data_source_github_app_token.go

package github

import (
	"context"
	"strings"

	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
)

func dataSourceGithubAppToken() *schema.Resource {
	return &schema.Resource{
		ReadContext: dataSourceGithubAppTokenRead,

		Schema: map[string]*schema.Schema{
			"app_id": {
				Type:        schema.TypeString,
				Required:    true,
				Description: descriptions["app_auth.id"],
			},
			"installation_id": {
				Type:        schema.TypeString,
				Required:    true,
				Description: descriptions["app_auth.installation_id"],
			},
			"pem_file": {
				Type:         schema.TypeString,
				Optional:     true,
				Sensitive:    true,
				Description:  descriptions["app_auth.pem_file"],
				ExactlyOneOf: []string{"pem_file", "aws_kms_key_id"},
			},
			"aws_kms_key_id": {
				Type:         schema.TypeString,
				Optional:     true,
				Description:  descriptions["app_auth.aws_kms_key_id"],
				ExactlyOneOf: []string{"pem_file", "aws_kms_key_id"},
			},
			"token": {
				Type:        schema.TypeString,
				Computed:    true,
				Sensitive:   true,
				Description: "The generated token from the credentials.",
			},
		},
	}
}

func dataSourceGithubAppTokenRead(ctx context.Context, d *schema.ResourceData, meta any) diag.Diagnostics {
	appID := d.Get("app_id").(string)
	installationID := d.Get("installation_id").(string)

	var signer Signer
	var err error
	if v, ok := d.GetOk("aws_kms_key_id"); ok {
		signer, err = NewAWSKMSSigner(ctx, v.(string))
		if err != nil {
			return diag.FromErr(err)
		}
	} else {
		// The Go encoding/pem package only decodes PEM formatted blocks
		// that contain new lines. Some platforms, like Terraform Cloud,
		// do not support new lines within Environment Variables.
		// Any occurrence of \n in the `pem_file` argument's value is replaced
		// with an actual new line character before decoding.
		pemFile := strings.ReplaceAll(d.Get("pem_file").(string), `\n`, "\n")
		signer, err = NewPEMSigner([]byte(pemFile))
		if err != nil {
			return diag.FromErr(err)
		}
	}

	token, err := GenerateOAuthTokenFromApp(ctx, signer, meta.(*Owner).v3client.BaseURL, appID, installationID)
	if err != nil {
		return diag.FromErr(err)
	}
	if err := d.Set("token", token); err != nil {
		return diag.FromErr(err)
	}
	d.SetId("id")

	return nil
}