fix(user_management): honor client_id in PKCE authorization URL

[gjtorikian]

Summary

• get_authorization_url_with_pkce accepted a client_id argument but silently ignored it — the URL always carried the client's configured client_id, while its PKCE sibling authenticate_with_code_pkce honored the override. Multi-tenant callers got an authorization URL for one application and a token exchange for another. Fixes get_authorization_url_with_pkce accepts client_id and silently ignores it (get_jwks_url honours it) #700.
• The generated get_authorization_url (in both user_management and sso) now accepts an optional client_id override that falls back to the client's configured value. Those files are oagen-generated, so this part of the change was made in oagen-emitters and regenerated rather than hand-edited here.
• The hand-maintained PKCE wrapper now forwards client_id in both the sync and async clients.
• Added tests covering the explicit override and the configured-value fallback.

[workos-sdk-automation]

🤖 This pull request was closed automatically

It edits files that are auto-generated by (each file has a header comment identifying it as generated). Hand edits to generated code are overwritten the next time the SDK is regenerated from the OpenAPI spec, so they can't be merged.

Generated files changed outside their hand-maintainable regions:

• src/workos/sso/_resource.py
• src/workos/user_management/_resource.py

What to do instead

• Generated code (models, resources, client wiring): make the change upstream in the OpenAPI spec so it lands on the next regeneration.
• Hand-maintained code inside a generated file: only the regions fenced by @oagen-ignore-start … @oagen-ignore-end may be edited by hand. Keep your changes within those fences.
• Adding, moving, or removing a fence (@oagen-ignore-start / @oagen-ignore-end): fence boundaries are owned by the generator, so they can't change in a hand-authored PR. This must come from a regeneration PR (opened by the SDK Automation Bot or carrying the autogenerated label).

If you believe this was closed in error, a maintainer can reopen the PR.

[greptile-apps]

Greptile Summary

The PR makes authorization URL generation honor an explicit client_id while retaining the configured client ID as the fallback.

• Adds optional client_id overrides to synchronous and asynchronous SSO and User Management authorization URL builders.
• Forwards the override through synchronous and asynchronous User Management PKCE helpers.
• Adds tests for explicit PKCE overrides and configured-value fallback behavior.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
src/workos/sso/_resource.py	Adds synchronous and asynchronous authorization URL client ID overrides while preserving configured fallback behavior.
src/workos/user_management/_resource.py	Adds client ID overrides to authorization URL builders and forwards them through both PKCE wrappers.
tests/test_inline_helpers.py	Covers configured and explicit client IDs for synchronous PKCE URLs and explicit overrides for asynchronous URLs.

_{Reviews (2): Last reviewed commit: "fix(user_management): honor client_id ov..." | Re-trigger Greptile}