FR: Add grants support

[ivant]

Is your feature request related to a problem? Please describe.
Tailscale just announced Grants GA.

Describe the solution you'd like
A resource for setting them up would be useful.

[mezuzza]

After tailscale/tailscale-client-go-v2#36, I believe the dependency for this provider simply needs to be updated and a release needs to be cut.

[mpminardi]

Hey folks! Apologies for the delayed response on this. To clear up some potential confusion: the existing tailscale_acl controls management of the entire policy file and not just the acls section within it.

For example, the minimal as_hujson example resource in the docs can be re-written as something like the following today using grants syntax:

resource "tailscale_acl" "as_hujson" {
  acl = <<EOF
  {
    // Comments in HuJSON policy are preserved when the policy is applied.
    "grants": [
      // Allow all users access to all ports.
      {"src": ["*"], "dst": ["*"], "ip": ["*"]},
    ],
  }
  EOF
}

Is something like the above what people were hoping to be able to do with the provider, or am I misunderstanding the ask here?

[nint8835]

Not sure how I missed that fact previously, I just tried doing it that way and can confirm it worked for my needs

[mezuzza]

This simply didn't work at the time this ticket was open. tailscale-client-go would fail to parse the json and we would get an error. I don't quite remember the error.

From my understanding, this change fixed this issue since it upgraded from tailscale.com/client/tailscale/v2 v2.0.0-20250616133344-8dcb33eb281b to tailscale.com/client/tailscale/v2 v2.0.0-20250917165625-03d1dde3a1fc.

You'll note that before that change, the code being ran can be found here. The code for after the change is found here.

See how Grants and IPSets was added between those two commits.