clean up

Author: KT-Doan

.github/workflows/acceptance-test.yml

@@ -43,7 +43,7 @@ permissions:
 jobs:
   detect-changes:
     name: Detect Changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     outputs:
       source-changed: ${{ steps.filter.outputs.source }}
     steps:
@@ -64,7 +64,7 @@ jobs:
     name: Build & Acceptance Test
     needs: detect-changes
     if: ${{ needs.detect-changes.outputs.source-changed == 'true' || github.event_name == 'workflow_dispatch' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     timeout-minutes: 30
 
     env:
@@ -88,8 +88,6 @@ jobs:
 
       - name: Run Acceptance Tests
         env:
-          # For push to main: run all tests
-          # For manual dispatch: run_all=true runs all, otherwise use individual toggles
           ORY_KETO_TESTS_ENABLED: ${{ github.event_name == 'push' || github.event.inputs.run_all == 'true' || github.event.inputs.enable_keto_tests == 'true' }}
           ORY_B2B_ENABLED: ${{ github.event_name == 'push' || github.event.inputs.run_all == 'true' || github.event.inputs.enable_b2b_tests == 'true' }}
           ORY_SOCIAL_PROVIDER_TESTS_ENABLED: ${{ github.event_name == 'push' || github.event.inputs.run_all == 'true' || github.event.inputs.enable_social_provider_tests == 'true' }}

.github/workflows/unit-test.yml

@@ -13,7 +13,7 @@ permissions:
 jobs:
   detect-changes:
     name: Detect Changes
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     outputs:
       source-changed: ${{ steps.filter.outputs.source }}
     steps:
@@ -34,7 +34,7 @@ jobs:
     name: Build & Unit Test
     needs: detect-changes
     if: ${{ needs.detect-changes.outputs.source-changed == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
 
     steps:
       - name: Checkout

CONTRIBUTING.md

@@ -28,39 +28,190 @@ make build
 make install
 ```
 
-### Running Tests
+## Testing
+
+### Test Types
+
+The provider has two types of tests:
+
+1. **Unit Tests** - Fast, isolated tests that don't require API access
+2. **Acceptance Tests** - Integration tests that create real resources in Ory Network
+
+### Unit Tests
+
+Unit tests can be run without any credentials:
+
+```bash
+make test           # Run all unit tests
+make test-short     # Run unit tests in short mode
+```
+
+### Acceptance Tests
 
 Acceptance tests are **self-contained** - they automatically create a temporary Ory project, run tests against it, and clean up when done.
 
+#### Required Environment Variables
+
 ```bash
-# Unit tests (no credentials needed)
-make test
+export ORY_WORKSPACE_API_KEY="ory_wak_..."  # Workspace API key
+export ORY_WORKSPACE_ID="..."               # Workspace ID
+```
 
-# Acceptance tests (requires Ory credentials)
-export ORY_WORKSPACE_API_KEY="ory_wak_..."
-export ORY_WORKSPACE_ID="..."
+#### Running Acceptance Tests
+
+```bash
+# Standard acceptance tests
 make test-acc
 
-# Acceptance tests with debug logging
+# With debug logging
 make test-acc-verbose
 
 # Run all tests with all features enabled
 make test-acc-all
+
+# Run specific resource tests
+ORY_KETO_TESTS_ENABLED=true make test-acc-keto
 ```
 
 #### Optional Feature Flags
 
 Some tests require specific Ory plan features. Enable them with environment variables:
 
+| Environment Variable | Description |
+|---------------------|-------------|
+| `ORY_KETO_TESTS_ENABLED=true` | Run relationship/Keto tests |
+| `ORY_B2B_ENABLED=true` | Run B2B/organization tests (requires B2B plan) |
+| `ORY_SOCIAL_PROVIDER_TESTS_ENABLED=true` | Run social provider tests |
+| `ORY_SCHEMA_TESTS_ENABLED=true` | Run identity schema tests |
+| `ORY_PROJECT_TESTS_ENABLED=true` | Run project creation/deletion tests |
+
+#### API URL Overrides (for local development)
+
 ```bash
-# Run relationship/Keto tests
-ORY_KETO_TESTS_ENABLED=true make test-acc
+export ORY_CONSOLE_API_URL="https://api.console.ory.sh"      # Console API
+export ORY_PROJECT_API_URL="https://%s.projects.oryapis.com" # Project API template
+```
 
