resource_github_team.go

package github

import (
	"context"
	"errors"
	"log"
	"net/http"
	"strconv"

	"github.com/google/go-github/v82/github"
	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
)

func resourceGithubTeam() *schema.Resource {
	return &schema.Resource{
		CreateContext: resourceGithubTeamCreate,
		ReadContext:   resourceGithubTeamRead,
		UpdateContext: resourceGithubTeamUpdate,
		DeleteContext: resourceGithubTeamDelete,
		Importer: &schema.ResourceImporter{
			StateContext: resourceGithubTeamImport,
		},

		CustomizeDiff: customdiff.Sequence(
			customdiff.ComputedIf("slug", func(_ context.Context, d *schema.ResourceDiff, meta any) bool {
				return d.HasChange("name")
			}),
		),

		Schema: map[string]*schema.Schema{
			"name": {
				Type:        schema.TypeString,
				Required:    true,
				Description: "The name of the team.",
			},
			"description": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "A description of the team.",
			},
			"privacy": {
				Type:             schema.TypeString,
				Optional:         true,
				Default:          "secret",
				Description:      "The level of privacy for the team. Must be one of 'secret' or 'closed'.",
				ValidateDiagFunc: validateValueFunc([]string{"secret", "closed"}),
			},
			"notification_setting": {
				Type:             schema.TypeString,
				Optional:         true,
				Default:          "notifications_enabled",
				Description:      "The notification setting for the team. Must be one of 'notifications_enabled' or 'notifications_disabled'.",
				ValidateDiagFunc: validateValueFunc([]string{"notifications_enabled", "notifications_disabled"}),
			},
			"parent_team_id": {
				Type:        schema.TypeString,
				Optional:    true,
				Default:     "",
				Description: "The ID or slug of the parent team, if this is a nested team.",
				DiffSuppressFunc: func(k, o, n string, d *schema.ResourceData) bool {
					if d.Get("parent_team_id") == d.Get("parent_team_read_id") || d.Get("parent_team_id") == d.Get("parent_team_read_slug") {
						return true
					}
					return false
				},
			},
			"ldap_dn": {
				Type:        schema.TypeString,
				Optional:    true,
				Description: "The LDAP Distinguished Name of the group where membership will be synchronized. Only available in GitHub Enterprise Server.",
			},
			"create_default_maintainer": {
				Type:        schema.TypeBool,
				Optional:    true,
				Default:     false,
				Description: "Adds a default maintainer to the team. Adds the creating user to the team when 'true'.",
				Deprecated:  "Use github_team_membership or github_team_members resource to manage team memberships explicitly.",
			},
			"slug": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The slug of the created team.",
			},
			"members_count": {
				Type:     schema.TypeInt,
				Computed: true,
			},
			"parent_team_read_id": {
				Type:        schema.TypeString,
				Optional:    true,
				Computed:    true,
				Description: "The id of the parent team read in Github.",
			},
			"parent_team_read_slug": {
				Type:        schema.TypeString,
				Optional:    true,
				Computed:    true,
				Description: "The id of the parent team read in Github.",
			},
			"node_id": {
				Type:        schema.TypeString,
				Computed:    true,
				Description: "The Node ID of the created team.",
			},
			"etag": {
				Type:     schema.TypeString,
				Optional: true,
				Computed: true,
				DiffSuppressFunc: func(k, o, n string, d *schema.ResourceData) bool {
					return true
				},
				DiffSuppressOnRefresh: true,
			},
		},
	}
}

func resourceGithubTeamCreate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	err := checkOrganization(meta)
	if err != nil {
		return diag.FromErr(err)
	}

	client := meta.(*Owner).v3client
	ownerName := meta.(*Owner).name

	name := d.Get("name").(string)

	newTeam := github.NewTeam{
		Name:                name,
		Description:         github.Ptr(d.Get("description").(string)),
		Privacy:             github.Ptr(d.Get("privacy").(string)),
		NotificationSetting: github.Ptr(d.Get("notification_setting").(string)),
	}

	if ldapDN := d.Get("ldap_dn").(string); ldapDN != "" {
		newTeam.LDAPDN = &ldapDN
	}

	if parentTeamID, ok := d.GetOk("parent_team_id"); ok {
		teamId, err := getTeamID(parentTeamID.(string), meta)
		if err != nil {
			return diag.FromErr(err)
		}
		newTeam.ParentTeamID = &teamId
	}

	team, resp, err := client.Teams.CreateTeam(ctx, ownerName, newTeam)
	if err != nil {
		return diag.FromErr(err)
	}

	slug := team.GetSlug()
	membersCount := team.GetMembersCount()

	/*
		When using a GitHub App for authentication, `members:write` permissions on the App are needed.

