Skip to content

Commit d9ded58

Browse files
sionsmithsionsmith
committed
Merge pull request #9 from danielloader/feat/organization-role-permission
feat: add permission resource, data source, and organization role permission resource
2 parents 4bde9d4 + 0df2991 commit d9ded58

17 files changed

Lines changed: 1414 additions & 1 deletion

‎README.md‎

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# WorkOS Terraform Provider
22

3-
Terraform provider for managing [WorkOS](https://workos.com) resources including organizations, users, organization memberships, and roles.
3+
Terraform provider for managing [WorkOS](https://workos.com) resources including organizations, users, organization memberships, roles, and permissions.
44

55
## Requirements
66

@@ -101,6 +101,38 @@ resource "workos_organization_role" "viewer" {
101101
}
102102
```
103103

104+
### Managing Permissions
105+
106+
```hcl
107+
resource "workos_permission" "billing_read" {
108+
slug = "billing:read"
109+
name = "Read Billing"
110+
description = "Allows reading billing data"
111+
}
112+
113+
resource "workos_permission" "billing_write" {
114+
slug = "billing:write"
115+
name = "Write Billing"
116+
description = "Allows modifying billing data"
117+
}
118+
```
119+
120+
### Assigning Permissions to Organization Roles
121+
122+
```hcl
123+
resource "workos_organization_role_permission" "billing_admin_read" {
124+
organization_id = workos_organization.example.id
125+
role_slug = workos_organization_role.billing_admin.slug
126+
permission = workos_permission.billing_read.slug
127+
}
128+
129+
resource "workos_organization_role_permission" "billing_admin_write" {
130+
organization_id = workos_organization.example.id
131+
role_slug = workos_organization_role.billing_admin.slug
132+
permission = workos_permission.billing_write.slug
133+
}
134+
```
135+
104136
### Data Sources
105137

106138
```hcl
@@ -129,6 +161,11 @@ data "workos_organization_role" "billing" {
129161
organization_id = workos_organization.example.id
130162
slug = "org-billing-admin"
131163
}
164+
165+
# Look up permission by slug
166+
data "workos_permission" "billing_read" {
167+
slug = "billing:read"
168+
}
132169
```
133170

134171
## Resources
@@ -139,6 +176,8 @@ data "workos_organization_role" "billing" {
139176
| `workos_user` | Manages AuthKit users |
140177
| `workos_organization_membership` | Manages user-organization memberships |
141178
| `workos_organization_role` | Manages organization authorization roles |
179+
| `workos_permission` | Manages environment-level permissions |
180+
| `workos_organization_role_permission` | Assigns a permission to an organization role |
142181

143182
## Data Sources
144183

@@ -151,6 +190,7 @@ data "workos_organization_role" "billing" {
151190
| `workos_directory_group` | Retrieves directory-synced group |
152191
| `workos_user` | Retrieves AuthKit user by ID or email |
153192
| `workos_organization_role` | Retrieves organization role by slug or ID |
193+
| `workos_permission` | Retrieves permission by slug |
154194

155195
## Development
156196

‎docs/data-sources/permission.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_permission Data Source - workos"
4+
subcategory: ""
5+
description: |-
6+
Use this data source to get information about a WorkOS Permission.
7+
You can look up a permission by its slug.
8+
Example Usage
9+
10+
data "workos_permission" "billing_read" {
11+
slug = "billing:read"
12+
}
13+
---
14+
15+
# workos_permission (Data Source)
16+
17+
Use this data source to get information about a WorkOS Permission.
18+
19+
You can look up a permission by its slug.
20+
21+
## Example Usage
22+
23+
```hcl
24+
data "workos_permission" "billing_read" {
25+
slug = "billing:read"
26+
}
27+
```
28+
29+
## Example Usage
30+
31+
```terraform
32+
data "workos_permission" "billing_read" {
33+
slug = "billing:read"
34+
}
35+
```
36+
37+
<!-- schema generated by tfplugindocs -->
38+
## Schema
39+
40+
### Required
41+
42+
- `slug` (String) The slug identifier of the permission to look up.
43+
44+
### Read-Only
45+
46+
- `created_at` (String) The timestamp when the permission was created (RFC3339 format).
47+
- `description` (String) A description of the permission.
48+
- `id` (String) The unique identifier of the permission.
49+
- `name` (String) The display name of the permission.
50+
