new resources for assigning permissions, creating resource instances (#55)

* feat: add role assignments, data sources, and import support

New resources:
- permitio_role_assignment: tenant-level role assignments
- permitio_resource_instance_role_assignment: instance-level role assignments
- permitio_group_resource_instance_role_assignment: group-based instance role assignments

New data sources:
- permitio_user: fetch user information by key

Import support added to existing resources:
- permitio_role: top-level and resource-level roles
- permitio_condition_set_rule: comma-separated user_set,permission,resource_set

Bug fixes & improvements:
- Drift detection for role assignments and resource instances
- Nil guards on API responses to prevent runtime panics
- Empty set handling in roles model for permissions and extends
- Global config module for resources needing direct HTTP access

* feat: add resource_instance resource

Manage Permit.io resource instances - specific objects of a resource type
(e.g., a specific document, project, or folder). Supports ABAC attributes
via JSON.

Includes:
- Full CRUD operations for resource instances
- Drift detection (removes from state when deleted externally)
- Nil guards on API responses to prevent runtime panics
- Import support using resource_key:instance_key format
- Documentation with usage examples

* docs: update docs with go generate

* fix: split resource_instance into separate fields and fix __user: prefix bug

Splits the combined resource_instance field (e.g. "document:doc-123") into
separate resource and resource_instance fields, matching the schema used by
permitio_group_resource_instance_role_assignment. Also fixes a bug where
tfModelFromRelationshipTupleRead stored the raw API subject including the
__user: prefix, causing permanent state drift on every plan.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix: use Users API instead of RelationshipTuples API for resource instance role assignments

* chore: update tenant docs

* docs: add examples for resource imports

* chore: fix cilinting errors, upgrade to go1.24

---------

Co-authored-by: Aden McCusker <aden.m@null.net>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: 3 people

.gitignore

@@ -35,3 +35,9 @@ website/vendor
 
 # Keep windows files with windows line endings
 *.winfile eol=crlf
+
+# Local claude configuration
+.claude/settings.local.json
+
+# Built binary for local testing
+terraform-provider-permit-io

docs/data-sources/permitio_user.md

@@ -0,0 +1,31 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "permitio_user Data Source - terraform-provider-permit-io"
+subcategory: ""
+description: |-
+  Fetches a user from the Permit.io directory.
+---
+
+# permitio_user (Data Source)
+
+Fetches a user from the Permit.io directory.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `key` (String) User key identifier
+
+### Read-Only
+
+- `attributes` (String) Custom user attributes as JSON string
+- `email` (String) User's email address
+- `environment_id` (String) Environment ID
+- `first_name` (String) User's first name
+- `id` (String) Unique user ID
+- `last_name` (String) User's last name
+- `organization_id` (String) Organization ID
+- `project_id` (String) Project ID

docs/resources/permitio_condition_set_rule.md

@@ -27,3 +27,12 @@ See [our documentation](https://api.permit.io/v2/redoc#tag/Condition-Set-Rules)
 - `id` (String) Unique id of the condition set rule
 - `organization_id` (String) Unique id of the organization that owns the condition set rule
 - `project_id` (String) Unique id of the project that owns the condition set rule
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import a condition set rule using the format: user_set,permission,resource_set
+terraform import permitio_condition_set_rule.example admins,document:read,sensitive-docs
+```

docs/resources/permitio_group_resource_instance_role_assignment.md

@@ -0,0 +1,37 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "permitio_group_resource_instance_role_assignment Resource - terraform-provider-permit-io"
+subcategory: ""
+description: |-
+  Assigns a role to a group on a specific resource instance within a tenant. This uses the Permit.io Groups API to manage group-level permissions on resource instances. For user-specific assignments, use permitio_resource_instance_role_assignment instead.
+---
+
+# permitio_group_resource_instance_role_assignment (Resource)
+
+Assigns a role to a group on a specific resource instance within a tenant. This uses the Permit.io Groups API to manage group-level permissions on resource instances. For user-specific assignments, use `permitio_resource_instance_role_assignment` instead.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `group` (String) Group key to assign the role to
+- `resource` (String) Resource type (e.g., 'workspace', 'document')
+- `resource_instance` (String) Resource instance key (e.g., 'ws-123', 'doc-456')
+- `role` (String) Role key to assign
+- `tenant` (String) Tenant key for scoped assignment
+
+### Read-Only
+
+- `id` (String) Unique identifier of the role assignment
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import a group resource instance role assignment using the format: group:role:resource:resource_instance:tenant
+terraform import permitio_group_resource_instance_role_assignment.example engineering:viewer:document:doc-1:default
+```

