Experimental embedded client fails to create org-collection

[hinricht]

Terraform Version

OpenTofu v1.8.4
on linux_amd64
+ provider registry.opentofu.org/maxlaverse/bitwarden v0.12.1

Affected Resource(s)

• bitwarden_org_collection

Terraform Configuration Files

terraform {
  backend "http" {}
  required_version = "1.8.4"
  required_providers {
    bitwarden = {
      source  = "maxlaverse/bitwarden"
      version = "0.12.1"
    }
  }
}

locals {
  collections = [
    "SecOps",
    "SecOps/Test",
    "SecOps/Test/Subtest",
  ]
}


provider "bitwarden" {
  server = "https://bitwarden…"
  experimental {
    embedded_client = true
  }
}

data "bitwarden_organization" "example_org" {
  search = "example-org"
}

resource "bitwarden_org_collection" "SecOps" {
  for_each        = toset(local.collections)
  name            = each.key
  organization_id = data.bitwarden_organization.example_org.id
}

Debug Output

As the debug output contains all our password metadata I don't like to share it.

Panic Output

Expected Behavior

The collection should get created.

Actual Behavior

Acquiring state lock. This may take a few moments...
bitwarden_org_collection.SecOps["SecOps/Test/Subtest"]: Creating...
╷
│ Error: error creating collection: bad response status code for 'POST https://bitwarden..../api/organizations/.../collections': 400!=200, body:{"message":"At least one member or group must have can manage permission.","validationErrors":null,"exceptionMessage":null,"exceptionStackTrace":null,"innerExceptionMessage":null,"object":"error"}
│ 
│   with bitwarden_org_collection.SecOps["SecOps/Test/Subtest"],
│   on main.tofu line [..], in resource "bitwarden_org_collection" "SecOps":
│   ..: resource "bitwarden_org_collection" "SecOps" {
│

Steps to Reproduce

1. tofu apply

Important Factoids

• Selfhosted Bitwarden instance
• Opentofu instead of Terraform
• If used to work with the embedded cient, but shortly after we migrated to it, it stopped working.
• Switching back to the bw client works with the same code.

References

[maxlaverse]

Thanks for the report @hinricht
I've actually started working on #134, which should solve this issue as well, but there are a lot of implementation details coming with the feature so it will probably take a bit of time.