Skip to content

Commit f5b0f89

Browse files
sionsmithsionsmith
authored
Merge pull request #20 from osodevops/feat/workos-apps-authz-resources
feat: add WorkOS application and authorization resources
2 parents 1d4e27d + f2548f4 commit f5b0f89

45 files changed

Lines changed: 3110 additions & 193 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎docs/data-sources/organization_role.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,5 +89,6 @@ output "role_name_by_id" {
8989
- `description` (String) A description of the role.
9090
- `name` (String) The display name of the role.
9191
- `permissions` (List of String) The permissions associated with the role.
92+
- `resource_type_slug` (String) The resource type slug this role is scoped to.
9293
- `type` (String) The type of the role.
9394
- `updated_at` (String) The timestamp when the role was last updated (RFC3339 format).

‎docs/resources/authorization_resource.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_authorization_resource Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Manages a WorkOS authorization resource.
7+
---
8+
9+
# workos_authorization_resource (Resource)
10+
11+
Manages a WorkOS authorization resource.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Create a top-level authorization resource
17+
resource "workos_authorization_resource" "workspace" {
18+
organization_id = workos_organization.example.id
19+
resource_type_slug = "workspace"
20+
external_id = "workspace-123"
21+
name = "Acme Workspace"
22+
description = "Primary workspace for Acme"
23+
cascade_delete = false
24+
}
25+
26+
# Create a child authorization resource
27+
resource "workos_authorization_resource" "project" {
28+
organization_id = workos_organization.example.id
29+
resource_type_slug = "project"
30+
external_id = "project-456"
31+
name = "Launch Project"
32+
parent_resource_id = workos_authorization_resource.workspace.id
33+
}
34+
35+
output "workspace_resource_id" {
36+
value = workos_authorization_resource.workspace.id
37+
}
38+
```
39+
40+
<!-- schema generated by tfplugindocs -->
41+
## Schema
42+
43+
### Required
44+
45+
- `external_id` (String) The external identifier for the resource in your system.
46+
- `name` (String) The display name for the resource.
47+
- `organization_id` (String) The organization ID that owns the resource.
48+
- `resource_type_slug` (String) The resource type slug.
49+
50+
### Optional
51+
52+
- `cascade_delete` (Boolean) Whether delete should cascade to descendant resources and role assignments.
53+
- `description` (String) An optional resource description.
54+
- `parent_resource_external_id` (String) The parent resource external ID when identifying the parent by external ID.
55+
- `parent_resource_id` (String) The parent resource ID.
56+
- `parent_resource_type_slug` (String) The parent resource type slug when identifying the parent by external ID.
57+
58+
### Read-Only
59+
60+
- `created_at` (String) The timestamp when the resource was created.
61+
- `id` (String) The unique identifier of the authorization resource.
62+
- `updated_at` (String) The timestamp when the resource was last updated.

‎docs/resources/authorization_role_assignment.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_authorization_role_assignment Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Assigns a WorkOS authorization role to an organization membership on a resource.
7+
---
8+
9+
# workos_authorization_role_assignment (Resource)
10+
11+
Assigns a WorkOS authorization role to an organization membership on a resource.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Assign a role to a membership on an authorization resource
17+
resource "workos_authorization_role_assignment" "workspace_admin" {
18+
organization_membership_id = workos_organization_membership.admin.id
19+
role_slug = workos_organization_role.workspace_admin.slug
20+
resource_id = workos_authorization_resource.workspace.id
21+
}
22+
23+
# Assign a role using a resource external ID
24+
resource "workos_authorization_role_assignment" "project_viewer" {
25+
organization_membership_id = workos_organization_membership.viewer.id
26+
role_slug = workos_organization_role.project_viewer.slug
27+
resource_type_slug = "project"
28+
resource_external_id = "project-456"
29+
}
30+
31+
output "workspace_assignment_id" {
32+
value = workos_authorization_role_assignment.workspace_admin.id
33+
}
34+
```
35+
36+
<!-- schema generated by tfplugindocs -->
37+
## Schema
38+
39+
### Required
40+
41+
- `organization_membership_id` (String) The organization membership ID receiving the role.
42+
- `role_slug` (String) The role slug to assign.
43+
44+
### Optional
45+
46+
- `resource_external_id` (String) The resource external ID when identifying the resource by external ID.
47+
- `resource_id` (String) The resource ID to assign the role on.
48+
- `resource_type_slug` (String) The resource type slug when identifying the resource by external ID.
49+
50+
### Read-Only
51+
52+
- `created_at` (String) The timestamp when the role assignment was created.
53+
- `id` (String) The unique identifier of the role assignment.
54+
- `updated_at` (String) The timestamp when the role assignment was last updated.

