feat: add new data source for marking ext identities

This data source can be used to mark external identity for organization
user. This is a light weight method to map user from external
service to aiven internal user.

CHANGELOG.md

@@ -13,6 +13,7 @@ nav_order: 1
 
 - Remove `aiven_valkey` from beta resources
 - Remove `aiven_valkey_user` from beta resources
+- Add capability to map external service user with internal aiven user with external_identity data source
 
 ## [4.25.0] - 2024-09-17
 

docs/data-sources/external_identity.md

@@ -0,0 +1,26 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "aiven_external_identity Data Source - terraform-provider-aiven"
+subcategory: ""
+description: |-
+  Map external service user with internal aiven user
+---
+
+# aiven_external_identity (Data Source)
+
+Map external service user with internal aiven user
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `external_user_id` (String) the identity of the user on external platfrom
+- `internal_user_id` (String) the identity of the user on aiven platform
+- `organization_id` (String) the organization where internal_user_id exists
+
+### Optional
+
+- `external_service_name` (String) the name of the external service where external_user_id exists

internal/plugin/provider.go

@@ -14,6 +14,7 @@ import (
 	"github.com/aiven/terraform-provider-aiven/internal/common"
 	"github.com/aiven/terraform-provider-aiven/internal/plugin/errmsg"
 	"github.com/aiven/terraform-provider-aiven/internal/plugin/service/organization"
+	"github.com/aiven/terraform-provider-aiven/internal/plugin/service/external_identity"
 	"github.com/aiven/terraform-provider-aiven/internal/plugin/util"
 )
 
@@ -134,6 +135,7 @@ func (p *AivenProvider) DataSources(context.Context) []func() datasource.DataSou
 	// List of data sources that are currently available in the provider.
 	dataSources := []func() datasource.DataSource{
 		organization.NewOrganizationDataSource,
+		external_identity.NewExternalIdentityDataSource,
 	}
 
 	// Add to a list of data sources that are currently in beta.

internal/plugin/service/external_identity/external_identity_data_source.go

@@ -0,0 +1,147 @@
+package external_identity
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/aiven/aiven-go-client/v2"
+	"github.com/hashicorp/terraform-plugin-framework/datasource"
+	"github.com/hashicorp/terraform-plugin-framework/datasource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	"github.com/aiven/terraform-provider-aiven/internal/plugin/util"
+)
+
+var (
+	_ datasource.DataSource              = &externalIdentityDataSource{}
+	_ datasource.DataSourceWithConfigure = &externalIdentityDataSource{}
+
+	_ util.TypeNameable = &externalIdentityDataSource{}
+)
+
+func NewExternalIdentityDataSource() datasource.DataSource {
+	return &externalIdentityDataSource{}
+}
+
+type externalIdentityDataSource struct {
+	client   *aiven.Client
+	typeName string
+}
+
+// externalIdentityDataSourceModel is the model for the external_identity data source.
+type externalIdentityDataSourceModel struct {
+	OrganizationID      types.String `tfsdk:"organization_id"`
+	InternalUserID      types.String `tfsdk:"internal_user_id"`
+	ExternalUserID      types.String `tfsdk:"external_user_id"`
+	ExternalServiceName types.String `tfsdk:"external_service_name"`
+}
+
+// Metadata returns the metadata for the external_identity data source.
+func (r *externalIdentityDataSource) Metadata(
+	_ context.Context,
+	req datasource.MetadataRequest,
+	resp *datasource.MetadataResponse,
+) {
+	resp.TypeName = req.ProviderTypeName + "_external_identity"
+	r.typeName = resp.TypeName
+}
+
+// TypeName returns the data source type name for the external_identity data source.
+func (r *externalIdentityDataSource) TypeName() string {
+	return r.typeName
+}
+
+// Schema defines the schema for the external_identity data source.
+func (r *externalIdentityDataSource) Schema(
+	_ context.Context,
+	_ datasource.SchemaRequest,
+	resp *datasource.SchemaResponse,
+) {
+	resp.Schema = schema.Schema{
+		Description: "Map external service user with internal aiven user",
+		Attributes: map[string]schema.Attribute{
+			"organization_id": schema.StringAttribute{
+				Description: "the organization where internal_user_id exists",
+				Required:    true,
+			},
+			"internal_user_id": schema.StringAttribute{
+				Description: "the identity of the user on aiven platform",
+				Required:    true,
+			},
+			"external_user_id": schema.StringAttribute{
+				Description: "the identity of the user on external platfrom",
+				Required:    true,
+			},
+			"external_service_name": schema.StringAttribute{
+				Description: "the name of the external service where external_user_id exists",
+				Optional:    true,
+			},
+		},
+	}
+}
+
+// Configure sets up the external_identity data source.
+func (r *externalIdentityDataSource) Configure(
+	_ context.Context,
+	req datasource.ConfigureRequest,
+	resp *datasource.ConfigureResponse,
+) {
+	if req.ProviderData == nil {
+		return
+	}
+
+	client, ok := req.ProviderData.(*aiven.Client)
+	if !ok {
+		resp.Diagnostics = util.DiagErrorUnexpectedProviderDataType(resp.Diagnostics, req.ProviderData)
+
+		return
+	}
+
+	r.client = client
+}
+
+// Read reads an external_identity data source.
+func (r *externalIdentityDataSource) Read(ctx context.Context, req datasource.ReadRequest, resp *datasource.ReadResponse) {
+	var state externalIdentityDataSourceModel
+
+	if !util.ConfigToModel(ctx, &req.Config, &state, &resp.Diagnostics) {
+		return
+	}
+
+	organizationID := state.OrganizationID.ValueString()
+	internalUserID := state.InternalUserID.ValueString()
+	externalUserID := state.ExternalUserID.ValueString()
+	externalServiceName := state.ExternalServiceName.ValueString()
+
+	rm, err := r.client.OrganizationUser.List(ctx, organizationID)
+	if err != nil {
+		resp.Diagnostics = util.DiagErrorReadingDataSource(resp.Diagnostics, r, err)
+	}
+
+	var user *aiven.OrganizationMemberInfo
+	for _, member := range rm.Users {
+		if member.UserID == internalUserID {
+			user = &member
+		}
+	}
+
+	if user == nil {
+		err := errors.New(fmt.Sprintf("organization user %s not found in organization %s", internalUserID, organizationID))
+		resp.Diagnostics = util.DiagErrorReadingDataSource(resp.Diagnostics, r, err)
+	}
+
+	state.OrganizationID = types.StringValue(organizationID)
+	state.InternalUserID = types.StringValue(internalUserID)
+	state.ExternalUserID = types.StringValue(externalUserID)
+
+	if externalServiceName != "" {
+		state.ExternalServiceName = types.StringValue(externalServiceName)
+	} else {
+		state.ExternalServiceName = types.StringValue("github")
+	}
+
+	if !util.ModelToPlanState(ctx, state, &resp.State, &resp.Diagnostics) {
+		return
+	}
+}

