CyberCoveLLC/terraform-provider-threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore(provider): Remove support for GrantScopeId (#627)

Browse Source
This commit is contained in:
Hugo authored and GitHub committed 2024-10-08 18:37:12 +01:00
1 parent 4590e7f8c8
commit 5d6d277186
6 files changed
+33 -180
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/provider/resource_role.go
-37
View File
@@ -19,7 +19,6 @@ import (
)
const (
roleGrantScopeIdKey = "grant_scope_id"
roleGrantScopeIdsKey = "grant_scope_ids"
rolePrincipalIdsKey = "principal_ids"
roleGrantStringsKey = "grant_strings"
@@ -71,13 +70,6 @@ func resourceRole() *schema.Resource {
Optional: true,
Elem: &schema.Schema{Type: schema.TypeString},
},
roleGrantScopeIdKey: {
Description: "For Boundary 0.15+, use `grant_scope_ids` instead. The scope for which the grants in the role should apply.",
Type: schema.TypeString,
Optional: true,
Computed: true,
Deprecated: "In Boundary 0.15+, please use `grant_scope_ids` instead. This field will be removed in a future release.",
},
roleGrantScopeIdsKey: {
Description: `A list of scopes for which the grants in this role should apply, which can include the special values "this", "children", or "descendants"`,
Type: schema.TypeSet,
@@ -108,9 +100,6 @@ func setFromRoleResponseMap(d *schema.ResourceData, raw map[string]interface{})
if err := d.Set(roleGrantScopeIdsKey, raw["grant_scope_ids"]); err != nil {
return err
}
if err := d.Set(roleGrantScopeIdKey, raw["grant_scope_id"]); err != nil {
return err
}
d.SetId(raw["id"].(string))
return nil
@@ -140,11 +129,6 @@ func resourceRoleCreate(ctx context.Context, d *schema.ResourceData, meta interf
opts = append(opts, roles.WithDescription(descStr))
}
grantScopeIdVal := d.Get(roleGrantScopeIdKey)
if grantScopeIdVal != "" {
grantScopeIdStr := grantScopeIdVal.(string)
opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr))
}
var grantScopeIds []string
if grantScopeIdsVal, ok := d.GetOk(roleGrantScopeIdsKey); ok {
list := grantScopeIdsVal.(*schema.Set).List()
@@ -288,22 +272,6 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
}
}
var grantScopeId *string
if d.HasChange(roleGrantScopeIdKey) {
// If it is an update to use the multi-value grant_scope_ids, and this
// has changed to "", then don't set it on the API. Instead let it fall
// through and below it'll be updated to be "".
if !d.HasChange(roleGrantScopeIdsKey) {
opts = append(opts, roles.DefaultGrantScopeId())
grantScopeIdVal, ok := d.GetOk(roleGrantScopeIdKey)
if ok {
grantScopeIdStr := grantScopeIdVal.(string)
grantScopeId = &grantScopeIdStr
opts = append(opts, roles.WithGrantScopeId(grantScopeIdStr))
}
}
}
if len(opts) > 0 {
opts = append(opts, roles.WithAutomaticVersioning(true))
_, err := rc.Update(ctx, d.Id(), 0, opts...)
@@ -322,11 +290,6 @@ func resourceRoleUpdate(ctx context.Context, d *schema.ResourceData, meta interf
return diag.FromErr(err)
}
}
if d.HasChange(roleGrantScopeIdKey) {
if err := d.Set(roleGrantScopeIdKey, grantScopeId); err != nil {
return diag.FromErr(err)
}
}
var diags diag.Diagnostics
if d.HasChange(roleGrantStringsKey) {
internal/provider/resource_role_grant_scope_ids_upgrade_test.go
-116
View File
@@ -47,22 +47,6 @@ var (
grant_scope_ids = ["this", "children", "p_foobar1234"]
}`
conversionOrgRoleWithGrantScopeId = `
resource "boundary_role" "with_grant_scope_id" {
name = "grant scope id role"
scope_id = boundary_scope.org1.id
depends_on = [boundary_role.org1_admin]
grant_scope_id = boundary_scope.org1.id
}`
conversionOrgRoleWithGrantScopeIdUpdate = `
resource "boundary_role" "with_grant_scope_id" {
name = "grant scope id role"
scope_id = boundary_scope.org1.id
depends_on = [boundary_role.org1_admin]
grant_scope_id = boundary_scope.proj1.id
}`
conversionOrgRoleWithGrantScopeIdsConversion = `
resource "boundary_role" "with_grant_scope_id" {
name = "grant scope id role"
@@ -132,106 +116,6 @@ func TestAccRoleWithGrantScopes(t *testing.T) {
})
}
// TestAccRoleGrantScopeUpgrade exercises some specific upgrade scenarios around
// grant_scope_id -> grant_scope_ids
func TestAccRoleWithGrantScopesUpdate(t *testing.T) {
tc := controller.NewTestController(t, tcConfig...)
