Skip to content

feat: add group_sync and role_sync for coderd_organization_resource #147

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 28 commits into from
Dec 3, 2024
Merged

feat: add group_sync and role_sync for coderd_organization_resource #147

Show file tree
Hide file tree
Changes from 20 commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
8b73a3e
add organization resource
aslilac Nov 5, 2024
69fab48
Merge branch 'main' into lilac/add-organization-resource
aslilac Nov 7, 2024
4743b9e
flesh out the organization resource
aslilac Nov 7, 2024
435032b
register new resource type + gen
aslilac Nov 7, 2024
71dc51b
start with tests from ethan
aslilac Nov 8, 2024
3397984
ooooh, I get it, that was correct :^)
aslilac Nov 8, 2024
75c0858
hmm
aslilac Nov 8, 2024
cc2bb2e
lets do members differently actually
aslilac Nov 8, 2024
d23168a
gen
aslilac Nov 8, 2024
28b395a
statecheck
aslilac Nov 8, 2024
f2d3e3c
feedback
aslilac Nov 12, 2024
236c11e
hiyo
aslilac Nov 12, 2024
16d10e7
:^)
aslilac Nov 12, 2024
f3ff5fb
how about
aslilac Nov 12, 2024
a2db0d6
this is probably bad :)
aslilac Nov 12, 2024
93f476b
this is probably also bad
aslilac Nov 13, 2024
39da842
Merge branch 'main' into lilac/idp-sync
aslilac Nov 25, 2024
69ebed9
get the attribute definitions out there
aslilac Nov 25, 2024
3bf1734
idek what I'm doing anymore apparently
aslilac Nov 26, 2024
a185262
so close...
aslilac Nov 26, 2024
03bdf17
pay attention
aslilac Nov 27, 2024
753eaa9
it WORKS!
aslilac Nov 27, 2024
85891d6
dogs
aslilac Nov 27, 2024
68c6ad5
Merge branch 'main' into lilac/idp-sync
aslilac Dec 2, 2024
bd73bb4
fix uuid handling
aslilac Dec 2, 2024
8f3e1b9
fix container name
aslilac Dec 2, 2024
d3f6e2c
do the reads
aslilac Dec 3, 2024
33e09a9
check regexp
aslilac Dec 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
195 changes: 195 additions & 0 deletions internal/provider/organization_resource.go
View file
Open in desktop
Copy link
Member

@ethanndickson ethanndickson Dec 3, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I just realised we're missing enterprise/premium entitlement checks on this and the provisioner key resource. We have them on the workspace proxy and the enterprise features of template resources, but they run during apply, when they should really run during plan. Let's not worry about it for now, and at some point I'll see if I can get them working at plan-time using a plan modifier (validators don't have the provider config we need).

If that doesn't work we can just copy the ones at apply-time to these two new resources.

Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,15 @@
import (
"context"
"fmt"
"regexp"

"github.com/coder/coder/v2/codersdk"
"github.com/coder/terraform-provider-coderd/internal/codersdkvalidator"
"github.com/google/uuid"
"github.com/hashicorp/terraform-plugin-framework-validators/listvalidator"
"github.com/hashicorp/terraform-plugin-framework-validators/mapvalidator"
"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
"github.com/hashicorp/terraform-plugin-framework/diag"
"github.com/hashicorp/terraform-plugin-framework/path"
"github.com/hashicorp/terraform-plugin-framework/resource"
"github.com/hashicorp/terraform-plugin-framework/resource/schema"
Expand All @@ -14,6 +20,7 @@
"github.com/hashicorp/terraform-plugin-framework/resource/schema/stringplanmodifier"
"github.com/hashicorp/terraform-plugin-framework/schema/validator"
"github.com/hashicorp/terraform-plugin-framework/types"
"github.com/hashicorp/terraform-plugin-framework/types/basetypes"
"github.com/hashicorp/terraform-plugin-log/tflog"
)

