Service creation fails with 400 when federation_registration_endpoint is unset (authlete_version 3.0)

[naga-lep]

Summary

Creating an authlete_service against Authlete 3.0 (authlete_version = "3.0") always fails with Error: 400 Bad Request unless federation_registration_endpoint is explicitly set to a non-empty value.

Root cause: in dataToService, the provider sets federation_registration_endpoint unconditionally, so when the attribute is unset it sends "" (empty string). The Authlete API rejects an empty string as an invalid URI and returns 400. Sibling endpoint fields (authorization_endpoint, token_endpoint, …) are guarded by NotZeroString, but this one is not.

Environment

• Provider: authlete/authlete v1.3.17
• authlete_version = "3.0" (uses openapi-for-go/v3 v3.0.0-alpha2 + idp-api)
• Backend: Authlete Shared Cloud (JP cluster, https://jp.authlete.com + https://login.authlete.com)

Steps to reproduce

Minimal config (no federation_registration_endpoint):

resource "authlete_service" "repro" {
  service_name             = "repro"
  issuer                   = "https://repro.example.com/"
  supported_grant_types    = ["AUTHORIZATION_CODE", "REFRESH_TOKEN"]
  supported_response_types = ["CODE"]
}

terraform apply →

Error: 400 Bad Request
  with authlete_service.repro,
  on main.tf line 1, in resource "authlete_service" "repro":
   1: resource "authlete_service" "repro" {

The provider surfaces only 400 Bad Request with no response body, which makes this very hard to diagnose.

Evidence that the empty string is the cause

• Posting the same service to the IdP create endpoint directly via curl (POST https://login.authlete.com/api/service, body {apiServerId, organizationId, service:{serviceName, issuer, supportedGrantTypes, supportedResponseTypes}}) without federationRegistrationEndpoint returns 200 and creates the service.
• Capturing the exact JSON the provider sends (by pointing AUTHLETE_IDP_SERVER at a local mock HTTP server) shows "federationRegistrationEndpoint": "" in the request body — the only empty-string field.
• Adding federation_registration_endpoint = "https://.../federation/register" to the HCL makes apply succeed.

Root cause (code)

internal/provider/serviceUtils.go, in dataToService:

// line ~459 — unconditional, unlike the sibling endpoint fields
newServiceDto.SetFederationRegistrationEndpoint(data.Get("federation_registration_endpoint").(string))

Compare with the guarded siblings a few lines above:

if NotZeroString(data, "authorization_endpoint") {
    newServiceDto.SetAuthorizationEndpoint(data.Get("authorization_endpoint").(string))
}
if NotZeroString(data, "token_endpoint") {
    newServiceDto.SetTokenEndpoint(data.Get("token_endpoint").(string))
}

Proposed fix

Guard the set with NotZeroString, consistent with the other endpoint fields:

if NotZeroString(data, "federation_registration_endpoint") {
    newServiceDto.SetFederationRegistrationEndpoint(data.Get("federation_registration_endpoint").(string))
}

Workaround (until fixed)

Set a valid URL in HCL even when federation is not used:

federation_registration_endpoint = "https://<issuer-host>/federation/register"

Additional note

It would help a lot if the provider surfaced the API response body (e.g. Authlete's resultCode / resultMessage) in the returned error instead of only 400 Bad Request — that alone would have made this trivial to diagnose.