From 67310cdb79d217e1f5d547e90ef918e960738c01 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Sun, 12 Jul 2026 22:41:56 +1000
Subject: [PATCH] Fix self-referential authentik_group parents

Adding the first managed group (argocd-admins) exposed a dormant bug: the
groups resource resolved `parents` by indexing authentik_group.this itself,
which OpenTofu rejects as a self-referential block. config/groups/ had been
empty, so `tofu plan` never hit it before.

Pass `parents` through as literal group PKs instead (the resource cannot
reference itself, so parent-by-map-key was never viable). Plan is clean:
3 to add (argocd provider, application, argocd-admins group).
---
 modules/authentik/main.tf      | 2 +-
 modules/authentik/variables.tf | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/authentik/main.tf b/modules/authentik/main.tf
index f6fc278..2ab3da6 100644
--- a/modules/authentik/main.tf
+++ b/modules/authentik/main.tf
@@ -3,7 +3,7 @@ resource "authentik_group" "this" {
 
   name         = each.value.name
   is_superuser = each.value.is_superuser
-  parents      = each.value.parents != null ? [for p in each.value.parents : authentik_group.this[p].id] : []
+  parents      = each.value.parents
   attributes   = jsonencode(each.value.attributes)
 }
 
diff --git a/modules/authentik/variables.tf b/modules/authentik/variables.tf
index 6b497a0..f08c87d 100644
--- a/modules/authentik/variables.tf
+++ b/modules/authentik/variables.tf
@@ -2,8 +2,10 @@ variable "groups" {
   type = map(object({
     name         = string
     is_superuser = optional(bool, false)
-    parents      = optional(list(string), null)
-    attributes   = optional(map(string), {})
+    # PKs of existing parent groups. These must be literal group PKs, not keys
+    # into this map: authentik_group cannot reference itself.
+    parents    = optional(list(string), null)
+    attributes = optional(map(string), {})
   }))
   default = {}
 }