Repository: cloudflare/cloudflare-go
Pull request #2126 (2024-05-22 17:04:15)

Enhancement - teams_accounts: Support 'UseZtVirtualIP'
## Description
Added field `UseZtVirtualIP` to `TeamsDeviceSettings` . Property `use_zt_virtual_ip` of `teams-devices_zero-trust-account-device-settings` in openapi.yaml. Allows us set up https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/private-net/warp-connector/#3-enable-cgnat-routing via the provider.

## Types of changes

What sort of change does your code introduce/modify?

- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)

## Checklist:

- [x] My code follows the code style of this project.
- [ ] My change requires a change to the documentation.
- [ ] I have updated the documentation accordingly.
- [x] I have added tests to cover my changes.
- [ ] All new and existing tests passed.
- [x] This change is using publicly documented in [cloudflare/api-schemas](https://github.com/cloudflare/api-schemas) 
      and relies on stable APIs.

[1]: https://help.github.com/articles/closing-issues-using-keywords/



Patch:
diff --git a/.changelog/2126.txt b/.changelog/2126.txt
new file mode 100644
index 000000000..47770bd2e
--- /dev/null
+++ b/.changelog/2126.txt
@@ -0,0 +1,3 @@
+```release-note:enhancement
+teams_accounts: Add `use_zt_virtual_ip` attribute
+```
\ No newline at end of file
diff --git a/.changelog/2131.txt b/.changelog/2131.txt
deleted file mode 100644
index d32928a2d..000000000
--- a/.changelog/2131.txt
+++ /dev/null
@@ -1,3 +0,0 @@
-```release-note:enhancement
-access_application: Add support for Hybrid/Implicit flows and options
-```
diff --git a/access_application.go b/access_application.go
index 315ccb027..75ef4f31c 100644
--- a/access_application.go
+++ b/access_application.go
@@ -210,11 +210,6 @@ type RefreshTokenOptions struct {
 	Lifetime string `json:"lifetime,omitempty"`
 }
 
-type AccessApplicationHybridAndImplicitOptions struct {
-	ReturnIDTokenFromAuthorizationEndpoint     *bool `json:"return_id_token_from_authorization_endpoint,omitempty"`
-	ReturnAccessTokenFromAuthorizationEndpoint *bool `json:"return_access_token_from_authorization_endpoint,omitempty"`
-}
-
 type SaasApplication struct {
 	// Items common to both SAML and OIDC
 	AppID     string     `json:"app_id,omitempty"`
@@ -235,17 +230,16 @@ type SaasApplication struct {
 	SamlAttributeTransformJsonata string                `json:"saml_attribute_transform_jsonata"`
 
 	// OIDC saas app
-	ClientID                     string                                     `json:"client_id,omitempty"`
-	ClientSecret                 string                                     `json:"client_secret,omitempty"`
-	RedirectURIs                 []string                                   `json:"redirect_uris,omitempty"`
-	GrantTypes                   []string                                   `json:"grant_types,omitempty"`
-	Scopes                       []string                                   `json:"scopes,omitempty"`
-	AppLauncherURL               string                                     `json:"app_launcher_url,omitempty"`
-	GroupFilterRegex             string                                     `json:"group_filter_regex,omitempty"`
-	CustomClaims                 []OIDCClaimConfig                          `json:"custom_claims,omitempty"`
-	AllowPKCEWithoutClientSecret *bool                                      `json:"allow_pkce_without_client_secret,omitempty"`
-	RefreshTokenOptions          *RefreshTokenOptions                       `json:"refresh_token_options,omitempty"`
-	HybridAndImplicitOptions     *AccessApplicationHybridAndImplicitOptions `json:"hybrid_and_implicit_options,omitempty"`
+	ClientID                     string               `json:"client_id,omitempty"`
+	ClientSecret                 string               `json:"client_secret,omitempty"`
+	RedirectURIs                 []string             `json:"redirect_uris,omitempty"`
+	GrantTypes                   []string             `json:"grant_types,omitempty"`
+	Scopes                       []string             `json:"scopes,omitempty"`
+	AppLauncherURL               string               `json:"app_launcher_url,omitempty"`
+	GroupFilterRegex             string               `json:"group_filter_regex,omitempty"`
+	CustomClaims                 []OIDCClaimConfig    `json:"custom_claims,omitempty"`
+	AllowPKCEWithoutClientSecret *bool                `json:"allow_pkce_without_client_secret,omitempty"`
+	RefreshTokenOptions          *RefreshTokenOptions `json:"refresh_token_options,omitempty"`
 }
 