internal/plugin/service/external_identity/external_identity_data_source_test.go

@@ -0,0 +1,65 @@
+package external_identity_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+
+	acc "github.com/aiven/terraform-provider-aiven/internal/acctest"
+)
+
+// TestExternalIdentityDataSource tests the external_identity datasource.
+func TestExternalIdentityDataSource(t *testing.T) {
+	deps := acc.CommonTestDependencies(t)
+
+	organizationName := deps.OrganizationName()
+	userID := deps.OrganizationUserID(true)
+	prefix := acc.DefaultResourceNamePrefix
+	suffix := acctest.RandStringFromCharSet(acc.DefaultRandomSuffixLength, acctest.CharSetAlphaNum)
+	userGroupName := fmt.Sprintf("%s-usr-group-%s", prefix, suffix)
+	resourceName := "data.aiven_external_identity.foo"
+	externalUserID := "alice"
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV6ProviderFactories: acc.TestProtoV6ProviderFactories,
+		PreCheck:                 func() { acc.TestAccPreCheck(t) },
+		Steps: []resource.TestStep{
+			{
+				Config: testExternalIdentityDataSourceBasic(organizationName, userGroupName, *userID, externalUserID),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "external_user_id", "alice"),
+					resource.TestCheckResourceAttr(resourceName, "internal_user_id", *userID),
+				),
+			},
+		},
+	})
+}
+
+func testExternalIdentityDataSourceBasic(organizationName string, userGroupName string, userID string, externalUserID string) string {
+	return fmt.Sprintf(`
+	data "aiven_organization" "foo" {
+	  name = "%s"
+	}
+	
+	resource "aiven_organization_user_group" "foo" {
+	  organization_id = data.aiven_organization.foo.id
+	  name            = "%s"
+	  description     = "Terraform acceptance tests"
+	}
+	
+	resource "aiven_organization_user_group_member" "foo" {
+	  organization_id = data.aiven_organization.foo.id
+	  group_id        = aiven_organization_user_group.foo.group_id
+	  user_id         = "%s"
+	}
+
+	data "aiven_external_identity" "foo" {
+		organization_id = data.aiven_organization.foo.id
+		internal_user_id = "%[3]s"
+		external_user_id = "%s"
+		external_service_name = "github"
+	}
+`, organizationName, userGroupName, userID, externalUserID)
+}