feat(coderd_oauth2_provider_settings): manage the OAuth2 DCR toggle

docs/resources/oauth2_provider_settings.md

@@ -0,0 +1,94 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "coderd_oauth2_provider_settings Resource - terraform-provider-coderd"
+subcategory: ""
+description: |-
+  Deployment-wide OAuth2 provider settings.
+  This is a deployment-wide singleton. Declare it once; duplicate resources silently overwrite each other.
+  ~> Warning
+  If DCR was configured out of band, terraform import this resource before the first apply. Otherwise Terraform overwrites the live value without a diff; disabling an enabled setting emits a non-blocking warning.
+  ~> Warning
+  terraform destroy resets dynamic_client_registration_enabled to false, the
+  deployment default. The API has no delete operation for this setting, so the
+  value cannot be returned to a "never configured" state.
+  -> Omit this resource to leave DCR unmanaged. Only one Terraform configuration should own it.
+  ~> Warning
+  This resource is only compatible with Coder version 2.37.0 https://github.com/coder/coder/releases/tag/v2.37.0 and later.
+  ~> Warning
+  Requires the oauth2 experiment (CODER_EXPERIMENTS=oauth2 or --experiments=oauth2); * does not enable it. Without it, /api/v2/oauth2-provider/settings returns 403 (development builds bypass this check).
+---
+
+# coderd_oauth2_provider_settings (Resource)
+
+Deployment-wide OAuth2 provider settings.
+
+This is a deployment-wide singleton. Declare it once; duplicate resources silently overwrite each other.
+
+~> **Warning**
+If DCR was configured out of band, `terraform import` this resource before the first apply. Otherwise Terraform overwrites the live value without a diff; disabling an enabled setting emits a non-blocking warning.
+
+~> **Warning**
+`terraform destroy` resets `dynamic_client_registration_enabled` to `false`, the
+deployment default. The API has no delete operation for this setting, so the
+value cannot be returned to a "never configured" state.
+
+-> Omit this resource to leave DCR unmanaged. Only one Terraform configuration should own it.
+
+~> **Warning**
+This resource is only compatible with Coder version [2.37.0](https://github.com/coder/coder/releases/tag/v2.37.0) and later.
+
+~> **Warning**
+Requires the `oauth2` experiment (`CODER_EXPERIMENTS=oauth2` or `--experiments=oauth2`); `*` does not enable it. Without it, `/api/v2/oauth2-provider/settings` returns `403` (development builds bypass this check).
+
+## Example Usage
+
+```terraform
+// Requires the `oauth2` experiment.
+// Import first if DCR is already managed out of band.
+resource "coderd_oauth2_provider_settings" "dcr" {
+  dynamic_client_registration_enabled = true
+
+  // Only needed when the same configuration also upgrades Coder itself.
+  // `/api/v2/oauth2-provider/settings` does not exist until the new version is
+  // actually serving, and `depends_on = [helm_release.coder]` alone only orders
+  // "the Helm apply returned", which for a rolling update can still leave
+  // old-version pods behind the load balancer. Gate on the API responding
+  // instead, or apply the upgrade and this resource in two separate runs.
+  depends_on = [terraform_data.coder_ready]
+}
+
+resource "terraform_data" "coder_ready" {
+  depends_on = [helm_release.coder]
+
+  provisioner "local-exec" {
+    command = "until curl -sfo /dev/null $CODER_URL/api/v2/buildinfo; do sleep 5; done"
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `dynamic_client_registration_enabled` (Boolean) Whether OAuth2 Dynamic Client Registration ([RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591)) is enabled for the deployment. When disabled, `POST /oauth2/register` is rejected and the `registration_endpoint` is omitted from the authorization server metadata document.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+# The singleton has no ID; any placeholder works.
+# Import before the first apply to adopt the live value.
+$ terraform import coderd_oauth2_provider_settings.dcr oauth2_provider_settings
+```
+Alternatively, in Terraform v1.5.0 and later, an [`import` block](https://developer.hashicorp.com/terraform/language/import) can be used:
+
+```terraform
+import {
+  to = coderd_oauth2_provider_settings.dcr
+  id = "oauth2_provider_settings"
+}
+```

examples/resources/coderd_oauth2_provider_settings/import.sh

@@ -0,0 +1,11 @@
+# The singleton has no ID; any placeholder works.
+# Import before the first apply to adopt the live value.
+$ terraform import coderd_oauth2_provider_settings.dcr oauth2_provider_settings
+```
+Alternatively, in Terraform v1.5.0 and later, an [`import` block](https://developer.hashicorp.com/terraform/language/import) can be used:
+
+```terraform
+import {
+  to = coderd_oauth2_provider_settings.dcr
+  id = "oauth2_provider_settings"
+}