 type AccessAppLauncherCustomization struct {
diff --git a/teams_accounts.go b/teams_accounts.go
index a027dbee9..b13ad1bf0 100644
--- a/teams_accounts.go
+++ b/teams_accounts.go
@@ -131,9 +131,10 @@ type TeamsLoggingSettings struct {
 }
 
 type TeamsDeviceSettings struct {
-	GatewayProxyEnabled                bool `json:"gateway_proxy_enabled"`
-	GatewayProxyUDPEnabled             bool `json:"gateway_udp_proxy_enabled"`
-	RootCertificateInstallationEnabled bool `json:"root_certificate_installation_enabled"`
+	GatewayProxyEnabled                bool  `json:"gateway_proxy_enabled"`
+	GatewayProxyUDPEnabled             bool  `json:"gateway_udp_proxy_enabled"`
+	RootCertificateInstallationEnabled bool  `json:"root_certificate_installation_enabled"`
+	UseZTVirtualIP                     *bool `json:"use_zt_virtual_ip"`
 }
 
 type TeamsDeviceSettingsResponse struct {


Test patch:
diff --git a/access_application_test.go b/access_application_test.go
index 714dde568..086479c95 100644
--- a/access_application_test.go
+++ b/access_application_test.go
@@ -1112,7 +1112,7 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 					"client_id": "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
 					"client_secret": "secret",
 					"redirect_uris": ["https://saas.example.com"],
-					"grant_types": ["authorization_code", "hybrid", "implicit"],
+					"grant_types": ["authorization_code"],
 					"scopes": ["openid", "email", "profile", "groups"],
 					"app_launcher_url": "https://saas.example.com",
 					"group_filter_regex": ".*",
@@ -1126,11 +1126,7 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 							"required": true,
 							"scope": "profile"
 						}
-					],
-					"hybrid_and_implicit_options": {
-						"return_id_token_from_authorization_endpoint": true,
-						"return_access_token_from_authorization_endpoint": true
-					}
+					]
 				}
 			}
 		}
@@ -1160,7 +1156,7 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 			ClientID:                     "737646a56ab1df6ec9bddc7e5ca84eaf3b0768850f3ffb5d74f1534911fe3893",
 			ClientSecret:                 "secret",
 			RedirectURIs:                 []string{"https://saas.example.com"},
-			GrantTypes:                   []string{"authorization_code", "hybrid", "implicit"},
+			GrantTypes:                   []string{"authorization_code"},
 			Scopes:                       []string{"openid", "email", "profile", "groups"},
 			AppLauncherURL:               "https://saas.example.com",
 			GroupFilterRegex:             ".*",
@@ -1173,10 +1169,6 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 					Scope:    "profile",
 				},
 			},
-			HybridAndImplicitOptions: &AccessApplicationHybridAndImplicitOptions{
-				ReturnIDTokenFromAuthorizationEndpoint:     BoolPtr(true),
-				ReturnAccessTokenFromAuthorizationEndpoint: BoolPtr(true),
-			},
 		},
 		CreatedAt:                &createdAt,
 		UpdatedAt:                &updatedAt,
@@ -1190,7 +1182,6 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 		Name: "Admin Saas Site",
 		SaasApplication: &SaasApplication{
 			AuthType:                     "oidc",
-			GrantTypes:                   []string{"authorization_code", "hybrid", "implicit"},
