setup_udp.tf

variable "org_name" {}
variable "api_token" {}
variable "base_url" {}

variable "demo_app_name" { default = "kotter" }
variable "udp_subdomain" { default = "local_kotter" }

locals {
  app_domain       = "${var.udp_subdomain}.${var.demo_app_name}.unidemo.info"
  # TODO: account for "stg.unidemo.info" for staging deployment
  nodash_subdomain = replace(var.udp_subdomain, "-", "_")
  local_url = "http://localhost:5000"
  audience = "https://kotter.udp.okta.com"
}

provider "okta" {
  org_name = var.org_name
  base_url = var.base_url
  api_token = var.api_token
  version   = "~> 3.0"
}

data "okta_group" "all" {
  name = "Everyone"
  include_users = true
  # NOTE: including users can cause trouble for TF when there
  # are many users in an org
}

resource "okta_group" "admin" {
  name        = "Admin [Kotter]"
  description = "Kotter Admin (Generated by UDP)"
  users = data.okta_group.all.users
}

resource "okta_app_oauth" "kotter" {
  label                      = "Kotter (Generated by UDP)"
  type                       = "web"
  grant_types                = ["authorization_code", "implicit"]
  redirect_uris              = [
    local.local_url,
    "${local.local_url}/authorization-code/callback",
    "${local.local_url}/implicit/callback",
    "https://${local.app_domain}",
    "https://${local.app_domain}/authorization-code/callback",
    "https://${local.app_domain}/implicit/callback"
  ]
  post_logout_redirect_uris  = ["http://localhost:5000", "https://${local.app_domain}"]
  login_uri                  = "https://${local.app_domain}/authorization-code"
  response_types             = ["token", "id_token", "code"]
  issuer_mode                = "ORG_URL"
  groups                     = ["${data.okta_group.all.id}"]
  consent_method             = "TRUSTED"
  # TODO: Grant this app the "okta.users.read" scope
}

resource "okta_app_oauth" "kotter_client_credentials" {
  label                      = "Kotter Client Credentials (Generated by UDP)"
  type                       = "service"
  grant_types                = ["client_credentials"]
  response_types             = ["token"]
  issuer_mode                = "ORG_URL"
  consent_method             = "REQUIRED"
}

resource "okta_app_user_schema" "app_permissions" {
  app_id      = okta_app_oauth.kotter.id
  index       = "app_permissions"
  title       = "Permissions"
  description = "Permission level for the user of this application"
  master      = "OKTA"
  scope       = "SELF"  # "NONE" for group ?
  type        = "array"
  array_type  = "string"
  array_enum  = ["base", "admin"]

  array_one_of {
    const = "base"
    title = "Base"
  }

  array_one_of {
    const = "admin"
    title = "Admin"
  }
}

resource "okta_app_user_schema" "app_features" {
  app_id      = okta_app_oauth.kotter.id
  index       = "app_features"
  title       = "Features"
  description = "Feature set for the user of this application"
  master      = "OKTA"
  scope       = "SELF"  # "NONE" for group ?
  depends_on  = [okta_app_user_schema.app_permissions]
  type        = "array"
  array_type  = "string"
  array_enum  = ["basic", "premium"]

  array_one_of {
    const = "basic"
    title = "Basic"
  }

  array_one_of {
    const = "premium"
    title = "Premium"
  }
}

# resource "okta_app_group_assignment" "admin" {
#   app_id   = okta_app_oauth.kotter.id
#   group_id = okta_group.admin.id
#   profile = <<JSON
#   {
#     "app_features": [
#         "basic",
#         "premium"
#     ],
#     "app_permissions": [
#         "base",
#         "admin"
#       ]
#     }
#   JSON
#   depends_on = [
#     okta_app_user_schema.app_permissions,
#     okta_app_user_schema.app_features
#   ]
# }

resource "okta_trusted_origin" "kotter" {
  name   = "https://${local.app_domain}"
  origin = "https://${local.app_domain}"
  scopes = ["CORS", "REDIRECT"]
}

resource "okta_trusted_origin" "kotter_local" {
  name   = local.local_url
  origin = local.local_url
  scopes = ["CORS", "REDIRECT"]
}

resource "okta_auth_server" "kotter" {
  audiences   = [local.audience]
  description = "kotter auth server"
  name        = "kotter"
}

resource "okta_auth_server_scope" "products_read" {
  description    = "products:read"
  name           = "products:read"
  auth_server_id = okta_auth_server.kotter.id

