Skip to content

Commit 4fd49dd

Browse files
Add user endpoints, model updates, tests, and example
1 parent be0394f commit 4fd49dd

5 files changed

Lines changed: 287 additions & 11 deletions

File tree

examples/user.py

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
"""Example usage of the Users API.
2+
3+
This example demonstrates how to read a user by ID using the Python TFE SDK.
4+
"""
5+
6+
import os
7+
import sys
8+
9+
# Add the src directory to the Python path so we can import the local package.
10+
sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "src"))
11+
12+
from pytfe import TFEClient, TFEConfig
13+
14+
15+
def main() -> None:
16+
"""Read and print user details from Terraform Cloud."""
17+
user_id = os.getenv("TFE_USER_ID")
18+
19+
try:
20+
client = TFEClient(TFEConfig.from_env())
21+
22+
current_user = client.users.read_current()
23+
print("=== Current Terraform Cloud User ===")
24+
print(f"User ID: {current_user.id}")
25+
print(f"Username: {current_user.username}")
26+
print(f"Email: {current_user.email or 'N/A'}")
27+
print(f"Auth Method: {current_user.auth_method or 'N/A'}")
28+
29+
if not user_id:
30+
print("\nTFE_USER_ID not set. Skipping client.users.read(user_id).")
31+
return
32+
33+
user = client.users.read(user_id)
34+
35+
print("\n=== Terraform Cloud User By ID ===")
36+
print(f"User ID: {user.id}")
37+
print(f"Username: {user.username}")
38+
print(f"Email: {user.email or 'N/A'}")
39+
print(f"Auth Method: {user.auth_method or 'N/A'}")
40+
except Exception as e:
41+
print(f"Error running user example: {e}")
42+
43+
44+
if __name__ == "__main__":
45+
main()

src/pytfe/client.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
from .resources.ssh_keys import SSHKeys
3737
from .resources.state_version_outputs import StateVersionOutputs
3838
from .resources.state_versions import StateVersions
39+
from .resources.user import Users
3940
from .resources.variable import Variables
4041
from .resources.variable_sets import VariableSets, VariableSetVariables
4142
from .resources.workspace_resources import WorkspaceResourcesService
@@ -73,6 +74,7 @@ def __init__(self, config: TFEConfig | None = None):
7374
self.plans = Plans(self._transport)
7475
self.organizations = Organizations(self._transport)
7576
self.organization_memberships = OrganizationMemberships(self._transport)
77+
self.users = Users(self._transport)
7678
self.organization_tokens = OrganizationTokens(self._transport)
7779
self.projects = Projects(self._transport)
7880
self.variables = Variables(self._transport)

src/pytfe/models/user.py

Lines changed: 34 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,49 @@
11
# Copyright IBM Corp. 2025, 2026
22
# SPDX-License-Identifier: MPL-2.0
3+
from pydantic import BaseModel, ConfigDict, Field
34

4-
from __future__ import annotations
5+
class TwoFactor(BaseModel):
6+
model_config = ConfigDict(populate_by_name=True, validate_by_name=True)
7+
enabled: bool = Field(default=False, alias="enabled")
8+
verified: bool = Field(default=False, alias="verified")
59

6-
from pydantic import BaseModel, ConfigDict, Field
10+
11+
class UserPermissions(BaseModel):
12+
model_config = ConfigDict(populate_by_name=True, validate_by_name=True)
13+
14+
can_create_organizations: bool = Field(
15+
default=False, alias="can-create-organizations"
16+
)
17+
can_change_email: bool = Field(default=False, alias="can-change-email")
18+
can_change_username: bool = Field(default=False, alias="can-change-username")
19+
can_manage_user_tokens: bool = Field(default=False, alias="can-manage-user-tokens")
20+
can_view_2fa_settings: bool = Field(default=False, alias="can-view2fa-settings")
21+
can_manage_hcp_account: bool = Field(default=False, alias="can-manage-hcp-account")
722

823

924
class User(BaseModel):
1025
model_config = ConfigDict(populate_by_name=True, validate_by_name=True)
1126

