Fix tests

Author: tobio

docs/resources/elasticsearch_security_role.md

@@ -135,10 +135,10 @@ Required:
 
 Optional:
 
-- `field_security` (Attributes List) The document fields that the owners of the role have read access to. (see [below for nested schema](#nestedatt--remote_indices--field_security))
+- `field_security` (Block List) The document fields that the owners of the role have read access to. (see [below for nested schema](#nestedblock--remote_indices--field_security))
 - `query` (String) A search query that defines the documents the owners of the role have read access to.
 
-<a id="nestedatt--remote_indices--field_security"></a>
+<a id="nestedblock--remote_indices--field_security"></a>
 ### Nested Schema for `remote_indices.field_security`
 
 Optional:

internal/elasticsearch/security/role/acc_test.go

@@ -46,7 +46,6 @@ func TestAccResourceSecurityRole(t *testing.T) {
 					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "run_as.#"),
 					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "global"),
 					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "applications.#"),
-					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "indices.0.allow_restricted_indices"),
 				),
 			},
 			{
@@ -75,7 +74,6 @@ func TestAccResourceSecurityRole(t *testing.T) {
 					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "run_as.#"),
 					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "global"),
 					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "applications.#"),
-					resource.TestCheckNoResourceAttr("elasticstack_elasticsearch_security_role.test", "indices.0.allow_restricted_indices"),
 					resource.TestCheckTypeSetElemAttr("elasticstack_elasticsearch_security_role.test", "remote_indices.*.clusters.*", "test-cluster2"),
 					resource.TestCheckTypeSetElemAttr("elasticstack_elasticsearch_security_role.test", "remote_indices.*.names.*", "sample2"),
 				),

internal/elasticsearch/security/role/models.go

@@ -13,35 +13,6 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/types"
 )
 
-var (
-	applicationAttrTypes = map[string]attr.Type{
-		"application": types.StringType,
-		"privileges":  types.SetType{ElemType: types.StringType},
-		"resources":   types.SetType{ElemType: types.StringType},
-	}
-
-	fieldSecurityAttrTypes = map[string]attr.Type{
-		"grant":  types.SetType{ElemType: types.StringType},
-		"except": types.SetType{ElemType: types.StringType},
-	}
-
-	indexPermsAttrTypes = map[string]attr.Type{
-		"field_security":           types.ListType{ElemType: types.ObjectType{AttrTypes: fieldSecurityAttrTypes}},
-		"names":                    types.SetType{ElemType: types.StringType},
-		"privileges":               types.SetType{ElemType: types.StringType},
-		"query":                    jsontypes.NormalizedType{},
-		"allow_restricted_indices": types.BoolType,
-	}
-
-	remoteIndexPermsAttrTypes = map[string]attr.Type{
-		"clusters":       types.SetType{ElemType: types.StringType},
-		"field_security": types.ListType{ElemType: types.ObjectType{AttrTypes: fieldSecurityAttrTypes}},
-		"query":          jsontypes.NormalizedType{},
-		"names":          types.SetType{ElemType: types.StringType},
-		"privileges":     types.SetType{ElemType: types.StringType},
-	}
-)
-
 type RoleData struct {
 	Id                      types.String         `tfsdk:"id"`
 	ElasticsearchConnection types.List           `tfsdk:"elasticsearch_connection"`
@@ -329,7 +300,7 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 				return diags
 			}
 
-			appObj, d := types.ObjectValue(applicationAttrTypes, map[string]attr.Value{
+			appObj, d := types.ObjectValue(getApplicationAttrTypes(), map[string]attr.Value{
 				"application": types.StringValue(app.Name),
 				"privileges":  privSet,
 				"resources":   resSet,
@@ -342,14 +313,14 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 			appElements[i] = appObj
 		}
 
