From c5010fe401e8c570a840dce5a85cfb33c33d41f6 Mon Sep 17 00:00:00 2001
From: Thomas Felix <tfelix@meshcloud.io>
Date: Wed, 4 Nov 2026 11:47:02 +0100
Subject: [PATCH] feat(client): report whether a binding waits for approval

With four-eyes approval on, meshStack keeps a binding created through the
API pending until a person approves it in meshPanel. Workspace and
project bindings now carry "status.approval", ASSIGNED or PENDING, so
the Terraform provider can tell its users. Group bindings get a status
for this.

BD-2877

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 client/binding_approval.go        | 27 +++++++++++++++++++++++++++
 client/project_group_binding.go   |  2 ++
 client/project_user_binding.go    |  4 +++-
 client/workspace_group_binding.go |  2 ++
 4 files changed, 34 insertions(+), 1 deletion(-)
 create mode 100644 client/binding_approval.go

diff --git a/client/binding_approval.go b/client/binding_approval.go
new file mode 100644
index 0000000..29e6f19
--- /dev/null
+++ b/client/binding_approval.go
@@ -0,0 +1,27 @@
+package client
+
+import "github.com/meshcloud/meshstack-cli/client/types/enum"
+
+type MeshBindingApproval string
+
+var (
+	MeshBindingApprovals        = enum.Enum[MeshBindingApproval]{}
+	MeshBindingApprovalAssigned = MeshBindingApprovals.Entry("ASSIGNED")
+	MeshBindingApprovalPending  = MeshBindingApprovals.Entry("PENDING")
+)
+
+type MeshGroupBindingStatus struct {
+	Approval *enum.Entry[MeshBindingApproval] `json:"approval,omitempty" tfsdk:"approval"`
+}
+
+func (s *MeshGroupBindingStatus) WaitsForApproval() bool {
+	return s != nil && isPending(s.Approval)
+}
+
+func (s *MeshUserBindingStatus) WaitsForApproval() bool {
+	return s != nil && isPending(s.Approval)
+}
+
+func isPending(approval *enum.Entry[MeshBindingApproval]) bool {
+	return approval != nil && *approval == MeshBindingApprovalPending
+}
diff --git a/client/project_group_binding.go b/client/project_group_binding.go
index f0f2d27..5920412 100644
--- a/client/project_group_binding.go
+++ b/client/project_group_binding.go
@@ -9,6 +9,8 @@ import (
 
 type MeshProjectGroupBinding struct {
 	MeshProjectBinding
+
+	Status *MeshGroupBindingStatus `json:"status,omitempty" tfsdk:"status"`
 }
 
 type MeshProjectGroupBindingClient interface {
diff --git a/client/project_user_binding.go b/client/project_user_binding.go
index bf13217..af3c233 100644
--- a/client/project_user_binding.go
+++ b/client/project_user_binding.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/meshcloud/meshstack-cli/client/internal"
+	"github.com/meshcloud/meshstack-cli/client/types/enum"
 	"github.com/meshcloud/meshstack-cli/internal/http"
 )
 
@@ -14,7 +15,8 @@ type MeshProjectUserBinding struct {
 }
 
 type MeshUserBindingStatus struct {
-	UserDisabled bool `json:"userDisabled" tfsdk:"user_disabled"`
+	UserDisabled bool                             `json:"userDisabled" tfsdk:"user_disabled"`
+	Approval     *enum.Entry[MeshBindingApproval] `json:"approval,omitempty" tfsdk:"approval"`
 }
 
 type MeshProjectUserBindingClient interface {
diff --git a/client/workspace_group_binding.go b/client/workspace_group_binding.go
index 4c4da9c..d2e4bc5 100644
--- a/client/workspace_group_binding.go
+++ b/client/workspace_group_binding.go
@@ -9,6 +9,8 @@ import (
 
 type MeshWorkspaceGroupBinding struct {
 	MeshWorkspaceBinding
+
+	Status *MeshGroupBindingStatus `json:"status,omitempty" tfsdk:"status"`
 }
 
 type MeshWorkspaceGroupBindingClient interface {