fix(authentik): grant_types

Author: chkpwd

terraform/_modules/authentik/oauth2_app/main.tf

@@ -8,6 +8,7 @@ resource "authentik_provider_oauth2" "oauth2" {
   invalidation_flow     = data.authentik_flow.default-provider-invalidation-flow.id
   access_token_validity = "minutes=10"
   property_mappings     = var.oauth2_values.property_mappings
+  grant_types           = var.oauth2_values.grant_types
   allowed_redirect_uris = var.oauth2_values.allowed_redirect_uris
   signing_key           = data.authentik_certificate_key_pair.generated.id
   lifecycle {

terraform/_modules/authentik/oauth2_app/vars.tf

@@ -17,9 +17,13 @@ variable "oauth2_values" {
     client_secret     = optional(string)
     client_type       = optional(string)
     property_mappings = optional(list(string))
+    grant_types       = optional(list(string), ["authorization_code", "refresh_token"])
     allowed_redirect_uris = list(object({
       matching_mode = string
       url           = string
+      # authentik's API stamps every redirect URI with this; set it so we don't
+      # perpetually diff it back to null.
+      redirect_uri_type = optional(string, "authorization")
     }))
   })
 }