-		appSet, d := types.SetValue(types.ObjectType{AttrTypes: applicationAttrTypes}, appElements)
+		appSet, d := types.SetValue(types.ObjectType{AttrTypes: getApplicationAttrTypes()}, appElements)
 		diags.Append(d...)
 		if diags.HasError() {
 			return diags
 		}
 		data.Applications = appSet
 	} else {
-		data.Applications = types.SetNull(types.ObjectType{AttrTypes: applicationAttrTypes})
+		data.Applications = types.SetNull(types.ObjectType{AttrTypes: getApplicationAttrTypes()})
 	}
 
 	// Cluster
@@ -420,7 +391,7 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 					return diags
 				}
 
-				fieldSecObj, d := types.ObjectValue(fieldSecurityAttrTypes, map[string]attr.Value{
+				fieldSecObj, d := types.ObjectValue(getFieldSecurityAttrTypes(), map[string]attr.Value{
 					"grant":  grantSet,
 					"except": exceptSet,
 				})
@@ -429,16 +400,16 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 					return diags
 				}
 
-				fieldSecList, d = types.ListValue(types.ObjectType{AttrTypes: fieldSecurityAttrTypes}, []attr.Value{fieldSecObj})
+				fieldSecList, d = types.ListValue(types.ObjectType{AttrTypes: getFieldSecurityAttrTypes()}, []attr.Value{fieldSecObj})
 				diags.Append(d...)
 				if diags.HasError() {
 					return diags
 				}
 			} else {
-				fieldSecList = types.ListNull(types.ObjectType{AttrTypes: fieldSecurityAttrTypes})
+				fieldSecList = types.ListNull(types.ObjectType{AttrTypes: getFieldSecurityAttrTypes()})
 			}
 
-			indexObj, d := types.ObjectValue(indexPermsAttrTypes, map[string]attr.Value{
+			indexObj, d := types.ObjectValue(getIndexPermsAttrTypes(), map[string]attr.Value{
 				"field_security":           fieldSecList,
 				"names":                    namesSet,
 				"privileges":               privSet,
@@ -453,14 +424,14 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 			indicesElements[i] = indexObj
 		}
 
-		indicesSet, d := types.SetValue(types.ObjectType{AttrTypes: indexPermsAttrTypes}, indicesElements)
+		indicesSet, d := types.SetValue(types.ObjectType{AttrTypes: getIndexPermsAttrTypes()}, indicesElements)
 		diags.Append(d...)
 		if diags.HasError() {
 			return diags
 		}
 		data.Indices = indicesSet
 	} else {
-		data.Indices = types.SetNull(types.ObjectType{AttrTypes: indexPermsAttrTypes})
+		data.Indices = types.SetNull(types.ObjectType{AttrTypes: getIndexPermsAttrTypes()})
 	}
 
 	// Remote Indices
@@ -494,19 +465,19 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 
 			var fieldSecList types.List
 			if remoteIndex.FieldSecurity != nil {
-				grantSet, d := types.SetValueFrom(ctx, types.StringType, remoteIndex.FieldSecurity.Grant)
+				grantSet, d := types.SetValueFrom(ctx, types.StringType, utils.NonNilSlice(remoteIndex.FieldSecurity.Grant))
 				diags.Append(d...)
 				if diags.HasError() {
 					return diags
 				}
 
-				exceptSet, d := types.SetValueFrom(ctx, types.StringType, remoteIndex.FieldSecurity.Except)
+				exceptSet, d := types.SetValueFrom(ctx, types.StringType, utils.NonNilSlice(remoteIndex.FieldSecurity.Except))
 				diags.Append(d...)
 				if diags.HasError() {
 					return diags
 				}
 
-				fieldSecObj, d := types.ObjectValue(fieldSecurityAttrTypes, map[string]attr.Value{
+				fieldSecObj, d := types.ObjectValue(getRemoteFieldSecurityAttrTypes(), map[string]attr.Value{
 					"grant":  grantSet,
 					"except": exceptSet,
 				})
@@ -515,16 +486,16 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 					return diags
 				}
 