		However, when using a GitHub App, CreateTeam will not correctly nest the team under the parent,
		if the parent team was created by someone else than the GitHub App. In that case, the response
		object will contain a `nil` parent object.

		This can be resolved by using an additional call to EditTeamByID. This will be able to set the
		parent team correctly when using a GitHub App with `members:write` permissions.

		Note that this is best-effort: when running this with a PAT that does not have admin permissions
		on the parent team, the operation might still fail to set the parent team.
	*/
	if newTeam.ParentTeamID != nil && team.Parent == nil {
		_, resp, err = client.Teams.EditTeamBySlug(ctx, ownerName, slug, newTeam, false)
		if err != nil {
			return diag.FromErr(err)
		}
	}

	create_default_maintainer := d.Get("create_default_maintainer").(bool)
	if !create_default_maintainer && membersCount > 0 {
		log.Printf("[DEBUG] Removing default maintainer from team: %s (%s)", name, ownerName)
		err := removeTeamMembers(ctx, client, ownerName, slug)
		if err != nil {
			return diag.FromErr(err)
		}

		membersCount = 0
	}

	d.SetId(strconv.FormatInt(team.GetID(), 10))
	if err = d.Set("slug", team.GetSlug()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("members_count", membersCount); err != nil {
		return diag.FromErr(err)
	}
	if parent := team.Parent; parent != nil {
		if err = d.Set("parent_team_id", strconv.FormatInt(team.Parent.GetID(), 10)); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_id", strconv.FormatInt(team.Parent.GetID(), 10)); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_slug", parent.Slug); err != nil {
			return diag.FromErr(err)
		}
	} else {
		if err = d.Set("parent_team_id", ""); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_id", ""); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_slug", ""); err != nil {
			return diag.FromErr(err)
		}
	}
	if err = d.Set("node_id", team.GetNodeID()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("etag", resp.Header.Get("ETag")); err != nil {
		return diag.FromErr(err)
	}

	return nil
}

func resourceGithubTeamRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	err := checkOrganization(meta)
	if err != nil {
		return diag.FromErr(err)
	}

	client := meta.(*Owner).v3client
	orgId := meta.(*Owner).id

	id, err := strconv.ParseInt(d.Id(), 10, 64)
	if err != nil {
		return diag.FromErr(unconvertibleIdErr(d.Id(), err))
	}

	if !d.IsNewResource() {
		ctx = context.WithValue(ctx, ctxEtag, d.Get("etag").(string))
	}

	team, resp, err := client.Teams.GetTeamByID(ctx, orgId, id)
	if err != nil {
		var ghErr *github.ErrorResponse
		if errors.As(err, &ghErr) {
			if ghErr.Response.StatusCode == http.StatusNotModified {
				return nil
			}
			if ghErr.Response.StatusCode == http.StatusNotFound {
				log.Printf("[INFO] Removing team %s from state because it no longer exists in GitHub",
					d.Id())
				d.SetId("")
				return nil
			}
		}
		return diag.FromErr(err)
	}

	if err = d.Set("slug", team.GetSlug()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("description", team.GetDescription()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("name", team.GetName()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("privacy", team.GetPrivacy()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("notification_setting", team.GetNotificationSetting()); err != nil {
		return diag.FromErr(err)
	}
	if parent := team.Parent; parent != nil {
		if err = d.Set("parent_team_id", strconv.FormatInt(team.Parent.GetID(), 10)); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_id", strconv.FormatInt(team.Parent.GetID(), 10)); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_slug", parent.Slug); err != nil {
			return diag.FromErr(err)
		}
	} else {
		if err = d.Set("parent_team_id", ""); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_id", ""); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_slug", ""); err != nil {
			return diag.FromErr(err)
		}
	}
	if err = d.Set("ldap_dn", team.GetLDAPDN()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("members_count", team.GetMembersCount()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("node_id", team.GetNodeID()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("etag", resp.Header.Get("ETag")); err != nil {
		return diag.FromErr(err)
	}

	return nil
}

func resourceGithubTeamUpdate(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	err := checkOrganization(meta)
	if err != nil {
		return diag.FromErr(err)
	}

	client := meta.(*Owner).v3client
	orgId := meta.(*Owner).id
	var removeParentTeam bool