Expand All @@ -33,6 +40,21 @@
DisplayName types.String `tfsdk:"display_name"`
Description types.String `tfsdk:"description"`
Icon types.String `tfsdk:"icon"`

GroupSync types.Object `tfsdk:"group_sync"`
RoleSync types.Object `tfsdk:"role_sync"`
}

type GroupSyncModel struct {
Field types.String `tfsdk:"field"`
RegexFilter types.String `tfsdk:"regex_filter"`
AutoCreateMissing types.Bool `tfsdk:"auto_create_missing"`
Mapping types.Map `tfsdk:"mapping"`
}

type RoleSyncModel struct {
Field types.String `tfsdk:"field"`
Mapping types.Map `tfsdk:"mapping"`
}

func NewOrganizationResource() resource.Resource {
Expand Down Expand Up @@ -83,6 +105,64 @@
Default: stringdefault.StaticString(""),
},
},

Blocks: map[string]schema.Block{
"group_sync": schema.SingleNestedBlock{
Attributes: map[string]schema.Attribute{
"field": schema.StringAttribute{
Optional: true,
MarkdownDescription: "The claim field that specifies what groups " +
"a user should be in.",
Validators: []validator.String{
stringvalidator.LengthAtLeast(1),
},
},
"regex_filter": schema.StringAttribute{
Optional: true,
MarkdownDescription: "A regular expression that will be used to " +
"filter the groups returned by the OIDC provider. Any group " +
"not matched will be ignored.",
Validators: []validator.String{
stringvalidator.LengthAtLeast(1),
},
},
"auto_create_missing": schema.BoolAttribute{
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This defaults to false on coder right? Should just have a default set in the schema, and then you can remove the null checks on it.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would that prevent group_sync from being null tho?

Copy link
Member

@ethanndickson ethanndickson Dec 4, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, the default only gets computed if the parent is known, so:

    group_sync {}

would default any values within it, but omitting the block altogether would not.

If you wanted to default the block to known, and the bool to false, then you'd also add a Default to the block itself.

Optional: true,
MarkdownDescription: "Controls whether groups will be created if " +
"they are missing.",
},
"mapping": schema.MapAttribute{
ElementType: types.ListType{ElemType: UUIDType},
Optional: true,
MarkdownDescription: "A map from OIDC group name to Coder group ID.",
Validators: []validator.Map{
mapvalidator.ValueListsAre(listvalidator.ValueStringsAre(stringvalidator.Any())),
},
},
},
},
"role_sync": schema.SingleNestedBlock{
Attributes: map[string]schema.Attribute{
"field": schema.StringAttribute{
Optional: true,
MarkdownDescription: "The claim field that specifies what " +
"organization roles a user should be given.",
Validators: []validator.String{
stringvalidator.LengthAtLeast(1),
},
},
"mapping": schema.MapAttribute{
ElementType: types.ListType{ElemType: UUIDType},
Optional: true,
MarkdownDescription: "A map from OIDC group name to Coder " +
"organization role.",
Validators: []validator.Map{
mapvalidator.ValueListsAre(listvalidator.ValueStringsAre(stringvalidator.Any())),
},
},
},
},
},
}
}

Expand Down Expand Up @@ -133,6 +213,26 @@
}
}

if !data.GroupSync.IsNull() {
_, err := r.Client.GroupIDPSyncSettings(ctx, data.ID.ValueUUID().String())
if err != nil {
resp.Diagnostics.AddError("Client Error", fmt.Sprintf("unable to get organization group sync settings, got error: %s", err))
return
}

// data.GroupSync = ???
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't recall if you can write to a config block (blocks can't be computed) like this. I suspect you can't.

