Resource: Gmail Send As Aliases (#122)

* WIP

* Implement delete

* handle not found in sendAs read

* Finish implementation

* Fix implementation

* Add tests and examples

* Remove parallel for send as tests

* PR comments

* regen docs

docs/resources/gmail_send_as_alias.md

@@ -0,0 +1,80 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "googleworkspace_gmail_send_as_alias Resource - terraform-provider-googleworkspace"
+subcategory: ""
+description: |-
+  Gmail Send As Alias resource in the Terraform Googleworkspace provider. Please ensure the Gmail API is enabled for your workspace and that the user being configured has a Gmail license.
+---
+
+# googleworkspace_gmail_send_as_alias (Resource)
+
+Gmail Send As Alias resource in the Terraform Googleworkspace provider. Please ensure the Gmail API is enabled for your workspace and that the user being configured has a Gmail license.
+
+## Example Usage
+
+```terraform
+data "googleworkspace_user" "example" {
+  primary_email = "[email protected]"
+}
+
+resource "googleworkspace_user" "alias" {
+  primary_email = "[email protected]"
+  password      = "34819d7beeabb9260a5c854bc85b3e44"
+  hash_function = "MD5"
+
+  name {
+    family_name = "Scott"
+    given_name  = "Michael"
+  }
+}
+
+resource "googleworkspace_gmail_send_as_alias" "test" {
+  primary_email = data.googleworkspace_user.example.primary_email
+  send_as_email = googleworkspace_user.alias.primary_email
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- **primary_email** (String) User's primary email address.
+- **send_as_email** (String) The email address that appears in the 'From:' header for mail sent using this alias.
+
+### Optional
+
+- **display_name** (String) A name that appears in the 'From:' header for mail sent using this alias. For custom 'from' addresses, when this is empty, Gmail will populate the 'From:' header with the name that is used for the primary address associated with the account. If the admin has disabled the ability for users to update their name format, requests to update this field for the primary login will silently fail.
+- **is_default** (Boolean) Whether this address is selected as the default 'From:' address in situations such as composing a new message or sending a vacation auto-reply. Every Gmail account has exactly one default send-as address, so the only legal value that clients may write to this field is true. Changing this from false to true for an address will result in this field becoming false for the other previous default address. Toggling an existing alias' default to false is not possible, another alias must be added/imported and toggled to true to remove the default from an existing alias. To avoid drift with Terraform, please change the previous default's config to false AFTER a new default is applied and perform a refresh to synchronize with remote state.
+- **reply_to_address** (String) An optional email address that is included in a 'Reply-To:' header for mail sent using this alias. If this is empty, Gmail will not generate a 'Reply-To:' header.
+- **signature** (String) An optional HTML signature that is included in messages composed with this alias in the Gmail web UI. This signature is added to new emails only.
+- **smtp_msa** (Block List, Max: 1) An optional SMTP service that will be used as an outbound relay for mail sent using this alias. If this is empty, outbound mail will be sent directly from Gmail's servers to the destination SMTP service. This setting only applies to custom 'from' aliases. (see [below for nested schema](#nestedblock--smtp_msa))
+- **treat_as_alias** (Boolean) Whether Gmail should treat this address as an alias for the user's primary email address. This setting only applies to custom 'from' aliases. See https://support.google.com/a/answer/1710338 for help on making this decision Defaults to `true`.
+
+### Read-Only
+
+- **id** (String) The ID of this resource.
+- **is_primary** (Boolean) Whether this address is the primary address used to login to the account. Every Gmail account has exactly one primary address, and it cannot be deleted from the collection of send-as aliases.
+- **verification_status** (String) Indicates whether this address has been verified for use as a send-as alias.
+
+<a id="nestedblock--smtp_msa"></a>
+### Nested Schema for `smtp_msa`
+
+Required:
+
+- **host** (String) The hostname of the SMTP service.
+- **port** (Number) The port of the SMTP service.
+
+Optional:
+
+- **password** (String, Sensitive) The password that will be used for authentication with the SMTP service. This is a write-only field that can be specified in requests to create or update SendAs settings; it is never populated in responses.
+- **security_mode** (String) The protocol that will be used to secure communication with the SMTP service. Defaults to `securityModeUnspecified`.
+- **username** (String) The username that will be used for authentication with the SMTP service. This is a write-only field that can be specified in requests to create or update SendAs settings; it is never populated in responses.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+terraform import googleworkspace_gmail_send_as_alias.alias [email protected]:[email protected]
+```

examples/resources/googleworkspace_gmail_send_as_alias/import.sh

@@ -0,0 +1 @@
+terraform import googleworkspace_gmail_send_as_alias.alias [email protected]:[email protected]

examples/resources/googleworkspace_gmail_send_as_alias/resource.tf

@@ -0,0 +1,19 @@
+data "googleworkspace_user" "example" {
+  primary_email = "[email protected]"
+}
+
+resource "googleworkspace_user" "alias" {
+  primary_email = "[email protected]"
+  password      = "34819d7beeabb9260a5c854bc85b3e44"
+  hash_function = "MD5"
+
+  name {
+    family_name = "Scott"
+    given_name  = "Michael"
+  }
+}
+
+resource "googleworkspace_gmail_send_as_alias" "test" {
+  primary_email = data.googleworkspace_user.example.primary_email
+  send_as_email = googleworkspace_user.alias.primary_email
+}