‎docs/resources/connect_application.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_connect_application Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Manages a WorkOS Connect application.
7+
---
8+
9+
# workos_connect_application (Resource)
10+
11+
Manages a WorkOS Connect application.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Create a first-party OAuth Connect application
17+
resource "workos_connect_application" "oauth" {
18+
name = "Customer Portal"
19+
application_type = "oauth"
20+
is_first_party = true
21+
uses_pkce = true
22+
scopes = ["openid", "profile", "email"]
23+
24+
redirect_uris = [
25+
{
26+
uri = "https://app.example.com/callback"
27+
default = true
28+
},
29+
{
30+
uri = "https://app.example.com/auth/workos/callback"
31+
},
32+
]
33+
}
34+
35+
# Create a machine-to-machine Connect application
36+
resource "workos_connect_application" "m2m" {
37+
name = "Billing Worker"
38+
application_type = "m2m"
39+
organization_id = workos_organization.example.id
40+
scopes = ["billing:read", "billing:write"]
41+
}
42+
43+
output "connect_application_client_id" {
44+
value = workos_connect_application.oauth.client_id
45+
}
46+
```
47+
48+
<!-- schema generated by tfplugindocs -->
49+
## Schema
50+
51+
### Required
52+
53+
- `application_type` (String) The Connect application type: oauth or m2m.
54+
- `name` (String) The Connect application name.
55+
56+
### Optional
57+
58+
- `description` (String) An optional Connect application description.
59+
- `is_first_party` (Boolean) Whether an OAuth application is first-party.
60+
- `organization_id` (String) The organization ID for organization-scoped applications.
61+
- `redirect_uris` (Attributes List) Redirect URIs configured for an OAuth application. (see [below for nested schema](#nestedatt--redirect_uris))
62+
- `scopes` (List of String) OAuth scopes granted to the application.
63+
- `uses_pkce` (Boolean) Whether an OAuth application uses PKCE.
64+
65+
### Read-Only
66+
67+
- `client_id` (String) The client ID of the Connect application.
68+
- `created_at` (String) The timestamp when the application was created.
69+
- `id` (String) The unique identifier of the Connect application.
70+
- `updated_at` (String) The timestamp when the application was last updated.
71+
- `was_dynamically_registered` (Boolean) Whether the application was dynamically registered.
72+
73+
<a id="nestedatt--redirect_uris"></a>
74+
### Nested Schema for `redirect_uris`
75+
76+
Required:
77+
78+
- `uri` (String) The redirect URI.
79+
80+
Optional:
81+
82+
- `default` (Boolean) Whether this redirect URI is the default.

‎docs/resources/group.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_group Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Manages a WorkOS group within an organization.
7+
---
8+
9+
# workos_group (Resource)
10+
11+
Manages a WorkOS group within an organization.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Create a group within an organization
17+
resource "workos_group" "engineering" {
18+
organization_id = workos_organization.example.id
19+
name = "Engineering"
20+
description = "Engineering team members"
21+
}
22+
23+
resource "workos_group" "billing" {
24+
organization_id = workos_organization.example.id
25+
name = "Billing"
26+
}
27+
28+
output "engineering_group_id" {
29+
value = workos_group.engineering.id
30+
}
31+
```
32+
33+
<!-- schema generated by tfplugindocs -->
34+
## Schema
35+
36+
### Required
37+
38+
- `name` (String) The group name.
39+
- `organization_id` (String) The ID of the organization this group belongs to.
40+
41+
### Optional
42+
43+
- `description` (String) An optional group description.
44+
45+
### Read-Only
46+
47+
- `created_at` (String) The timestamp when the group was created.
48+
- `id` (String) The unique identifier of the group.
49+
- `updated_at` (String) The timestamp when the group was last updated.

