Skip to content

Commit 763c45a

Browse files
JEETDESAI25JEETDESAI25
authored
feat: add third-party auth resource (#334)
* feat: add third-party auth resource * refactor: extract shared helper for service health polling
1 parent 3609eeb commit 763c45a

11 files changed

Lines changed: 1743 additions & 23 deletions

File tree

‎docs/resources/third_party_auth.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
# generated by https://github.com/hashicorp/terraform-plugin-docs
3+
page_title: "supabase_third_party_auth Resource - terraform-provider-supabase"
4+
subcategory: ""
5+
description: |-
6+
Third-party auth resource
7+
---
8+
9+
# supabase_third_party_auth (Resource)
10+
11+
Third-party auth resource
12+
13+
## Example Usage
14+
15+
```terraform
16+
resource "supabase_third_party_auth" "oidc" {
17+
project_ref = "mayuaycdtijbctgqbycg"
18+
oidc_issuer_url = "https://issuer.example.com"
19+
}
20+
21+
resource "supabase_third_party_auth" "jwks_url" {
22+
project_ref = "mayuaycdtijbctgqbycg"
23+
jwks_url = "https://issuer.example.com/.well-known/jwks.json"
24+
}
25+
26+
resource "supabase_third_party_auth" "custom_jwks" {
27+
project_ref = "mayuaycdtijbctgqbycg"
28+
29+
# custom_jwks must contain public JWKS material only.
30+
custom_jwks = jsonencode({
31+
keys = [
32+
{
33+
kty = "RSA"
34+
kid = "example-key"
35+
n = "example-modulus"
36+
e = "AQAB"
37+
}
38+
]
39+
})
40+
}
41+
```
42+
43+
<!-- schema generated by tfplugindocs -->
44+
## Schema
45+
46+
### Required
47+
48+
- `project_ref` (String) Project reference ID
49+
50+
### Optional
51+
52+
- `custom_jwks` (String) Custom public JWKS as serialised JSON. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured. This field follows Terraform provider industry practice for public verification keys and is not marked sensitive; do not include private or symmetric JWK material.
53+
- `jwks_url` (String) JWKS URL. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured.
54+
- `oidc_issuer_url` (String) OIDC issuer URL. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured.
55+
- `timeouts` (Block, Optional) (see [below for nested schema](#nestedblock--timeouts))
56+
57+
### Read-Only
58+
59+
- `id` (String) Third-party auth integration identifier
60+
- `inserted_at` (String) Timestamp when the integration was created
61+
- `resolved_at` (String) Timestamp when JWKS was last resolved
62+
- `resolved_jwks` (String) Resolved JWKS as serialised JSON
63+
- `type` (String) Third-party auth integration type
64+
- `updated_at` (String) Timestamp when the integration was last updated
65+
66+
<a id="nestedblock--timeouts"></a>
67+
### Nested Schema for `timeouts`
68+
69+
Optional:
70+
71+
- `create` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
72+
73+
## Import
74+
75+
Import is supported using the following syntax:
76+
77+
The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
78+
79+
```shell
80+
# Third-party auth integrations can be imported using the project reference and
81+
# the third-party auth integration ID, separated by a '/'.
82+
#
83+
# - project_ref: Found in the Supabase dashboard under Project Settings -> General,
84+
# or in the project's URL: https://supabase.com/dashboard/project/<project_ref>
85+
# - third_party_auth_id: The UUID of the third-party auth integration.
86+
terraform import supabase_third_party_auth.oidc <project_ref>/<third_party_auth_id>
87+
```

‎docs/schema.json‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -485,6 +485,91 @@
485485
"description": "Settings resource",
486486
"description_kind": "markdown"
487487
}
488+
},
489+
"supabase_third_party_auth": {
490+
"version": 0,
491+
"block": {
492+
"attributes": {
493+
"custom_jwks": {
494+
"type": "string",
495+
"description": "Custom public JWKS as serialised JSON. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured. This field follows Terraform provider industry practice for public verification keys and is not marked sensitive; do not include private or symmetric JWK material.",
496+
"description_kind": "markdown",
497+
"optional": true
498+
},
499+
"id": {
500+
"type": "string",
501+
"description": "Third-party auth integration identifier",
502+
"description_kind": "markdown",
503+
"computed": true
504+
},
505+
"inserted_at": {
506+
"type": "string",
507+
"description": "Timestamp when the integration was created",
508+
"description_kind": "markdown",
509+
"computed": true
510+
},
511+
"jwks_url": {
512+
"type": "string",
513+
"description": "JWKS URL. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured.",
514+
"description_kind": "markdown",
515+
"optional": true
516+
},
517+
"oidc_issuer_url": {
518+
"type": "string",
519+
"description": "OIDC issuer URL. Exactly one of `oidc_issuer_url`, `jwks_url`, or `custom_jwks` must be configured.",
520+
"description_kind": "markdown",
521+
"optional": true
522+
},
523+
"project_ref": {
524+
"type": "string",
525+
"description": "Project reference ID",
526+
"description_kind": "markdown",
527+
"required": true
528+
},
529+
"resolved_at": {
530+
"type": "string",
531+
"description": "Timestamp when JWKS was last resolved",
532+
"description_kind": "markdown",
533+
"computed": true
534+
},
535+
"resolved_jwks": {
536+
"type": "string",
537+
"description": "Resolved JWKS as serialised JSON",
538+
"description_kind": "markdown",
539+
"computed": true
540+
},
541+
"type": {
542+
"type": "string",
543+
"description": "Third-party auth integration type",
544+
"description_kind": "markdown",
545+
"computed": true
546+
},
547+
"updated_at": {
548+
"type": "string",
549+
"description": "Timestamp when the integration was last updated",
550+
"description_kind": "markdown",
551+
"computed": true
552+
}
553+
},
554+
"block_types": {
555+
"timeouts": {
556+
"nesting_mode": "single",
557+
"block": {
558+
"attributes": {
559+
"create": {
560+
"type": "string",
561+
"description": "A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as \"30s\" or \"2h45m\". Valid time units are \"s\" (seconds), \"m\" (minutes), \"h\" (hours).",
562+
"description_kind": "plain",
563+
"optional": true
564+
}
565+
},
566+
"description_kind": "plain"
567+
}
568+
}
569+
},
570+
"description": "Third-party auth resource",
571+
"description_kind": "markdown"
572+
}
488573
}
489574
},
490575
"data_source_schemas": {

