feat: support auth0_organization_discovery_domains resource

Author: ewanharris

docs/resources/organization_discovery_domains.md

@@ -0,0 +1,67 @@
+---
+page_title: "Resource: auth0_organization_discovery_domains"
+description: |-
+  With this resource, you can manage discovery domains on an organization.
+---
+
+# Resource: auth0_organization_discovery_domains
+
+With this resource, you can manage discovery domains on an organization.
+
+## Example Usage
+
+```terraform
+resource "auth0_organization" "my_organization" {
+  name         = "my-organization"
+  display_name = "My Organization"
+}
+
+resource "auth0_organization_discovery_domains" "my_org_discovery_domains" {
+  organization_id = auth0_organization.my_organization.id
+
+  discovery_domains {
+    domain = "example.com"
+    status = "pending"
+  }
+
+  discovery_domains {
+    domain = "test.com"
+    status = "verified"
+  }
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `discovery_domains` (Set of Object) Discovery domains that are configured for the organization. (see [below for nested schema](#nestedatt--discovery_domains))
+- `organization_id` (String) ID of the organization on which to manage the discovery domains.
+
+### Read-Only
+
+- `id` (String) The ID of this resource.
+
+<a id="nestedatt--discovery_domains"></a>
+### Nested Schema for `discovery_domains`
+
+Required:
+
+- `domain` (String) The domain name for organization discovery.
+- `status` (String) Verification status. Must be either 'pending' or 'verified'.
+
+Read-Only:
+
+- `id` (String) The ID of the discovery domain.
+- `verification_host` (String) The full domain where the TXT record should be added.
+- `verification_txt` (String) TXT record value for domain verification.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Organization discovery domains can be imported using the organization ID.
+terraform import auth0_organization_discovery_domains.my_org_discovery_domains "org_XXXXXXXXXXXXXXXX"
+```

internal/auth0/organization/expand.go

@@ -90,3 +90,23 @@ func expandOrganizationDiscoveryDomain(data *schema.ResourceData) *management.Or
 		// Note: ID, VerificationTXT, and VerificationHost are read-only and should not be sent to the API.
 	}
 }
+
+func expandOrganizationDiscoveryDomainFromConfig(domainCfg cty.Value) *management.OrganizationDiscoveryDomain {
+	return &management.OrganizationDiscoveryDomain{
+		Domain: value.String(domainCfg.GetAttr("domain")),
+		Status: value.String(domainCfg.GetAttr("status")),
+		// Note: ID, VerificationTXT, and VerificationHost are read-only and should not be sent to the API.
+	}
+}
+
+func expandOrganizationDiscoveryDomains(cfg cty.Value) []*management.OrganizationDiscoveryDomain {
+	domains := make([]*management.OrganizationDiscoveryDomain, 0)
+
+	cfg.ForEachElement(func(_ cty.Value, domainCfg cty.Value) (stop bool) {
+		domains = append(domains, expandOrganizationDiscoveryDomainFromConfig(domainCfg))
+
+		return stop
+	})
+
+	return domains
+}

internal/auth0/organization/flatten.go

@@ -142,3 +142,22 @@ func flattenOrganizationDiscoveryDomain(data *schema.ResourceData, discoveryDoma
 
 	return result.ErrorOrNil()
 }
+
+func flattenOrganizationDiscoveryDomains(data *schema.ResourceData, domains []*management.OrganizationDiscoveryDomain) error {
+	if len(domains) == 0 {
+		return data.Set("discovery_domains", []interface{}{})
+	}
+
+	var enabledDomains []interface{}
+	for _, domain := range domains {
+		enabledDomains = append(enabledDomains, map[string]interface{}{
+			"id":                domain.GetID(),
+			"domain":            domain.GetDomain(),
+			"status":            domain.GetStatus(),
+			"verification_txt":  domain.GetVerificationTXT(),
+			"verification_host": domain.GetVerificationHost(),
+		})
+	}
+
+	return data.Set("discovery_domains", enabledDomains)
+}