feat: add group_sync and role_sync for coderd_organization_resource

[aslilac]

Group and role sync settings can now be configured as such:

resource "coderd_organization" "example" {
	group_sync {
		field = "wibble"
		regex_filter = "wib{2,}le"
		auto_create_missing = true
		mapping = {
			wibble = ["6e57187f-6543-46ab-a62c-a10065dd4314"]
		}
	}

	role_sync {
		field = "wobble"
		mapping = {
			wobble = ["wobbly"]
		}
	}
}

[ethanndickson]

I don't recall if you can write to a config block (blocks can't be computed) like this. I suspect you can't.

If you can, I assume it would just be to error if the post-apply plan isn't empty.
For that you'd need to use types.ObjectValueFrom and provide it the type of the object using a map[string]attr.Type. I've got an example on the template resource & data source.

[aslilac]

I think I figured something out that works 😄

[ethanndickson]

few comments but otherwise nice, lgtm!

[ethanndickson]

I just realised we're missing enterprise/premium entitlement checks on this and the provisioner key resource. We have them on the workspace proxy and the enterprise features of template resources, but they run during apply, when they should really run during plan. Let's not worry about it for now, and at some point I'll see if I can get them working at plan-time using a plan modifier (validators don't have the provider config we need).

If that doesn't work we can just copy the ones at apply-time to these two new resources.

[ethanndickson]

This defaults to false on coder right? Should just have a default set in the schema, and then you can remove the null checks on it.

[aslilac]

would that prevent group_sync from being null tho?

[ethanndickson]

Nope, the default only gets computed if the parent is known, so:

    group_sync {}

would default any values within it, but omitting the block altogether would not.

If you wanted to default the block to known, and the bool to false, then you'd also add a Default to the block itself.