 			RedirectURIs:                 []string{"https://saas.example.com"},
 			AppLauncherURL:               "https://saas.example.com",
 			GroupFilterRegex:             ".*",
@@ -1203,10 +1194,6 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 					Scope:    "profile",
 				},
 			},
-			HybridAndImplicitOptions: &AccessApplicationHybridAndImplicitOptions{
-				ReturnIDTokenFromAuthorizationEndpoint:     BoolPtr(true),
-				ReturnAccessTokenFromAuthorizationEndpoint: BoolPtr(true),
-			},
 		},
 		SessionDuration: "24h",
 	})
@@ -1221,7 +1208,6 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 		Name: "Admin Saas Site",
 		SaasApplication: &SaasApplication{
 			AuthType:                     "oidc",
-			GrantTypes:                   []string{"authorization_code", "hybrid", "implicit"},
 			RedirectURIs:                 []string{"https://saas.example.com"},
 			AppLauncherURL:               "https://saas.example.com",
 			GroupFilterRegex:             ".*",
@@ -1234,10 +1220,6 @@ func TestCreateOIDCSaasAccessApplications(t *testing.T) {
 					Scope:    "profile",
 				},
 			},
-			HybridAndImplicitOptions: &AccessApplicationHybridAndImplicitOptions{
-				ReturnIDTokenFromAuthorizationEndpoint:     BoolPtr(true),
-				ReturnAccessTokenFromAuthorizationEndpoint: BoolPtr(true),
-			},
 		},
 		SessionDuration: "24h",
 	})
diff --git a/teams_accounts_test.go b/teams_accounts_test.go
index 10f4807a2..cf044f6ab 100644
--- a/teams_accounts_test.go
+++ b/teams_accounts_test.go
@@ -289,7 +289,7 @@ func TestTeamsAccountGetDeviceConfiguration(t *testing.T) {
 			"success": true,
 			"errors": [],
 			"messages": [],
-			"result": {"gateway_proxy_enabled": true,"gateway_udp_proxy_enabled":false, "root_certificate_installation_enabled":true}
+			"result": {"gateway_proxy_enabled": true,"gateway_udp_proxy_enabled":false, "root_certificate_installation_enabled":true, "use_zt_virtual_ip":false}
 		}`)
 	}
 
@@ -302,6 +302,7 @@ func TestTeamsAccountGetDeviceConfiguration(t *testing.T) {
 			GatewayProxyEnabled:                true,
 			GatewayProxyUDPEnabled:             false,
 			RootCertificateInstallationEnabled: true,
+			UseZTVirtualIP:                     BoolPtr(false),
 		})
 	}
 }
@@ -317,7 +318,7 @@ func TestTeamsAccountUpdateDeviceConfiguration(t *testing.T) {
 			"success": true,
 			"errors": [],
 			"messages": [],
-			"result": {"gateway_proxy_enabled": true,"gateway_udp_proxy_enabled":true, "root_certificate_installation_enabled":true}
+			"result": {"gateway_proxy_enabled": true,"gateway_udp_proxy_enabled":true, "root_certificate_installation_enabled":true, "use_zt_virtual_ip":true}
 		}`)
 	}
 
@@ -327,6 +328,7 @@ func TestTeamsAccountUpdateDeviceConfiguration(t *testing.T) {
 		GatewayProxyUDPEnabled:             true,
 		GatewayProxyEnabled:                true,
 		RootCertificateInstallationEnabled: true,
+		UseZTVirtualIP:                     BoolPtr(true),
 	})
 
 	if assert.NoError(t, err) {
@@ -334,6 +336,7 @@ func TestTeamsAccountUpdateDeviceConfiguration(t *testing.T) {
 			GatewayProxyEnabled:                true,
 			GatewayProxyUDPEnabled:             true,
 			RootCertificateInstallationEnabled: true,
+			UseZTVirtualIP:                     BoolPtr(true),
 		})
 	}
 }