Skip to content

ResourceIdentity: Validate that identities do not change after Terraform stores it #1137

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
May 16, 2025
Merged

ResourceIdentity: Validate that identities do not change after Terraform stores it #1137

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
beaf5d0
add immutability validation to plan and apply
austinvalle May 9, 2025
562a852
add private key to import and validation to read
austinvalle May 9, 2025
db68555
add `MutableIdentity` resource behavior
austinvalle May 12, 2025
d928925
fix immutability
austinvalle May 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions internal/fromproto5/applyresourcechange.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ import (

// ApplyResourceChangeRequest returns the *fwserver.ApplyResourceChangeRequest
// equivalent of a *tfprotov5.ApplyResourceChangeRequest.
func ApplyResourceChangeRequest(ctx context.Context, proto5 *tfprotov5.ApplyResourceChangeRequest, resource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, identitySchema fwschema.Schema) (*fwserver.ApplyResourceChangeRequest, diag.Diagnostics) {
func ApplyResourceChangeRequest(ctx context.Context, proto5 *tfprotov5.ApplyResourceChangeRequest, resource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, resourceBehavior resource.ResourceBehavior, identitySchema fwschema.Schema) (*fwserver.ApplyResourceChangeRequest, diag.Diagnostics) {
if proto5 == nil {
return nil, nil
}
Expand All @@ -39,9 +39,10 @@ func ApplyResourceChangeRequest(ctx context.Context, proto5 *tfprotov5.ApplyReso
}

fw := &fwserver.ApplyResourceChangeRequest{
ResourceSchema: resourceSchema,
IdentitySchema: identitySchema,
Resource: resource,
ResourceSchema: resourceSchema,
ResourceBehavior: resourceBehavior,
IdentitySchema: identitySchema,
Resource: resource,
}

config, configDiags := Config(ctx, proto5.Config, resourceSchema)
Expand Down
16 changes: 15 additions & 1 deletion internal/fromproto5/applyresourcechange_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ func TestApplyResourceChangeRequest(t *testing.T) {

testCases := map[string]struct {
input *tfprotov5.ApplyResourceChangeRequest
resourceBehavior resource.ResourceBehavior
resourceSchema fwschema.Schema
resource resource.Resource
providerMetaSchema fwschema.Schema
Expand Down Expand Up @@ -309,13 +310,26 @@ func TestApplyResourceChangeRequest(t *testing.T) {
ResourceSchema: testFwSchema,
},
},
"resource-behavior": {
input: &tfprotov5.ApplyResourceChangeRequest{},
resourceSchema: testFwSchema,
resourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
expected: &fwserver.ApplyResourceChangeRequest{
ResourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
ResourceSchema: testFwSchema,
},
},
}

for name, testCase := range testCases {
t.Run(name, func(t *testing.T) {
t.Parallel()

got, diags := fromproto5.ApplyResourceChangeRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.identitySchema)
got, diags := fromproto5.ApplyResourceChangeRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.resourceBehavior, testCase.identitySchema)

if diff := cmp.Diff(got, testCase.expected, cmp.AllowUnexported(privatestate.ProviderData{})); diff != "" {
t.Errorf("unexpected difference: %s", diff)
Expand Down
3 changes: 2 additions & 1 deletion internal/fromproto5/readresource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ import (

// ReadResourceRequest returns the *fwserver.ReadResourceRequest
// equivalent of a *tfprotov5.ReadResourceRequest.
func ReadResourceRequest(ctx context.Context, proto5 *tfprotov5.ReadResourceRequest, reqResource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, identitySchema fwschema.Schema) (*fwserver.ReadResourceRequest, diag.Diagnostics) {
func ReadResourceRequest(ctx context.Context, proto5 *tfprotov5.ReadResourceRequest, reqResource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, resourceBehavior resource.ResourceBehavior, identitySchema fwschema.Schema) (*fwserver.ReadResourceRequest, diag.Diagnostics) {
if proto5 == nil {
return nil, nil
}
Expand All @@ -26,6 +26,7 @@ func ReadResourceRequest(ctx context.Context, proto5 *tfprotov5.ReadResourceRequ

fw := &fwserver.ReadResourceRequest{
Resource: reqResource,
ResourceBehavior: resourceBehavior,
IdentitySchema: identitySchema,
ClientCapabilities: ReadResourceClientCapabilities(proto5.ClientCapabilities),
}
Expand Down
15 changes: 14 additions & 1 deletion internal/fromproto5/readresource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ func TestReadResourceRequest(t *testing.T) {

