Add vercel_oauth_app and vercel_oauth_app_client_secret resources

[TooTallNate]

What

Adds Terraform support for Sign in with Vercel OAuth applications, which until now could only be created in the dashboard.

vercel_oauth_app

Manages the application: name, slug, description, home_page_uri, redirect_uris, scopes (openid / email / profile / offline_access), and the consent-page policy URLs (privacy_policy_url, terms_of_service_url, code_of_conduct_url). The resource id is the OAuth client_id. Importable as [team_id/]client_id.

• A set validator enforces that explicitly configured scopes include "openid" — the API force-includes it server-side, so omitting it would otherwise produce a perpetual diff (Provider produced inconsistent result).
• Nullable URL fields are cleared with explicit JSON nulls on update (pointer fields without omitempty), so removing an attribute from config actually clears it.

vercel_oauth_app_client_secret

Generates a client secret for an app. The API returns the plaintext exactly once, so it's captured at create time (client_secret, sensitive) and tracked afterwards via last_four_chars — which is also how the delete endpoint addresses secrets. Apps allow at most two secrets, so zero-downtime rotation works with create_before_destroy + -replace. Not importable by nature; every change requires replacement.

API quirks handled in the client

• GET /v1/oauth-apps/:id wraps its response in { app } (create/update return the bare object)
• A missing app is reported as HTTP 400 invalid_client rather than 404 — handled by a dedicated client.OAuthAppNotFound helper (verified against production)
• POST .../secret rejects body-less requests with 415, so an empty JSON object is sent

Testing

Acceptance tests pass against the production API:

--- PASS: TestAcc_OAuthAppResource (3.75s)            # create → import → update (name/desc/URIs/scopes) → destroy
--- PASS: TestAcc_OAuthAppClientSecretResource (2.10s) # create secret → verify metadata via GET → destroy

Note for CI: all mutations require the team Owner role — the token behind VERCEL_API_TOKEN must be an Owner of VERCEL_TERRAFORM_TESTING_TEAM (a Developer-role token gets forbidden).

staticcheck, tfproviderlint -R018=false, gofmt -s, and go vet are all clean; docs generated with tfplugindocs v0.25.0.

Motivation

vercel-labs/durabench is moving its operator auth to Sign in with Vercel and wants the whole app provisioned via Terraform (vercel/infra#32272 currently has to treat the app as a dashboard-created input — with this it can own the app end to end).

[Copilot]

Pull request overview

Adds Terraform support for managing Vercel “Sign in with Vercel” OAuth apps and rotating their client secrets, including provider resources, API client support, generated docs, examples, and acceptance tests.

Changes:

• Introduces vercel_oauth_app resource (CRUD + import) with scope validation enforcing openid.
• Introduces vercel_oauth_app_client_secret resource to create/delete secrets while persisting the one-time plaintext secret in state.
• Adds corresponding Vercel API client methods, acceptance tests, examples, and generated docs.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
vercel/validator_oauth_app_scopes.go	Adds set validator enforcing openid in explicitly configured scopes.
vercel/resource_oauth_app.go	Implements vercel_oauth_app resource schema, CRUD, and import mapping.
vercel/resource_oauth_app_test.go	Adds acceptance tests for OAuth app and client secret resources.
vercel/resource_oauth_app_client_secret.go	Implements vercel_oauth_app_client_secret resource (create/read/delete).
vercel/provider.go	Registers the new resources with the provider.
examples/resources/vercel_oauth_app/resource.tf	Adds example configuration for vercel_oauth_app.
examples/resources/vercel_oauth_app/import.sh	Adds import usage examples for vercel_oauth_app.
examples/resources/vercel_oauth_app_client_secret/resource.tf	Adds example configuration for vercel_oauth_app_client_secret and rotation workflow.
docs/resources/oauth_app.md	Generated docs for vercel_oauth_app.
docs/resources/oauth_app_client_secret.md	Generated docs for vercel_oauth_app_client_secret.
client/oauth_app.go	Adds OAuth app + secret API helpers and “not found” handling.

Suppressed comments (2)

vercel/resource_oauth_app.go:329

• redirect_uris is Optional, so it may be null in the plan when omitted or explicitly set to null. Unconditionally calling ElementsAs will add diagnostics and block update; treat null as an empty slice (clear) and only decode when non-null (and preserve state if unknown).

	redirectURIs := []string{}
	diags = plan.RedirectURIs.ElementsAs(ctx, &redirectURIs, false)
	resp.Diagnostics.Append(diags...)
	if resp.Diagnostics.HasError() {
		return

vercel/resource_oauth_app.go:336

• scopes can be null if explicitly configured as null (it’s Optional+Computed), but the update path always calls ElementsAs which will fail on a null Set. Decode only when non-null, and let the existing len(scopes)==0 fallback apply for the default openid behavior (preserving state if the value is unknown).

	var scopes []string
	diags = plan.Scopes.ElementsAs(ctx, &scopes, false)
	resp.Diagnostics.Append(diags...)
	if resp.Diagnostics.HasError() {
		return
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.