If you can, I assume it would just be to error if the post-apply plan isn't empty.
For that you'd need to use types.ObjectValueFrom and provide it the type of the object using a map[string]attr.Type. I've got an example on the template resource & data source.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think I figured something out that works 😄

}

if !data.RoleSync.IsNull() {
_, err := r.Client.RoleIDPSyncSettings(ctx, data.ID.ValueUUID().String())
if err != nil {
resp.Diagnostics.AddError("Client Error", fmt.Sprintf("unable to get organization role sync settings, got error: %s", err))
return
}

// data.RoleSync = ???
}

// We've fetched the organization ID from state, and the latest values for
// everything else from the backend. Ensure that any mutable data is synced
// with the backend.
Expand Down Expand Up @@ -183,6 +283,21 @@
// default it.
data.DisplayName = types.StringValue(org.DisplayName)

// Now apply group and role sync settings, if specified
orgID := data.ID.ValueUUID()
tflog.Trace(ctx, "updating group sync", map[string]any{
"orgID": orgID,
})
if !data.GroupSync.IsNull() {
r.patchGroupSync(ctx, orgID, data.GroupSync)
}
tflog.Trace(ctx, "updating role sync", map[string]any{
"orgID": orgID,
})
if !data.RoleSync.IsNull() {
r.patchRoleSync(ctx, orgID, data.RoleSync)
}

// Save data into Terraform state
resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
}
Expand Down Expand Up @@ -215,6 +330,7 @@
resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to update organization %s, got error: %s", orgID, err))
return
}

tflog.Trace(ctx, "successfully updated organization", map[string]any{
"id": orgID,
"name": org.Name,
Expand All @@ -223,6 +339,19 @@
"icon": org.Icon,
})

tflog.Trace(ctx, "updating group sync", map[string]any{
"orgID": orgID,
})
if !data.GroupSync.IsNull() {
r.patchGroupSync(ctx, orgID, data.GroupSync)
}
tflog.Trace(ctx, "updating role sync", map[string]any{
"orgID": orgID,
})
if !data.RoleSync.IsNull() {
r.patchRoleSync(ctx, orgID, data.RoleSync)
}

// Save updated data into Terraform state
resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
}
Expand Down Expand Up @@ -260,3 +389,69 @@
// set the `name` attribute.
resource.ImportStatePassthroughID(ctx, path.Root("name"), req, resp)
}

func (r *OrganizationResource) patchGroupSync(
ctx context.Context,
orgID uuid.UUID,
groupSyncObject types.Object,
) diag.Diagnostics {

Check failure on line 397 in internal/provider/organization_resource.go

View workflow job for this annotation

GitHub Actions / Build 

(*OrganizationResource).patchGroupSync - result 0 (github.com/hashicorp/terraform-plugin-framework/diag.Diagnostics) is never used (unparam)
var diags diag.Diagnostics

// Read values from Terraform
var groupSyncData GroupSyncModel
diags.Append(groupSyncObject.As(ctx, &groupSyncData, basetypes.ObjectAsOptions{})...)
if diags.HasError() {
return diags
}

// Convert that into the type used to send the PATCH to the backend
var groupSync codersdk.GroupSyncSettings
groupSync.Field = groupSyncData.Field.ValueString()
groupSync.RegexFilter = regexp.MustCompile(groupSyncData.RegexFilter.ValueString())
groupSync.AutoCreateMissing = groupSyncData.AutoCreateMissing.ValueBool()
diags.Append(groupSyncData.Mapping.ElementsAs(ctx, &groupSync.Mapping, false)...)
if diags.HasError() {
return diags
}

// Perform the PATCH
_, err := r.Client.PatchGroupIDPSyncSettings(ctx, orgID.String(), groupSync)
if err != nil {
diags.AddError("Group Sync Update error", err.Error())
return diags
}

return diags
}

func (r *OrganizationResource) patchRoleSync(
ctx context.Context,
orgID uuid.UUID,
roleSyncObject types.Object,
) diag.Diagnostics {

Check failure on line 431 in internal/provider/organization_resource.go

View workflow job for this annotation

GitHub Actions / Build 

(*OrganizationResource).patchRoleSync - result 0 (github.com/hashicorp/terraform-plugin-framework/diag.Diagnostics) is never used (unparam)
var diags diag.Diagnostics

