Merge pull request #708 from imjaroiswebdev/app-oauth-scoped-token-su…

…pport

Support for PagerDuty Apps Oauth scoped token

GNUmakefile

@@ -1,6 +1,5 @@
 TEST?=$$(go list ./... |grep -v 'vendor')
 GOFMT_FILES?=$$(find . -name '*.go' |grep -v vendor)
-WEBSITE_REPO=github.com/hashicorp/terraform-website
 PKG_NAME=pagerduty
 
 default: build
@@ -46,19 +45,5 @@ test-compile:
 update-go-pagerduty:
 	go get github.com/heimweh/go-pagerduty/pagerduty && go mod tidy && go mod vendor
 
-website:
-ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
-	echo "$(WEBSITE_REPO) not found in your GOPATH (necessary for layouts and assets), get-ting..."
-	git clone https://$(WEBSITE_REPO) $(GOPATH)/src/$(WEBSITE_REPO)
-endif
-	@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
-
-website-test:
-ifeq (,$(wildcard $(GOPATH)/src/$(WEBSITE_REPO)))
-	echo "$(WEBSITE_REPO) not found in your GOPATH (necessary for layouts and assets), get-ting..."
-	git clone https://$(WEBSITE_REPO) $(GOPATH)/src/$(WEBSITE_REPO)
-endif
-	@$(MAKE) -C $(GOPATH)/src/$(WEBSITE_REPO) website-provider-test PROVIDER_PATH=$(shell pwd) PROVIDER_NAME=$(PKG_NAME)
-
 .PHONY: build test testacc vet fmt fmtcheck errcheck test-compile website website-test
 

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/hashicorp/terraform-exec v0.16.0
 	github.com/hashicorp/terraform-json v0.13.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.11.0
-	github.com/heimweh/go-pagerduty v0.0.0-20230821205435-23a4af661dd7
+	github.com/heimweh/go-pagerduty v0.0.0-20230908205257-a96e6c05f7ea
 )
 
 require (
@@ -20,7 +20,6 @@ require (
 	github.com/cloudflare/circl v1.3.3 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fatih/color v1.7.0 // indirect
-	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/golang/snappy v0.0.4 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
@@ -43,14 +42,14 @@ require (
 	github.com/mattn/go-colorable v0.1.4 // indirect
 	github.com/mattn/go-isatty v0.0.10 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
-	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/montanaflynn/stats v0.6.6 // indirect
 	github.com/oklog/run v1.0.0 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
+	github.com/spf13/afero v1.9.5 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
 	github.com/vmihailenco/tagparser v0.1.1 // indirect
@@ -62,13 +61,13 @@ require (
 	go.mongodb.org/mongo-driver v1.10.2 // indirect
 	golang.org/x/crypto v0.11.0 // indirect
 	golang.org/x/mod v0.10.0 // indirect
-	golang.org/x/net v0.12.0 // indirect
-	golang.org/x/sync v0.0.0-20220601150217-0de741cfad7f // indirect
+	golang.org/x/net v0.10.0 // indirect
+	golang.org/x/sync v0.1.0 // indirect
 	golang.org/x/sys v0.10.0 // indirect
-	golang.org/x/text v0.11.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/genproto v0.0.0-20230110181048-76db0878b65f // indirect
-	google.golang.org/grpc v1.53.0 // indirect
-	google.golang.org/protobuf v1.31.0 // indirect
-	gopkg.in/yaml.v2 v2.3.0 // indirect
+	google.golang.org/genproto v0.0.0-20210226172003-ab064af71705 // indirect
+	google.golang.org/grpc v1.45.0 // indirect
+	google.golang.org/protobuf v1.27.1 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 )

pagerduty/config.go

@@ -8,6 +8,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/logging"
 	"github.com/heimweh/go-pagerduty/pagerduty"
+	"github.com/heimweh/go-pagerduty/persistentconfig"
 )
 
 // Config defines the configuration options for the PagerDuty client
@@ -35,6 +36,12 @@ type Config struct {
 	// UserAgent for API Client
 	UserAgent string
 
