stackless_integrations/providers/workos/
auth.rs

1//! `workos/auth` integration.
2
3use std::collections::BTreeMap;
4
5use serde::Serialize;
6use stackless_stripe_projects::catalog::verify::CatalogService;
7use stackless_stripe_projects::provision::ProvisionContext;
8
9use super::FamilyResource;
10use crate::error::IntegrationError;
11use crate::hostable::{ConfigScope, Hostable, IntegrationHosting};
12
13pub const RESOURCE_KIND: &str = "integration-workos";
14
15#[derive(Debug, Serialize)]
16pub struct WorkOSAuthConfig {
17    #[serde(skip_serializing_if = "Option::is_none")]
18    pub environment: Option<String>,
19}
20
21impl CatalogService for WorkOSAuthConfig {
22    const REFERENCE: &'static str = "workos/auth";
23}
24
25#[derive(Debug)]
26pub struct WorkOSAuth;
27
28impl Hostable for WorkOSAuth {
29    const PROVIDER: &'static str = "workos";
30    const HOSTING: IntegrationHosting = IntegrationHosting::Managed;
31    const CONFIG_SCOPE: ConfigScope = ConfigScope::GlobalOnly;
32    const RESOURCE_KIND: &'static str = RESOURCE_KIND;
33    const OUTPUTS: &'static [&'static str] = &["api_key", "client_id"];
34}
35
36impl FamilyResource for WorkOSAuth {
37    type Config = WorkOSAuthConfig;
38    const PROVIDER_PREFIX: &'static str = "WORKOS";
39    const OUTPUT_FIELDS: &'static [(&'static str, &'static str, bool)] = &[
40        ("API_KEY", "api_key", true),
41        ("CLIENT_ID", "client_id", true),
42    ];
43
44    fn build_config(ctx: &ProvisionContext<'_>) -> Result<WorkOSAuthConfig, IntegrationError> {
45        let config = super::integration_config(ctx)?;
46        // Catalog default + paid_pricing free tier key on environment=sandbox.
47        let environment = super::interp_optional(ctx, &config, "environment")?
48            .or_else(|| Some("sandbox".to_owned()));
49        Ok(WorkOSAuthConfig { environment })
50    }
51}
52
53pub fn validate_config(
54    name: &str,
55    config: &BTreeMap<String, toml::Value>,
56) -> Result<(), IntegrationError> {
57    let _ = (name, config);
58    Ok(())
59}
60
61#[cfg(test)]
62mod tests {
63    use super::*;
64    use crate::ProviderOps;
65    use crate::resource::ResourcePayload;
66    use stackless_core::def::StackDef;
67    use stackless_stripe_projects::stripe::StripeProjects;
68    use stackless_stripe_projects::test_support;
69
70    #[test]
71    fn config_matches_catalog() {
72        const FIXTURE: &str = include_str!(concat!(
73            env!("CARGO_MANIFEST_DIR"),
74            "/../stackless-stripe-projects/tests/fixtures/catalog.json"
75        ));
76        let catalog = stackless_stripe_projects::Catalog::from_json_envelope(FIXTURE).unwrap();
77        let failures = stackless_stripe_projects::verify_service(
78            &catalog,
79            &WorkOSAuthConfig {
80                environment: Some("sandbox".into()),
81            },
82        );
83        assert!(
84            failures.is_empty(),
85            "workos/auth catalog gaps:\n{}",
86            failures.join("\n")
87        );
88    }
89
90    const CATALOG_ENVELOPE: &str = r##"{"ok":true,"command":"projects catalog","data":{"last_updated":"2026-07-11T00:00:00Z","services":[{"id":"prvsvc_auth","object":"v2.provisioning.provider_service_detail","provider_id":"prvdr_workos","provider_name":"WorkOS","service_id":"auth","categories":["database"],"kind":"deployable","scope":"project","availability":"available","development":false,"livemode":true,"pricing":{"type":"paid"},"configuration_schema":{"properties":{"environment":{"default":"sandbox","description":"Environment type. Sandbox environments are free for development and testing.","enum":["sandbox","production"],"type":"string"}},"required":[],"type":"object"}}]}}"##;
91
92    fn test_def() -> StackDef {
93        StackDef::parse(
94            r#"
95[stack]
96name = "atto"
97[stack.projects.stripe]
98project = "project_1"
99[integrations.res]
100provider = "workos"
101[services.api]
102source = { repo = "r", ref = "main" }
103env = { OUT = "${integrations.res.api_key}" }
104health = { path = "/health" }
105[services.api.local]
106run = "true"
107"#,
108        )
109        .unwrap()
110    }
111
112    #[tokio::test]
113    async fn provision_records_outputs() {
114        let runner = test_support::provision_script(
115            CATALOG_ENVELOPE,
116            serde_json::json!({"WORKOS_API_KEY": "val_api_key", "WORKOS_CLIENT_ID": "val_client_id"}),
117            0,
118        );
119        let dir = tempfile::tempdir().unwrap();
120        std::fs::write(
121            dir.path().join("stackless.toml"),
122            "[stack]\nname=\"atto\"\n",
123        )
124        .unwrap();
125        let stripe = StripeProjects::new(&runner, dir.path());
126
127        let resource = WorkOSAuth
128            .provision(
129                &stripe.as_dyn(),
130                &test_def(),
131                dir.path(),
132                "demo",
133                "res",
134                "local",
135                false,
136            )
137            .await
138            .unwrap();
139        assert_eq!(resource.resource_kind, "integration-workos");
140        let payload: ResourcePayload = serde_json::from_str(&resource.payload).unwrap();
141        assert_eq!(payload.outputs["api_key"], "val_api_key");
142    }
143}
stackless_integrations/providers/workos/auth.rs

stackless_integrations/providers/workos/
auth.rs
