From cc9e59bf46b0e96952c6d79526e1855a3dd430ad Mon Sep 17 00:00:00 2001
From: evgeniy-scherbina <evgeniy.shcherbina.es@gmail.com>
Date: Fri, 1 Aug 2025 15:02:16 +0000
Subject: [PATCH] feat: add coder_secret data source

---
 provider/provider.go |  1 +
 provider/secret.go   | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 41 insertions(+)
 create mode 100644 provider/secret.go

diff --git a/provider/provider.go b/provider/provider.go
index a0ef63f9..d42e2603 100644
--- a/provider/provider.go
+++ b/provider/provider.go
@@ -64,6 +64,7 @@ func New() *schema.Provider {
 			"coder_external_auth":    externalAuthDataSource(),
 			"coder_workspace_owner":  workspaceOwnerDataSource(),
 			"coder_workspace_preset": workspacePresetDataSource(),
+			"coder_secret":           secretDataSource(),
 		},
 		ResourcesMap: map[string]*schema.Resource{
 			"coder_agent":          agentResource(),
diff --git a/provider/secret.go b/provider/secret.go
new file mode 100644
index 00000000..a3ee20f8
--- /dev/null
+++ b/provider/secret.go
@@ -0,0 +1,40 @@
+package provider
+
+import (
+	"context"
+
+	"github.com/coder/terraform-provider-coder/v2/provider/helpers"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+)
+
+func secretDataSource() *schema.Resource {
+	return &schema.Resource{
+		SchemaVersion: 1,
+
+		Description: "",
+		ReadContext: func(ctx context.Context, rd *schema.ResourceData, i interface{}) diag.Diagnostics {
+			envName, ok := rd.Get("env_name").(string)
+			if !ok || envName == "" {
+				return diag.Errorf("env_name is required")
+			}
+			envVal := helpers.OptionalEnv(envName)
+
+			rd.Set("value", envVal)
+			rd.SetId(envName)
+			return nil
+		},
+		Schema: map[string]*schema.Schema{
+			"env_name": {
+				Type:        schema.TypeString,
+				Description: "",
+				Required:    true,
+			},
+			"value": {
+				Type:        schema.TypeString,
+				Description: "",
+				Computed:    true,
+			},
+		},
+	}
+}