testCases := map[string]struct {
input *tfprotov5.ReadResourceRequest
resourceBehavior resource.ResourceBehavior
resourceSchema fwschema.Schema
identitySchema fwschema.Schema
resource resource.Resource
Expand Down Expand Up @@ -251,13 +252,25 @@ func TestReadResourceRequest(t *testing.T) {
},
},
},
"resource-behavior": {
input: &tfprotov5.ReadResourceRequest{},
resourceSchema: testFwSchema,
resourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
expected: &fwserver.ReadResourceRequest{
ResourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
},
},
}

for name, testCase := range testCases {
t.Run(name, func(t *testing.T) {
t.Parallel()

got, diags := fromproto5.ReadResourceRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.identitySchema)
got, diags := fromproto5.ReadResourceRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.resourceBehavior, testCase.identitySchema)

if diff := cmp.Diff(got, testCase.expected, cmp.AllowUnexported(privatestate.ProviderData{})); diff != "" {
t.Errorf("unexpected difference: %s", diff)
Expand Down
9 changes: 5 additions & 4 deletions internal/fromproto6/applyresourcechange.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ import (

// ApplyResourceChangeRequest returns the *fwserver.ApplyResourceChangeRequest
// equivalent of a *tfprotov6.ApplyResourceChangeRequest.
func ApplyResourceChangeRequest(ctx context.Context, proto6 *tfprotov6.ApplyResourceChangeRequest, resource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, identitySchema fwschema.Schema) (*fwserver.ApplyResourceChangeRequest, diag.Diagnostics) {
func ApplyResourceChangeRequest(ctx context.Context, proto6 *tfprotov6.ApplyResourceChangeRequest, resource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, resourceBehavior resource.ResourceBehavior, identitySchema fwschema.Schema) (*fwserver.ApplyResourceChangeRequest, diag.Diagnostics) {
if proto6 == nil {
return nil, nil
}
Expand All @@ -39,9 +39,10 @@ func ApplyResourceChangeRequest(ctx context.Context, proto6 *tfprotov6.ApplyReso
}

fw := &fwserver.ApplyResourceChangeRequest{
ResourceSchema: resourceSchema,
IdentitySchema: identitySchema,
Resource: resource,
ResourceSchema: resourceSchema,
ResourceBehavior: resourceBehavior,
IdentitySchema: identitySchema,
Resource: resource,
}

config, configDiags := Config(ctx, proto6.Config, resourceSchema)
Expand Down
16 changes: 15 additions & 1 deletion internal/fromproto6/applyresourcechange_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ func TestApplyResourceChangeRequest(t *testing.T) {

testCases := map[string]struct {
input *tfprotov6.ApplyResourceChangeRequest
resourceBehavior resource.ResourceBehavior
resourceSchema fwschema.Schema
resource resource.Resource
providerMetaSchema fwschema.Schema
Expand Down Expand Up @@ -309,13 +310,26 @@ func TestApplyResourceChangeRequest(t *testing.T) {
ResourceSchema: testFwSchema,
},
},
"resource-behavior": {
input: &tfprotov6.ApplyResourceChangeRequest{},
resourceSchema: testFwSchema,
resourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
expected: &fwserver.ApplyResourceChangeRequest{
ResourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
ResourceSchema: testFwSchema,
},
},
}

for name, testCase := range testCases {
t.Run(name, func(t *testing.T) {
t.Parallel()

got, diags := fromproto6.ApplyResourceChangeRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.identitySchema)
got, diags := fromproto6.ApplyResourceChangeRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.resourceBehavior, testCase.identitySchema)

if diff := cmp.Diff(got, testCase.expected, cmp.AllowUnexported(privatestate.ProviderData{})); diff != "" {
t.Errorf("unexpected difference: %s", diff)
Expand Down
3 changes: 2 additions & 1 deletion internal/fromproto6/readresource.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ import (

