feat: expose authentication method on action contexts

[Deborah-Digges]

Description

Follow-up to workos/workos#68754, which adds authentication_method to both Actions payloads. The SDK's deserializeAction builds its result field-by-field, so it silently drops the new field — SDK users can't see it until it's mapped here.

 interface UserRegistrationActionContext {
   userData: UserData;
   invitation?: Invitation;
+  authenticationMethod: AuthenticationMethod;
 }

…and the same on AuthenticationActionContext, so an Action can do:

const action = await workos.actions.constructAction({ payload, sigHeader, secret });
if (action.object === 'user_registration_action_context'
    && action.userData.email.endsWith('@gmail.com')
    && action.authenticationMethod === 'Password') {
  return workos.actions.signResponse({ type: 'user_registration', verdict: 'Deny', errorMessage: '…' }, secret);
}

Two things worth flagging:

• AuthenticationMethod was private to authentication-response.interface.ts; it's now exported (so it's part of the public API via the existing export *) and reused for actions rather than duplicated. While reusing it I noticed it was missing GrokOAuth and XOAuth, which the API's enum has had — added.
• The field is non-optional on both context and payload types, matching the API, where it's required in the shared ActionPayloadSchemaCommon. That's technically a breaking change for anyone hand-constructing an ActionPayload (test fixtures, mocks); it doesn't affect runtime behavior, since nothing validates the payload — an older API that omitted the field would just yield undefined.

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes

The Actions docs list the payload fields, so they'll want authentication_method added — but that's driven by the API change in workos/workos#68754, not by this PR.

Test plan

npx jest src/actions, npx tsc --noEmit, npx eslint, and prettier all pass locally; the action fixtures now carry authentication_method (Password / GoogleOAuth) and the constructAction assertions cover the deserialized value.

Link to Devin session: https://app.devin.ai/sessions/d1b4af9c560e47399605005a3b923af6
Requested by: @Deborah-Digges

[devin-ai-integration]

Original prompt from deborah.digges

Open a draft PR for this change: https://work-os.slack.com/archives/C0173N0DDSQ/p1786373799633009

Use https://github.com/workos/workos/pull/68598 as a reference

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

The PR exposes the signed Actions payload’s authentication method through the SDK and expands the shared authentication-method union.

• Maps authentication_method to authenticationMethod for authentication and user-registration action contexts.
• Updates action payload types, fixtures, and deserialization tests, including compatibility with payloads that omit the field.
• Exports AuthenticationMethod and adds GrokOAuth and XOAuth.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/actions/interfaces/action.interface.ts	Adds optional authentication-method fields to both wire payload and public action-context variants.
src/actions/serializers/action.serializer.ts	Preserves the signed payload’s authentication method during snake_case-to-camelCase deserialization.
src/user-management/interfaces/authentication-response.interface.ts	Exports the shared authentication-method type and adds two OAuth method values.
src/actions/actions.spec.ts	Verifies both action variants expose the mapped value and that omitted legacy fields remain undefined.

_{Reviews (2): Last reviewed commit: "fix: make authenticationMethod optional ..." | Re-trigger Greptile}