feat: add get_jwks_url helper to UserManagement

[gjtorikian]

Summary

Adds user_management.get_jwks_url(client_id=None) to both sync and async clients — a small helper that constructs the JWKS URL for a given client.

Why

v6 exposed user_management.get_jwks_url(), which customers used to integrate with JWT libraries that take a URL and handle fetching/caching themselves (e.g. PyJWT's PyJWKClient(url)). v7's generated get_jwks(client_id) returns the JWKS document, not the URL — so customers integrating with URL-based JWT libraries have been hand-constructing the URL with f"{client.base_url}sso/jwks/{client_id}", duplicating what session.py does internally.

Implementation

• Adds get_jwks_url to UserManagement and AsyncUserManagement inside the existing @oagen-ignore-start / @oagen-ignore-end fences in src/workos/user_management/_resource.py. Verified the methods survive npm run sdk:generate -- --lang python.
• Parameter is Optional[str] with fallback to the client's configured client_id via _require_client_id() — matches v6 ergonomics where the method took no arguments.
• URL construction mirrors session.py:195 / session.py:373 exactly.

Test plan

• uv run pytest tests/test_inline_helpers.py -k "JwksUrl" — 5 new tests pass (default lookup, explicit override, ConfigurationError when no client_id; sync + async)
• uv run pytest tests/test_inline_helpers.py tests/test_user_management.py tests/test_session.py — 184 tests pass
• uv run ruff format --check and uv run ruff check — clean
• uv run pyright — 0 errors
• Verified get_jwks_url survives a full npm run sdk:generate run

🤖 Generated with Claude Code

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[greptile-apps]

Greptile Summary

Adds a get_jwks_url(client_id=None) helper to both UserManagement and AsyncUserManagement, restoring the v6 ergonomic that customers were hand-rolling with f"{client.base_url}sso/jwks/{client_id}". The URL construction and client_id fallback via _require_client_id() are consistent with session.py and sso/_resource.py.

Confidence Score: 5/5

Safe to merge; the change is small, correct, and follows established codebase patterns.

Implementation mirrors the existing URL-construction pattern from session.py and the client_id fallback pattern from sso/_resource.py exactly. The only gap is a missing ConfigurationError test for the async class (P2), which does not affect correctness.

No files require special attention.

Important Files Changed

Filename	Overview
src/workos/user_management/_resource.py	Adds get_jwks_url to both UserManagement and AsyncUserManagement inside @oagen-ignore fences; URL construction mirrors session.py and client_id fallback matches the pattern used in sso/_resource.py.
tests/test_inline_helpers.py	Adds 5 tests covering default client_id, explicit override, and ConfigurationError for the sync path; the async class is missing the test_raises_when_no_client_id_configured equivalent.

Sequence Diagram

sequenceDiagram
    participant Caller
    participant UserManagement
    participant BaseClient

    Caller->>UserManagement: get_jwks_url(client_id=None)
    alt client_id provided
        UserManagement->>UserManagement: use provided client_id
    else no client_id
        UserManagement->>BaseClient: _require_client_id()
        BaseClient-->>UserManagement: configured client_id (or raises ConfigurationError)
    end
    UserManagement-->>Caller: f"{base_url}sso/jwks/{resolved_client_id}"

Loading

_{Reviews (1): Last reviewed commit: "feat: add get_jwks_url helper to UserMan..." | Re-trigger Greptile}

[greptile-apps]

Missing ConfigurationError test for async path

The sync TestGetJwksUrl has test_raises_when_no_client_id_configured but TestAsyncGetJwksUrl does not. Since both implementations are identical, parity is worth adding to confirm the error path works through async_workos as well.