DXCDT-246: Add new resource to manage enabled clients on a connection

docs/resources/connection_client.md

@@ -0,0 +1,58 @@
+---
+page_title: "Resource: auth0_connection_client"
+description: |-
+  With this resource, you can manage enabled clients on a connection.
+  ~> Avoid using the enabledclients property on the "auth0connection" if making use of this resource, to avoid unexpected behavior.
+---
+
+# Resource: auth0_connection_client
+
+With this resource, you can manage enabled clients on a connection.
+
+~> Avoid using the enabled_clients property on the "auth0_connection" if making use of this resource, to avoid unexpected behavior.
+
+## Example Usage
+
+```terraform
+resource "auth0_connection" "my_conn" {
+  name     = "My-Auth0-Connection"
+  strategy = "auth0"
+  # Avoid using the enabled_clients = [...],
+  # if using the auth0_connection_client resource.
+}
+
+resource "auth0_client" "my_client" {
+  name = "My-Auth0-Client"
+}
+
+resource "auth0_connection_client" "my_conn_client_assoc" {
+  connection_id = auth0_connection.my_conn.id
+  client_id     = auth0_client.my_client.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `client_id` (String) ID of the client for which the connection is enabled.
+- `connection_id` (String) ID of the connection on which to enable the client.
+
+### Read-Only
+
+- `id` (String) The ID of this resource.
+- `name` (String) The name of the connection on which to enable the client.
+- `strategy` (String) The strategy of the connection on which to enable the client.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# This resource can be imported by specifying the
+# connection ID and client ID separated by ":".
+#
+# Example:
+terraform import auth0_connection_client.my_conn_client_assoc con_XXXXX:XXXXXXXX
+```

examples/resources/auth0_connection_client/import.sh

@@ -0,0 +1,5 @@
+# This resource can be imported by specifying the
+# connection ID and client ID separated by ":".
+#
+# Example:
+terraform import auth0_connection_client.my_conn_client_assoc con_XXXXX:XXXXXXXX

examples/resources/auth0_connection_client/resource.tf

@@ -0,0 +1,15 @@
+resource "auth0_connection" "my_conn" {
+  name     = "My-Auth0-Connection"
+  strategy = "auth0"
+  # Avoid using the enabled_clients = [...],
+  # if using the auth0_connection_client resource.
+}
+
+resource "auth0_client" "my_client" {
+  name = "My-Auth0-Client"
+}
+
+resource "auth0_connection_client" "my_conn_client_assoc" {
+  connection_id = auth0_connection.my_conn.id
+  client_id     = auth0_client.my_client.id
+}

internal/provider/provider.go

@@ -102,6 +102,7 @@ func New() *schema.Provider {
 			"auth0_trigger_binding":            newTriggerBinding(),
 			"auth0_attack_protection":          newAttackProtection(),
 			"auth0_branding_theme":             newBrandingTheme(),
+			"auth0_connection_client":          newConnectionClient(),
 		},
 		DataSourcesMap: map[string]*schema.Resource{
 			"auth0_client":        newDataClient(),