}

resource "okta_auth_server_scope" "products_update" {
  description    = "products:update"
  name           = "products:update"
  auth_server_id = okta_auth_server.kotter.id
  depends_on  = [okta_auth_server_scope.products_read]
}

resource "okta_auth_server_scope" "orders_create" {
  description    = "orders:create"
  name           = "orders:create"
  auth_server_id = okta_auth_server.kotter.id
  depends_on  = [okta_auth_server_scope.products_update]
}

resource "okta_auth_server_scope" "orders_read" {
  description    = "orders:read"
  name           = "orders:read"
  auth_server_id = okta_auth_server.kotter.id
  depends_on  = [okta_auth_server_scope.orders_create]
}

resource "okta_auth_server_scope" "orders_update" {
  description    = "orders:update"
  name           = "orders:update"
  auth_server_id = okta_auth_server.kotter.id
  depends_on  = [okta_auth_server_scope.orders_read]
}

resource "okta_auth_server_scope" "orders_read_user" {
  description    = "orders:read:user"
  name           = "orders:read:user"
  auth_server_id = okta_auth_server.kotter.id
  consent        = "REQUIRED"
  depends_on  = [okta_auth_server_scope.orders_update]
}

resource "okta_auth_server_claim" "feature_access" {
  name              = "feature_access"
  status            = "ACTIVE"
  claim_type        = "RESOURCE"
  value_type        = "EXPRESSION"
  value             = "appuser.app_features"
  auth_server_id    = okta_auth_server.kotter.id
}

resource "okta_auth_server_claim" "app_permissions" {
  name              = "app_permissions"
  status            = "ACTIVE"
  claim_type        = "RESOURCE"
  value_type        = "EXPRESSION"
  value             = "appuser.app_permissions"
  auth_server_id    = okta_auth_server.kotter.id
}

resource "okta_auth_server_claim" "groups" {
  name              = "groups"
  status            = "ACTIVE"
  claim_type        = "IDENTITY"
  value_type        = "GROUPS"
  group_filter_type = "REGEX"
  value             = ".*"
  auth_server_id    = okta_auth_server.kotter.id
}

resource "okta_auth_server_policy" "default" {
  status           = "ACTIVE"
  name             = "Default"
  description      = "Default"
  priority         = 1
  client_whitelist = ["ALL_CLIENTS"]
  auth_server_id   = okta_auth_server.kotter.id
}
resource "okta_auth_server_policy_rule" "default" {
  auth_server_id       = okta_auth_server.kotter.id
  policy_id            = okta_auth_server_policy.default.id
  status               = "ACTIVE"
  name                 = "Default"
  priority             = 2
  group_whitelist      = ["EVERYONE"]
  grant_type_whitelist = ["authorization_code", "implicit"]
  scope_whitelist      = ["orders:create", "products:read", "openid", "profile", "email"]
  depends_on  = [
    okta_auth_server_scope.products_read,
    okta_auth_server_scope.orders_create
  ]
}
resource "okta_auth_server_policy_rule" "admin" {
  auth_server_id       = okta_auth_server.kotter.id
  policy_id            = okta_auth_server_policy.default.id
  status               = "ACTIVE"
  name                 = "Admin"
  priority             = 1
  group_whitelist      = ["${okta_group.admin.id}"]  # []
  grant_type_whitelist = ["authorization_code", "implicit"]
  scope_whitelist      = ["orders:create", "products:read", "openid", "profile", "email", "orders:read", "orders:update", "products:update"]
  depends_on  = [
    okta_auth_server_scope.products_read,
    okta_auth_server_scope.products_update,
    okta_auth_server_scope.orders_create,
    okta_auth_server_scope.orders_read,
    okta_auth_server_scope.orders_update
  ]
}

resource "okta_auth_server_policy" "client_credentials_admin" {
  status           = "ACTIVE"
  name             = "Admin Client Credentials"
  description      = "Admin Client Credentials"
  priority         = 2
  client_whitelist = [okta_app_oauth.kotter_client_credentials.id]
  auth_server_id   = okta_auth_server.kotter.id
}
resource "okta_auth_server_policy_rule" "client_credentials_admin" {
  auth_server_id       = okta_auth_server.kotter.id
  policy_id            = okta_auth_server_policy.client_credentials_admin.id
  status               = "ACTIVE"
  name                 = "Default"
  priority             = 1
  group_whitelist      = ["EVERYONE"]
  grant_type_whitelist = ["client_credentials"]
  scope_whitelist      = ["products:read", "orders:create", "orders:read", "orders:update", "products:update"]
  depends_on  = [
    okta_auth_server_scope.products_read,
    okta_auth_server_scope.products_update,
    okta_auth_server_scope.orders_create,
    okta_auth_server_scope.orders_read,
    okta_auth_server_scope.orders_update
  ]
}

