with subject_token and organization_id, returning the standard ProfileAndToken. Bumps to 4.16.0.
Greptile SummaryThe PR adds an SSO helper that exchanges an externally issued OIDC ID token for a WorkOS profile and access token, and bumps the 4.x package version to 4.16.0.
Confidence Score: 4/5The PR appears safe to merge, with the non-blocking caveat that its new unit test should validate the token-exchange request payload. The implementation follows the existing SSO request and response paths, and the package version is wired correctly; the remaining concern is that malformed token-exchange fields could pass the added response-only test. Files Needing Attention: tests/test_sso.py Important Files Changed
Sequence DiagramsequenceDiagram
participant App as Backend application
participant SDK as WorkOS Python SDK
participant API as WorkOS /sso/token
App->>SDK: get_profile_and_token_from_id_token(id_token, organization_id)
SDK->>API: POST token-exchange grant and credentials
API-->>SDK: profile and access_token
SDK-->>App: WorkOSProfileAndToken
### Issue 1
tests/test_sso.py:452
**Token-exchange payload remains untested**
This mock verifies only response deserialization and never inspects the outgoing request, so incorrect `grant_type`, `subject_token`, `subject_token_type`, or `organization_id` values can pass the test and fail only against the live API. Assert the endpoint, method, and exact JSON body for this new flow.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "Add get_profile_and_token_from_id_token ..." | Re-trigger Greptile |
Sorry, something went wrong.
| "access_token": "01DY34ACQTM3B1CSX1YSZ8Z00D", | ||
| } | ||
|
|
||
| mock_request_method("post", response_dict, 200) |
There was a problem hiding this comment.
Token-exchange payload remains untested
This mock verifies only response deserialization and never inspects the outgoing request, so incorrect grant_type, subject_token, subject_token_type, or organization_id values can pass the test and fail only against the live API. Assert the endpoint, method, and exact JSON body for this new flow.
Prompt To Fix With AIThis is a comment left during a code review.
Path: tests/test_sso.py
Line: 452
Comment:
**Token-exchange payload remains untested**
This mock verifies only response deserialization and never inspects the outgoing request, so incorrect `grant_type`, `subject_token`, `subject_token_type`, or `organization_id` values can pass the test and fail only against the live API. Assert the endpoint, method, and exact JSON body for this new flow.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
Sorry, something went wrong.
Summary
Backport onto the 4.x line for customers who need the /sso/token token-exchange grant (native MSAL sign-in: a mobile app gets an Entra ID token and the backend exchanges it for a WorkOS profile) but are still on 4.x and can't move to 10.x yet.
Adds a new, additive SSO method:
It POSTs the token-exchange grant (grant_type=urn:ietf:params:oauth:grant-type:token-exchange, subject_token, subject_token_type=...:id_token, organization_id) to /sso/token and returns the same WorkOSProfileAndToken as the authorization-code flow. Existing get_profile_and_token is untouched.
Version bumped 4.15.0 → 4.16.0 (additive, non-breaking). Added a unit test mirroring the existing get_profile_and_token test; pytest tests/test_sso.py passes locally.
Why a 4.x backport (and why isolated)
⚠️ Draft — needs a maintainer to own the release
I can't publish to PyPI. Before release, please confirm the 4.x release/CI process still works from this branch, the version bump is where you want it, and whether you want the same method mirrored into the 10.x codegen path so it doesn't regress on upgrade.
🤖 Generated with Claude Code