Allow managing project permissions

[mwudka]

Description

This adds support for managing a team's project permissions. It introduces a new resource called tfe_team_project_access to grant a team read or admin permission on a specific project, and adds a new manage_projects attribute on the tfe_team resource to allow giving a team access to all projects in an org.

Testing plan

1. Ensure new tests pass
2. Try importing existing resources
3. Ensure existing configs still apply cleanly
4. Manually test with various configurations similar to:

resource "tfe_organization" "test-organization" {
  name  = "my-org-name"
  email = "admin@company.com"
}

resource "tfe_project" "test" {
  organization = tfe_organization.test-organization.name
  name = "projectname"
}

resource "tfe_team" "manage-proj" {
  organization = tfe_organization.test-organization.name
  name = "manage-proj"
  organization_access {
    manage_projects = true
    manage_workspaces = true
  }
}

resource "tfe_team" "read-proj" {
  organization = tfe_organization.test-organization.name
  name = "read-proj"
}

resource "tfe_team_project_access" "read" {
  team_id = tfe_team.read-proj.id
  project_id = tfe_project.test.id
  access = "read"
}

resource "tfe_team" "admin-proj" {
  organization = tfe_organization.test-organization.name
  name = "admin-proj"
}

resource "tfe_team_project_access" "admin" {
  team_id = tfe_team.admin-proj.id
  project_id = tfe_project.test.id
  access = "admin"
}

data "tfe_team" "manage-proj" {
  organization = tfe_organization.test-organization.name
  name = "manage-proj"
}

data "tfe_team_project_access" "reader" {
  team_id = tfe_team.read-proj.id
  project_id = tfe_project.test.id
}

output "reader-access" {
  value = data.tfe_team_project_access.reader.access
}

External links

• go-tfe documentation
• API documentation

Output from acceptance tests

Please run applicable acceptance tests locally and include the output here. See TESTS.md to learn how to run acceptance tests.

If you are an external contributor, your contribution(s) will first be reviewed before running them against the project's CI pipeline.

Ran with ENABLE_BETA=1

=== RUN   TestAccTFETeamProjectAccess_admin
--- PASS: TestAccTFETeamProjectAccess_admin (24.28s)
=== RUN   TestAccTFETeamProjectAccess_import
--- PASS: TestAccTFETeamProjectAccess_import (13.18s)
PASS

=== RUN   TestAccTFETeamProjectAccessDataSource_basic
--- PASS: TestAccTFETeamProjectAccessDataSource_basic (15.64s)
PASS

Process finished with the exit code 0

...

[sebasslash]

So far things are looking great. While smoke testing I uncovered a panic ⬇️

[sebasslash]

Panic ❗

Suggested change

	tfeClient := meta.(*tfe.Client)
	config := meta.(ConfiguredClient)
	// you can use the tfe client: config.Client.Workspaces.Blah()

This change was introduced in #762

In effect, organization attributes are no longer required since you can configure the provider with a universal org.

[mwudka]

Oops oops oops, I didn't realize I had pulled this in with a rebase. At it would have burned me in the merge anyway, so thanks for catching this! I applied that pattern to remove all usages of meta.(*tfe.Client).

[sebasslash]

We're going to need elevated privileges here, so createBusinessOrganization() 😄

[uturunku1]

I got the chance to run a smoke test on your configuration example. It works!

[tkaburagi]

When will it be available?

[cmicck]

When will it be available?

We are also looking forward to have this available.

[brandonc]

@tkaburagi @cmicck This was released yesterday in provider version v0.42.0