Add multi-team token support

[drewmullen]

Partially closes: #6

add new role parameter credential_type to set to new team token behavior. if you set team_id and credential_type=team then youll get new behavior. leaving out credential_type defaults to team_legacy (if also setting team_id) which maintains previous behaviors. if empty, credential_type is set automatically for users based on the id type they passed and is used for internal logic decisions.

Vault Docs PR: hashicorp/vault#30477

Notes:

• when max_ttl is set we also set the ExpiredAt field. Tokens in API remain even after they expire so vault can still delete and maintain lease as expected.
• when creating a new team token we use up 5 chars at the end to add randomness (format: (#####)). This will help with identifying the token in the GUI.
• creating a new team token type now requires a description
• internally refer to legacy related functions as TeamLegacy
• Previously it was possible to set max_ttl and ttl on the legacy token but they didnt do anything. This was deceptive to users so I have added an error when trying to set a role like this.

$ go test -run TestMultiTeamRole
PASS
ok  	github.com/hashicorp/vault-plugin-secrets-terraform	0.277s

$ CGO_ENABLED=0 VAULT_TOKEN= VAULT_ACC=1 go test -v -tags='vault-plugin-secrets-terraform' $(go list ./... | grep -v /vendor/ | grep -v /integ) --run=TestMultiTeamRole -count=1 -timeout=10m -parallel=4
=== RUN   TestMultiTeamRole
=== RUN   TestMultiTeamRole/Create_MultiTeam_Role_-_pass
=== RUN   TestMultiTeamRole/Read_MultiTeam_Role
=== RUN   TestMultiTeamRole/Update_MultiTeam_Role
=== RUN   TestMultiTeamRole/Re-read_MultiTeam_Role
--- PASS: TestMultiTeamRole (0.00s)
    --- PASS: TestMultiTeamRole/Create_MultiTeam_Role_-_pass (0.00s)
    --- PASS: TestMultiTeamRole/Read_MultiTeam_Role (0.00s)
    --- PASS: TestMultiTeamRole/Update_MultiTeam_Role (0.00s)
    --- PASS: TestMultiTeamRole/Re-read_MultiTeam_Role (0.00s)
PASS
ok  	github.com/hashicorp/vault-plugin-secrets-terraform	0.259s
?   	github.com/hashicorp/vault-plugin-secrets-terraform/cmd/vault-plugin-secrets-terraform

with a max_ttl

$ vault write terraform/role/tfc-mgmt team_id=$TFE_TEAM_ID description="test team description" credential_type="team" ttl=10 max_ttl=15

$ vault read terraform/creds/tfc-mgmt
Key                Value
---                -----
lease_id           terraform/creds/tfc-mgmt/xugKru01A15kA1eBmdYMYTC7
lease_duration     10s
lease_renewable    true
description        test team description(1099)
expired_at         2025-04-29T21:14:38Z
token              <token>
token_id           at-qXxjwa3hVaDhTcHM

**properly removed after 10s

when max_ttl set larger than system max_ttl (respected in HCP tf api)

$ vault write terraform/role/tfc-mgmt team_id=$TFE_TEAM_ID description="test team description" credential_type="team" ttl=200 max_ttl=900000h
Success! Data written to: terraform/role/tfc-mgmt

$ vault read terraform/creds/tfc-mgmt
Key                Value
---                -----
lease_id           terraform/creds/tfc-mgmt/ljjL2d9kzR2p7p9Kt67mjvTQ
lease_duration     3m20s
lease_renewable    true
description        test team description(5326)
expired_at         2128-01-03T23:49:17Z
token              <token>
token_id           at-mxtz2BbSQF5mmDdi

**notice respected max ttl of 768h (default)

with no max_ttl set

uses system max_ttl

[robmonte]

For my initial review this looks good. Depending on any final changes made to the PR based on the feedback in Slack I think the design for the support of this feature is done well.

I would consider this a soft approval, as someone else will need to give it a bit more thorough of a review and test, since I will be out on PTO.

[drewmullen]

I was also asked to show a test that pre-existing legacy tokens are not effect:

i created a token using the legacy api:

curl \
  --header "Authorization: Bearer $TFE_TOKEN" \
  --header "Content-Type: application/vnd.api+json" \
  --request POST \
  "https://app.terraform.io/api/v2/teams/$TFE_TEAM_ID/authentication-token" \
  --data '{
  "data": {
    "type": "authentication-token",
    "attributes": {
      "expired-at": "2026-04-06T12:00:00.000Z"
    }
  }
}
'

then i created one with the new vault team tokens from the secret engine

$ vault write terraform/role/tfc-mgmt team_id=$TFE_TEAM_ID description="test team description" credential_type="team" ttl=200 max_ttl=300
$ vault read terraform/creds/tfc-mgmt
Key                Value
---                -----
lease_id           terraform/creds/tfc-mgmt/lB7WOlEDcXFhPJeHc2cwbcvf
lease_duration     3m20s
lease_renewable    true
description        test team description(7135)
expired_at         2025-06-23T18:51:34Z
token              jRRTLapDx9NK7A.atlasv1.<>
token_id           at-fVMZ1TyGDtLgm2Gx

Both still exist in the UI :)