‎examples/examples.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,8 @@ var (
1515
EdgeFunctionSecretsResourceConfig string
1616
//go:embed resources/supabase_apikey/resource.tf
1717
ApiKeyResourceConfig string
18+
//go:embed resources/supabase_third_party_auth/resource.tf
19+
ThirdPartyAuthResourceConfig string
1820
//go:embed data-sources/supabase_branch/data-source.tf
1921
BranchDataSourceConfig string
2022
//go:embed data-sources/supabase_pooler/data-source.tf

‎examples/resources/supabase_third_party_auth/import.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Third-party auth integrations can be imported using the project reference and
2+
# the third-party auth integration ID, separated by a '/'.
3+
#
4+
# - project_ref: Found in the Supabase dashboard under Project Settings -> General,
5+
# or in the project's URL: https://supabase.com/dashboard/project/<project_ref>
6+
# - third_party_auth_id: The UUID of the third-party auth integration.
7+
terraform import supabase_third_party_auth.oidc <project_ref>/<third_party_auth_id>

‎examples/resources/supabase_third_party_auth/resource.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resource "supabase_third_party_auth" "oidc" {
2+
project_ref = "mayuaycdtijbctgqbycg"
3+
oidc_issuer_url = "https://issuer.example.com"
4+
}
5+
6+
resource "supabase_third_party_auth" "jwks_url" {
7+
project_ref = "mayuaycdtijbctgqbycg"
8+
jwks_url = "https://issuer.example.com/.well-known/jwks.json"
9+
}
10+
11+
resource "supabase_third_party_auth" "custom_jwks" {
12+
project_ref = "mayuaycdtijbctgqbycg"
13+
14+
# custom_jwks must contain public JWKS material only.
15+
custom_jwks = jsonencode({
16+
keys = [
17+
{
18+
kty = "RSA"
19+
kid = "example-key"
20+
n = "example-modulus"
21+
e = "AQAB"
22+
}
23+
]
24+
})
25+
}

‎internal/provider/constants_test.go‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -16,16 +16,19 @@ const (
1616
networkRestrictionsApiPath = projectApiPath + "/network-restrictions"
1717
postgrestApiPath = projectApiPath + "/postgrest"
1818
authConfigApiPath = projectApiPath + "/config/auth"
19+
thirdPartyAuthApiPath = authConfigApiPath + "/third-party-auth"
1920
storageConfigApiPath = projectApiPath + "/config/storage"
2021
sslEnforcementApiPath = projectApiPath + "/ssl-enforcement"
2122
secretsApiPath = projectApiPath + "/secrets"
2223

23-
functionSlug = "foo"
24-
testApiKeyUUID = "d9bece6b-52cc-4d67-a948-2349d46676f5" //nolint:gosec
25-
testBranchUUID = "3574ed44-5151-4f01-a6e3-2bc0339152d9" //nolint:gosec
26-
apiKeyApiPath = apiKeysApiPath + "/" + testApiKeyUUID
27-
legacyApiKeysApiPath = apiKeysApiPath + "/legacy"
28-
branchApiPath = "/v1/branches/" + testBranchUUID
29-
deployFunctionApiPath = functionsApiPath + "/deploy"
30-
functionApiPath = functionsApiPath + "/" + functionSlug
24+
functionSlug = "foo"
25+
testApiKeyUUID = "d9bece6b-52cc-4d67-a948-2349d46676f5" //nolint:gosec
26+
testThirdPartyAuthUUID = "88888888-8888-4888-8888-888888888888" //nolint:gosec
27+
testBranchUUID = "3574ed44-5151-4f01-a6e3-2bc0339152d9" //nolint:gosec
28+
apiKeyApiPath = apiKeysApiPath + "/" + testApiKeyUUID
29+
thirdPartyAuthItemApiPath = thirdPartyAuthApiPath + "/" + testThirdPartyAuthUUID
30+
legacyApiKeysApiPath = apiKeysApiPath + "/legacy"
31+
branchApiPath = "/v1/branches/" + testBranchUUID
32+
deployFunctionApiPath = functionsApiPath + "/deploy"
33+
functionApiPath = functionsApiPath + "/" + functionSlug
3134
)

‎internal/provider/provider.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -252,6 +252,7 @@ func (p *SupabaseProvider) Resources(ctx context.Context) []func() resource.Reso
252252
NewEdgeFunctionResource,
253253
NewEdgeFunctionSecretsResource,
254254
NewApiKeyResource,
255+
NewThirdPartyAuthResource,
255256
}
256257
}
257258

0 commit comments

Comments
 (0)