-# Run B2B/organization tests (requires B2B plan)
-ORY_B2B_ENABLED=true make test-acc
+### Cleaning Up Dangling Resources
 
-# Run social provider tests
-ORY_SOCIAL_PROVIDER_TESTS_ENABLED=true make test-acc
+If tests fail and leave resources behind, use the sweepers to clean up:
+
+```bash
+# Sweep all test resources
+go test -v ./internal/acctest -sweep=all -timeout 30m
+
+# Sweep specific resource types
+go test -v ./internal/acctest -sweep=ory_oauth2_client -timeout 30m
+
+# Enable project deletion (use with caution!)
+ORY_SWEEP_PROJECTS=true go test -v ./internal/acctest -sweep=ory_project -timeout 30m
+```
+
+Sweepers only delete resources with names starting with `tf-acc-test` or `Test`.
+
+### Writing Acceptance Tests
+
+Follow these guidelines when writing acceptance tests:
+
+#### 1. Use the Test Utilities
+
+```go
+//go:build acceptance
+
+package myresource_test
+
+import (
+    "testing"
+    "github.com/hashicorp/terraform-plugin-testing/helper/resource"
+    "github.com/ory/terraform-provider-orynetwork/internal/acctest"
+)
+
+func TestAccMyResource_basic(t *testing.T) {
+    // Use acctest.RunTest for consistent test execution
+    acctest.RunTest(t, resource.TestCase{
+        PreCheck:                 func() { acctest.AccPreCheck(t) },
+        ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories(),
+        CheckDestroy:             acctest.CheckDestroy("ory_myresource", myResourceExists),
+        Steps: []resource.TestStep{
+            // Create and Read
+            {
+                Config: testAccMyResourceConfig(),
+                Check: resource.ComposeAggregateTestCheckFunc(
+                    resource.TestCheckResourceAttrSet("ory_myresource.test", "id"),
+                ),
+            },
+            // ImportState
+            {
+                ResourceName:      "ory_myresource.test",
+                ImportState:       true,
+                ImportStateVerify: true,
+            },
+        },
+    })
+}
+```
+
+#### 2. Implement CheckDestroy
+
+Every acceptance test should verify resources are properly deleted:
+
+```go
+// Use existing check functions
+CheckDestroy: acctest.CheckDestroy("ory_identity", acctest.IdentityExists),
+CheckDestroy: acctest.CheckDestroy("ory_oauth2_client", acctest.OAuth2ClientExists),
+CheckDestroy: acctest.CheckDestroy("ory_organization", acctest.OrganizationExists),
+CheckDestroy: acctest.CheckDestroy("ory_project", acctest.ProjectExists),
+
+// Or implement a custom existence check
+func myResourceExists(ctx context.Context, id string) (bool, error) {
+    c, err := acctest.GetOryClient()
+    if err != nil {
+        return false, err
+    }
+    _, err = c.GetMyResource(ctx, id)
+    if err != nil {
+        if strings.Contains(err.Error(), "404") {
+            return false, nil
+        }
+        return false, err
+    }
+    return true, nil
+}
+```
+
+#### 3. Test Configuration Best Practices
+
+- Use `fmt.Sprintf()` for variable injection in HCL configs
+- Prefix test resource names with `tf-acc-test` or `Test` for sweeper compatibility
+- Include the `provider "ory" {}` declaration in each config
+- Test create, read, update, import, and delete operations
+
+```go
+func testAccMyResourceConfig(name string) string {
+    return fmt.Sprintf(`
+provider "ory" {}
+
+resource "ory_myresource" "test" {
+  name = %[1]q
+}
+`, name)
+}
+```
+
+#### 4. Feature-Gated Tests
+
+For tests requiring specific Ory plan features:
+
+```go
+func TestAccOrganizationResource_basic(t *testing.T) {
+    acctest.RequireB2BTests(t)  // Skips if ORY_B2B_ENABLED != "true"
+    // ... test implementation
+}
+
+func TestAccRelationshipResource_basic(t *testing.T) {
+    acctest.RequireKetoTests(t)  // Skips if ORY_KETO_TESTS_ENABLED != "true"
+    // ... test implementation
+}
 ```
 
 ### Using Local Provider
@@ -93,7 +244,18 @@ provider_installation {
 3. Register the resource in `internal/provider/provider.go`
 4. Add documentation in `docs/resources/`
 5. Add examples in `examples/resources/`
-6. Write acceptance tests
+6. Write acceptance tests with CheckDestroy
+
+### Resource Contribution Checklist
+
+- [ ] Resource implements all CRUD operations
+- [ ] Resource supports import via `ImportState()`
+- [ ] Acceptance tests cover create, read, update, import, delete
+- [ ] Tests use `acctest.CheckDestroy()` to verify cleanup
+- [ ] Tests use `acctest.RunTest()` for consistent test execution
+- [ ] Documentation added to `docs/resources/`
+- [ ] Examples added to `examples/resources/`
+- [ ] Code passes `make lint` and `make fmt`
 
 ### Code Style
 
@@ -110,7 +272,7 @@ Use clear, descriptive commit messages:
 Add ory_foo resource for managing foos
 
 - Implement CRUD operations
-- Add acceptance tests
+- Add acceptance tests with CheckDestroy
 - Add documentation
 ```
 