1227
id: str = Field(..., alias="id")
13-
avatar_url: str = Field(default="", alias="avatar-url")
14-
email: str = Field(default="", alias="email")
28+
auth_method: str | None = Field(default=None, alias="auth-method")
29+
avatar_url: str | None = Field(default=None, alias="avatar-url")
30+
email: str | None = Field(default=None, alias="email")
1531
is_service_account: bool = Field(default=False, alias="is-service-account")
16-
two_factor: dict = Field(default_factory=dict, alias="two-factor")
17-
unconfirmed_email: str = Field(default="", alias="unconfirmed-email")
32+
two_factor: TwoFactor | None = Field(default=None, alias="two-factor")
33+
unconfirmed_email: str | None = Field(default=None, alias="unconfirmed-email")
1834
username: str = Field(default="", alias="username")
1935
v2_only: bool = Field(default=False, alias="v2-only")
20-
is_site_admin: bool = Field(default=False, alias="is-site-admin") # Deprecated
21-
is_admin: bool = Field(default=False, alias="is-admin")
22-
is_sso_login: bool = Field(default=False, alias="is-sso-login")
23-
permissions: dict = Field(default_factory=dict, alias="permissions")
24-
36+
is_site_admin: bool | None = Field(
37+
default=None, alias="is-site-admin"
38+
) # Deprecated
39+
is_admin: bool | None = Field(default=None, alias="is-admin")
40+
is_sso_login: bool | None = Field(default=None, alias="is-sso-login")
41+
permissions: UserPermissions | None = Field(default=None, alias="permissions")
2542
# Relations
2643
# authentication_tokens: AuthenticationTokens = Field(..., alias="authentication-tokens")
44+
45+
class UserUpdateCurrentOptions(BaseModel):
46+
model_config = ConfigDict(populate_by_name=True, validate_by_name=True)
47+
48+
username: str | None = Field(default=None, alias="username")
49+
email: str | None = Field(default=None, alias="email")

src/pytfe/resources/user.py

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
from __future__ import annotations
2+
3+
from ..models.user import User, UserUpdateCurrentOptions
4+
from ..utils import valid_string_id
5+
from ._base import _Service
6+
7+
8+
class Users(_Service):
9+
def read(self, user_id: str) -> User:
10+
if not valid_string_id(user_id):
11+
raise ValueError("invalid user id")
12+
13+
r = self.t.request("GET", f"/api/v2/users/{user_id}")
14+
d = r.json()["data"]
15+
attr = d.get("attributes", {}) or {}
16+
user_data = dict(attr)
17+
user_data["id"] = d.get("id")
18+
return User(**user_data)
19+
20+
def read_current(self) -> User:
21+
r = self.t.request("GET", "/api/v2/account/details")
22+
d = r.json()["data"]
23+
attr = d.get("attributes", {}) or {}
24+
user_data = dict(attr)
25+
user_data["id"] = d.get("id")
26+
return User(**user_data)
27+
28+
def update_current(self, options: UserUpdateCurrentOptions) -> User:
29+
body = {
30+
"data": {
31+
"type": "users",
32+
"attributes": options.model_dump(exclude_none=True),
33+
}
34+
}
35+
r = self.t.request("PATCH", "/api/v2/account/update", json_body=body)
36+
d = r.json()["data"]
37+
attr = d.get("attributes", {}) or {}
38+
user_data = dict(attr)
39+
user_data["id"] = d.get("id")
40+
return User(**user_data)