// ReadResourceRequest returns the *fwserver.ReadResourceRequest
// equivalent of a *tfprotov6.ReadResourceRequest.
func ReadResourceRequest(ctx context.Context, proto6 *tfprotov6.ReadResourceRequest, reqResource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, identitySchema fwschema.Schema) (*fwserver.ReadResourceRequest, diag.Diagnostics) {
func ReadResourceRequest(ctx context.Context, proto6 *tfprotov6.ReadResourceRequest, reqResource resource.Resource, resourceSchema fwschema.Schema, providerMetaSchema fwschema.Schema, resourceBehavior resource.ResourceBehavior, identitySchema fwschema.Schema) (*fwserver.ReadResourceRequest, diag.Diagnostics) {
if proto6 == nil {
return nil, nil
}
Expand All @@ -26,6 +26,7 @@ func ReadResourceRequest(ctx context.Context, proto6 *tfprotov6.ReadResourceRequ

fw := &fwserver.ReadResourceRequest{
Resource: reqResource,
ResourceBehavior: resourceBehavior,
IdentitySchema: identitySchema,
ClientCapabilities: ReadResourceClientCapabilities(proto6.ClientCapabilities),
}
Expand Down
15 changes: 14 additions & 1 deletion internal/fromproto6/readresource_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,7 @@ func TestReadResourceRequest(t *testing.T) {

testCases := map[string]struct {
input *tfprotov6.ReadResourceRequest
resourceBehavior resource.ResourceBehavior
resourceSchema fwschema.Schema
identitySchema fwschema.Schema
resource resource.Resource
Expand Down Expand Up @@ -251,13 +252,25 @@ func TestReadResourceRequest(t *testing.T) {
},
},
},
"resource-behavior": {
input: &tfprotov6.ReadResourceRequest{},
resourceSchema: testFwSchema,
resourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
expected: &fwserver.ReadResourceRequest{
ResourceBehavior: resource.ResourceBehavior{
MutableIdentity: true,
},
},
},
}

for name, testCase := range testCases {
t.Run(name, func(t *testing.T) {
t.Parallel()

got, diags := fromproto6.ReadResourceRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.identitySchema)
got, diags := fromproto6.ReadResourceRequest(context.Background(), testCase.input, testCase.resource, testCase.resourceSchema, testCase.providerMetaSchema, testCase.resourceBehavior, testCase.identitySchema)

if diff := cmp.Diff(got, testCase.expected, cmp.AllowUnexported(privatestate.ProviderData{})); diff != "" {
t.Errorf("unexpected difference: %s", diff)
Expand Down
38 changes: 20 additions & 18 deletions internal/fwserver/server_applyresourcechange.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,15 +17,16 @@ import (
// ApplyResourceChangeRequest is the framework server request for the
// ApplyResourceChange RPC.
type ApplyResourceChangeRequest struct {
Config *tfsdk.Config
PlannedPrivate *privatestate.Data
PlannedState *tfsdk.Plan
PlannedIdentity *tfsdk.ResourceIdentity
PriorState *tfsdk.State
ProviderMeta *tfsdk.Config
ResourceSchema fwschema.Schema
IdentitySchema fwschema.Schema
Resource resource.Resource
Config *tfsdk.Config
PlannedPrivate *privatestate.Data
PlannedState *tfsdk.Plan
PlannedIdentity *tfsdk.ResourceIdentity
PriorState *tfsdk.State
ProviderMeta *tfsdk.Config
ResourceSchema fwschema.Schema
IdentitySchema fwschema.Schema
Resource resource.Resource
ResourceBehavior resource.ResourceBehavior
}

// ApplyResourceChangeResponse is the framework server response for the
Expand Down Expand Up @@ -101,15 +102,16 @@ func (s *Server) ApplyResourceChange(ctx context.Context, req *ApplyResourceChan
logging.FrameworkTrace(ctx, "ApplyResourceChange running UpdateResource")

updateReq := &UpdateResourceRequest{
Config: req.Config,
PlannedPrivate: req.PlannedPrivate,
PlannedState: req.PlannedState,
PlannedIdentity: req.PlannedIdentity,
PriorState: req.PriorState,
ProviderMeta: req.ProviderMeta,
ResourceSchema: req.ResourceSchema,
IdentitySchema: req.IdentitySchema,
Resource: req.Resource,
Config: req.Config,
PlannedPrivate: req.PlannedPrivate,
PlannedState: req.PlannedState,
PlannedIdentity: req.PlannedIdentity,
PriorState: req.PriorState,
ProviderMeta: req.ProviderMeta,
ResourceSchema: req.ResourceSchema,
IdentitySchema: req.IdentitySchema,
Resource: req.Resource,
ResourceBehavior: req.ResourceBehavior,
}
updateResp := &UpdateResourceResponse{}

Expand Down
Loading
Loading