From 5d6d277186282a030f5dcaae1332847a3da02f23 Mon Sep 17 00:00:00 2001 From: Hugo <10965479+hugoghx@users.noreply.github.com> Date: Tue, 8 Oct 2024 18:37:12 +0100 Subject: [PATCH] chore(provider): Remove support for GrantScopeId (#627) --- CHANGELOG.md | 8 ++ docs/resources/role.md | 1 - go.mod | 18 +-- go.sum | 33 +++-- internal/provider/resource_role.go | 37 ------ ...ource_role_grant_scope_ids_upgrade_test.go | 116 ------------------ 6 files changed, 33 insertions(+), 180 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0d577f5a..d98d3e44 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,14 @@ Canonical reference for changes, improvements, and bugfixes for the Boundary Ter ## Next +### Deprecations/Changes + +* With Boundary 0.15, a deprecation notice was put under the `grant_scope_id` + field, and a new `grant_scope_ids` field was introduced to replace it. With + Boundary v0.17.1 and Boundary API v0.0.52, `grant_scope_id` support was + entirely removed. `grant_scope_id` support has now been removed from this TF + provider. + ## 1.1.15 (May 1, 2024) ### New and Improved diff --git a/docs/resources/role.md b/docs/resources/role.md index 9f3faf9f..836399c9 100644 --- a/docs/resources/role.md +++ b/docs/resources/role.md @@ -127,7 +127,6 @@ resource "boundary_role" "readonly" { ### Optional - `description` (String) The role description. -- `grant_scope_id` (String, Deprecated) For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply. - `grant_scope_ids` (Set of String) A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants" - `grant_strings` (Set of String) A list of stringified grants for the role. - `name` (String) The role name. Defaults to the resource name. diff --git a/go.mod b/go.mod index 5902d0af..2ab27110 100644 --- a/go.mod +++ b/go.mod @@ -1,12 +1,12 @@ module github.com/hashicorp/terraform-provider-boundary -go 1.22.2 +go 1.23.1 require ( github.com/YakDriver/regexache v0.23.0 - github.com/hashicorp/boundary v0.16.0 - github.com/hashicorp/boundary/api v0.0.49 - github.com/hashicorp/boundary/sdk v0.0.46 + github.com/hashicorp/boundary v0.17.1 + github.com/hashicorp/boundary/api v0.0.52 + github.com/hashicorp/boundary/sdk v0.0.48 github.com/hashicorp/cap v0.5.1-0.20240315182732-faa330bfb8df github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744 github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637 @@ -53,7 +53,7 @@ require ( github.com/danieljoos/wincred v1.2.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/docker/cli v25.0.3+incompatible // indirect - github.com/docker/docker v26.0.2+incompatible // indirect + github.com/docker/docker v27.1.1+incompatible // indirect github.com/docker/go-connections v0.5.0 // indirect github.com/docker/go-units v0.5.0 // indirect github.com/dustin/go-humanize v1.0.1 // indirect @@ -83,13 +83,13 @@ require ( github.com/hashicorp/go-checkpoint v0.5.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-dbw v0.1.3-0.20240312210008-7ed943176e5b // indirect - github.com/hashicorp/go-hclog v1.6.2 // indirect + github.com/hashicorp/go-hclog v1.6.3 // indirect github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231219183231-6bac757bb482 // indirect github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hashicorp/go-plugin v1.6.0 // indirect github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab // indirect - github.com/hashicorp/go-retryablehttp v0.7.5 // indirect + github.com/hashicorp/go-retryablehttp v0.7.7 // indirect github.com/hashicorp/go-rootcerts v1.0.2 // indirect github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect @@ -106,7 +106,7 @@ require ( github.com/hashicorp/hcl v1.0.1-vault-5 // indirect github.com/hashicorp/hcl/v2 v2.19.1 // indirect github.com/hashicorp/logutils v1.0.0 // indirect - github.com/hashicorp/nodeenrollment v0.2.10 // indirect + github.com/hashicorp/nodeenrollment v0.2.13 // indirect github.com/hashicorp/terraform-exec v0.20.0 // indirect github.com/hashicorp/terraform-json v0.21.0 // indirect github.com/hashicorp/terraform-plugin-go v0.22.0 // indirect @@ -192,7 +192,7 @@ require ( golang.org/x/net v0.23.0 // indirect golang.org/x/oauth2 v0.17.0 // indirect golang.org/x/sync v0.6.0 // indirect - golang.org/x/sys v0.18.0 // indirect + golang.org/x/sys v0.20.0 // indirect golang.org/x/term v0.18.0 // indirect golang.org/x/text v0.14.0 // indirect golang.org/x/time v0.5.0 // indirect diff --git a/go.sum b/go.sum index 6d14b77f..ce2ef5a8 100644 --- a/go.sum +++ b/go.sum @@ -91,8 +91,8 @@ github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/docker/cli v25.0.3+incompatible h1:KLeNs7zws74oFuVhgZQ5ONGZiXUUdgsdy6/EsX/6284= github.com/docker/cli v25.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= -github.com/docker/docker v26.0.2+incompatible h1:yGVmKUFGgcxA6PXWAokO0sQL22BrQ67cgVjko8tGdXE= -github.com/docker/docker v26.0.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= +github.com/docker/docker v27.1.1+incompatible h1:hO/M4MtV36kzKldqnA37IWhebRA+LnqqcqDja6kVaKY= +github.com/docker/docker v27.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c= github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc= github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4= @@ -193,12 +193,12 @@ github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDa github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8= github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is= github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHgRbTWrTHu6tqPeKxEQv15giM= -github.com/hashicorp/boundary v0.16.0 h1:VS3uKVMYBEdCKr0vBOqmo9f2Vms7ePOngrWQk/vaefE= -github.com/hashicorp/boundary v0.16.0/go.mod h1:mF8dJ7vI7dOMrApAIFReb1738VG7L1J9KkTD998+zrA= -github.com/hashicorp/boundary/api v0.0.49 h1:Gq5yHYtx1DYGkPj9XhD22RB1Edj2qv+d3hT4117jYHk= -github.com/hashicorp/boundary/api v0.0.49/go.mod h1:64V8LYtPUXm6H/bhI/w0O9p8mufZlQpsbWtEQ7nP0kg= -github.com/hashicorp/boundary/sdk v0.0.46 h1:yPRrnWmHGkh1C30JwHQAMLvYVObwQw9fkHWOtwEhaS8= -github.com/hashicorp/boundary/sdk v0.0.46/go.mod h1:9iOT7kDM6mYcSkKxNuZlv8rP7U5BG1kXoevjLLL8lNQ= +github.com/hashicorp/boundary v0.17.1 h1:F7jxgYDqVJXaoc2lECKa1fNCd67+Ax7ensj0SF/k0u8= +github.com/hashicorp/boundary v0.17.1/go.mod h1:yjHRazW2F6qQMA+HZzZvnsC9QXsP6LvTtwFXX7BQSXY= +github.com/hashicorp/boundary/api v0.0.52 h1:eGs+bktswyyOQLlFHF834q/0Eh3itpvrHwsP8Uxd0Ng= +github.com/hashicorp/boundary/api v0.0.52/go.mod h1:64V8LYtPUXm6H/bhI/w0O9p8mufZlQpsbWtEQ7nP0kg= +github.com/hashicorp/boundary/sdk v0.0.48 h1:4HqyX1tS1kuaCa18OSbPGf8ZHJuwdmm1yaxr1u+nxZ4= +github.com/hashicorp/boundary/sdk v0.0.48/go.mod h1:9iOT7kDM6mYcSkKxNuZlv8rP7U5BG1kXoevjLLL8lNQ= github.com/hashicorp/cap v0.5.1-0.20240315182732-faa330bfb8df h1:GG98gdcZqXuOgY6UnPpgGfynKd492IGICpjaEz4rKmw= github.com/hashicorp/cap v0.5.1-0.20240315182732-faa330bfb8df/go.mod h1:9XAXB89zPUrfaNzjbUG4f0/cVQ81oNx/vUudy6wnOzw= github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744 h1:6cU01ORaCUxRXRS0YYnmm4tMfAvFRjamhjgMrgmoWZs= @@ -225,9 +225,8 @@ github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637 h1:Ud/6/AdmJ1R7 github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs= github.com/hashicorp/go-dbw v0.1.3-0.20240312210008-7ed943176e5b