Support adding team_members by email address

Author: dglsparsons

client/team_member.go

@@ -21,7 +21,14 @@ type TeamMemberInviteRequest struct {
 	TeamID       string        `json:"-"`
 }
 
-func (c *Client) InviteTeamMember(ctx context.Context, request TeamMemberInviteRequest) error {
+type TeamMemberInviteResponse struct {
+	UserID   string `json:"uid"`
+	Email    string `json:"email"`
+	Username string `json:"username"`
+	Role     string `json:"role"`
+}
+
+func (c *Client) InviteTeamMember(ctx context.Context, request TeamMemberInviteRequest) (TeamMemberInviteResponse, error) {
 	url := fmt.Sprintf("%s/v1/teams/%s/members", c.baseURL, request.TeamID)
 	tflog.Info(ctx, "inviting user", map[string]any{
 		"url":   url,
@@ -30,13 +37,14 @@ func (c *Client) InviteTeamMember(ctx context.Context, request TeamMemberInviteR
 		"role":  request.Role,
 	})
 
+	var res TeamMemberInviteResponse
 	err := c.doRequest(clientRequest{
 		ctx:    ctx,
 		method: "POST",
 		url:    url,
 		body:   string(mustMarshal(request)),
-	}, nil)
-	return err
+	}, &res)
+	return res, err
 }
 
 type TeamMemberRemoveRequest struct {
@@ -93,6 +101,7 @@ type TeamMember struct {
 	Confirmed    bool          `json:"confirmed"`
 	Role         string        `json:"role"`
 	UserID       string        `json:"uid"`
+	Email        string        `json:"email"`
 	Projects     []ProjectRole `json:"projects"`
 	AccessGroups []struct {
 		ID   string `json:"id"`