tests/units/test_user.py

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
"""Unit tests for the Users resource."""
2+
3+
import copy
4+
from unittest.mock import Mock
5+
6+
import pytest
7+
from pytfe.models.user import User, UserPermissions, UserUpdateCurrentOptions
8+
from pytfe.resources.user import Users
9+
10+
11+
class TestUsers:
12+
"""Test suite for user resource operations."""
13+
14+
@pytest.fixture
15+
def mock_transport(self):
16+
"""Mock HTTP transport."""
17+
return Mock()
18+
19+
@pytest.fixture
20+
def users_service(self, mock_transport):
21+
"""Create users service with mocked transport."""
22+
return Users(mock_transport)
23+
24+
@pytest.fixture
25+
def sample_user_response(self):
26+
"""Sample JSON:API response for a user."""
27+
return {
28+
"data": {
29+
"id": "user-MA4GL63FmYRpSFxa",
30+
"type": "users",
31+
"attributes": {
32+
"username": "admin",
33+
"email": "admin@example.com",
34+
"is-service-account": False,
35+
"auth-method": "hcp_sso",
36+
"avatar-url": "https://example.com/avatar.png",
37+
"v2-only": True,
38+
"permissions": {
39+
"can-create-organizations": False,
40+
"can-change-email": True,
41+
"can-change-username": True,
42+
},
43+
},
44+
}
45+
}
46+
47+
def test_read_user(self, users_service, mock_transport, sample_user_response):
48+
"""Test reading a specific user by ID."""
49+
mock_transport.request.return_value.json.return_value = sample_user_response
50+
51+
user_id = "user-MA4GL63FmYRpSFxa"
52+
user = users_service.read(user_id)
53+
54+
mock_transport.request.assert_called_once_with(
55+
"GET", f"/api/v2/users/{user_id}"
56+
)
57+
assert isinstance(user, User)
58+
assert user.id == user_id
59+
assert user.username == "admin"
60+
assert user.email == "admin@example.com"
61+
assert user.is_service_account is False
62+
assert user.auth_method == "hcp_sso"
63+
assert user.avatar_url == "https://example.com/avatar.png"
64+
assert user.v2_only is True
65+
assert isinstance(user.permissions, UserPermissions)
66+
assert user.permissions is not None
67+
assert user.permissions.can_create_organizations is False
68+
assert user.permissions.can_change_email is True
69+
assert user.permissions.can_change_username is True
70+
assert user.permissions.can_manage_user_tokens is False
71+
assert user.permissions.can_view_2fa_settings is False
72+
assert user.permissions.can_manage_hcp_account is False
73+
74+
def test_read_user_invalid_id(self, users_service):
75+
"""Test reading a user with an invalid user ID."""
76+
with pytest.raises(ValueError, match="invalid user id"):
77+
users_service.read("")
78+
79+
def test_read_user_with_null_unconfirmed_email(
80+
self, users_service, mock_transport, sample_user_response
81+
):
82+
"""Test reading a user when unconfirmed-email is null."""
83+
sample_user_response["data"]["attributes"]["unconfirmed-email"] = None
84+
mock_transport.request.return_value.json.return_value = sample_user_response
85+
86+
user = users_service.read("user-MA4GL63FmYRpSFxa")
87+
88+
assert isinstance(user, User)
89+
assert user.unconfirmed_email is None
90+
91+
def test_read_user_two_factor_parsing(
92+
self, users_service, mock_transport, sample_user_response
93+
):
94+
"""Test reading a user with two-factor data."""
95+
modified_response = copy.deepcopy(sample_user_response)
96+
modified_response["data"]["attributes"]["two-factor"] = {
97+
"enabled": True,
98+
"verified": False,
99+
}
100+
mock_transport.request.return_value.json.return_value = modified_response
101+
102+
user_id = "user-MA4GL63FmYRpSFxa"
103+
user = users_service.read(user_id)
104+
105+
assert user.two_factor is not None
106+
assert user.two_factor.enabled is True
107+
assert user.two_factor.verified is False
108+
109+
def test_read_user_nullable_bools(
110+
self, users_service, mock_transport, sample_user_response
111+
):
112+
"""Test reading a user when pointer-style boolean fields are null."""
113+
modified_response = copy.deepcopy(sample_user_response)
114+
modified_response["data"]["attributes"]["is-site-admin"] = None
115+
modified_response["data"]["attributes"]["is-admin"] = None
116+
modified_response["data"]["attributes"]["is-sso-login"] = None
117+
mock_transport.request.return_value.json.return_value = modified_response
118+
119+
user_id = "user-MA4GL63FmYRpSFxa"
120+
user = users_service.read(user_id)
121+
122+
assert user.is_site_admin is None
123+
assert user.is_admin is None
124+
assert user.is_sso_login is None
125+
126+
def test_read_current_user(
127+
self, users_service, mock_transport, sample_user_response
128+
):
129+
"""Test reading the currently authenticated user."""
130+
mock_transport.request.return_value.json.return_value = sample_user_response
131+
132+
user = users_service.read_current()
133+
134+
mock_transport.request.assert_called_once_with("GET", "/api/v2/account/details")
135+
assert isinstance(user, User)
136+
assert user.id == "user-MA4GL63FmYRpSFxa"
137+
assert user.username == "admin"
138+
assert user.email == "admin@example.com"
139+
140+
def test_update_current_user(
141+
self, users_service, mock_transport, sample_user_response
142+
):
143+
"""Test updating the currently authenticated user."""
144+
mock_transport.request.return_value.json.return_value = sample_user_response
145+
options = UserUpdateCurrentOptions(
146+
username="new-admin",
147+
email="new-admin@example.com",
148+
)
149+
150+
user = users_service.update_current(options)
151+
152+
mock_transport.request.assert_called_once_with(
153+
"PATCH",
154+
"/api/v2/account/update",
155+
json_body={
156+
"data": {
157+
"type": "users",
158+
"attributes": {
159+
"username": "new-admin",
160+
"email": "new-admin@example.com",
161+
},
162+
}
163+
},
164+
)
165+
assert isinstance(user, User)
166+
assert user.id == "user-MA4GL63FmYRpSFxa"

0 commit comments

Comments
 (0)