‎docs/resources/group_membership.md‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_group_membership Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Adds a WorkOS organization membership to a group.
7+
---
8+
9+
# workos_group_membership (Resource)
10+
11+
Adds a WorkOS organization membership to a group.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Add an organization membership to a group
17+
resource "workos_group_membership" "engineering_member" {
18+
organization_id = workos_organization.example.id
19+
group_id = workos_group.engineering.id
20+
organization_membership_id = workos_organization_membership.member.id
21+
}
22+
23+
output "engineering_member_status" {
24+
value = workos_group_membership.engineering_member.status
25+
}
26+
```
27+
28+
<!-- schema generated by tfplugindocs -->
29+
## Schema
30+
31+
### Required
32+
33+
- `group_id` (String) The group ID.
34+
- `organization_id` (String) The organization ID.
35+
- `organization_membership_id` (String) The organization membership ID to add to the group.
36+
37+
### Read-Only
38+
39+
- `created_at` (String) The timestamp when the organization membership was created.
40+
- `id` (String) The composite ID for the group membership.
41+
- `status` (String) The organization membership status.
42+
- `updated_at` (String) The timestamp when the organization membership was last updated.
43+
- `user_id` (String) The user ID on the organization membership.

‎docs/resources/organization_domain.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "workos_organization_domain Resource - workos"
4+
subcategory: ""
5+
description: |-
6+
Manages a WorkOS Organization Domain.
7+
---
8+
9+
# workos_organization_domain (Resource)
10+
11+
Manages a WorkOS Organization Domain.
12+
13+
## Example Usage
14+
15+
```terraform
16+
# Add an additional domain to an organization
17+
resource "workos_organization_domain" "example" {
18+
organization_id = workos_organization.example.id
19+
domain = "example.com"
20+
}
21+
22+
# Start WorkOS DNS verification for a domain
23+
resource "workos_organization_domain" "verified" {
24+
organization_id = workos_organization.example.id
25+
domain = "login.example.com"
26+
verify = true
27+
}
28+
29+
output "organization_domain_state" {
30+
value = workos_organization_domain.example.state
31+
}
32+
```
33+
34+
<!-- schema generated by tfplugindocs -->
35+
## Schema
36+
37+
### Required
38+
39+
- `domain` (String) The domain name to add to the organization.
40+
- `organization_id` (String) The ID of the organization to add the domain to.
41+
42+
### Optional
43+
44+
- `verify` (Boolean) Whether to initiate WorkOS domain verification after create or when toggled to true.
45+
46+
### Read-Only
47+
48+
- `created_at` (String) The timestamp when the organization domain was created.
49+
- `id` (String) The unique identifier of the organization domain.
50+
- `state` (String) The domain verification state.
51+
- `updated_at` (String) The timestamp when the organization domain was last updated.
52+
- `verification_prefix` (String) The DNS verification prefix.
53+
- `verification_strategy` (String) The verification strategy for the domain.
54+
- `verification_token` (String) The DNS verification token.

‎docs/resources/organization_membership.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,7 @@ output "membership_status" {
138138
### Optional
139139

140140
- `role_slug` (String) The slug of the role to assign to the user within the organization (e.g., `admin`, `member`).
141+
- `role_slugs` (List of String) The slugs of multiple roles to assign to the user within the organization. Use either `role_slug` or `role_slugs`, not both.
141142

142143
### Read-Only
143144

‎docs/resources/organization_role.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,7 @@ output "billing_admin_role_type" {
8787
### Optional
8888

8989
- `description` (String) A description of the role.
90+
- `resource_type_slug` (String) The resource type slug this role is scoped to. Changing this value recreates the role.
9091

9192
### Read-Only
9293

‎examples/resources/workos_authorization_resource/resource.tf‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Create a top-level authorization resource
2+
resource "workos_authorization_resource" "workspace" {
3+
organization_id = workos_organization.example.id
4+
resource_type_slug = "workspace"
5+
external_id = "workspace-123"
6+
name = "Acme Workspace"
7+
description = "Primary workspace for Acme"
8+
cascade_delete = false
9+
}
10+
11+
# Create a child authorization resource
12+
resource "workos_authorization_resource" "project" {
13+
organization_id = workos_organization.example.id
14+
resource_type_slug = "project"
15+
external_id = "project-456"
16+
name = "Launch Project"
17+
parent_resource_id = workos_authorization_resource.workspace.id
18+
}
19+
20+
output "workspace_resource_id" {
21+
value = workos_authorization_resource.workspace.id
22+
}

0 commit comments

Comments
 (0)