docs/resources/team_member.md

@@ -13,11 +13,17 @@ Provider a resource for managing a team member.
 ## Example Usage
 
 ```terraform
-resource "vercel_team_member" "example" {
+resource "vercel_team_member" "by_user_id" {
   team_id = "team_xxxxxxxxxxxxxxxxxxxxxxxx"
   user_id = "uuuuuuuuuuuuuuuuuuuuuuuuuu"
   role    = "MEMBER"
 }
+
+resource "vercel_team_member" "by_email" {
+  team_id = "team_xxxxxxxxxxxxxxxxxxxxxxxx"
+  email   = "[email protected]"
+  role    = "MEMBER"
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -27,12 +33,13 @@ resource "vercel_team_member" "example" {
 
 - `role` (String) The role that the user should have in the project. One of 'MEMBER', 'OWNER', 'VIEWER', 'DEVELOPER', 'BILLING' or 'CONTRIBUTOR'. Depending on your Team's plan, some of these roles may be unavailable.
 - `team_id` (String) The ID of the existing Vercel Team.
-- `user_id` (String) The ID of the user to add to the team.
 
 ### Optional
 
 - `access_groups` (Set of String) If access groups are enabled on the team, and the user is a CONTRIBUTOR, `projects`, `access_groups` or both must be specified. A set of access groups IDs that the user should be granted access to.
+- `email` (String) The email of the user to add to the team. Must specify one of user_id or email.
 - `projects` (Attributes Set) If access groups are enabled on the team, and the user is a CONTRIBUTOR, `projects`, `access_groups` or both must be specified. A set of projects that the user should be granted access to, along with their role in each project. (see [below for nested schema](#nestedatt--projects))
+- `user_id` (String) The ID of the user to add to the team. Must specify one of user_id or email.
 
 <a id="nestedatt--projects"></a>
 ### Nested Schema for `projects`

examples/resources/vercel_team_member/resource.tf

@@ -1,5 +1,11 @@
-resource "vercel_team_member" "example" {
+resource "vercel_team_member" "by_user_id" {
   team_id = "team_xxxxxxxxxxxxxxxxxxxxxxxx"
   user_id = "uuuuuuuuuuuuuuuuuuuuuuuuuu"
   role    = "MEMBER"
 }
+
+resource "vercel_team_member" "by_email" {
+  team_id = "team_xxxxxxxxxxxxxxxxxxxxxxxx"
+  email   = "[email protected]"
+  role    = "MEMBER"
+}

vercel/data_source_team_member.go

@@ -104,6 +104,7 @@ func (d *teamMemberDataSource) Schema(_ context.Context, req datasource.SchemaRe
 
 type TeamMemberWithID struct {
 	UserID       types.String `tfsdk:"user_id"`
+	Email        types.String `tfsdk:"email"`
 	TeamID       types.String `tfsdk:"team_id"`
 	Role         types.String `tfsdk:"role"`
 	Projects     types.Set    `tfsdk:"projects"`
@@ -133,6 +134,7 @@ func (d *teamMemberDataSource) Read(ctx context.Context, req datasource.ReadRequ
 	diags = resp.State.Set(ctx, TeamMemberWithID{
 		UserID:       teamMember.UserID,
 		TeamID:       teamMember.TeamID,
+		Email:        teamMember.Email,
 		Role:         teamMember.Role,
 		Projects:     teamMember.Projects,
 		AccessGroups: teamMember.AccessGroups,

vercel/provider_test.go

@@ -73,6 +73,10 @@ func testAdditionalUser() string {
 	return os.Getenv("VERCEL_TERRAFORM_TESTING_ADDITIONAL_USER")
 }
 
+func testAdditionalUserEmail() string {
+	return os.Getenv("VERCEL_TERRAFORM_TESTING_ADDITIONAL_USER_EMAIL")
+}
+
 func testExistingIntegration() string {
 	return os.Getenv("VERCEL_TERRAFORM_TESTING_EXISTING_INTEGRATION")
 }

vercel/resource_team_config.go

@@ -130,10 +130,10 @@ func (r *teamConfigResource) Schema(_ context.Context, req resource.SchemaReques
 						ElementType: types.StringType,
 						Validators: []validator.Map{
 							// Validate only this attribute or roles is configured.
-							mapvalidator.ExactlyOneOf(path.Expressions{
+							mapvalidator.ExactlyOneOf(
 								path.MatchRoot("saml.roles"),
 								path.MatchRoot("saml.access_group_id"),
-							}...),
+							),
 						},
 					},
 					"access_group_id": schema.StringAttribute{
@@ -142,10 +142,10 @@ func (r *teamConfigResource) Schema(_ context.Context, req resource.SchemaReques
 						Validators: []validator.String{
 							stringvalidator.RegexMatches(regexp.MustCompile("^ag_[A-z0-9_ -]+$"), "Access group ID must be a valid access group"),
 							// Validate only this attribute or roles is configured.
-							stringvalidator.ExactlyOneOf(path.Expressions{
+							stringvalidator.ExactlyOneOf(
 								path.MatchRoot("saml.roles"),
 								path.MatchRoot("saml.access_group_id"),
-							}...),
+							),
 						},
 					},
 				},

vercel/resource_team_member.go

@@ -10,6 +10,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
 	"github.com/hashicorp/terraform-plugin-framework/attr"
 	"github.com/hashicorp/terraform-plugin-framework/diag"
