1Password/terraform-provider-onepassword

🔒 Security

• Update `google.golang.org/grpc` to v1.79.3 to address an authorization bypass reported by Dependabot. {#346}
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.3.0...v3.3.1

✨ Features

• Provider adds `onepassword_environment` datasource for reading environment variables from 1Password Environments (service account or desktop app auth only). {#302}

🐛 Fixes

• Provider removes fallback to listing vaults when `GetOverview` fails; this workaround is no longer needed with the stable SDK. {#339}
• Replace slash-command-dispatch fork with upstream v5 in the ok-to-test workflow. {#338}
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.2.1...v3.3.0

🐛 Fixes

• `onepassword-sdk-go` dependecy is updated to the latest stable v0.4.0. {#333}
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.2.0...v3.2.1

✨ Features

• Provider supports ephemeral `onepassword_item` for retrieving item values without persisting them in state. {#212}

✨ New Contributors

• @BlackHoleFox made their first contribution in https://github.com/1Password/terraform-provider-onepassword/pull/328
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.1.2...v3.2.0

🐛 Fixes

• Provider now falls back to listing vaults when `GetOverview` fails with "enum Invocation" error for SDK. {#310}
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.1.1...v3.1.2

🐛 Fixes

• Provider properly handles dynamic sections. {#319}
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.1.0...v3.1.1

✨ Features

• Provider supports `section_map` and `field_map` attributes for organizing sections and fields in items. {#316}
• Provider supports `filename` and `valid_from` attributes to item data source for API Credential items. {#210}
• Provider supports `note_value_wo` attribute to item resource for write-only secure note values. {#304}

🐛 Fixes

• Provider validates that `password_recipe` and `value` cannot be used together in the same field. {#314}
• `MONTH_YEAR` field type now enforces YYYYMM format to avoid state inconsistencies. {#311}

✨ New Contributors

• @speto made their first contribution in https://github.com/1Password/terraform-provider-onepassword/pull/210
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.0.2...v3.1.0

🐛 Fixes

• Docs are updated to not mention specific provider version. {#297}
• `purpose` property is removed from the section field. {#251}
• Item data source correctly fetches the item with provided vault name when using service account or account to authenticate. {#306}
• Provider automatically retries Create/Update/Delete operations when vault version conflicts occur. {#222}

✨ Features

• Add new resource item field `password_wo` {#229}

✨ New Contributors

• @tbarthel-fr made their first contribution in https://github.com/1Password/terraform-provider-onepassword/pull/229
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.0.1...v3.0.2

🐛 Fixes

• Provider produces consistent results after apply. {#223, #170}
• Database item doesn't throw an error anymore. {#215}
• Provider doesn't throw an error for sensitive attibutes. {#185}
• SSH private keys in OpenSSH format are properly handled. {#286}
• Provider reads API credential items correctly. {#287}
• Provider properly handles string values in sections. {#214}
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v3.0.0...v3.0.1

💥 🔴 Breaking Changes

• Remove `letters` option from password recipes. Letters are now always included in generated passwords and cannot be disabled. Configurations using `letters` in `password_recipe` will result in an error. {#256}
• The `account` field should now be set to the account name. Account name appears at the top of the left sidebar in the 1Password desktop app.
• Users who use biometric authentication should configure 1Password desktop app. {#270}

✨ Features

• Enable provider to run using Terraform Stacks on HCP Terraform with a self-hosted agent. {#227}
• Enable provider to run on Terraform Cloud. {#141}
• `connect_url` and `connect_token` configuration parameters are available now. These are more specific alternatives to `url` and `token` for Connect authentication. The original `url` and `token` parameters continue to be supported but are set for deprecation. {#265}

🐛 Fixes

• `1password cli` is not required anymore to use the provider. {#148, #206}
• Biometric unlock doesn't pop up multiple times anymore. {#140, #130}
• Provider re-creates item when it's missing in 1Password vault. {#97}
• No 504 Gateway Timeout errors anymore for newly created items. {#5}
• Fix field reference from `label` to `id` for item data source. {#213}
• `password_recipe` properly generates passwords now. {#129}
• Testing documentation now includes make commands and setup instructions about how to run e2e tests. {#269}
• README and documentation now to references to 1Password developer portal for more info. {#266}

🔒 Security

• Update `golang.org/x/crypto` from 0.39.0 to 0.45.0 to address security vulnerabilities. {#276}

🐛 Fixes

• Add testing documentation. {#242}
• Eventual consistency for Connect client. {#246}
• Fix eventual consultancy issue in Connect's item get implementation. {#244}
• Fix item creation with incorrect date when using Connect. {#247}
• Trimming trailing newline from `op read` command output. {#245}
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v2.2.0...v2.2.1

✨ Features

• Add `private_key_openssh` property to Item Data Source that returns SSH private key in OpenSSH format. {#189}

