When multiple organization users found, filter results for an exact match on email or login

internal/resources/grafana/data_source_organization_user.go

@@ -45,34 +45,48 @@ func dataSourceOrganizationUserRead(ctx context.Context, d *schema.ResourceData,
 	client, orgID := OAPIClientFromNewOrgResource(meta, d)
 
 	var resp interface {
-		GetPayload() []*models.UserLookupDTO
+		GetPayload() []*models.OrgUserDTO
 	}
 
+	matchBy := matchByEmail
 	emailOrLogin := d.Get("email").(string)
+	searchType := "email"
 	if emailOrLogin == "" {
 		emailOrLogin = d.Get("login").(string)
+		matchBy = matchByLogin
+		searchType = "login"
 	}
 	if emailOrLogin == "" {
 		return diag.Errorf("must specify one of email or login")
 	}
 
-	params := org.NewGetOrgUsersForCurrentOrgLookupParams().WithQuery(&emailOrLogin)
-	resp, err := client.Org.GetOrgUsersForCurrentOrgLookup(params)
+	params := org.NewGetOrgUsersForCurrentOrgParams().WithQuery(&emailOrLogin)
+	resp, err := client.Org.GetOrgUsersForCurrentOrg(params)
 	if err != nil {
 		return diag.FromErr(err)
 	}
 
-	// Make sure that exactly 1 user was returned
-	if len(resp.GetPayload()) > 1 {
-		return diag.Errorf("ambiguous query when reading organization user, multiple users returned by query: %q", emailOrLogin)
-	} else if len(resp.GetPayload()) == 0 {
+	if len(resp.GetPayload()) == 0 {
 		return diag.Errorf("organization user not found with query: %q", emailOrLogin)
 	}
 
-	user := resp.GetPayload()[0]
-	d.Set("user_id", user.UserID)
-	d.Set("login", user.Login)
+	for _, user := range resp.GetPayload() {
+		if matchBy(user, emailOrLogin) {
+			d.Set("user_id", user.UserID)
+			d.Set("login", user.Login)
+			d.Set("email", user.Email)
+			d.SetId(MakeOrgResourceID(orgID, user.UserID))
+			return nil
+		}
+	}
+
+	return diag.Errorf("no organization user found with %s: %q (users returned: %d)", searchType, emailOrLogin, len(resp.GetPayload()))
+}
+
+func matchByEmail(user *models.OrgUserDTO, email string) bool {
+	return user.Email == email
+}
 
-	d.SetId(MakeOrgResourceID(orgID, user.UserID))
-	return nil
+func matchByLogin(user *models.OrgUserDTO, login string) bool {
+	return user.Login == login
 }

internal/resources/grafana/data_source_organization_user_test.go

@@ -38,3 +38,55 @@ func TestAccDatasourceOrganizationUser_basic(t *testing.T) {
 		},
 	})
 }
+
+func TestAccDatasourceOrganizationUser_disambiguation(t *testing.T) {
+	testutils.CheckOSSTestsEnabled(t)
+
+	var user1, user2 models.UserProfileDTO
+	checks := []resource.TestCheckFunc{
+		userCheckExists.exists("grafana_user.user1", &user1),
+		userCheckExists.exists("grafana_user.user2", &user2),
+		resource.TestCheckResourceAttr("data.grafana_organization_user.from_email", "login", "login1"),
+		resource.TestCheckResourceAttr("data.grafana_organization_user.from_email", "email", "[email protected]"),
+		resource.TestCheckResourceAttr("data.grafana_organization_user.from_login", "login", "log"),
+		resource.TestCheckResourceAttr("data.grafana_organization_user.from_login", "email", "[email protected]~"),
+	}
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV5ProviderFactories: testutils.ProtoV5ProviderFactories,
+		CheckDestroy: resource.ComposeTestCheckFunc(
+			userCheckExists.destroyed(&user1, nil),
+			userCheckExists.destroyed(&user2, nil),
+		),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDatasourceOrganizationUserDisambiguation,
+				Check:  resource.ComposeTestCheckFunc(checks...),
+			},
+		},
+	})
+}
+
+var testAccDatasourceOrganizationUserDisambiguation = `
+resource "grafana_user" "user1" {
+  email = "[email protected]"
+  name = "Test User 1"
+  login = "login1"
+  password = "my-password"
+}
+
+resource "grafana_user" "user2" {
+  email = "[email protected]~"
+  name = "Test User 1a"
+  login = "log"
+  password = "my-password"
+}
+
+data "grafana_organization_user" "from_email" {
+  email = grafana_user.user1.email
+}
+
+data "grafana_organization_user" "from_login" {
+  login = grafana_user.user2.login
+}
+`