switch to using prod source system with CICD running (docs generated) (…

…#7)

* use prod domain, make client fields private

* appease linters, remove remaining template files

* gofmt

* appease and update the linters

* I can't spell heirarchy

* gofmt

* clean up examples and generate docs

* update test.yml to use creds from secrets in CI

* [temp] only run tests on prs

* make user props more fault tolerant

* add missed fields when repopulating missing default user props

* gofmt

* update docs and regenerate, small fix since merging main

* fix typos in docs copy

* appease godot

* fix path in theme test

* pass thru full detail of error responses

* skip custom domain test in ci

* add correct CODEOWNERS

.github/CODEOWNERS

@@ -1 +1 @@
-* @hashicorp/terraform-devex
+* @PropelAuth/engineering

.github/workflows/test.yml

@@ -7,9 +7,9 @@ on:
   pull_request:
     paths-ignore:
       - 'README.md'
-  push:
-    paths-ignore:
-      - 'README.md'
+  # push:
+  #   paths-ignore:
+  #     - 'README.md'
 
 # Testing only needs permissions to read the repository contents.
 permissions:
@@ -65,10 +65,10 @@ jobs:
       matrix:
         # list whatever Terraform versions here you would like to support
         terraform:
-          - '1.0.*'
-          - '1.1.*'
-          - '1.2.*'
-          - '1.3.*'
+          # - '1.0.*'
+          # - '1.1.*'
+          # - '1.2.*'
+          # - '1.3.*'
           - '1.4.*'
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -83,5 +83,8 @@ jobs:
       - run: go mod download
       - env:
           TF_ACC: "1"
-        run: go test -v -cover ./internal/provider/
+          PROPELAUTH_TENANT_ID: ${{ secrets.PROPELAUTH_TENANT_ID }}
+          PROPELAUTH_PROJECT_ID: ${{ secrets.PROPELAUTH_PROJECT_ID }}
+          PROPELAUTH_API_KEY: ${{ secrets.PROPELAUTH_API_KEY }}
+        run: go test -v -cover ./internal/provider/ -skip TestAccCustomDomainResource
         timeout-minutes: 10

.golangci.yml

@@ -9,7 +9,7 @@ linters:
   enable:
     - durationcheck
     - errcheck
-    - exportloopref
+    - copyloopvar
     - forcetypeassert
     - godot
     - gofmt
@@ -24,4 +24,4 @@ linters:
     - unconvert
     - unparam
     - unused
-    - vet
+    - govet

docs/data-sources/be_integration.md

@@ -0,0 +1,33 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "propelauth_be_integration Data Source - propelauth"
+subcategory: ""
+description: |-
+  Retrieve the parameters for a backend integration with one of your PropelAuth environments.
+---
+
+# propelauth_be_integration (Data Source)
+
+Retrieve the parameters for a backend integration with one of your PropelAuth environments.
+
+## Example Usage
+
+```terraform
+# Retrieve the details of a Back-end Integration to PropelAuth by environment.
+data "propelauth_be_integration" "example" {
+  environment = "Test"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `environment` (String) The environment for which you are configuring the backend integration. Accepted values are `Test`, `Staging`, and `Prod`.
+
+### Read-Only
+
+- `auth_url` (String) The URL to the authentication endpoint for the environment. This is needed in PropelAuth backend libraries.
+- `issuer` (String) A value that we verify in the access token. This is optional in our backend libraries, and if unspecified, the libraries will fetch it for you.
+- `public_key` (String) Your public key that can be used to verify access tokens. This is optional in our backend libraries, and if unspecified, the libraries will fetch it for you.

docs/index.md

@@ -10,7 +10,23 @@ description: |-
 
 Manage your PropelAuth integration for authentication, B2B authorization, and user management.
 
+## Example Usage
 
+```terraform
+terraform {
+  required_providers {
+    propelauth = {
+      source = "registry.terraform.io/propelauth/propelauth"
+    }
+  }
+}
+
+provider "propelauth" {
+  tenant_id  = "<PROPELAUTH_TENANT_ID>"  # or PROPELAUTH_TENANT_ID environment variable
+  project_id = "<PROPELAUTH_PROJECT_ID>" # or PROPELAUTH_PROJECT_ID environment variable
+  api_key    = "<PROPELAUTH_API_KEY>"    # or PROPELAUTH_API_KEY environment variable
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema

docs/resources/api_key_settings.md

@@ -0,0 +1,57 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "propelauth_api_key_settings Resource - propelauth"
+subcategory: ""
+description: |-
+  Api Key Configurations. This is for configuring the API global settings for t.
+---
+
+# propelauth_api_key_settings (Resource)
+
+Api Key Configurations. This is for configuring the API global settings for t.
+
+## Example Usage
+
+```terraform
+# Configure the API key settings for your PropelAuth project.
+resource "propelauth_api_key_settings" "example" {
+  personal_api_keys_enabled                = true
+  org_api_keys_enabled                     = true
+  invalidate_org_api_key_upon_user_removal = true
+  api_key_config = {
+    expiration_options = {
+      options = [
+        "TwoWeeks",
+        "OneMonth",
+        "ThreeMonths",
+      ]
+      default = "ThreeMonths"
+    }
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+- `api_key_config` (Attributes) API Key Configuration. This is for setting the options available to your users when creating an API key. (see [below for nested schema](#nestedatt--api_key_config))
+- `invalidate_org_api_key_upon_user_removal` (Boolean) If true, invalidate org API keys when the user that created them is removed from the organization. The default setting is false.
+- `org_api_keys_enabled` (Boolean) Allow users to create API keys for their organization. The default setting is false.
+- `personal_api_keys_enabled` (Boolean) Allow users to create personal API keys. The default setting is false.
+
+<a id="nestedatt--api_key_config"></a>
+### Nested Schema for `api_key_config`
+
+Required:
+
+- `expiration_options` (Attributes) API Key Expiration Options. This is for setting the options available to your users when creating an API key. (see [below for nested schema](#nestedatt--api_key_config--expiration_options))
+
+<a id="nestedatt--api_key_config--expiration_options"></a>
+### Nested Schema for `api_key_config.expiration_options`
+
+Required:
+
+- `default` (String) The default expiration option for an API key. Valid values are `TwoWeeks`, `OneMonth`, `ThreeMonths`, `SixMonths`, `OneYear`, and `Never`.
+- `options` (List of String) The options available for the expiration of an API key. Valid values are `TwoWeeks`, `OneMonth`, `ThreeMonths`, `SixMonths`, `OneYear`, and `Never`.

docs/resources/basic_auth_configuration.md

@@ -0,0 +1,36 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "propelauth_basic_auth_configuration Resource - propelauth"
+subcategory: ""
+description: |-
+  Basic Auth Configuration. This is for configuring basic authentication, signup, and user-account-management settings in PropelAuth.
+---
+
+# propelauth_basic_auth_configuration (Resource)
+
+Basic Auth Configuration. This is for configuring basic authentication, signup, and user-account-management settings in PropelAuth.
+
+## Example Usage
+
+```terraform
+# Configure basic authentication settings for your PropelAuth project.
+resource "propelauth_basic_auth_configuration" "example" {
+  has_password_login     = true
+  has_passwordless_login = true
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Optional
+
+- `allow_users_to_signup_with_personal_email` (Boolean) If true, your users will be able to sign up using personal email domains (@gmail.com, @yahoo.com, etc.).The default setting is true.
+- `has_password_login` (Boolean) If true, your users will be able to log in using their email and password. The default setting is true.
+- `has_passwordless_login` (Boolean) If true, your users will be able to log in using a magic link sent to their email. The default setting is false.
+- `include_login_method` (Boolean) If true, the login method will be included in the access token. The default setting is false.See `https://docs.propelauth.com/overview/user-management/user-properties#login-method-property` for more information.
+- `user_autologout_seconds` (Number) The number of seconds before a user is automatically logged out. The default setting is 1209600 (14 days).See also "user_autologout_type" for more information.
+- `user_autologout_type` (String) This sets the behavior for when the counting for "user_autologout_seconds" starts. Valid values are "AfterInactivity" and the stricter "AfterLogin". The default setting is "AfterInactivity".
+- `users_can_change_email` (Boolean) If true, your users will be able to change their email address. The default setting is true.
+- `users_can_delete_own_account` (Boolean) If true, your users will be able to delete their own account. The default setting is false.
+- `waitlist_users_enabled` (Boolean) If true, you will be able to use the APIs to collect emails before launching. The default setting is false.

docs/resources/be_api_key.md

@@ -0,0 +1,41 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "propelauth_be_api_key Resource - propelauth"
+subcategory: ""
+description: |-
+  Backend API Key resource. This is for configuring the basic BE API key information in PropelAuth.
+---
+
+# propelauth_be_api_key (Resource)
+
+Backend API Key resource. This is for configuring the basic BE API key information in PropelAuth.
+
+## Example Usage
+
+```terraform
+# Create a PropelAuth API key for use in the Back End of your application.
+resource "propelauth_be_api_key" "example" {
+  environment = "Prod"
+  name        = "Test API Key"
+  read_only   = false
+}
+
+output "be_api_key_result" {
+  value     = propelauth_be_api_key.example.api_key
+  sensitive = true
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `environment` (String) The environment for which you are configuring the backend integration. Accepted values are `Test`, `Staging`, and `Prod`.
+- `name` (String) The API key's name. This is only for internal dislay purposes.
+- `read_only` (Boolean) If true, the API key has read-only privileges. For example, it cannot be used for creating, editing, or deleting users/orgs. This value can only be set during the creation of the API key.
+
+### Read-Only
+
+- `api_key` (String, Sensitive) The API key value. This is the secret value that is used to authenticate requests to PropelAuth.
+- `api_key_id` (String) The API key ID. This is a unique identifier for the API key.