docs/resources/permitio_resource_instance.md

@@ -0,0 +1,45 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "permitio_resource_instance Resource - terraform-provider-permit-io"
+subcategory: ""
+description: |-
+  Manages a Permit.io resource instance. Resource instances represent specific objects of a resource type (e.g., a specific document, project, or folder). See the documentation https://api.permit.io/v2/redoc#tag/Resource-Instances for more information.
+---
+
+# permitio_resource_instance (Resource)
+
+Manages a Permit.io resource instance. Resource instances represent specific objects of a resource type (e.g., a specific document, project, or folder). See [the documentation](https://api.permit.io/v2/redoc#tag/Resource-Instances) for more information.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `key` (String) The key. This is a unique identifier.
+- `resource` (String) The resource type key that this instance belongs to.
+
+### Optional
+
+- `attributes` (String) Arbitrary resource instance attributes in JSON format that will be used to enforce attribute-based access control policies.
+- `tenant` (String) The tenant key for multi-tenant enforcement.
+- `updated_at` (String) The update timestamp. This is a timestamp for when the object was last updated.
+
+### Read-Only
+
+- `created_at` (String) The creation timestamp. This is a timestamp for when the object was created.
+- `environment_id` (String) The environment ID. This is a unique identifier for the environment.
+- `id` (String) The resource ID. This is a unique identifier for the resource.
+- `organization_id` (String) The organization ID. This is a unique identifier for the organization.
+- `project_id` (String) The project ID. This is a unique identifier for the project.
+- `resource_id` (String) The unique resource type ID.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import a resource instance using the format: resource_key:instance_key
+terraform import permitio_resource_instance.example document:doc-1
+```

docs/resources/permitio_resource_instance_role_assignment.md

@@ -0,0 +1,41 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "permitio_resource_instance_role_assignment Resource - terraform-provider-permit-io"
+subcategory: ""
+description: |-
+  Assigns a role to a user on a specific resource instance within a tenant. This is for instance-level permissions (e.g., giving a user editor access to a specific document). For tenant-level role assignments, use permitio_role_assignment instead.
+---
+
+# permitio_resource_instance_role_assignment (Resource)
+
+Assigns a role to a user on a specific resource instance within a tenant. This is for instance-level permissions (e.g., giving a user editor access to a specific document). For tenant-level role assignments, use `permitio_role_assignment` instead.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `resource` (String) Resource type (e.g., 'workspace', 'document')
+- `resource_instance` (String) Resource instance key (e.g., 'ws-123', 'doc-456')
+- `role` (String) Role key to assign
+- `tenant` (String) Tenant key for scoped assignment
+- `user` (String) User key to assign the role to
+
+### Read-Only
+
+- `created_at` (String)
+- `environment_id` (String)
+- `id` (String) Unique identifier of the role assignment
+- `organization_id` (String)
+- `project_id` (String)
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import a resource instance role assignment using the format: user:role:resource:resource_instance:tenant
+terraform import permitio_resource_instance_role_assignment.example john@example.com:viewer:document:doc-1:default
+```

docs/resources/permitio_role.md

@@ -38,3 +38,15 @@ See [the documentation](https://api.permit.io/v2/redoc#tag/Resources/operation/c
 - `organization_id` (String) The organization ID. This is a unique identifier for the organization.
 - `project_id` (String) The project ID. This is a unique identifier for the project.
 - `resource_id` (String) The unique resource ID that the role belongs to.
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import a top-level role using the format: role_key
+terraform import permitio_role.example admin
+
+# Import a resource-level role using the format: resource_key:role_key
+terraform import permitio_role.example document:editor
+```

docs/resources/permitio_role_assignment.md

@@ -0,0 +1,39 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "permitio_role_assignment Resource - terraform-provider-permit-io"
+subcategory: ""
+description: |-
+  Assigns a role to a user within a specific tenant.
+---
+
+# permitio_role_assignment (Resource)
+
+Assigns a role to a user within a specific tenant.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `role` (String) Role key to assign
+- `tenant` (String) Tenant key for scoped assignment
+- `user` (String) User key to assign the role to
+
+### Read-Only
+
+- `created_at` (String)
+- `environment_id` (String)
+- `id` (String) Unique identifier of the role assignment
+- `organization_id` (String)
+- `project_id` (String)
+
+## Import
+
+Import is supported using the following syntax:
+
+```shell
+# Import a role assignment using the format: user:role:tenant
+terraform import permitio_role_assignment.example john@example.com:admin:default
+```

docs/resources/permitio_tenant.md

@@ -0,0 +1,36 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "permitio_tenant Resource - terraform-provider-permit-io"
+subcategory: ""
+description: |-
+  Manages a Permit.io tenant. Tenants represent isolated groups or organizations within your application. See the documentation https://api.permit.io/v2/redoc#tag/Tenants for more information about tenants.
+---
+
+# permitio_tenant (Resource)
+
+Manages a Permit.io tenant. Tenants represent isolated groups or organizations within your application. See [the documentation](https://api.permit.io/v2/redoc#tag/Tenants) for more information about tenants.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `key` (String) The key. This is a unique identifier.
+- `name` (String) The name. This is a human-readable name for the object.
+
+### Optional
+
+- `attributes` (String) Arbitrary tenant attributes in JSON format that will be used to enforce attribute-based access control policies.
+- `description` (String) The description. This is a human-readable description for the object.
+- `updated_at` (String) The update timestamp. This is a timestamp for when the object was last updated.
+
+### Read-Only
+
+- `created_at` (String) The creation timestamp. This is a timestamp for when the object was created.
+- `environment_id` (String) The environment ID. This is a unique identifier for the environment.
+- `id` (String) The resource ID. This is a unique identifier for the resource.
+- `last_action_at` (String) Date and time when the tenant was last active (ISO_8601 format). In other words, this is the last time a permission check was done on a resource belonging to this tenant.
+- `organization_id` (String) The organization ID. This is a unique identifier for the organization.
+- `project_id` (String) The project ID. This is a unique identifier for the project.

examples/resources/permitio_condition_set_rule/import.sh

@@ -0,0 +1,2 @@
+# Import a condition set rule using the format: user_set,permission,resource_set
+terraform import permitio_condition_set_rule.example admins,document:read,sensitive-docs