// Read values from Terraform
var roleSyncData RoleSyncModel
diags.Append(roleSyncObject.As(ctx, &roleSyncData, basetypes.ObjectAsOptions{})...)
if diags.HasError() {
return diags
}

// Convert that into the type used to send the PATCH to the backend
var roleSync codersdk.RoleSyncSettings
roleSync.Field = roleSyncData.Field.ValueString()
diags.Append(roleSyncData.Mapping.ElementsAs(ctx, &roleSync.Mapping, false)...)
if diags.HasError() {
return diags
}

// Perform the PATCH
_, err := r.Client.PatchRoleIDPSyncSettings(ctx, orgID.String(), roleSync)
if err != nil {
diags.AddError("Role Sync Update error", err.Error())
return diags
}

return diags
}
48 changes: 48 additions & 0 deletions internal/provider/organization_resource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ import (
"github.com/coder/coder/v2/coderd/util/ptr"
"github.com/coder/coder/v2/codersdk"
"github.com/coder/terraform-provider-coderd/integration"
"github.com/google/uuid"
"github.com/hashicorp/terraform-plugin-testing/helper/resource"
"github.com/hashicorp/terraform-plugin-testing/knownvalue"
"github.com/hashicorp/terraform-plugin-testing/statecheck"
Expand Down Expand Up @@ -40,6 +41,20 @@ func TestAccOrganizationResource(t *testing.T) {
cfg2.Name = ptr.Ref("example-org-new")
cfg2.DisplayName = ptr.Ref("Example Organization New")

cfg3 := cfg2
cfg3.GroupSync = ptr.Ref(codersdk.GroupSyncSettings{
Field: "wibble",
Mapping: map[string][]uuid.UUID{
"wibble": {uuid.MustParse("6e57187f-6543-46ab-a62c-a10065dd4314")},
},
})
cfg3.RoleSync = ptr.Ref(codersdk.RoleSyncSettings{
Field: "wobble",
Mapping: map[string][]string{
"wobble": {"wobbly"},
},
})

t.Run("CreateImportUpdateReadOk", func(t *testing.T) {
resource.Test(t, resource.TestCase{
IsUnitTest: true,
Expand Down Expand Up @@ -71,6 +86,14 @@ func TestAccOrganizationResource(t *testing.T) {
statecheck.ExpectKnownValue("coderd_organization.test", tfjsonpath.New("display_name"), knownvalue.StringExact("Example Organization New")),
},
},
// Add group and role sync
{
Config: cfg3.String(t),
ConfigStateChecks: []statecheck.StateCheck{
statecheck.ExpectKnownValue("coderd_organization.test", tfjsonpath.New("group_sync.field"), knownvalue.StringExact("wibble")),
statecheck.ExpectKnownValue("coderd_organization.test", tfjsonpath.New("role_sync.field"), knownvalue.StringExact("wobble")),
},
},
},
})
})
Expand All @@ -84,6 +107,9 @@ type testAccOrganizationResourceConfig struct {
DisplayName *string
Description *string
Icon *string

GroupSync *codersdk.GroupSyncSettings
RoleSync *codersdk.RoleSyncSettings
}

func (c testAccOrganizationResourceConfig) String(t *testing.T) string {
Expand All @@ -99,6 +125,28 @@ resource "coderd_organization" "test" {
display_name = {{orNull .DisplayName}}
description = {{orNull .Description}}
icon = {{orNull .Icon}}

{{- if .GroupSync}}
group_sync {
field = "{{.GroupSync.Field}}"
mapping = {
{{- range $key, $value := .GroupSync.Mapping}}
{{$key}} = {{printf "%q" $value}}
{{- end}}
}
}
{{- end}}

{{- if .RoleSync}}
role_sync {
field = "{{.RoleSync.Field}}"
mapping = {
{{- range $key, $value := .RoleSync.Mapping}}
{{$key}} = {{printf "%q" $value}}
{{- end}}
}
}
{{- end}}
}
`
funcMap := template.FuncMap{
Expand Down
Loading