h1:DKThhRxpCyHtmzCwdZUPTSM+DRSOHCUv7eBs+AqIJ7c= github.com/hashicorp/go-dbw v0.1.3-0.20240312210008-7ed943176e5b/go.mod h1:dEiD86O4U0CNjS6p4xgRLjXCyMfj1DUQtpsnG/ORU38= -github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ= -github.com/hashicorp/go-hclog v1.6.2 h1:NOtoftovWkDheyUM/8JW3QMiXyxJK3uHRK7wV04nD2I= -github.com/hashicorp/go-hclog v1.6.2/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= +github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k= +github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M= github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231219183231-6bac757bb482 h1:1DqTnLaNk658AEenlF4PNGYd9b1hXE/+0jSOBIGOAms= github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231219183231-6bac757bb482/go.mod h1:323uN1BJ6bc9F1U6DPvgmLTVlBlMMnOIRrzCd5ZDee0= github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7 h1:gM4OwbF16Cmfxt2QMkoGMQbRTfYFZLvDMPgU3rM3KIo= @@ -241,8 +240,8 @@ github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDm github.com/hashicorp/go-plugin v1.6.0/go.mod h1:lBS5MtSSBZk0SHc66KACcjjlU6WzEVP/8pwz68aMkCI= github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab h1:XIeGyyCCS80b5MKfU4E6ioLocIYtT4FmfdNH0uNYQi8= github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab/go.mod h1:uTQC66EFZuSKunHYx0hHIfdH3nhRrv7UOOE8Ug0yI0A= -github.com/hashicorp/go-retryablehttp v0.7.5 h1:bJj+Pj19UZMIweq/iie+1u5YCdGrnxCT9yvm0e+Nd5M= -github.com/hashicorp/go-retryablehttp v0.7.5/go.mod h1:Jy/gPYAdjqffZ/yFGCFV2doI5wjtH1ewM9u8iYVjtX8= +github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU= +github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk= github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc= github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8= github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw= @@ -285,8 +284,8 @@ github.com/hashicorp/hcl/v2 v2.19.1 h1://i05Jqznmb2EXqa39Nsvyan2o5XyMowW5fnCKW5R github.com/hashicorp/hcl/v2 v2.19.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE= github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y= github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64= -github.com/hashicorp/nodeenrollment v0.2.10 h1:KDp5z3wJ3cRmfnNdMmiDrEqN1V4FTtFaeM4AFg8FYfo= -github.com/hashicorp/nodeenrollment v0.2.10/go.mod h1:3TcYV0L7N4EmeGHIQWr/JFAAsV+yHJaX9IQjeff/w5Q= +github.com/hashicorp/nodeenrollment v0.2.13 h1:TkVH6giSXgq4ojwWzbK1Q9JQgvGVilWtdmAdw7Lfeug= +github.com/hashicorp/nodeenrollment v0.2.13/go.mod h1:3TcYV0L7N4EmeGHIQWr/JFAAsV+yHJaX9IQjeff/w5Q= github.com/hashicorp/terraform-exec v0.20.0 h1:DIZnPsqzPGuUnq6cH8jWcPunBfY+C+M8JyYF3vpnuEo= github.com/hashicorp/terraform-exec v0.20.0/go.mod h1:ckKGkJWbsNqFKV1itgMnE0hY9IYf1HoiekpuN0eWoDw= github.com/hashicorp/terraform-json v0.21.0 h1:9NQxbLNqPbEMze+S6+YluEdXgJmhQykRyRNd+zTI05U= @@ -709,8 +708,8 @@ golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4= -golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y= +golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= diff --git a/internal/provider/resource_role.go b/internal/provider/resource_role.go index af3e11ec..add6de2c 100644 --- a/internal/provider/resource_role.go +++ b/internal/provider/resource_role.go @@ -19,7 +19,6 @@ import ( ) const ( - roleGrantScopeIdKey = "grant_scope_id" roleGrantScopeIdsKey = "grant_scope_ids" rolePrincipalIdsKey = "principal_ids" roleGrantStringsKey = "grant_strings" @@ -71,13 +70,6 @@ func resourceRole() *schema.Resource { Optional: true, Elem: &schema.Schema{Type: schema.TypeString}, }, - roleGrantScopeIdKey: { - Description: "For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply.", - Type: schema.TypeString, - Optional: true, - Computed: true, - Deprecated: "In Boundary 0.15+, please use `grant_scope_ids` instead. This field will be removed in a future release.", - }, roleGrantScopeIdsKey: { Description: `A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"`, Type: schema.TypeSet, @@ -108,9 +100,6 @@ func setFromRoleResponseMap(d *schema.ResourceData, raw map[string]interface{}) if err := d.Set(roleGrantScopeIdsKey, raw["grant_scope_ids"]); err != nil { return err } - if err := d.Set(roleGrantScopeIdKey, raw["grant_scope_id"]); err != nil { - return err - } d.SetId(raw["id"].(string)) return nil @@ -140,11 +129,6 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf opts = append(opts, roles.WithDescription(descStr)) } - grantScopeIdVal := d.Get(roleGrantScopeIdKey) - if grantScopeIdVal != "" { - grantScopeIdStr := grantScopeIdVal.(string) - opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr)) - } var grantScopeIds []string if grantScopeIdsVal, ok := d.GetOk(roleGrantScopeIdsKey); ok { list := grantScopeIdsVal.(*schema.Set).List() @@ -288,22 +272,6 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf } } - var grantScopeId *string - if d.HasChange(roleGrantScopeIdKey) { - // If it is an update to use the multi-value grant_scope_ids, and this - // has changed to "", then don't set it on the API. Instead let it fall - // through and below it'll be updated to be "". - if !d.HasChange(roleGrantScopeIdsKey) { - opts = append(opts, roles.DefaultGrantScopeId()) - grantScopeIdVal, ok := d.GetOk(roleGrantScopeIdKey) - if ok { - grantScopeIdStr := grantScopeIdVal.(string) - grantScopeId = &grantScopeIdStr - opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr)) - } - } - } - if len(opts) > 0 { opts = append(opts, roles.WithAutomaticVersioning(true)) _, err := rc.Update(ctx, d.Id(), 0, opts...) @@ -322,11 +290,6 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf return diag.FromErr(err) } } - if d.HasChange(roleGrantScopeIdKey) { - if err := d.Set(roleGrantScopeIdKey, grantScopeId); err != nil { - return diag.FromErr(err) - } - } var diags diag.Diagnostics if d.HasChange(roleGrantStringsKey) { diff --git a/internal/provider/resource_role_grant_scope_ids_upgrade_test.go b/internal/provider/resource_role_grant_scope_ids_upgrade_test.go index 03dafc90..3f003f2f 100644 --- a/internal/provider/resource_role_grant_scope_ids_upgrade_test.go +++ b/internal/provider/resource_role_grant_scope_ids_upgrade_test.go @@ -47,22 +47,6 @@ var ( grant_scope_ids = ["this", "children", "p_foobar1234"] }` - conversionOrgRoleWithGrantScopeId = ` -resource "boundary_role" "with_grant_scope_id" { - name = "grant scope id role" - scope_id = boundary_scope.org1.id - depends_on = [boundary_role.org1_admin] - grant_scope_id = boundary_scope.org1.id -}` - - conversionOrgRoleWithGrantScopeIdUpdate = ` -resource "boundary_role" "with_grant_scope_id" { - name = "grant scope id role" - scope_id = boundary_scope.org1.id - depends_on = [boundary_role.org1_admin] - grant_scope_id = boundary_scope.proj1.id -}` - conversionOrgRoleWithGrantScopeIdsConversion = ` resource "boundary_role" "with_grant_scope_id" { name = "grant scope id role" @@ -132,106 +116,6 @@ func TestAccRoleWithGrantScopes(t *testing.T) { }) } -// TestAccRoleGrantScopeUpgrade exercises some specific upgrade scenarios around -// grant_scope_id -> grant_scope_ids -func TestAccRoleWithGrantScopesUpdate(t *testing.T) { - tc := controller.NewTestController(t, tcConfig...) - t.Cleanup(tc.Shutdown) - url := tc.ApiAddrs()[0] - - var provider *schema.Provider - resource.Test(t, resource.TestCase{ - IsUnitTest: true, - ProviderFactories: providerFactories(&provider), - CheckDestroy: testAccCheckRoleResourceDestroy(t, provider), - Steps: []resource.TestStep{ - { - // Create - Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeId), - Check: resource.ComposeTestCheckFunc( - testAccCheckScopeResourceExists(provider, "boundary_scope.org1"), - testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"), - testAccCheckUserResourceExists(provider, "boundary_user.foo"), - testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.org1"}), - testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.org1"), - ), - }, - importStep("boundary_role.with_grant_scope_id"), - { - Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdUpdate), - Check: resource.ComposeTestCheckFunc( - testAccCheckScopeResourceExists(provider, "boundary_scope.org1"), - testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"), - testAccCheckUserResourceExists(provider, "boundary_user.foo"), - testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.proj1"}), - testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.proj1"), - ), - }, - importStep("boundary_role.with_grant_scope_id"), - { - Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsConversion), - Check: resource.ComposeTestCheckFunc( - testAccCheckScopeResourceExists(provider, "boundary_scope.org1"), - testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"), - testAccCheckUserResourceExists(provider, "boundary_user.foo"), - testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "boundary_scope.proj1"}), - testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""), - ), - }, - importStep("boundary_role.with_grant_scope_id"), - { - Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsUpdate), - Check: resource.ComposeTestCheckFunc( - testAccCheckScopeResourceExists(provider, "boundary_scope.org1"), - testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"), - testAccCheckUserResourceExists(provider, "boundary_user.foo"), - testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "children"}), - testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""), - ), - }, - importStep("boundary_role.with_grant_scope_id"), - }, - }) -} - -func testAccCheckRoleResourceGrantScopeSet(testProvider *schema.Provider, name string, grantScope string) resource.TestCheckFunc { - return func(s *terraform.State) error { - rs, ok := s.RootModule().Resources[name] - if !ok { - return fmt.Errorf("role resource not found: %s", name) - } - - roleId := rs.Primary.ID - - scopeId := grantScope - if grantScope != "children" && grantScope != "this" && grantScope != "descendants" && grantScope != "" { - scope, ok := s.RootModule().Resources[grantScope] - if !ok { - return fmt.Errorf("scope resource not found: %s", grantScope) - } - - scopeId = scope.Primary.ID - if scopeId == "" { - return fmt.Errorf("role resource ID is not set") - } - } - - md := testProvider.Meta().(*metaData) - rolesClient := roles.NewClient(md.client) - - rr, err := rolesClient.Read(context.Background(), roleId) - if err != nil { - return fmt.Errorf("Got an error when reading role %q: %v", roleId, err) - } - - if rr.Item.GrantScopeId != scopeId { - return fmt.Errorf("grant scope id in state is %s but in boundary is %s", scopeId, rr.Item.GrantScopeId) - } - - return nil - } -} - func testAccCheckRoleResourceGrantScopesSet(testProvider *schema.Provider, name string, grantScopeIds []string) resource.TestCheckFunc { return func(s *terraform.State) error { rs, ok := s.RootModule().Resources[name]