fix: validate domain uniqueness across organizations

[sionsmith]

Summary

Addresses #8 — the WorkOS API does not enforce domain uniqueness at the API level. Uniqueness is only enforced via DNS TXT verification, which this provider bypasses by setting domains as pre-verified (state: "verified"). This could allow multiple organizations to silently share the same domain, causing:

• Unpredictable SSO routing — WorkOS uses domains to match users to organizations during authentication
• Nondeterministic data source lookups — data.workos_organization domain lookup would silently return whichever org appeared first in the API response
• Silent data corruption — no feedback to operators that a dangerous configuration exists

Changes

• Client layer (internal/client/organizations.go):

  • Added ListOrganizationsByDomain() — returns all organizations matching a domain (exposes the full list)
  • Updated GetOrganizationByDomain() — now returns a clear error when multiple organizations share the same domain, directing users to look up by ID instead

• Resource (internal/provider/resource_organization.go):

  • Added validateDomainUniqueness() helper that checks each domain against existing organizations before create/update
  • On create: validates no other org already has any of the planned domains
  • On update: validates no other org (excluding the current one) has any of the planned domains
  • Clear error messages explain why the constraint exists and how to resolve conflicts

Test plan

• Existing acceptance tests pass (TestAccOrganizationResource_Basic, TestAccOrganizationResource_WithDomains, TestAccOrganizationDataSource_ByDomain)
• Create two organizations with the same domain → should error on the second create with "Domain Already In Use"
• Update an organization to use a domain already assigned to another org → should error
• Update an organization keeping its own domains → should succeed (excludeOrgID logic)
• Data source domain lookup with ambiguous results → should error with list of conflicting org IDs
• Data source domain lookup with a single result → should work as before

🤖 Generated with Claude Code

[danielloader]

Any chance of a new published version? Thanks for the work.

[sionsmith]

Hey @danielloader — we've just raised #11 which adds automated release management via release-please. Once that's merged, pushing to main will automatically create a release PR with version bumps and changelog. Merging that release PR will trigger goreleaser to build and publish to the Terraform registry.

All CI checks are passing on #11, so we should have a new published version shortly after it lands. Thanks for the nudge! 🙏