internal/provider/data_source_privileges_test.go

@@ -20,7 +20,7 @@ func TestAccDataSourcePrivileges_basic(t *testing.T) {
 				Config: testAccDataSourcePrivileges(),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet("data.googleworkspace_privileges.test", "etag"),
-					resource.TestCheckResourceAttr("data.googleworkspace_privileges.test", "items.#", "104"),
+					resource.TestCheckResourceAttr("data.googleworkspace_privileges.test", "items.#", "107"),
 				),
 			},
 		},

internal/provider/provider.go

@@ -14,6 +14,8 @@ import (
 )
 
 var DefaultClientScopes = []string{
+	"https://www.googleapis.com/auth/gmail.settings.basic",
+	"https://www.googleapis.com/auth/gmail.settings.sharing",
 	"https://www.googleapis.com/auth/chrome.management.policy",
 	"https://www.googleapis.com/auth/cloud-platform",
 	"https://www.googleapis.com/auth/admin.directory.customer",
@@ -101,17 +103,18 @@ func New(version string) func() *schema.Provider {
 				"googleworkspace_user":                 dataSourceUser(),
 			},
 			ResourcesMap: map[string]*schema.Resource{
-				"googleworkspace_chrome_policy":   resourceChromePolicy(),
-				"googleworkspace_domain":          resourceDomain(),
-				"googleworkspace_domain_alias":    resourceDomainAlias(),
-				"googleworkspace_group":           resourceGroup(),
-				"googleworkspace_group_member":    resourceGroupMember(),
-				"googleworkspace_group_settings":  resourceGroupSettings(),
-				"googleworkspace_org_unit":        resourceOrgUnit(),
-				"googleworkspace_role":            resourceRole(),
-				"googleworkspace_role_assignment": resourceRoleAssignment(),
-				"googleworkspace_schema":          resourceSchema(),
-				"googleworkspace_user":            resourceUser(),
+				"googleworkspace_chrome_policy":       resourceChromePolicy(),
+				"googleworkspace_domain":              resourceDomain(),
+				"googleworkspace_domain_alias":        resourceDomainAlias(),
+				"googleworkspace_gmail_send_as_alias": resourceGmailSendAsAlias(),
+				"googleworkspace_group":               resourceGroup(),
+				"googleworkspace_group_member":        resourceGroupMember(),
+				"googleworkspace_group_settings":      resourceGroupSettings(),
+				"googleworkspace_org_unit":            resourceOrgUnit(),
+				"googleworkspace_role":                resourceRole(),
+				"googleworkspace_role_assignment":     resourceRoleAssignment(),
+				"googleworkspace_schema":              resourceSchema(),
+				"googleworkspace_user":                resourceUser(),
 			},
 		}
 

internal/provider/provider_config.go

@@ -12,6 +12,7 @@ import (
 	"golang.org/x/oauth2"
 	googleoauth "golang.org/x/oauth2/google"
 	"google.golang.org/api/chromepolicy/v1"
+	"google.golang.org/api/gmail/v1"
 	"google.golang.org/api/option"
 
 	directory "google.golang.org/api/admin/directory/v1"
@@ -108,6 +109,42 @@ func (c *apiClient) NewDirectoryService() (*directory.Service, diag.Diagnostics)
 
 	return directoryService, diags
 }
+func (c *apiClient) NewGmailService(ctx context.Context, userId string) (*gmail.Service, diag.Diagnostics) {
+	var diags diag.Diagnostics
+
+	log.Printf("[INFO] Instantiating Google Admin Gmail service")
+
+	// the send-as-alias resource requires the oauth token impersonate the user
+	// the alias is being created for.
+	log.Printf("[INFO] Creating Google Admin Gmail client that impersonates %q", userId)
+	newClient := &apiClient{
+		Credentials:           c.Credentials,
+		ClientScopes:          c.ClientScopes,
+		Customer:              c.Customer,
+		UserAgent:             c.UserAgent,
+		ImpersonatedUserEmail: userId,
+	}
+	diags = newClient.loadAndValidate(ctx)
+	if diags.HasError() {
+		return nil, diags
+	}
+
+	gmailService, err := gmail.NewService(ctx, option.WithHTTPClient(newClient.client))
+	if err != nil {
+		return nil, diag.FromErr(err)
+	}
+
+	if gmailService == nil {
+		diags = append(diags, diag.Diagnostic{
+			Severity: diag.Error,
+			Summary:  "Gmail Service could not be created.",
+		})
+
+		return nil, diags
+	}
+
+	return gmailService, diags
+}
 
 func (c *apiClient) NewGroupsSettingsService() (*groupssettings.Service, diag.Diagnostics) {
 	var diags diag.Diagnostics