+	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource/schema/planmodifier"
@@ -71,11 +72,33 @@ func (r *teamMemberResource) Schema(_ context.Context, req resource.SchemaReques
 				},
 			},
 			"user_id": schema.StringAttribute{
-				Description: "The ID of the user to add to the team.",
-				Required:    true,
+				Description: "The ID of the user to add to the team. Must specify one of user_id or email.",
+				Optional:    true,
+				Computed:    true,
 				PlanModifiers: []planmodifier.String{
 					stringplanmodifier.UseStateForUnknown(),
-					stringplanmodifier.RequiresReplace(),
+					stringplanmodifier.RequiresReplaceIfConfigured(),
+				},
+				Validators: []validator.String{
+					stringvalidator.ExactlyOneOf(
+						path.MatchRoot("user_id"),
+						path.MatchRoot("email"),
+					),
+				},
+			},
+			"email": schema.StringAttribute{
+				Description: "The email of the user to add to the team. Must specify one of user_id or email.",
+				Optional:    true,
+				Computed:    true,
+				PlanModifiers: []planmodifier.String{
+					stringplanmodifier.UseStateForUnknown(),
+					stringplanmodifier.RequiresReplaceIfConfigured(),
+				},
+				Validators: []validator.String{
+					stringvalidator.ExactlyOneOf(
+						path.MatchRoot("user_id"),
+						path.MatchRoot("email"),
+					),
 				},
 			},
 			"role": schema.StringAttribute{
@@ -126,6 +149,7 @@ func (r *teamMemberResource) Schema(_ context.Context, req resource.SchemaReques
 
 type TeamMember struct {
 	UserID       types.String `tfsdk:"user_id"`
+	Email        types.String `tfsdk:"email"`
 	TeamID       types.String `tfsdk:"team_id"`
 	Role         types.String `tfsdk:"role"`
 	Projects     types.Set    `tfsdk:"projects"`
@@ -177,6 +201,7 @@ func (t TeamMember) toInviteTeamMemberRequest(ctx context.Context) (client.TeamM
 	return client.TeamMemberInviteRequest{
 		TeamID:       t.TeamID.ValueString(),
 		UserID:       t.UserID.ValueString(),
+		Email:        t.Email.ValueString(),
 		Role:         t.Role.ValueString(),
 		Projects:     projects,
 		AccessGroups: accessGroups,
@@ -269,6 +294,7 @@ func convertResponseToTeamMember(response client.TeamMember, teamID types.String
 
 	return TeamMember{
 		UserID:       types.StringValue(response.UserID),
+		Email:        types.StringValue(response.Email),
 		TeamID:       teamID,
 		Role:         types.StringValue(response.Role),
 		Projects:     projects,
@@ -289,7 +315,7 @@ func (r *teamMemberResource) Create(ctx context.Context, req resource.CreateRequ
 		resp.Diagnostics.Append(diags...)
 		return
 	}
-	err := r.client.InviteTeamMember(ctx, request)
+	res, err := r.client.InviteTeamMember(ctx, request)
 	if err != nil {
 		resp.Diagnostics.AddError(
 			"Error inviting Team Member",
@@ -303,21 +329,30 @@ func (r *teamMemberResource) Create(ctx context.Context, req resource.CreateRequ
 		"user_id": plan.UserID.ValueString(),
 	})
 
-	projects := types.SetNull(projectsElemType)
-	if !plan.Projects.IsUnknown() && !plan.Projects.IsNull() {
-		projects = plan.Projects
+	response, err := r.client.GetTeamMember(ctx, client.GetTeamMemberRequest{
+		TeamID: plan.TeamID.ValueString(),
+		UserID: res.UserID,
+	})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"Error reading Team Member",
+			"Could not read Team Member, unexpected error: "+err.Error(),
+		)
 	}
-	ags := types.SetNull(types.StringType)
-	if !plan.AccessGroups.IsUnknown() && !plan.AccessGroups.IsNull() {
-		ags = plan.AccessGroups
+	teamMember := convertResponseToTeamMember(response, plan.TeamID)
+	if !response.Confirmed {
+		// The API doesn't return the projects or access groups for unconfirmed members, so we have to
+		// manually set these fields to whatever was in the plan.
+		teamMember.Projects = types.SetNull(projectsElemType)
+		if !plan.Projects.IsUnknown() && !plan.Projects.IsNull() {
+			teamMember.Projects = plan.Projects
+		}
+		teamMember.AccessGroups = types.SetNull(types.StringType)
+		if !plan.AccessGroups.IsUnknown() && !plan.AccessGroups.IsNull() {
+			teamMember.AccessGroups = plan.AccessGroups
+		}
 	}
-	diags = resp.State.Set(ctx, TeamMember{
-		TeamID:       plan.TeamID,
-		UserID:       plan.UserID,
-		Role:         plan.Role,
-		Projects:     projects,
-		AccessGroups: ags,
-	})
+	diags = resp.State.Set(ctx, teamMember)
 	resp.Diagnostics.Append(diags...)
 	sleepInTests()
 }
@@ -414,6 +449,7 @@ func (r *teamMemberResource) Update(ctx context.Context, req resource.UpdateRequ
 	diags = resp.State.Set(ctx, TeamMember{
 		TeamID:       plan.TeamID,
 		UserID:       plan.UserID,
+		Email:        plan.Email,
 		Role:         plan.Role,
 		Projects:     projects,
 		AccessGroups: ags,