From f80b22fcd70d036b28b754d950c5b63b84634775 Mon Sep 17 00:00:00 2001 From: Sergiu Ghitea Date: Sat, 16 Jul 2022 17:40:51 +0200 Subject: [PATCH] Throw warning when encountering untracked action secrets --- auth0/resource_auth0_action.go | 44 ++++++++++++-- auth0/resource_auth0_action_test.go | 92 ++++++++++++++++++++++++++++- 2 files changed, 130 insertions(+), 6 deletions(-) diff --git a/auth0/resource_auth0_action.go b/auth0/resource_auth0_action.go index cca933769..c3e70898a 100644 --- a/auth0/resource_auth0_action.go +++ b/auth0/resource_auth0_action.go @@ -6,6 +6,7 @@ import ( "net/http" "github.com/auth0/go-auth0/management" + "github.com/hashicorp/go-cty/cty" "github.com/hashicorp/go-multierror" "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" @@ -153,18 +154,26 @@ func readAction(ctx context.Context, d *schema.ResourceData, m interface{}) diag return diag.FromErr(err) } - result := multierror.Append( + var result *multierror.Error + if action.DeployedVersion != nil { + result = multierror.Append(result, d.Set("version_id", action.DeployedVersion.GetID())) + } + + result = multierror.Append( + result, d.Set("name", action.Name), d.Set("supported_triggers", flattenActionTriggers(action.SupportedTriggers)), d.Set("code", action.Code), d.Set("dependencies", flattenActionDependencies(action.Dependencies)), d.Set("runtime", action.Runtime), ) - if action.DeployedVersion != nil { - result = multierror.Append(result, d.Set("version_id", action.DeployedVersion.GetID())) + + diagnostics := checkForUntrackedActionSecrets(List(d, "secrets").List(), action.Secrets) + if err = result.ErrorOrNil(); err != nil { + diagnostics = append(diagnostics, diag.FromErr(err)...) } - return diag.FromErr(result.ErrorOrNil()) + return diagnostics } func updateAction(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics { @@ -251,6 +260,33 @@ func deployAction(ctx context.Context, d *schema.ResourceData, m interface{}) di return diag.FromErr(d.Set("version_id", actionVersion.GetID())) } +func checkForUntrackedActionSecrets( + secretsFromConfig []interface{}, + secretsFromAPI []*management.ActionSecret, +) diag.Diagnostics { + secretKeysInConfigMap := make(map[string]bool, len(secretsFromAPI)) + for _, configSecret := range secretsFromConfig { + secretKeyName := configSecret.(map[string]string)["name"] + secretKeysInConfigMap[secretKeyName] = true + } + + var warnings diag.Diagnostics + for _, secret := range secretsFromAPI { + if _, ok := secretKeysInConfigMap[secret.GetName()]; !ok { + warnings = append(warnings, diag.Diagnostic{ + Severity: diag.Warning, + Summary: "Unexpected Action Secrets", + Detail: fmt.Sprintf("Found unexpected action secrets with key: %s. ", secret.GetName()) + + "To prevent issues, manage them through terraform. If you've just imported this resource " + + "(and your secretsFromAPI match), to make this warning disappear, run a terraform apply.", + AttributePath: cty.Path{cty.GetAttrStep{Name: "secrets"}}, + }) + } + } + + return warnings +} + func expandAction(d *schema.ResourceData) *management.Action { action := &management.Action{ Name: String(d, "name"), diff --git a/auth0/resource_auth0_action_test.go b/auth0/resource_auth0_action_test.go index 7a4846bd7..19e2b82d3 100644 --- a/auth0/resource_auth0_action_test.go +++ b/auth0/resource_auth0_action_test.go @@ -5,7 +5,12 @@ import ( "regexp" "testing" + "github.com/auth0/go-auth0" + "github.com/auth0/go-auth0/management" + "github.com/hashicorp/go-cty/cty" + "github.com/hashicorp/terraform-plugin-sdk/v2/diag" "github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource" + "github.com/stretchr/testify/assert" "github.com/auth0/terraform-provider-auth0/auth0/internal/template" ) @@ -19,6 +24,11 @@ resource auth0_action my_action { id = "post-login" version = "v3" } + + secrets { + name = "foo" + value = "111111" + } } ` @@ -43,6 +53,11 @@ resource auth0_action my_action { name = "foo" value = "123456" } + + secrets { + name = "bar" + value = "654321" + } } ` @@ -79,7 +94,9 @@ func TestAccAction(t *testing.T) { Check: resource.ComposeTestCheckFunc( resource.TestCheckResourceAttr("auth0_action.my_action", "name", fmt.Sprintf("Test Action %s", t.Name())), resource.TestCheckResourceAttr("auth0_action.my_action", "code", "exports.onExecutePostLogin = async (event, api) => {};"), - resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.#", "0"), + resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.#", "1"), + resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.0.name", "foo"), + resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.0.value", "111111"), resource.TestCheckResourceAttr("auth0_action.my_action", "dependencies.#", "0"), resource.TestCheckResourceAttr("auth0_action.my_action", "runtime", "node16"), resource.TestCheckResourceAttr("auth0_action.my_action", "deploy", "false"), @@ -103,9 +120,11 @@ func TestAccAction(t *testing.T) { resource.TestCheckResourceAttr("auth0_action.my_action", "dependencies.#", "1"), resource.TestCheckResourceAttr("auth0_action.my_action", "dependencies.0.name", "auth0"), resource.TestCheckResourceAttr("auth0_action.my_action", "dependencies.0.version", "2.41.0"), - resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.#", "1"), + resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.#", "2"), resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.0.name", "foo"), resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.0.value", "123456"), + resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.1.name", "bar"), + resource.TestCheckResourceAttr("auth0_action.my_action", "secrets.1.value", "654321"), ), }, { @@ -179,3 +198,72 @@ resource auth0_action my_action { } } ` + +func TestCheckForUntrackedActionSecrets(t *testing.T) { + var testCases = []struct { + name string + givenSecretsConfig []interface{} + givenActionSecrets []*management.ActionSecret + expectedDiagnostics diag.Diagnostics + }{ + { + name: "action has no secrets", + givenSecretsConfig: []interface{}{}, + givenActionSecrets: []*management.ActionSecret{}, + expectedDiagnostics: diag.Diagnostics(nil), + }, + { + name: "action has no untracked secrets", + givenSecretsConfig: []interface{}{ + map[string]string{ + "name": "secretName", + "value": "secretValue", + }, + }, + givenActionSecrets: []*management.ActionSecret{ + { + Name: auth0.String("secretName"), + }, + }, + expectedDiagnostics: diag.Diagnostics(nil), + }, + { + name: "action has untracked secrets", + givenSecretsConfig: []interface{}{ + map[string]string{ + "name": "secretName", + "value": "secretValue", + }, + }, + givenActionSecrets: []*management.ActionSecret{ + { + Name: auth0.String("secretName"), + }, + { + Name: auth0.String("anotherSecretName"), + }, + }, + expectedDiagnostics: diag.Diagnostics{ + { + Severity: diag.Warning, + Summary: "Unexpected Action Secrets", + Detail: "Found unexpected action secrets with key: anotherSecretName. To prevent issues, " + + "manage them through terraform. If you've just imported this resource " + + "(and your secretsFromAPI match), to make this warning disappear, run a terraform apply.", + AttributePath: cty.Path{cty.GetAttrStep{Name: "secrets"}}, + }, + }, + }, + } + + for _, testCase := range testCases { + t.Run(testCase.name, func(t *testing.T) { + actualDiagnostics := checkForUntrackedActionSecrets( + testCase.givenSecretsConfig, + testCase.givenActionSecrets, + ) + + assert.Equal(t, testCase.expectedDiagnostics, actualDiagnostics) + }) + } +}