+	APITokenType *pagerduty.AuthTokenType
+
+	AppOauthScopedTokenParams *persistentconfig.AppOauthScopedTokenParams
+
+	ServiceRegion string
+
 	client      *pagerduty.Client
 	slackClient *pagerduty.Client
 }
@@ -57,7 +64,7 @@ func (c *Config) Client() (*pagerduty.Client, error) {
 	}
 
 	// Validate that the PagerDuty token is set
-	if c.Token == "" {
+	if c.Token == "" && c.APITokenType != nil && *c.APITokenType == pagerduty.AuthTokenTypeAPIToken {
 		return nil, fmt.Errorf(invalidCreds)
 	}
 
@@ -71,11 +78,13 @@ func (c *Config) Client() (*pagerduty.Client, error) {
 	}
 
 	config := &pagerduty.Config{
-		BaseURL:    apiUrl,
-		Debug:      logging.IsDebugOrHigher(),
-		HTTPClient: httpClient,
-		Token:      c.Token,
-		UserAgent:  c.UserAgent,
+		BaseURL:                   apiUrl,
+		Debug:                     logging.IsDebugOrHigher(),
+		HTTPClient:                httpClient,
+		Token:                     c.Token,
+		UserAgent:                 c.UserAgent,
+		AppOauthScopedTokenParams: c.AppOauthScopedTokenParams,
+		APIAuthTokenType:          c.APITokenType,
 	}
 
 	client, err := pagerduty.NewClient(config)

pagerduty/provider.go

@@ -1,14 +1,17 @@
 package pagerduty
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"regexp"
 	"runtime"
 	"strings"
 
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/heimweh/go-pagerduty/pagerduty"
+	"github.com/heimweh/go-pagerduty/persistentconfig"
 )
 
 // Provider represents a resource provider in Terraform
@@ -23,7 +26,7 @@ func Provider() *schema.Provider {
 
 			"token": {
 				Type:        schema.TypeString,
-				Required:    true,
+				Optional:    true,
 				DefaultFunc: schema.EnvDefaultFunc("PAGERDUTY_TOKEN", nil),
 			},
 
@@ -39,6 +42,31 @@ func Provider() *schema.Provider {
 				Default:  "",
 			},
 
+			"use_app_oauth_scoped_token": {
+				Type:     schema.TypeList,
+				Optional: true,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"pd_client_id": {
+							Type:        schema.TypeString,
+							Required:    true,
+							DefaultFunc: schema.EnvDefaultFunc("PAGERDUTY_CLIENT_ID", nil),
+						},
+						"pd_client_secret": {
+							Type:        schema.TypeString,
+							Required:    true,
+							DefaultFunc: schema.EnvDefaultFunc("PAGERDUTY_CLIENT_SECRET", nil),
+						},
+						"pd_subdomain": {
+							Type:        schema.TypeString,
+							Required:    true,
+							DefaultFunc: schema.EnvDefaultFunc("PAGERDUTY_SUBDOMAIN", nil),
+						},
+					},
+				},
+			},
+
 			"api_url_override": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -123,14 +151,14 @@ func Provider() *schema.Provider {
 		},
 	}
 
-	p.ConfigureFunc = func(d *schema.ResourceData) (interface{}, error) {
+	p.ConfigureContextFunc = func(ctx context.Context, d *schema.ResourceData) (interface{}, diag.Diagnostics) {
 		terraformVersion := p.TerraformVersion
 		if terraformVersion == "" {
 			// Terraform 0.12 introduced this field to the protocol
 			// We can therefore assume that if it's missing it's 0.10 or 0.11
 			terraformVersion = "0.11+compatible"
 		}
-		return providerConfigure(d, terraformVersion)
+		return providerConfigureContextFunc(ctx, d, terraformVersion)
 	}
 
 	return p
@@ -164,25 +192,74 @@ func handleNotFoundError(err error, d *schema.ResourceData) error {
 	return genError(err, d)
 }
 