resource "okta_auth_server_policy" "client_credentials_developer" {
  status           = "ACTIVE"
  name             = "Developer Client Credentials"
  description      = "Developer Client Credentials"
  priority         = 3
  client_whitelist = []
  auth_server_id   = okta_auth_server.kotter.id
}
resource "okta_auth_server_policy_rule" "client_credentials_developer" {
  auth_server_id       = okta_auth_server.kotter.id
  policy_id            = okta_auth_server_policy.client_credentials_developer.id
  status               = "ACTIVE"
  name                 = "Default"
  priority             = 1
  group_whitelist      = ["EVERYONE"]
  grant_type_whitelist = ["client_credentials"]
  scope_whitelist      = ["products:read"]
  depends_on  = [
    okta_auth_server_scope.products_read
  ]
}

resource "okta_auth_server_policy" "pkce_developer" {
  status           = "ACTIVE"
  name             = "Developer PKCE Clients"
  description      = "Developer PKCE Clients"
  priority         = 4
  client_whitelist = []
  auth_server_id   = okta_auth_server.kotter.id
}
resource "okta_auth_server_policy_rule" "pkce_developer" {
  auth_server_id       = okta_auth_server.kotter.id
  policy_id            = okta_auth_server_policy.pkce_developer.id
  status               = "ACTIVE"
  name                 = "Default"
  priority             = 1
  group_whitelist      = ["EVERYONE"]
  grant_type_whitelist = ["authorization_code", "implicit"]
  scope_whitelist      = ["orders:read:user"]
  depends_on  = [
    okta_auth_server_scope.orders_read_user
  ]
}

# resource "okta_event_hook" "hook" {
#   name    = "Kotter Event Hook"
#   events  = [
#     "application.user_membership.add",
#     "user.session.start",
#     "user.session.end",
#     "user.lifecycle.create",
#     "user.lifecycle.delete.initiated"
#   ]
#   channel = {
#     type    = "HTTP"
#     version = "1.0.0"
#     uri     = "https://tunnel.textmethod.cc/api/events" #"${local.base_url}/api/events"
#   }
# }

# resource "null_resource" "env_file" {
#     count = var.udp_subdomain == "local_kotter" ? 1 : 0
# }

# data "template_file" "configuration" {
#   template = "${file("${path.module}/.env.example")}"
#   vars = {
#     okta_base_url     = "https://${var.org_name}.${var.base_url}"
#     okta_api_key      = var.api_token
#     client_id         = okta_app_oauth.kotter.client_id
#     client_secret     = okta_app_oauth.kotter.client_secret
#     issuer            = okta_auth_server.kotter.issuer
#     audience          = local.audience
#     admin_client_id   = okta_app_oauth.kotter_client_credentials.client_id
#     admin_client_secret = okta_app_oauth.kotter_client_credentials.client_secret
#     developer_client_credentials_policy_id = okta_auth_server_policy.client_credentials_developer.id
#     portfolio_client_group_id = okta_auth_server_policy.pkce_developer.id
#     developer_pkce_policy_id = okta_auth_server_policy.pkce_developer.id
#     # event_hook_id     = okta_event_hook.hook.id
#   }
# }

# resource "local_file" "env" {
#   count = var.udp_subdomain == "local_kotter" ? 1 : 0
#   content  = data.template_file.configuration.rendered
#   filename = "${path.module}/.env.terraformed"
# }

output "client_id" {
  value = "${okta_app_oauth.kotter.client_id}"
}
output "client_secret" {
  value = "${okta_app_oauth.kotter.client_secret}"
}
output "domain" {
  value = "${var.org_name}.${var.base_url}"
}
output "auth_server_id" {
  value = "${okta_auth_server.kotter.id}"
}
output "issuer" {
  value = "${okta_auth_server.kotter.issuer}"
}
output "okta_app_oauth_id" {
  value = "${okta_app_oauth.kotter.id}"
}
# output "ff_event_hook_id" {
#   value = "${okta_event_hook.hook.id}"
# }
output "ff_developer_cc_policy_id" {
  value = "${okta_auth_server_policy.client_credentials_developer.id}"
}
output "ff_developer_pkce_policy_id" {
  value = "${okta_auth_server_policy.pkce_developer.id}"
}
output "ff_portfolio_client_group" {
  value = "${data.okta_group.all.id}"
}