docs/resources/custom_domain.md

@@ -0,0 +1,44 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "propelauth_custom_domain Resource - propelauth"
+subcategory: ""
+description: |-
+  This resource just sets up the process of verifying the domain. It will return the TXT and CNAME records that you need to add to your DNS settings. You will need to add these records to your DNS settings manually or using Terraform. Then, the propelauth_custom_domain_verification resource will verify the domain.
+---
+
+# propelauth_custom_domain (Resource)
+
+This resource just sets up the process of verifying the domain. It will return the TXT and CNAME records that you need to add to your DNS settings. You will need to add these records to your DNS settings manually or using Terraform. Then, the `propelauth_custom_domain_verification` resource will verify the domain.
+
+## Example Usage
+
+```terraform
+# Initialize a custom domain with your PropelAuth environment. This does not verify the domain:
+# You will need a DNS provider and the `propelauth_custom_domain_verification` resource to verify the domain.
+resource "propelauth_custom_domain" "my_custom_domain" {
+  environment = "Prod"
+  domain      = "example.com"
+  subdomain   = "app"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `domain` (String) The domain name for the custom domain. Your resulting auth domain will be `auth.<domain>`. You can also specify a subdomain like prod.example.com which will result in auth.prod.example.com
+- `environment` (String) The environment for which you are configuring the custom domain. Accepted values are `Staging` and `Prod`.
+
+### Optional
+
+- `subdomain` (String) The subdomain for the custom domain. This is optional, but recommended, as it will allow PropelAuth to automatically redirect users to your application after they login.
+
+### Read-Only
+
+- `cname_record_key` (String) The CNAME record key for the custom domain.
+- `cname_record_key_without_domain` (String) The CNAME record key for the custom domain without the domain (e.g. just auth instead of auth.example.com) .
+- `cname_record_value` (String) The CNAME record value for the custom domain.
+- `txt_record_key` (String) The TXT record key for the custom domain.
+- `txt_record_key_without_domain` (String) The TXT record key for the custom domain without the domain (e.g. just auth instead of auth.example.com) .
+- `txt_record_value` (String) The TXT record value for the custom domain.

docs/resources/custom_domain_verification.md

@@ -0,0 +1,76 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "propelauth_custom_domain_verification Resource - propelauth"
+subcategory: ""
+description: |-
+  Custom Domain Verification resource. This is for verifying a custom domain for Production or Staging.
+---
+
+# propelauth_custom_domain_verification (Resource)
+
+Custom Domain Verification resource. This is for verifying a custom domain for Production or Staging.
+
+## Example Usage
+
+```terraform
+resource "propelauth_custom_domain" "my_custom_domain" {
+  environment = "Prod"
+  domain      = "example.com"
+}
+
+# AWS Route53 Example
+resource "aws_route53_zone" "primary" {
+  name = "example.com"
+}
+
+resource "aws_route53_record" "txt_record_for_propelauth" {
+  zone_id    = aws_route53_zone.primary.zone_id
+  name       = propelauth_custom_domain.my_custom_domain.txt_record_key
+  type       = "TXT"
+  ttl        = 300
+  records    = [propelauth_custom_domain.my_custom_domain.txt_record_value]
+  depends_on = [propelauth_custom_domain.my_custom_domain]
+}
+
+resource "aws_route53_record" "cname_record_for_propelauth" {
+  zone_id    = aws_route53_zone.primary.zone_id
+  name       = propelauth_custom_domain.my_custom_domain.cname_record_key
+  type       = "CNAME"
+  ttl        = 300
+  records    = [propelauth_custom_domain.my_custom_domain.cname_record_value]
+  depends_on = [propelauth_custom_domain.my_custom_domain]
+}
+
+# This resource will verify the domain once your DNS records have been set up. See the above
+# for how to do that with AWS Route 53 and the output of the "propelauth_custom_domain" resource 
+# to set up the DNS records.
+resource "propelauth_custom_domain_verification" "my_custom_domain_verification" {
+  depends_on = [
+    propelauth_custom_domain.my_custom_domain,
+    aws_route53_record.txt_record_for_propelauth,
+    aws_route53_record.cname_record_for_propelauth
+  ]
+  environment = propelauth_custom_domain.my_custom_domain.environment
+  domain      = propelauth_custom_domain.my_custom_domain.domain
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `domain` (String) The domain to verify.
+- `environment` (String) The environment for which you are configuring the custom domain. Accepted values are `Staging`, `Prod`.
+
+### Optional
+
+- `timeouts` (Attributes) (see [below for nested schema](#nestedatt--timeouts))
+
+<a id="nestedatt--timeouts"></a>
+### Nested Schema for `timeouts`
+
+Optional:
+
+- `create` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).
+- `update` (String) A string that can be [parsed as a duration](https://pkg.go.dev/time#ParseDuration) consisting of numbers and unit suffixes, such as "30s" or "2h45m". Valid time units are "s" (seconds), "m" (minutes), "h" (hours).