Add typed keycloak_client_registration_policy_* resources (closes #715)

[xrl]

Summary

Adds one typed Terraform resource per built-in Keycloak Client Registration
Policy provider, replacing the need for users to manage these via a generic
keycloak_generic_component-style escape hatch. Closes #715.

Eight resources, one per built-in policy factory in
org.keycloak.services.clientregistration.policy.impl:

Resource	provider_id
keycloak_client_registration_policy_trusted_hosts	trusted-hosts
keycloak_client_registration_policy_max_clients	max-clients
keycloak_client_registration_policy_allowed_client_scopes	allowed-client-templates (legacy provider id; config keys use modern scopes naming)
keycloak_client_registration_policy_allowed_protocol_mappers	allowed-protocol-mappers
keycloak_client_registration_policy_web_origins	registration-web-origins
keycloak_client_registration_policy_consent_required	consent-required
keycloak_client_registration_policy_full_scope_disallowed	scope (resource named after the admin UI label)
keycloak_client_registration_policy_client_disabled	client-disabled

Design notes

• Typed resources, no config = map(string) escape hatch. Each resource
  exposes the policy's config keys as typed schema fields:
  trusted_hosts = ["127.0.0.1", "localhost"], not
  config = { "trusted-hosts" = jsonencode(["127.0.0.1", "localhost"]) }.
  Real plan diffs, schema validation at plan time, per-resource docs.
• Pattern follows keycloak_realm_keystore_* — one typed resource per
  Component subtype, sharing a small CRUD layer over the existing
  components endpoint plumbing in *KeycloakClient.
• Multivalued-string fields use TypeSet — Keycloak's components API
  does not preserve list order on round-trip, so TypeList would produce
  spurious diffs. Affects trusted_hosts, web_origins,
  allowed_client_scopes, allowed_protocol_mapper_types.
• One-line addition to keycloak/component.go: add a
  SubType string json:"subType,omitempty"field on the package-privatecomponentstruct. Required because Client Registration Policies use the ComponentsubType field (anonymous/authenticated); existing keystore / LDAP / IdP-mapper components don't, and omitempty` makes
  this a no-op for them.
• Three config-less policies share a small Configless() factory in
  provider/generic_client_registration_policy_helpers.go. They are
  byte-for-byte identical except for one provider_id constant; ~250 lines
  of mechanical copy-paste avoided.
• Importer guards against cross-resource imports. The shared
  importer parses {realmId}/{componentId} and asserts the imported
  component's providerId matches the resource type, so importing a
  trusted-hosts component into a max_clients resource fails with a
  clear error instead of silently corrupting state.

Test plan

18 acceptance tests, all passing against Keycloak 26.5.5 (~9s wall):

• _basic for each of the 8 resources (Create + ImportStateVerify
  round-trip, exercising TypeBool/TypeInt/TypeSet schemas)
• _update for each of the 8 resources (mutates every mutable field)
• _importMismatch — verifies the provider_id guard fires with
  a readable error
• _fullStack — declares all 8 resources in a single config (4
  anonymous + 4 authenticated) to confirm they coexist cleanly
• subType=authenticated is exercised by all 3 config-less basic
  tests + the fullstack test

KEYCLOAK_CLIENT_ID=terraform \
KEYCLOAK_CLIENT_SECRET=884e0f95-0f42-4a63-9b1f-94274655669e \
KEYCLOAK_CLIENT_TIMEOUT=120 \
KEYCLOAK_REALM=master \
KEYCLOAK_URL=http://localhost:8080 \
TF_ACC=1 CHECKPOINT_DISABLE=1 \
go test -v -timeout 10m -run 'TestAccKeycloakClientRegistrationPolic' \
  github.com/keycloak/terraform-provider-keycloak/provider

Out of scope

• A generic keycloak_client_registration_policy for custom SPI policies.
  Can be added separately; nothing in this PR forecloses it.
• A keycloak_generic_component resource.
• Documentation pages — happy to add them in a follow-up if maintainers
  prefer; let me know the preferred format/location.

[Copilot]

Pull request overview

Adds first-class Terraform resources for managing Keycloak Client Registration Policy components (typed schema per built-in provider), backed by a small shared CRUD/import layer over the existing /components endpoint plumbing.

Changes:

• Introduces typed resources for several built-in client registration policy providers (trusted hosts, max clients, allowed scopes, allowed protocol mappers, and three config-less policies).
• Adds shared schema/import/delete helpers (including an importer guard to prevent cross-resource imports).
• Extends the Keycloak component model to support subType and adds a Keycloak client API for CRUD on client registration policy components, with accompanying acceptance tests.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
provider/resource_keycloak_client_registration_policy_trusted_hosts.go	Implements the trusted-hosts client registration policy resource with typed config fields.
provider/resource_keycloak_client_registration_policy_trusted_hosts_test.go	Acceptance tests for trusted-hosts policy (basic/update/import mismatch).
provider/resource_keycloak_client_registration_policy_max_clients.go	Implements the max-clients policy resource with typed max_clients field.
provider/resource_keycloak_client_registration_policy_max_clients_test.go	Acceptance tests for max-clients policy (basic/update).
provider/resource_keycloak_client_registration_policy_helpers_test.go	Shared acceptance-test helpers for existence/destroy/import ID generation.
provider/resource_keycloak_client_registration_policy_full_scope_disallowed.go	Adds config-less wrapper resource for providerId scope.
provider/resource_keycloak_client_registration_policy_consent_required.go	Adds config-less wrapper resource for providerId consent-required.
provider/resource_keycloak_client_registration_policy_client_disabled.go	Adds config-less wrapper resource for providerId client-disabled.
provider/resource_keycloak_client_registration_policy_configless_test.go	Shared acceptance tests for the three config-less policy resources.
provider/resource_keycloak_client_registration_policy_allowed_protocol_mappers.go	Implements allowed-protocol-mappers policy resource with a typed set field.
provider/resource_keycloak_client_registration_policy_allowed_protocol_mappers_test.go	Acceptance tests for allowed-protocol-mappers policy (basic/update).
provider/resource_keycloak_client_registration_policy_allowed_client_scopes.go	Implements allowed-client-scopes policy resource (legacy providerId, modern config keys).
provider/resource_keycloak_client_registration_policy_allowed_client_scopes_test.go	Acceptance tests for allowed-client-scopes policy (basic/update).
provider/resource_keycloak_client_registration_policies_fullstack_test.go	Full-stack acceptance test asserting multiple policy resources can coexist.
provider/provider.go	Registers the new policy resources in the provider resource map.
provider/generic_client_registration_policy_helpers.go	Shared schema/importer/CRUD helpers for all client registration policy resources.
keycloak/component.go	Adds SubType to the internal component model for serialization.
keycloak/client_registration_policy.go	Adds Keycloak client model + CRUD methods for client registration policy components.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.