- `resource_type_slug` (String) The slug of the resource type this permission applies to.
51+
- `system` (Boolean) Whether this is a system-managed permission.
52+
- `updated_at` (String) The timestamp when the permission was last updated (RFC3339 format).

‎docs/resources/organization_role_permission.md‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_organization_role_permission Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Assigns a permission to a WorkOS Organization Role.
7+
This resource manages the assignment of a permission to an organization role. All fields
8+
are immutable — changing any field will destroy and recreate the assignment.
9+
Example Usage
10+
11+
resource "workos_organization_role_permission" "assign" {
12+
organization_id = workos_organization.acme.id
13+
role_slug = workos_organization_role.billing.slug
14+
permission = workos_permission.billing_read.slug
15+
}
16+
17+
Import
18+
Organization role permissions can be imported using a composite key of organization ID, role slug, and permission slug:
19+
20+
terraform import workos_organization_role_permission.example org_01HXYZ.../billing-admin/billing:read
21+
---
22+
23+
# workos_organization_role_permission (Resource)
24+
25+
Assigns a permission to a WorkOS Organization Role.
26+
27+
This resource manages the assignment of a permission to an organization role. All fields
28+
are immutable — changing any field will destroy and recreate the assignment.
29+
30+
## Example Usage
31+
32+
```hcl
33+
resource "workos_organization_role_permission" "assign" {
34+
organization_id = workos_organization.acme.id
35+
role_slug = workos_organization_role.billing.slug
36+
permission = workos_permission.billing_read.slug
37+
}
38+
```
39+
40+
## Import
41+
42+
Organization role permissions can be imported using a composite key of organization ID, role slug, and permission slug:
43+
44+
```shell
45+
terraform import workos_organization_role_permission.example org_01HXYZ.../billing-admin/billing:read
46+
```
47+
48+
## Example Usage
49+
50+
```terraform
51+
resource "workos_organization_role_permission" "billing_admin_read" {
52+
organization_id = workos_organization.example.id
53+
role_slug = workos_organization_role.billing_admin.slug
54+
permission = workos_permission.billing_read.slug
55+
}
56+
```
57+
58+
<!-- schema generated by tfplugindocs -->
59+
## Schema
60+
61+
### Required
62+
63+
- `organization_id` (String) The ID of the organization the role belongs to (e.g., `org_01HXYZ...`).
64+
- `permission` (String) The slug of the permission to assign to the role.
65+
- `role_slug` (String) The slug of the organization role to assign the permission to.
66+
67+
### Read-Only
68+
69+
- `id` (String) The composite identifier of the organization role permission (`organization_id/role_slug/permission`).

‎docs/resources/permission.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_permission Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Manages a WorkOS Permission.
7+
Permissions are environment-level resources that can be assigned to both environment roles
8+
and organization roles. Permissions are identified by their slug.
9+
Example Usage
10+
11+
resource "workos_permission" "billing_read" {
12+
slug = "billing:read"
13+
name = "Read Billing"
14+
description = "Allows reading billing data"
15+
}
16+
17+
Import
18+
Permissions can be imported using their slug:
19+
20+
terraform import workos_permission.example billing:read
21+
---
22+
23+
# workos_permission (Resource)
24+
25+
Manages a WorkOS Permission.
26+
27+
Permissions are environment-level resources that can be assigned to both environment roles
28+
and organization roles. Permissions are identified by their slug.
29+
30+
## Example Usage
31+
32+
```hcl
33+
resource "workos_permission" "billing_read" {
34+
slug = "billing:read"
35+
name = "Read Billing"
36+
description = "Allows reading billing data"
37+
}
38+
```
39+
40+
## Import
41+
42+
Permissions can be imported using their slug:
43+
44+
```shell
45+
terraform import workos_permission.example billing:read
46+
```
47+
48+
## Example Usage
49+
50+
```terraform
51+
resource "workos_permission" "billing_read" {
52+
slug = "billing:read"
53+
name = "Read Billing"
54+
description = "Allows reading billing data"
55+
}
56+
```
57+
58+
<!-- schema generated by tfplugindocs -->
59+
## Schema
60+
61+
### Required
62+
63+