-				fieldSecList, d = types.ListValue(types.ObjectType{AttrTypes: fieldSecurityAttrTypes}, []attr.Value{fieldSecObj})
+				fieldSecList, d = types.ListValue(types.ObjectType{AttrTypes: getRemoteFieldSecurityAttrTypes()}, []attr.Value{fieldSecObj})
 				diags.Append(d...)
 				if diags.HasError() {
 					return diags
 				}
 			} else {
-				fieldSecList = types.ListNull(types.ObjectType{AttrTypes: fieldSecurityAttrTypes})
+				fieldSecList = types.ListNull(types.ObjectType{AttrTypes: getRemoteFieldSecurityAttrTypes()})
 			}
 
-			remoteIndexObj, d := types.ObjectValue(remoteIndexPermsAttrTypes, map[string]attr.Value{
+			remoteIndexObj, d := types.ObjectValue(getRemoteIndexPermsAttrTypes(), map[string]attr.Value{
 				"clusters":       clustersSet,
 				"field_security": fieldSecList,
 				"query":          queryVal,
@@ -539,14 +510,14 @@ func (data *RoleData) fromAPIModel(ctx context.Context, role *models.Role) diag.
 			remoteIndicesElements[i] = remoteIndexObj
 		}
 
-		remoteIndicesSet, d := types.SetValue(types.ObjectType{AttrTypes: remoteIndexPermsAttrTypes}, remoteIndicesElements)
+		remoteIndicesSet, d := types.SetValue(types.ObjectType{AttrTypes: getRemoteIndexPermsAttrTypes()}, remoteIndicesElements)
 		diags.Append(d...)
 		if diags.HasError() {
 			return diags
 		}
 		data.RemoteIndices = remoteIndicesSet
 	} else {
-		data.RemoteIndices = types.SetNull(types.ObjectType{AttrTypes: remoteIndexPermsAttrTypes})
+		data.RemoteIndices = types.SetNull(types.ObjectType{AttrTypes: getRemoteIndexPermsAttrTypes()})
 	}
 
 	// Metadata

internal/elasticsearch/security/role/read.go

@@ -7,6 +7,7 @@ import (
 	"github.com/elastic/terraform-provider-elasticstack/internal/clients"
 	"github.com/elastic/terraform-provider-elasticstack/internal/clients/elasticsearch"
 	"github.com/elastic/terraform-provider-elasticstack/internal/diagutil"
+	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/types"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
@@ -19,39 +20,53 @@ func (r *roleResource) Read(ctx context.Context, req resource.ReadRequest, resp
 		return
 	}
 
-	compId, diags := clients.CompositeIdFromStrFw(data.Id.ValueString())
+	readData, diags := r.read(ctx, data)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return
 	}
+
+	if readData == nil {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	resp.Diagnostics.Append(req.State.Set(ctx, readData)...)
+}
+
+func (r *roleResource) read(ctx context.Context, data RoleData) (*RoleData, diag.Diagnostics) {
+	compId, diags := clients.CompositeIdFromStrFw(data.Id.ValueString())
+	diags.Append(diags...)
+	if diags.HasError() {
+		return nil, diags
+	}
 	roleId := compId.ResourceId
 
 	client, diags := clients.MaybeNewApiClientFromFrameworkResource(ctx, data.ElasticsearchConnection, r.client)
-	resp.Diagnostics.Append(diags...)
-	if resp.Diagnostics.HasError() {
-		return
+	diags.Append(diags...)
+	if diags.HasError() {
+		return nil, diags
 	}
 
 	role, sdkDiags := elasticsearch.GetRole(ctx, client, roleId)
-	resp.Diagnostics.Append(diagutil.FrameworkDiagsFromSDK(sdkDiags)...)
-	if resp.Diagnostics.HasError() {
-		return
+	diags.Append(diagutil.FrameworkDiagsFromSDK(sdkDiags)...)
+	if diags.HasError() {
+		return nil, diags
 	}
 
 	if role == nil {
-		tflog.Warn(ctx, fmt.Sprintf(`Role "%s" not found, removing from state`, roleId))
-		resp.State.RemoveResource(ctx)
-		return
+		tflog.Warn(ctx, fmt.Sprintf(`Role "%s" not found`, roleId))
+		return nil, diags
 	}
 