-func providerConfigure(data *schema.ResourceData, terraformVersion string) (interface{}, error) {
-	var ServiceRegion = strings.ToLower(data.Get("service_region").(string))
+func providerConfigureContextFunc(ctx context.Context, data *schema.ResourceData, terraformVersion string) (interface{}, diag.Diagnostics) {
+	var diags diag.Diagnostics
+	var serviceRegion = strings.ToLower(data.Get("service_region").(string))
 
-	if ServiceRegion == "us" || ServiceRegion == "" {
-		ServiceRegion = ""
+	var regionApiUrl string
+	if serviceRegion == "us" || serviceRegion == "" {
+		regionApiUrl = ""
 	} else {
-		ServiceRegion = ServiceRegion + "."
+		regionApiUrl = serviceRegion + "."
 	}
 
 	config := Config{
-		ApiUrl:              "https://api." + ServiceRegion + "pagerduty.com",
-		AppUrl:              "https://app." + ServiceRegion + "pagerduty.com",
+		ApiUrl:              "https://api." + regionApiUrl + "pagerduty.com",
+		AppUrl:              "https://app." + regionApiUrl + "pagerduty.com",
 		SkipCredsValidation: data.Get("skip_credentials_validation").(bool),
 		Token:               data.Get("token").(string),
 		UserToken:           data.Get("user_token").(string),
 		UserAgent:           fmt.Sprintf("(%s %s) Terraform/%s", runtime.GOOS, runtime.GOARCH, terraformVersion),
 		ApiUrlOverride:      data.Get("api_url_override").(string),
+		ServiceRegion:       serviceRegion,
 	}
 
+	useAuthTokenType := pagerduty.AuthTokenTypeAPIToken
+	if attr, ok := data.GetOk("use_app_oauth_scoped_token"); ok {
+		config.AppOauthScopedTokenParams = expandAppOauthTokenParams(attr)
+		config.AppOauthScopedTokenParams.Region = serviceRegion
+		useAuthTokenType = pagerduty.AuthTokenTypeUseAppCredentials
+		if err := validateAuthMethodConfig(data); err != nil {
+			diag := diag.Diagnostic{
+				Severity: diag.Warning,
+				Summary:  fmt.Sprint("`token` and `use_app_oauth_scoped_token` are both configured at the same time"),
+				Detail:   err.Error(),
+			}
+			diags = append(diags, diag)
+		}
+	}
+
+	config.APITokenType = &useAuthTokenType
+
 	log.Println("[INFO] Initializing PagerDuty client")
-	return &config, nil
+	return &config, diags
+}
+
+func expandAppOauthTokenParams(v interface{}) *persistentconfig.AppOauthScopedTokenParams {
+	aotp := &persistentconfig.AppOauthScopedTokenParams{}
+
+	i := v.([]interface{})[0]
+	if isNilFunc(i) {
+		return nil
+	}
+	mi := i.(map[string]interface{})
+
+	aotp.ClientID = mi["pd_client_id"].(string)
+	aotp.ClientSecret = mi["pd_client_secret"].(string)
+	aotp.PDSubDomain = mi["pd_subdomain"].(string)
+
+	return aotp
+}
+
+var validationAuthMethodConfigWarning = "PagerDuty Provider has been set to authenticate API calls utilizing API token and App Oauth token at same time, in this scenario the use of App Oauth token is prioritised over API token authentication configuration. It is recommended to explicitely set just one authentication method.\nWe also suggest you to check your environment variables in case `token` being automatically read by Provider configuration through `PAGERDUTY_TOKEN` environment variable."
+
+func validateAuthMethodConfig(data *schema.ResourceData) error {
+	_, isSetAPIToken := data.GetOk("token")
+	_, isSetUseAppOauthScopedToken := data.GetOk("use_app_oauth_scoped_token")
+
+	if isSetUseAppOauthScopedToken && isSetAPIToken {
+		return fmt.Errorf(validationAuthMethodConfigWarning)
+	}
+
+	return nil
 }