- `name` (String) The display name of the permission.
64+
- `slug` (String) The slug identifier for the permission. Must be unique within the environment.
65+
66+
### Optional
67+
68+
- `description` (String) A description of the permission.
69+
- `resource_type_slug` (String) The slug of the resource type this permission applies to.
70+
71+
### Read-Only
72+
73+
- `created_at` (String) The timestamp when the permission was created (RFC3339 format).
74+
- `id` (String) The unique identifier of the permission.
75+
- `system` (Boolean) Whether this is a system-managed permission.
76+
- `updated_at` (String) The timestamp when the permission was last updated (RFC3339 format).

‎examples/data-sources/workos_permission/data-source.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "workos_permission" "billing_read" {
2+
slug = "billing:read"
3+
}

‎examples/resources/workos_organization_role_permission/resource.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resource "workos_organization_role_permission" "billing_admin_read" {
2+
organization_id = workos_organization.example.id
3+
role_slug = workos_organization_role.billing_admin.slug
4+
permission = workos_permission.billing_read.slug
5+
}

‎examples/resources/workos_permission/resource.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resource "workos_permission" "billing_read" {
2+
slug = "billing:read"
3+
name = "Read Billing"
4+
description = "Allows reading billing data"
5+
}

‎internal/client/models.go‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -218,3 +218,41 @@ type OrganizationRoleListResponse struct {
218218
Data []OrganizationRole `json:"data"`
219219
ListMetadata ListMetadata `json:"list_metadata"`
220220
}
221+
222+
// Permission represents a WorkOS Permission
223+
type Permission struct {
224+
ID string `json:"id"`
225+
Object string `json:"object"`
226+
Slug string `json:"slug"`
227+
Name string `json:"name"`
228+
Description string `json:"description,omitempty"`
229+
System bool `json:"system"`
230+
ResourceTypeSlug string `json:"resource_type_slug,omitempty"`
231+
CreatedAt time.Time `json:"created_at"`
232+
UpdatedAt time.Time `json:"updated_at"`
233+
}
234+
235+
// PermissionCreateRequest represents the request to create a permission
236+
type PermissionCreateRequest struct {
237+
Slug string `json:"slug"`
238+
Name string `json:"name"`
239+
Description string `json:"description,omitempty"`
240+
ResourceTypeSlug string `json:"resource_type_slug,omitempty"`
241+
}
242+
243+
// PermissionUpdateRequest represents the request to update a permission
244+
type PermissionUpdateRequest struct {
245+
Name string `json:"name"`
246+
Description string `json:"description"`
247+
}
248+
249+
// PermissionListResponse represents the response from listing permissions
250+
type PermissionListResponse struct {
251+
Data []Permission `json:"data"`
252+
ListMetadata ListMetadata `json:"list_metadata"`
253+
}
254+
255+
// AddPermissionRequest represents the request to add a permission to a role
256+
type AddPermissionRequest struct {
257+
Slug string `json:"slug"`
258+
}

‎internal/client/organization_role_permissions.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
// Copyright (c) OSO DevOps
2+
// SPDX-License-Identifier: MPL-2.0
3+
4+
package client
5+
6+
import (
7+
"context"
8+
"fmt"
9+
)
10+
11+
// AddOrganizationRolePermission adds a permission to an organization role
12+
func (c *Client) AddOrganizationRolePermission(ctx context.Context, orgID, roleSlug, permSlug string) (*OrganizationRole, error) {
13+
req := &AddPermissionRequest{
14+
Slug: permSlug,
15+
}
16+
var role OrganizationRole
17+
err := c.Post(ctx, fmt.Sprintf("/authorization/organizations/%s/roles/%s/permissions", orgID, roleSlug), req, &role)
18+
if err != nil {
19+
return nil, fmt.Errorf("failed to add permission to organization role: %w", err)
20+
}
21+
return &role, nil
22+
}
23+
24+
// RemoveOrganizationRolePermission removes a permission from an organization role
25+
func (c *Client) RemoveOrganizationRolePermission(ctx context.Context, orgID, roleSlug, permSlug string) error {
26+
err := c.Delete(ctx, fmt.Sprintf("/authorization/organizations/%s/roles/%s/permissions/%s", orgID, roleSlug, permSlug))
27+
if err != nil {
28+
return fmt.Errorf("failed to remove permission from organization role: %w", err)
29+
}
30+
return nil
31+
}

0 commit comments

Comments
 (0)