 	// Convert from API model
-	resp.Diagnostics.Append(data.fromAPIModel(ctx, role)...)
-	if resp.Diagnostics.HasError() {
-		return
+	diags.Append(data.fromAPIModel(ctx, role)...)
+	if diags.HasError() {
+		return nil, diags
 	}
 
 	// Set the name to the roleId we extracted to ensure consistency
 	data.Name = types.StringValue(roleId)
 
-	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+	return &data, diags
 }

internal/elasticsearch/security/role/resource.go

@@ -2,16 +2,20 @@ package role
 
 import (
 	"context"
+	"encoding/json"
 
 	"github.com/elastic/terraform-provider-elasticstack/internal/clients"
+	"github.com/elastic/terraform-provider-elasticstack/internal/utils"
 	"github.com/hashicorp/terraform-plugin-framework/path"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
 )
 
 // Ensure provider defined types fully satisfy framework interfaces
 var _ resource.Resource = &roleResource{}
 var _ resource.ResourceWithConfigure = &roleResource{}
 var _ resource.ResourceWithImportState = &roleResource{}
+var _ resource.ResourceWithUpgradeState = &roleResource{}
 
 func NewRoleResource() resource.Resource {
 	return &roleResource{}
@@ -34,3 +38,70 @@ func (r *roleResource) Configure(_ context.Context, req resource.ConfigureReques
 func (r *roleResource) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
 	resource.ImportStatePassthroughID(ctx, path.Root("id"), req, resp)
 }
+
+func (r *roleResource) UpgradeState(_ context.Context) map[int64]resource.StateUpgrader {
+	return map[int64]resource.StateUpgrader{
+		0: {
+			PriorSchema:   utils.Pointer(GetSchema(0)),
+			StateUpgrader: v0ToV1,
+		},
+	}
+}
+
+func v0ToV1(ctx context.Context, req resource.UpgradeStateRequest, resp *resource.UpgradeStateResponse) {
+	var priorState map[string]interface{}
+	err := json.Unmarshal(req.RawState.JSON, &priorState)
+	if err != nil {
+		resp.Diagnostics.AddError("State Upgrade Error", "Could not unmarshal prior state: "+err.Error())
+		return
+	}
+
+	if priorState["global"] == "" {
+		delete(priorState, "global")
+	}
+
+	if priorState["metadata"] == "" {
+		delete(priorState, "metadata")
+	}
+
+	indices, ok := priorState["indices"]
+	if ok {
+		indicesSlice, ok := indices.([]interface{})
+		if ok {
+			for i, index := range indicesSlice {
+				indexMap, ok := index.(map[string]interface{})
+				if ok {
+					if indexMap["query"] == "" {
+						delete(indexMap, "query")
+					}
+					indicesSlice[i] = indexMap
+				}
+			}
+		}
+	}
+
+	remoteIndices, ok := priorState["remote_indices"]
+	if ok {
+		remoteIndicesSlice, ok := remoteIndices.([]interface{})
+		if ok {
+			for i, remoteIndex := range remoteIndicesSlice {
+				remoteIndexMap, ok := remoteIndex.(map[string]interface{})
+				if ok {
+					if remoteIndexMap["query"] == "" {
+						delete(remoteIndexMap, "query")
+					}
+					remoteIndicesSlice[i] = remoteIndexMap
+				}
+			}
+		}
+	}
+
+	stateJSON, err := json.Marshal(priorState)
+	if err != nil {
+		resp.Diagnostics.AddError("State Upgrade Error", "Could not marshal new state: "+err.Error())
+		return
+	}
+	resp.DynamicValue = &tfprotov6.DynamicValue{
+		JSON: stateJSON,
+	}
+}