	editedTeam := github.NewTeam{
		Name:                d.Get("name").(string),
		Description:         github.Ptr(d.Get("description").(string)),
		Privacy:             github.Ptr(d.Get("privacy").(string)),
		NotificationSetting: github.Ptr(d.Get("notification_setting").(string)),
	}
	if parentTeamID, ok := d.GetOk("parent_team_id"); ok {
		teamId, err := getTeamID(parentTeamID.(string), meta)
		if err != nil {
			return diag.FromErr(err)
		}
		editedTeam.ParentTeamID = &teamId
		removeParentTeam = false
	} else {
		removeParentTeam = true
	}

	teamId, err := strconv.ParseInt(d.Id(), 10, 64)
	if err != nil {
		return diag.FromErr(unconvertibleIdErr(d.Id(), err))
	}

	team, resp, err := client.Teams.EditTeamByID(ctx, orgId, teamId, editedTeam, removeParentTeam)
	if err != nil {
		return diag.FromErr(err)
	}

	if d.HasChange("ldap_dn") {
		ldapDN := d.Get("ldap_dn").(string)
		mapping := &github.TeamLDAPMapping{
			LDAPDN: github.Ptr(ldapDN),
		}
		_, _, err = client.Admin.UpdateTeamLDAPMapping(ctx, team.GetID(), mapping)
		if err != nil {
			return diag.FromErr(err)
		}
	}

	d.SetId(strconv.FormatInt(team.GetID(), 10))
	if err = d.Set("slug", team.GetSlug()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("members_count", team.GetMembersCount()); err != nil {
		return diag.FromErr(err)
	}
	if parent := team.Parent; parent != nil {
		if err = d.Set("parent_team_id", strconv.FormatInt(team.Parent.GetID(), 10)); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_id", strconv.FormatInt(team.Parent.GetID(), 10)); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_slug", parent.Slug); err != nil {
			return diag.FromErr(err)
		}
	} else {
		if err = d.Set("parent_team_id", ""); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_id", ""); err != nil {
			return diag.FromErr(err)
		}
		if err = d.Set("parent_team_read_slug", ""); err != nil {
			return diag.FromErr(err)
		}
	}
	if err = d.Set("node_id", team.GetNodeID()); err != nil {
		return diag.FromErr(err)
	}
	if err = d.Set("etag", resp.Header.Get("ETag")); err != nil {
		return diag.FromErr(err)
	}

	return nil
}

func resourceGithubTeamDelete(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	err := checkOrganization(meta)
	if err != nil {
		return diag.FromErr(err)
	}

	client := meta.(*Owner).v3client
	orgId := meta.(*Owner).id

	id, err := strconv.ParseInt(d.Id(), 10, 64)
	if err != nil {
		return diag.FromErr(unconvertibleIdErr(d.Id(), err))
	}

	_, err = client.Teams.DeleteTeamByID(ctx, orgId, id)
	/*
		When deleting a team and it failed, we need to check if it has already been deleted meanwhile.
		This could be the case when deleting nested teams via Terraform by looping through a module
		or resource and the parent team might have been deleted already. If the parent team had
		been deleted already (via parallel runs), the child team is also already gone (deleted by
		GitHub automatically).
		So we're checking if it still exists and if not, simply remove it from TF state.
	*/if err != nil {
		// Fetch the team in order to see if it exists or not (http 404)
		_, _, err = client.Teams.GetTeamByID(ctx, orgId, id)
		if err != nil {
			var ghErr *github.ErrorResponse
			if errors.As(err, &ghErr) {
				if ghErr.Response.StatusCode == http.StatusNotFound {
					// If team we failed to delete does not exist, remove it from TF state.
					log.Printf("[WARN] Removing team: %s from state because it no longer exists",
						d.Id())
					d.SetId("")
					return nil
				}
			}
			return diag.FromErr(err)
		}
	}
	return nil
}

func resourceGithubTeamImport(ctx context.Context, d *schema.ResourceData, meta any) ([]*schema.ResourceData, error) {
	teamId, err := getTeamID(d.Id(), meta)
	if err != nil {
		return nil, err
	}

	d.SetId(strconv.FormatInt(teamId, 10))
	if err = d.Set("create_default_maintainer", false); err != nil {
		return nil, err
	}

	return []*schema.ResourceData{d}, nil
}

func removeTeamMembers(ctx context.Context, client *github.Client, owner, slug string) error {
	users, _, err := client.Teams.ListTeamMembersBySlug(ctx, owner, slug, &github.TeamListTeamMembersOptions{})
	if err != nil {
		return err
	}

	for _, user := range users {
		_, err := client.Teams.RemoveTeamMembershipBySlug(ctx, owner, slug, user.GetLogin())
		if err != nil {
			return err
		}
	}

	return nil
}