# 3.6.2

**Release Date:** May 21, 2026

---

## ✨ New Features

### Terraform Modules

#### Enable External and Corporate Auth Server Configurations 🔐

**Module:** `saif-api-service` / `saif-resources` (api module)

**Commit:** [`c44e3859`](https://github.com/saif-corp/forge/commit/c44e385938db18f218f0f089b37ec6c08feb7f68)

Enables full support for external (Okta) and corporate (Entra ID) auth server discovery keys in the `saif-api-service` module. Previously, all App Configuration service-discovery keys for auth servers were created unconditionally — which caused Terraform errors at plan time when the auth-server resources did not yet exist (because `count` was driven by resource outputs, which are unknown until apply).

This release introduces explicit opt-in boolean flags in `service_discovery_config` so that each auth server key is only created when the flag is `true` — a value known at plan time. The companion `Test-WorkspaceMigration.ps1` tooling script has also been enhanced to support full apply testing against TFC workspaces.

**Key Features:**

- ✅ **`enable_external_auth_server`** — Controls creation of `ext:authserver` and `ext:authserveraudience` App Configuration keys (default: `false`)
- ✅ **`enable_corp_auth_server`** — Controls creation of `corp:authserver` and `corp:authserveraudience` App Configuration keys (default: `false`)
- ✅ **Plan-time-known booleans** — Eliminates Terraform plan errors caused by resource-output-dependent `count` expressions
- ✅ **`Test-WorkspaceMigration.ps1` enhancements** — Added `-Apply` and `-auto-approve` flags for running full applies against TFC workspaces; improved run selection logic to fall back to most-recent run when no applied run exists

**Benefits:**

- 🚀 Eliminates "The `count` argument depends on resource attributes that cannot be determined until apply" plan errors
- 🔐 Allows APIs to opt in to only the auth server integrations they require
- 🧪 Enables local module changes to be tested end-to-end against a real TFC workspace with a single command

**Example:**

```hcl
module "saif-appservices" {
  source  = "app.terraform.io/SAIFCorp/saif-api-service/forge"
  version = "~> 3.6.0"

  # ...

  service_discovery_config = {
    enable_external_auth_server = true   # creates ext:authserver + ext:authserveraudience keys
    enable_corp_auth_server     = true   # creates corp:authserver + corp:authserveraudience keys
  }
}
```

---

## 🐛 Bug Fixes

### Terraform Modules

#### Fix Missing `ai_search_docs_index_name` Output Gracefully 🔧

**Module:** `saif-resources` (environment module)

**Commit:** [`1db6420d`](https://github.com/saif-corp/forge/commit/1db6420d523054a303269c54ae340d9cb21c9e1c)

Fixes a Terraform error when the `ai_search_docs_index_name` output was referenced but the underlying resource did not exist in the environment. The `outputs.tf` in the `environment` module now handles the absence of this value without erroring, preventing plan failures for environments that do not have an AI Search docs index configured.

**Changes:**

- ✅ `outputs.tf` — Output value is now conditional; returns `null` when the AI Search docs index is not configured instead of causing a reference error

**Benefits:**

- 🔧 Prevents plan failures in environments without an AI Search docs index
- 🔧 Improves module robustness for partial environment configurations

---

## 🔄 Breaking Changes

None in this release ✅

---

## 📋 Additional Notes

- **Total commits:** 2
- **Files changed:** 5
- **Contributors:** Emmitt Johnson

---

### Support

- 📧 Teams Support Channel: [Support](https://teams.microsoft.com/l/channel/19%3Acb611810fb0b42b080cfff5590bdd51c%40thread.tacv2/Support?groupId=514d2dac-2d62-48ce-bf99-0fa0ce39469c&tenantId=a86cb8ed-369b-4df5-ace5-43811f6e08cf)

---