🔒 Security

• Address dependabot alerts and update Go version. {#226}

✨ New Contributors

• @JillRegan made their first contribution in https://github.com/1Password/terraform-provider-onepassword/pull/230 🎉
• @ZeroErrors made their first contribution in https://github.com/1Password/terraform-provider-onepassword/pull/216 🎉
• Full Changelog: https://github.com/1Password/terraform-provider-onepassword/compare/v2.1.2...v2.2.0

🐛 Fixes

• Export provider initialization function. {#196}

🐛 Fixes

• Update Go mod name. {#193}

🔒 Security

• Update dependencies with security vulnerabilities to patched versions. {#192}

✨ Features

• Add support for Document Item category in item data source. Credits to @sdahlbac for this contribution. {#171}
• Add support for getting file attachments of an item in item data source. Credits to @sdahlbac for this contribution. {#171}
• Add support for getting an API Credential item's credential value in item data source. Credits to @SMillerDev for this contribution. {#151}
• Add support for SSH Key Item category in item data source. Credits to @atammy-narmi for this contribution. {#158}

🐛 Fixes

• Set password to null if not set. {#173}
• Throw a better error message when item creation fails. {#174}
• Improve examples and documentation. {#174}

✨ Features

• Added support for `Secure Note` items. {#149}
• Added `note_value` attribute representing a 1Password Item's `notes` field. {#57}

🐛 Fixes

• The data handling is more robust, making it less prone to errors and inconsistencies. {#157,#146}
• CLI and Connect clients now have a more consistent behavior.
• Fields of type `OTP` are better handled when user provides a custom ID for them. Terraform will throw an error if the custom ID doesn't have the `TOTP_` prefix, which is required for this field type.
• The values that are generated will only show in the plan to be recomputed when the recipe is changed or the value is explicitly set.
• When fetching Database items from 1Password, the `server` field (previously known as `hostname`) will populate the Terraform `hostname` attribute. This ensures that the data from new Database items is mapped as expected. {#76}
• Vault description is now fetched when getting a vault from 1Password by name and the provider was configured to use the CLI client.
• Generated values (using a recipe) are now regenerated when the recipe is changed.
• Tag ordering mismatch between Terraform state and 1Password no longer causes a change if the tags are the same. The mismatch can be caused by 1Password storing the tags in alphabetical order. {#155}

🔒 Security

• Migration to Terraform Provider Framework addressed an issue in the terraform-plugin-sdk where it is possible that sensitive data pulled from 1Password items can be shown in plaintext when a user runs `terraform plan`. This only affects the sensitive data pulled from custom sections within 1Password items that aren’t marked as sensitive in the terraform plan. This also applies to third-party providers that don’t treat the data as sensitive. {#167}

🐛 Fixes

• Pass proper user agent info to the CLI. {#124}

🐛 Fixes

• Field of type 'DATE' updates item even if there were no changes. {#137}

🔒 Security

• Update dependencies with security vulnerabilities to patched versions. {#144}

✨ Features

• Using provider on Terraform Cloud. {#116}

🐛 Fixes

• Terraform cannot create items with the password we provide in the code. {#128}

🐛 Fixes

• Using provider on Terraform Cloud. {#116}

✨ Features

• Authenticate 1Password CLI with biometric unlock using user account. {#113}

🐛 Fixes

• Retry CLI request in case of 409 Conflict error. {#108}
• Update documentation. {#115}

🐛 Fixes:

• Update documentation to mention that the provider supports Service Accounts. {#106}

✨ Features

• Add Service Accounts support. Credits to @tim-oster for the contribution! {#79}
• Add debugging support. {#102}

🔒 Security

• Update dependencies with security vulnerabilities to patched versions. {#104, #112}

🐛 Fixes

• Fix item creation with sections. {#96}

✨ Features

• Updating to use version 1.5.2 of the Connect SDK.

🐛 Fixes

• Improved sanitization for use with Github action.
• Terraform provider no longer lowercases item label. {59}

🔒 Security

• Updated dependencies with security vulnerabilities to patched versions

🐛 Fixes

• Fix (T)OTP field type. {#54}

🐛 Fixes

• Setting the provider's `token` field through Terraform's built-in prompt no longer leads to an error about the `url` not beign set. {#46}
• The purpose of the `id` and `uuid` fields of the item and vault data-source is now correctly described in the docs. {#42}
• The `tags` field for the item data-source is now correctly identified as an output.

🐛 Fixes

• Improved error message reporting.

✨ Features

• This release includes a binary for `darwin/arm64`. {#35}

✨ Features

• Adds the `onepassword_vault` data source that can be used to look up a vault by its name or uuid. {#25}
• The `onepassword_item` data source can now be used by setting the `title` instead of the `uuid` field. {#25}
• The documentation now clearly mentions that the Connect Token can also be provided thorugh `$OP_CONNECT_TOKEN`.

🐛 Fixes

• The `id` and `uuid` fields of the `onepassword_item` resource are now correctly designated as outputs.