feat(access-token): add ephemeral access-token resource

[h3adex]

Description

Internal Issue: STACKITTPR-353

Checklist

• Issue was linked above
• Code format was applied: make fmt
• Examples were added / adjusted (see examples/ directory)
• Docs are up-to-date: make generate-docs (will be checked by CI)
• Unit tests got implemented or updated
• Acceptance tests got implemented or updated (see e.g. here)
• Unit tests are passing: make test (will be checked by CI)
• No linter issues: make lint (will be checked by CI)

[h3adex]

Implementing all the service account key and environment variable logic might not have been the best idea in hindsight. What do you think about leveraging the existing auth.KeyAuth method and type asserting to *client.KeyFlow instead?

Right now, the Go SDK only returns an http.RoundTripper, but since the underlying type is KeyFlow, we could safely assert it and access the full client. This would significantly simplify and clean up the entire resource implementation.

[rubenhoenle]

After taking a deeper look at auth.KeyAuth from the SDK: lgtm

[rubenhoenle]

But: Could we please have a unit tests which mocks the API call(s) and tests the whole process? To make sure the type assertion doesn't break on future updates of the SDK core module?

It might help to extract the logic for the access token into a seperate func beforehand which might look like this:

func (e *accessTokenEphemeralResource) Open(ctx context.Context, req ephemeral.OpenRequest, resp *ephemeral.OpenResponse) {
	var model ephemeralTokenModel

	resp.Diagnostics.Append(req.Config.Get(ctx, &model)...)
	if resp.Diagnostics.HasError() {
		return
	}

	accessToken, err := getAccessToken(ctx, &e.keyAuthConfig)
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, "Access token generation failed", err.Error())
		return
	}

	model.AccessToken = types.StringValue(accessToken)
	resp.Diagnostics.Append(resp.Result.Set(ctx, model)...)
}

func getAccessToken(ctx context.Context, keyAuthConfig *config.Configuration) (string, error) {
	rt, err := auth.KeyAuth(keyAuthConfig)
	if err != nil {
		return "", fmt.Errorf("failed to initialize authentication: %v", err)
	}

	// Type assert to access token functionality
	client, ok := rt.(*clients.KeyFlow)
	if !ok {
		return "", fmt.Errorf("internal error: expected *clients.KeyFlow, but received a different implementation of http.RoundTripper")
	}

	// Retrieve the access token
	accessToken, err := client.GetAccessToken()
	if err != nil {
		return "", fmt.Errorf("error obtaining access token: %v", err)
	}

	return accessToken, nil
}

[h3adex]

Good idea. Just pushed something which goes into that direction.

[rubenhoenle]

either you remove the ProviderData type embedding from the EphemeralProviderData because you don't seem to need it or you set the values here. Currently this is pretty useless.

[rubenhoenle]

@h3adex this is still not resolved. The following line is missing here:

ephemeralProviderData.ProviderData = providerData

[h3adex]

Thank you! Fixed.

[rubenhoenle]

One general question I still have: What happens when the user authenticates via token flow?

provider "stackit" {
  default_region        = "eu01"
  service_account_token = var.service_account_token
}

[rubenhoenle]

After taking a deeper look at auth.KeyAuth from the SDK: lgtm

[rubenhoenle]

But: Could we please have a unit tests which mocks the API call(s) and tests the whole process? To make sure the type assertion doesn't break on future updates of the SDK core module?

It might help to extract the logic for the access token into a seperate func beforehand which might look like this:

func (e *accessTokenEphemeralResource) Open(ctx context.Context, req ephemeral.OpenRequest, resp *ephemeral.OpenResponse) {
	var model ephemeralTokenModel

	resp.Diagnostics.Append(req.Config.Get(ctx, &model)...)
	if resp.Diagnostics.HasError() {
		return
	}

	accessToken, err := getAccessToken(ctx, &e.keyAuthConfig)
	if err != nil {
		core.LogAndAddError(ctx, &resp.Diagnostics, "Access token generation failed", err.Error())
		return
	}

	model.AccessToken = types.StringValue(accessToken)
	resp.Diagnostics.Append(resp.Result.Set(ctx, model)...)
}

func getAccessToken(ctx context.Context, keyAuthConfig *config.Configuration) (string, error) {
	rt, err := auth.KeyAuth(keyAuthConfig)
	if err != nil {
		return "", fmt.Errorf("failed to initialize authentication: %v", err)
	}

	// Type assert to access token functionality
	client, ok := rt.(*clients.KeyFlow)
	if !ok {
		return "", fmt.Errorf("internal error: expected *clients.KeyFlow, but received a different implementation of http.RoundTripper")
	}

	// Retrieve the access token
	accessToken, err := client.GetAccessToken()
	if err != nil {
		return "", fmt.Errorf("error obtaining access token: %v", err)
	}

	return accessToken, nil
}

[h3adex]

One general question I still have: What happens when the user authenticates via token flow?

provider "stackit" {
  default_region        = "eu01"
  service_account_token = var.service_account_token
}

Will look into that tomorrow.

[h3adex]

Error message when you try to generate a access token without a valid config

[rubenhoenle]

Error message when you try to generate a access token without a valid config

For me it must be at least stated in the docs which requirements exist to use this resource: User must use keyflow for authentication. Or am I wrong here?

[h3adex]

E2E Tests