examples/resources/ory_social_provider/resource.tf

@@ -23,7 +23,7 @@ resource "ory_social_provider" "microsoft" {
   scopes        = ["openid", "profile", "email"]
 }
 
-# Generic OIDC Provider (e.g., Okta, Auth0)
+# Generic OIDC Provider
 resource "ory_social_provider" "corporate_sso" {
   provider_id    = "generic"
   provider_label = "Corporate SSO"

internal/acctest/acctest.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-framework/providerserver"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	ory "github.com/ory/client-go"
 
 	"github.com/ory/terraform-provider-orynetwork/internal/client"
@@ -251,11 +252,29 @@ func getOryClient() (*client.OryClient, error) {
 		ProjectAPIURL:   projectURL,
 	}
 
+	// Also set project credentials if available
+	if sharedTestProject != nil {
+		cfg.ProjectAPIKey = sharedTestProject.APIKey
+		cfg.ProjectSlug = sharedTestProject.Slug
+		cfg.ProjectID = sharedTestProject.ID
+	} else {
+		// Fall back to environment variables
+		cfg.ProjectAPIKey = os.Getenv("ORY_PROJECT_API_KEY")
+		cfg.ProjectSlug = os.Getenv("ORY_PROJECT_SLUG")
+		cfg.ProjectID = os.Getenv("ORY_PROJECT_ID")
+	}
+
 	var err error
 	oryClient, err = client.NewOryClient(cfg)
 	return oryClient, err
 }
 
+// GetOryClient returns a shared Ory client for use in tests.
+// This is an exported version for use in custom CheckDestroy functions.
+func GetOryClient() (*client.OryClient, error) {
+	return getOryClient()
+}
+
 // SkipIfFeatureDisabled skips the test if the specified feature flag is not set to "true".
 func SkipIfFeatureDisabled(t *testing.T, envVar, featureName string) {
 	t.Helper()
@@ -293,3 +312,11 @@ func RequireProjectTests(t *testing.T) {
 	t.Helper()
 	SkipIfFeatureDisabled(t, "ORY_PROJECT_TESTS_ENABLED", "project")
 }
+
+// RunTest runs an acceptance test.
+// This is a convenience wrapper around resource.Test() that follows
+// provider conventions and can be extended in the future.
+func RunTest(t *testing.T, tc resource.TestCase) {
+	t.Helper()
+	resource.Test(t, tc)
+}