Query around domains, unique constraints and the workos_organization (Data Source)

[danielloader]

So, since verification of a domain is skipped when this provider sets domains via the API thus skipping the TXT DNS record verification phase - there doesn't seem to be a built in constraint in this system that says an organization can't have a domain already assigned to an existing organization.

The WorkOS constraint on this is via the TXT DNS challenge, since multiple orgs will have different challenges and thus incompatible TXT values for the same DNS zone - but if you're pre verifying the domain and this constraint is no longer in play, what stops you creating multiple organizations in terraform using the same domain.

Given that, the data source for workos_organization, when you try to capture the state via a domain (rather than id) is currently working under the impression the list orgs response will either give an empty array or a single response, because the data source does not return multiple.

This may be a known limitation of the provider, or it's a capability miss that could be dangerous and unpredictable results when using this data source with the domain lookup key.

[sionsmith]

Hi @danielloader — thanks for raising this, it's a really sharp observation about the domain uniqueness gap.

You're correct on both counts:

1. No API-level domain uniqueness: Since the provider sets domains with state: "verified" (bypassing DNS TXT verification), the WorkOS API happily allows multiple organizations to share the same domain. The TXT challenge is the only natural uniqueness constraint, and we bypass it.

2. Data source returns unpredictable results: GetOrganizationByDomain was silently returning resp.Data[0] — whichever org happened to be first in the list response.

This has been addressed in #10 with three changes:

• Data source domain lookup now returns a clear error when multiple organizations share the same domain, listing all conflicting org IDs and directing users to look up by ID instead
• Resource create/update now validates domain uniqueness before mutating — if a domain is already assigned to a different organization, the operation fails with a descriptive error explaining why and how to resolve it
• New ListOrganizationsByDomain client method exposes the full list of matching organizations, so the ambiguity is no longer hidden

This is a provider-side safeguard since WorkOS itself doesn't enforce this at the API level. Operators will now get immediate feedback if they accidentally configure duplicate domains.