t.Cleanup(tc.Shutdown)
url := tc.ApiAddrs()[0]
var provider *schema.Provider
resource.Test(t, resource.TestCase{
IsUnitTest: true,
ProviderFactories: providerFactories(&provider),
CheckDestroy: testAccCheckRoleResourceDestroy(t, provider),
Steps: []resource.TestStep{
{
// Create
Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeId),
Check: resource.ComposeTestCheckFunc(
testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
testAccCheckUserResourceExists(provider, "boundary_user.foo"),
testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.org1"}),
testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.org1"),
),
},
importStep("boundary_role.with_grant_scope_id"),
{
Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdUpdate),
Check: resource.ComposeTestCheckFunc(
testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
testAccCheckUserResourceExists(provider, "boundary_user.foo"),
testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"boundary_scope.proj1"}),
testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", "boundary_scope.proj1"),
),
},
importStep("boundary_role.with_grant_scope_id"),
{
Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsConversion),
Check: resource.ComposeTestCheckFunc(
testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
testAccCheckUserResourceExists(provider, "boundary_user.foo"),
testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "boundary_scope.proj1"}),
testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""),
),
},
importStep("boundary_role.with_grant_scope_id"),
{
Config: testConfig(url, fooOrg, firstProjectFoo, fooUser, conversionOrgRoleWithGrantScopeIdsUpdate),
Check: resource.ComposeTestCheckFunc(
testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
testAccCheckRoleResourceExists(provider, "boundary_role.with_grant_scope_id"),
testAccCheckUserResourceExists(provider, "boundary_user.foo"),
testAccCheckRoleResourceGrantScopesSet(provider, "boundary_role.with_grant_scope_id", []string{"this", "children"}),
testAccCheckRoleResourceGrantScopeSet(provider, "boundary_role.with_grant_scope_id", ""),
),
},
importStep("boundary_role.with_grant_scope_id"),
},
})
}
func testAccCheckRoleResourceGrantScopeSet(testProvider *schema.Provider, name string, grantScope string) resource.TestCheckFunc {
return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[name]
if !ok {
return fmt.Errorf("role resource not found: %s", name)
}
roleId := rs.Primary.ID
scopeId := grantScope
if grantScope != "children" && grantScope != "this" && grantScope != "descendants" && grantScope != "" {
scope, ok := s.RootModule().Resources[grantScope]
if !ok {
return fmt.Errorf("scope resource not found: %s", grantScope)
}
scopeId = scope.Primary.ID
if scopeId == "" {
return fmt.Errorf("role resource ID is not set")
}
}
md := testProvider.Meta().(*metaData)
rolesClient := roles.NewClient(md.client)
rr, err := rolesClient.Read(context.Background(), roleId)
if err != nil {
return fmt.Errorf("Got an error when reading role %q: %v", roleId, err)
}
if rr.Item.GrantScopeId != scopeId {
return fmt.Errorf("grant scope id in state is %s but in boundary is %s", scopeId, rr.Item.GrantScopeId)
}
return nil
}
}
func testAccCheckRoleResourceGrantScopesSet(testProvider *schema.Provider, name string, grantScopeIds []string) resource.TestCheckFunc {
return func(s *terraform.State) error {
rs, ok := s.RootModule().Resources[name]