ext/dynblock: Allow callers to veto for_each values

Callers might have additional rules for what's acceptable in a for_each
value for a dynamic block. For example, Terraform wants to forbid using
sensitive values here because it would cause the expansion to disclose the
length of the given collection.

Therefore this provides a hook point for callers to insert additional
checks just after the for_each expression has been evaluated and before
any of the built-in checks are run.

This introduces the "functional options" pattern for ExpandBlock for the
first time, as a way to extend the API without breaking compatibility with
existing callers. There is currently only this one option.

ext/dynblock/expand_body.go

@@ -17,6 +17,8 @@ type expandBody struct {
 	forEachCtx *hcl.EvalContext
 	iteration  *iteration // non-nil if we're nested inside another "dynamic" block
 
+	checkForEach []func(cty.Value, hcl.Expression, *hcl.EvalContext) hcl.Diagnostics
+
 	// These are used with PartialContent to produce a "remaining items"
 	// body to return. They are nil on all bodies fresh out of the transformer.
 	//
@@ -66,6 +68,7 @@ func (b *expandBody) PartialContent(schema *hcl.BodySchema) (*hcl.BodyContent, h
 		original:     b.original,
 		forEachCtx:   b.forEachCtx,
 		iteration:    b.iteration,
+		checkForEach: b.checkForEach,
 		hiddenAttrs:  make(map[string]struct{}),
 		hiddenBlocks: make(map[string]hcl.BlockHeaderSchema),
 	}
@@ -236,6 +239,7 @@ func (b *expandBody) expandChild(child hcl.Body, i *iteration) hcl.Body {
 	chiCtx := i.EvalContext(b.forEachCtx)
 	ret := Expand(child, chiCtx)
 	ret.(*expandBody).iteration = i
+	ret.(*expandBody).checkForEach = b.checkForEach
 	return ret
 }
 

ext/dynblock/expand_body_test.go

@@ -7,9 +7,11 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/davecgh/go-spew/spew"
 	"github.com/hashicorp/hcl/v2"
 	"github.com/hashicorp/hcl/v2/hcldec"
 	"github.com/hashicorp/hcl/v2/hcltest"
+	"github.com/zclconf/go-cty-debug/ctydebug"
 	"github.com/zclconf/go-cty/cty"
 )
 
@@ -336,6 +338,89 @@ func TestExpand(t *testing.T) {
 
 }
 
+func TestExpandWithForEachCheck(t *testing.T) {
+	forEachExpr := hcltest.MockExprLiteral(cty.MapValEmpty(cty.String).Mark("boop"))
+	evalCtx := &hcl.EvalContext{}
+	srcContent := &hcl.BodyContent{
+		Blocks: hcl.Blocks{
+			{
+				Type:        "dynamic",
+				Labels:      []string{"foo"},
+				LabelRanges: []hcl.Range{{}},
+				Body: hcltest.MockBody(&hcl.BodyContent{
+					Attributes: hcltest.MockAttrs(map[string]hcl.Expression{
+						"for_each": forEachExpr,
+					}),
+					Blocks: hcl.Blocks{
+						{
+							Type: "content",
+							Body: hcltest.MockBody(&hcl.BodyContent{}),
+						},
+					},
+				}),
+			},
+		},
+	}
+	srcBody := hcltest.MockBody(srcContent)
+
+	hookCalled := false
+	var gotV cty.Value
+	var gotEvalCtx *hcl.EvalContext
+
+	expBody := Expand(
+		srcBody, evalCtx,
+		OptCheckForEach(func(v cty.Value, e hcl.Expression, ec *hcl.EvalContext) hcl.Diagnostics {
+			hookCalled = true
+			gotV = v
+			gotEvalCtx = ec
+			return hcl.Diagnostics{
+				&hcl.Diagnostic{
+					Severity:    hcl.DiagError,
+					Summary:     "Bad for_each",
+					Detail:      "I don't like it.",
+					Expression:  e,
+					EvalContext: ec,
+					Extra:       "diagnostic extra",
+				},
+			}
+		}),
+	)
+
+	_, diags := expBody.Content(&hcl.BodySchema{
+		Blocks: []hcl.BlockHeaderSchema{
+			{
+				Type: "foo",
+			},
+		},
+	})
+	if !diags.HasErrors() {
+		t.Fatal("succeeded; want an error")
+	}
+	if len(diags) != 1 {
+		t.Fatalf("wrong number of diagnostics; want only one\n%s", spew.Sdump(diags))
+	}
+	if got, want := diags[0].Summary, "Bad for_each"; got != want {
+		t.Fatalf("wrong error\ngot:  %s\nwant: %s\n\n%s", got, want, spew.Sdump(diags[0]))
+	}
+	if got, want := diags[0].Extra, "diagnostic extra"; got != want {
+		// This is important to allow the application which provided the
+		// hook to pass application-specific extra values through this
+		// API in case the hook's diagnostics need some sort of special
+		// treatment.
+		t.Fatalf("diagnostic didn't preserve 'extra' field\ngot:  %s\nwant: %s\n\n%s", got, want, spew.Sdump(diags[0]))
+	}
+
+	if !hookCalled {
+		t.Fatal("check hook wasn't called")
+	}
+	if !gotV.HasMark("boop") {
+		t.Errorf("wrong value passed to check hook; want the value marked \"boop\"\n%s", ctydebug.ValueString(gotV))
+	}
+	if gotEvalCtx != evalCtx {
+		t.Error("wrong EvalContext passed to check hook; want the one passed to Expand")
+	}
+}
+
 func TestExpandUnknownBodies(t *testing.T) {
 	srcContent := &hcl.BodyContent{
 		Blocks: hcl.Blocks{

