add import + delete support for organization users

docs/resources/user_role.md

@@ -26,3 +26,17 @@ resource "openai_user_role" "example" {
 
 - `role` (String) `owner` or `reader`.
 - `user_id` (String) The ID of the user.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+# Import an organization user
+terraform import openai_user_role.example user-id
+
+# Example
+terraform import openai_user_role.example user-000000000000000000000000
+```

examples/resources/openai_user_role/import.sh

@@ -0,0 +1,5 @@
+# Import an organization user
+terraform import openai_user_role.example user-id
+
+# Example
+terraform import openai_user_role.example user-000000000000000000000000

internal/provider/resource_user_role.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
@@ -151,5 +152,27 @@ func (r *UserRoleResource) Update(ctx context.Context, req resource.UpdateReques
 }
 
 func (r *UserRoleResource) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
-	resp.Diagnostics.AddWarning("Delete not supported", "This resource does not support deletion.")
+	var data UserRoleResourceModel
+
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	httpResp, err := r.client.DeleteUserWithResponse(
+		ctx,
+		data.UserId.ValueString(),
+	)
+
+	if err != nil {
+		resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to delete, got error: %s", err))
+		return
+	} else if httpResp.StatusCode() != http.StatusOK {
+		resp.Diagnostics.AddError("Client Error", fmt.Sprintf("Unable to delete, got status code %d: %s", httpResp.StatusCode(), string(httpResp.Body)))
+		return
+	}
+}
+
+func (r *UserRoleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	resource.ImportStatePassthroughID(ctx, path.Root("user_id"), req, resp)
 }

internal/provider/resource_user_role_test.go

@@ -18,6 +18,13 @@ func TestAccUserRoleResource(t *testing.T) {
 		PreCheck:                 func() { acctest.PreCheck(t) },
 		ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories,
 		Steps: []resource.TestStep{
+			// Import existing user role
+			{
+				Config:        testAccUserRoleResourceConfig(acctest.TestUserId, "owner"),
+				ResourceName:  rn,
+				ImportState:   true,
+				ImportStateId: acctest.TestUserId,
+			},
 			{
 				Config: testAccUserRoleResourceConfig(acctest.TestUserId, "owner"),
 				ConfigStateChecks: []statecheck.StateCheck{
@@ -32,6 +39,10 @@ func TestAccUserRoleResource(t *testing.T) {
 					statecheck.ExpectKnownValue(rn, tfjsonpath.New("role"), knownvalue.StringExact("reader")),
 				},
 			},
+			{
+				// Detach state to prevent deletion of user
+				Config: testAccUserRoleDetachState(),
+			},
 		},
 	})
 }
@@ -41,6 +52,22 @@ func testAccUserRoleResourceConfig(userId, role string) string {
 resource "openai_user_role" "test" {
 	user_id = %[1]q
 	role    = %[2]q
+
+	lifecycle {
+		prevent_destroy = true
+	}
 }
 `, userId, role)
 }
+
+func testAccUserRoleDetachState() string {
+	return `
+removed {
+  from = openai_user_role.test
+
+  lifecycle {
+    destroy = false
+  }
+}
+`
+}