internal/provider/resource_auth0_connection_client.go

@@ -0,0 +1,189 @@
+package provider
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"strings"
+
+	"github.com/auth0/go-auth0/management"
+	"github.com/hashicorp/go-multierror"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+var (
+	errEmptyConnectionClientID         = fmt.Errorf("ID cannot be empty")
+	errInvalidConnectionClientIDFormat = fmt.Errorf("ID must be formated as <connectionID>:<clientID>")
+)
+
+func newConnectionClient() *schema.Resource {
+	return &schema.Resource{
+		Schema: map[string]*schema.Schema{
+			"connection_id": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: "ID of the connection on which to enable the client.",
+			},
+			"client_id": {
+				Type:        schema.TypeString,
+				Required:    true,
+				ForceNew:    true,
+				Description: "ID of the client for which the connection is enabled.",
+			},
+			"name": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "The name of the connection on which to enable the client.",
+			},
+			"strategy": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "The strategy of the connection on which to enable the client.",
+			},
+		},
+		CreateContext: createConnectionClient,
+		ReadContext:   readConnectionClient,
+		DeleteContext: deleteConnectionClient,
+		Importer: &schema.ResourceImporter{
+			StateContext: importConnectionClient,
+		},
+		Description: `With this resource, you can manage enabled clients on a connection.
+
+~> Avoid using the enabled_clients property on the "auth0_connection" if making use of this resource, to avoid unexpected behavior.`,
+	}
+}
+
+func importConnectionClient(
+	_ context.Context,
+	data *schema.ResourceData,
+	_ interface{},
+) ([]*schema.ResourceData, error) {
+	rawID := data.Id()
+	if rawID == "" {
+		return nil, errEmptyConnectionClientID
+	}
+
+	if !strings.Contains(rawID, ":") {
+		return nil, errInvalidConnectionClientIDFormat
+	}
+
+	idPair := strings.Split(rawID, ":")
+	if len(idPair) != 2 {
+		return nil, errInvalidConnectionClientIDFormat
+	}
+
+	result := multierror.Append(
+		data.Set("connection_id", idPair[0]),
+		data.Set("client_id", idPair[1]),
+	)
+
+	data.SetId(resource.UniqueId())
+
+	return []*schema.ResourceData{data}, result.ErrorOrNil()
+}
+
+func createConnectionClient(ctx context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	api := meta.(*management.Management)
+
+	connectionID := data.Get("connection_id").(string)
+	connection, err := api.Connection.Read(connectionID)
+	if err != nil {
+		if mErr, ok := err.(management.Error); ok && mErr.Status() == http.StatusNotFound {
+			data.SetId("")
+			return nil
+		}
+		return diag.FromErr(err)
+	}
+
+	clientID := data.Get("client_id").(string)
+	enabledClients := append(connection.GetEnabledClients(), clientID)
+
+	if err := api.Connection.Update(
+		connectionID,
+		&management.Connection{EnabledClients: &enabledClients},
+	); err != nil {
+		if mErr, ok := err.(management.Error); ok && mErr.Status() == http.StatusNotFound {
+			data.SetId("")
+			return nil
+		}
+		return diag.FromErr(err)
+	}
+
+	data.SetId(resource.UniqueId())
+
+	return readConnectionClient(ctx, data, meta)
+}
+
+func readConnectionClient(_ context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	api := meta.(*management.Management)
+
+	connectionID := data.Get("connection_id").(string)
+	clientID := data.Get("client_id").(string)
+
+	connection, err := api.Connection.Read(connectionID)
+	if err != nil {
+		if mErr, ok := err.(management.Error); ok && mErr.Status() == http.StatusNotFound {
+			data.SetId("")
+			return nil
+		}
+		return diag.FromErr(err)
+	}
+
+	found := false
+	for _, enabledClientID := range connection.GetEnabledClients() {
+		if enabledClientID == clientID {
+			found = true
+		}
+	}
+	if !found {
+		data.SetId("")
+		return nil
+	}
+
+	result := multierror.Append(
+		data.Set("name", connection.GetName()),
+		data.Set("strategy", connection.GetStrategy()),
+	)
+
+	return diag.FromErr(result.ErrorOrNil())
+}
+
+func deleteConnectionClient(_ context.Context, data *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	api := meta.(*management.Management)
+
+	connectionID := data.Get("connection_id").(string)
+	connection, err := api.Connection.Read(connectionID)
+	if err != nil {
+		if mErr, ok := err.(management.Error); ok && mErr.Status() == http.StatusNotFound {
+			data.SetId("")
+			return nil
+		}
+		return diag.FromErr(err)
+	}
+
+	clientID := data.Get("client_id").(string)
+	var enabledClients []string
+	for _, enabledClientID := range connection.GetEnabledClients() {
+		if enabledClientID == clientID {
+			continue
+		}
+		enabledClients = append(enabledClients, enabledClientID)
+	}
+
+	if err := api.Connection.Update(
+		connectionID,
+		&management.Connection{EnabledClients: &enabledClients},
+	); err != nil {
+		if mErr, ok := err.(management.Error); ok && mErr.Status() == http.StatusNotFound {
+			data.SetId("")
+			return nil
+		}
+		return diag.FromErr(err)
+	}
+
+	data.SetId("")
+	return nil
+}