examples/resources/coderd_oauth2_provider_settings/resource.tf

@@ -0,0 +1,21 @@
+// Requires the `oauth2` experiment.
+// Import first if DCR is already managed out of band.
+resource "coderd_oauth2_provider_settings" "dcr" {
+  dynamic_client_registration_enabled = true
+
+  // Only needed when the same configuration also upgrades Coder itself.
+  // `/api/v2/oauth2-provider/settings` does not exist until the new version is
+  // actually serving, and `depends_on = [helm_release.coder]` alone only orders
+  // "the Helm apply returned", which for a rolling update can still leave
+  // old-version pods behind the load balancer. Gate on the API responding
+  // instead, or apply the upgrade and this resource in two separate runs.
+  depends_on = [terraform_data.coder_ready]
+}
+
+resource "terraform_data" "coder_ready" {
+  depends_on = [helm_release.coder]
+
+  provisioner "local-exec" {
+    command = "until curl -sfo /dev/null $CODER_URL/api/v2/buildinfo; do sleep 5; done"
+  }
+}

go.mod

@@ -1,10 +1,10 @@
 module github.com/coder/terraform-provider-coderd
 
-go 1.26.4
+go 1.26.5
 
 require (
 	cdr.dev/slog/v3 v3.1.0
-	github.com/coder/coder/v2 v2.34.0-rc.0.0.20260713111656-06107768a8d6
+	github.com/coder/coder/v2 v2.34.0-rc.0.0.20260728235933-fbac602456c9
 	github.com/coder/retry v1.5.1
 	github.com/coder/serpent v0.15.0
 	github.com/coder/websocket v1.8.15
@@ -59,7 +59,7 @@ require (
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect
 	github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c // indirect
-	github.com/aws/aws-sdk-go-v2 v1.42.1 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.43.0 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
@@ -75,12 +75,12 @@ require (
 	github.com/clipperhouse/uax29/v2 v2.6.0 // indirect
 	github.com/cloudflare/circl v1.6.3 // indirect
 	github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 // indirect
-	github.com/coder/terraform-provider-coder/v2 v2.18.0 // indirect
+	github.com/coder/terraform-provider-coder/v2 v2.19.0 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/coreos/go-oidc/v3 v3.19.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.20.0 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
@@ -114,7 +114,7 @@ require (
 	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
 	github.com/hashicorp/terraform-exec v0.25.1 // indirect
-	github.com/hashicorp/terraform-json v0.27.3-0.20260213134036-298b8f6b673a // indirect
+	github.com/hashicorp/terraform-json v0.28.0 // indirect
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.1 // indirect
 	github.com/hashicorp/terraform-registry-address v0.4.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.2.1 // indirect
@@ -123,7 +123,7 @@ require (
 	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/invopop/jsonschema v0.14.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/klauspost/compress v1.19.0 // indirect
+	github.com/klauspost/compress v1.19.1 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/linkdata/deadlock v0.5.5 // indirect
 	github.com/lucasb-eyer/go-colorful v1.4.0 // indirect
@@ -167,10 +167,10 @@ require (
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/posener/complete v1.2.3 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
-	github.com/prometheus/client_golang v1.23.2 // indirect
+	github.com/prometheus/client_golang v1.24.0 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.69.0 // indirect
-	github.com/prometheus/procfs v0.20.1 // indirect
+	github.com/prometheus/common v0.70.0 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/puzpuzpuz/xsync/v3 v3.5.1 // indirect
 	github.com/richardartoul/molecule v1.0.1-0.20240531184615-7ca0df43c0b3 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
@@ -187,7 +187,7 @@ require (
 	github.com/tklauser/go-sysconf v0.3.16 // indirect
 	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/trailofbits/go-mutexasserts v0.0.0-20250514102930-c1f3d2e37561 // indirect
-	github.com/valyala/fasthttp v1.72.0 // indirect
+	github.com/valyala/fasthttp v1.73.0 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
@@ -217,21 +217,21 @@ require (
 	go.uber.org/zap v1.27.1 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/mod v0.38.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.21.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/term v0.44.0 // indirect
-	golang.org/x/text v0.39.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
-	golang.org/x/tools v0.47.0 // indirect
+	golang.org/x/tools v0.48.0 // indirect
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260610212136-7ab31c22f7ad // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260622175928-b703f567277d // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260706201446-f0a921348800 // indirect
 	google.golang.org/grpc v1.82.1 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/DataDog/dd-trace-go.v1 v1.74.0 // indirect