ext/dynblock/expand_spec.go

@@ -43,6 +43,16 @@ func (b *expandBody) decodeSpec(blockS *hcl.BlockHeaderSchema, rawSpec *hcl.Bloc
 	eachAttr := specContent.Attributes["for_each"]
 	eachVal, eachDiags := eachAttr.Expr.Value(b.forEachCtx)
 	diags = append(diags, eachDiags...)
+	if diags.HasErrors() {
+		return nil, diags
+	}
+	for _, check := range b.checkForEach {
+		moreDiags := check(eachVal, eachAttr.Expr, b.forEachCtx)
+		diags = append(diags, moreDiags...)
+		if moreDiags.HasErrors() {
+			return nil, diags
+		}
+	}
 
 	if !eachVal.CanIterateElements() && eachVal.Type() != cty.DynamicPseudoType {
 		// We skip this error for DynamicPseudoType because that means we either

ext/dynblock/options.go

@@ -0,0 +1,23 @@
+package dynblock
+
+import (
+	"github.com/hashicorp/hcl/v2"
+	"github.com/zclconf/go-cty/cty"
+)
+
+type ExpandOption interface {
+	applyExpandOption(*expandBody)
+}
+
+type optCheckForEach struct {
+	check func(cty.Value, hcl.Expression, *hcl.EvalContext) hcl.Diagnostics
+}
+
+func OptCheckForEach(check func(cty.Value, hcl.Expression, *hcl.EvalContext) hcl.Diagnostics) ExpandOption {
+	return optCheckForEach{check}
+}
+
+// applyExpandOption implements ExpandOption.
+func (o optCheckForEach) applyExpandOption(body *expandBody) {
+	body.checkForEach = append(body.checkForEach, o.check)
+}

ext/dynblock/public.go

@@ -27,24 +27,28 @@ import (
 // multi-dimensional iteration. However, it is not possible to
 // dynamically-generate the "dynamic" blocks themselves except through nesting.
 //
-//     parent {
-//       dynamic "child" {
-//         for_each = child_objs
-//         content {
-//           dynamic "grandchild" {
-//             for_each = child.value.children
-//             labels   = [grandchild.key]
-//             content {
-//               parent_key = child.key
-//               value      = grandchild.value
-//             }
-//           }
-//         }
-//       }
-//     }
-func Expand(body hcl.Body, ctx *hcl.EvalContext) hcl.Body {
-	return &expandBody{
+//	parent {
+//	  dynamic "child" {
+//	    for_each = child_objs
+//	    content {
+//	      dynamic "grandchild" {
+//	        for_each = child.value.children
+//	        labels   = [grandchild.key]
+//	        content {
+//	          parent_key = child.key
+//	          value      = grandchild.value
+//	        }
+//	      }
+//	    }
+//	  }
+//	}
+func Expand(body hcl.Body, ctx *hcl.EvalContext, opts ...ExpandOption) hcl.Body {
+	ret := &expandBody{
 		original:   body,
 		forEachCtx: ctx,
 	}
+	for _, opt := range opts {
+		opt.applyExpandOption(ret)
+	}
+	return ret
 }