stackless_integrations/providers/workos/
auth.rs

1//! `workos/auth` integration.
2
3use std::collections::BTreeMap;
4
5use serde::Serialize;
6use stackless_stripe_projects::catalog::verify::CatalogService;
7use stackless_stripe_projects::provision::ProvisionContext;
8
9use super::FamilyResource;
10use crate::error::IntegrationError;
11use crate::hostable::{ConfigScope, Hostable, IntegrationHosting};
12
13pub const RESOURCE_KIND: &str = "integration-workos";
14
15#[derive(Debug, Serialize)]
16pub struct WorkOSAuthConfig {
17    #[serde(skip_serializing_if = "Option::is_none")]
18    pub environment: Option<String>,
19}
20
21impl CatalogService for WorkOSAuthConfig {
22    const REFERENCE: &'static str = "workos/auth";
23}
24
25#[derive(Debug)]
26pub struct WorkOSAuth;
27
28impl Hostable for WorkOSAuth {
29    const PROVIDER: &'static str = "workos";
30    const HOSTING: IntegrationHosting = IntegrationHosting::Managed;
31    const CONFIG_SCOPE: ConfigScope = ConfigScope::GlobalOnly;
32    const RESOURCE_KIND: &'static str = RESOURCE_KIND;
33    const OUTPUTS: &'static [&'static str] = &["api_key", "client_id"];
34}
35
36impl FamilyResource for WorkOSAuth {
37    type Config = WorkOSAuthConfig;
38    const PROVIDER_PREFIX: &'static str = "WORKOS";
39    // Provisional until pinned by `mise run discover workos/auth`.
40    const OUTPUT_FIELDS: &'static [(&'static str, &'static str, bool)] = &[
41        ("API_KEY", "api_key", true),
42        ("CLIENT_ID", "client_id", true),
43    ];
44
45    fn build_config(ctx: &ProvisionContext<'_>) -> Result<WorkOSAuthConfig, IntegrationError> {
46        let config = super::integration_config(ctx)?;
47        // Catalog default + paid_pricing free tier key on environment=sandbox.
48        let environment = super::interp_optional(ctx, &config, "environment")?
49            .or_else(|| Some("sandbox".to_owned()));
50        Ok(WorkOSAuthConfig { environment })
51    }
52}
53
54pub fn validate_config(
55    name: &str,
56    config: &BTreeMap<String, toml::Value>,
57) -> Result<(), IntegrationError> {
58    let _ = (name, config);
59    Ok(())
60}
61
62#[cfg(test)]
63mod tests {
64    use super::*;
65    use crate::ProviderOps;
66    use crate::resource::ResourcePayload;
67    use stackless_core::def::StackDef;
68    use stackless_stripe_projects::stripe::StripeProjects;
69    use stackless_stripe_projects::test_support;
70
71    #[test]
72    fn config_matches_catalog() {
73        const FIXTURE: &str = include_str!(concat!(
74            env!("CARGO_MANIFEST_DIR"),
75            "/../stackless-stripe-projects/tests/fixtures/catalog.json"
76        ));
77        let catalog = stackless_stripe_projects::Catalog::from_json_envelope(FIXTURE).unwrap();
78        let failures = stackless_stripe_projects::verify_service(
79            &catalog,
80            &WorkOSAuthConfig {
81                environment: Some("sandbox".into()),
82            },
83        );
84        assert!(
85            failures.is_empty(),
86            "workos/auth catalog gaps:\n{}",
87            failures.join("\n")
88        );
89    }
90
91    const CATALOG_ENVELOPE: &str = r##"{"ok":true,"command":"projects catalog","data":{"last_updated":"2026-07-11T00:00:00Z","services":[{"id":"prvsvc_auth","object":"v2.provisioning.provider_service_detail","provider_id":"prvdr_workos","provider_name":"WorkOS","service_id":"auth","categories":["database"],"kind":"deployable","scope":"project","availability":"available","development":false,"livemode":true,"pricing":{"type":"paid"},"configuration_schema":{"properties":{"environment":{"default":"sandbox","description":"Environment type. Sandbox environments are free for development and testing.","enum":["sandbox","production"],"type":"string"}},"required":[],"type":"object"}}]}}"##;
92
93    fn test_def() -> StackDef {
94        StackDef::parse(
95            r#"
96[stack]
97name = "atto"
98[stack.projects.stripe]
99project = "project_1"
100[integrations.res]
101provider = "workos"
102[services.api]
103source = { repo = "r", ref = "main" }
104env = { OUT = "${integrations.res.api_key}" }
105health = { path = "/health" }
106[services.api.local]
107run = "true"
108"#,
109        )
110        .unwrap()
111    }
112
113    #[tokio::test]
114    async fn provision_records_outputs() {
115        let runner = test_support::provision_script(
116            CATALOG_ENVELOPE,
117            serde_json::json!({"WORKOS_API_KEY": "val_api_key", "WORKOS_CLIENT_ID": "val_client_id"}),
118            0,
119        );
120        let dir = tempfile::tempdir().unwrap();
121        std::fs::write(
122            dir.path().join("stackless.toml"),
123            "[stack]\nname=\"atto\"\n",
124        )
125        .unwrap();
126        let stripe = StripeProjects::new(&runner, dir.path());
127
128        let resource = WorkOSAuth
129            .provision(
130                &stripe.as_dyn(),
131                &test_def(),
132                dir.path(),
133                "demo",
134                "res",
135                "local",
136                false,
137            )
138            .await
139            .unwrap();
140        assert_eq!(resource.resource_kind, "integration-workos");
141        let payload: ResourcePayload = serde_json::from_str(&resource.payload).unwrap();
142        assert_eq!(payload.outputs["api_key"], "val_api_key");
143    }
144}
stackless_integrations/providers/workos/auth.rs

stackless_integrations/providers/workos/
auth.rs
