alloydb: added password_wo and password_wo_version fields to google_alloydb_user resource (#15743)

Author: ramonvermeulen

mmv1/api/resource.go

@@ -713,6 +713,10 @@ func (r Resource) SettableProperties() []*Type {
 		return v.UrlParamOnly
 	})
 
+	props = google.Reject(props, func(v *Type) bool {
+		return v.ClientSide
+	})
+
 	props = google.Reject(props, func(v *Type) bool {
 		return v.IsA("KeyValueLabels") || v.IsA("KeyValueAnnotations")
 	})
@@ -884,13 +888,17 @@ func buildWriteOnlyField(name string, versionFieldName string, originalField *Ty
 		}
 		options = append(options, propertyWithExactlyOneOfPointer(originalField.ExactlyOneOfGroup))
 	} else {
+		newConflicts := deduplicateSliceOfStrings(append([]string{originalFieldLineage}, originalField.Conflicts...))
+		newConflicts = slices.DeleteFunc(newConflicts, func(s string) bool {
+			return s == newFieldLineage
+		})
+		options = append(options, propertyWithConflicts(newConflicts))
+
 		if originalField.ConflictsGroup != nil {
 			*originalField.ConflictsGroup = deduplicateSliceOfStrings(append(*originalField.ConflictsGroup, newFieldLineage))
 		} else {
 			originalField.Conflicts = deduplicateSliceOfStrings(append(originalField.Conflicts, newFieldLineage))
 		}
-		newConflicts := deduplicateSliceOfStrings(append([]string{originalFieldLineage}, originalField.Conflicts...))
-		options = append(options, propertyWithConflicts(newConflicts))
 	}
 
 	if originalField.AtLeastOneOfGroup != nil {

mmv1/products/alloydb/User.yaml

@@ -121,6 +121,7 @@ properties:
       Password for this database user.
     sensitive: true
     ignore_read: true
+    write_only: true
   - name: 'databaseRoles'
     type: Array
     description: |

mmv1/third_party/terraform/services/alloydb/resource_alloydb_user_test.go

@@ -221,3 +221,130 @@ resource "google_alloydb_user" "user2" {
   depends_on = [google_alloydb_instance.default]
 }`, context)
 }
+
+func TestAccAlloydbUser_alloydbUserBuiltinWithPasswordWo(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbUserDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbUser_alloydbUserBuiltinWithPasswordWo(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_alloydb_user.user1", "password_wo"),
+					resource.TestCheckResourceAttr("google_alloydb_user.user1", "password_wo_version", "1"),
+				),
+			},
+			{
+				ResourceName:            "google_alloydb_user.user1",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"password"},
+			},
+		},
+	})
+}
+
+func testAccAlloydbUser_alloydbUserBuiltinWithPasswordWo(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+}
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+    network = data.google_compute_network.default.id
+  }
+  initial_user {
+    password = "tf_test_cluster_secret%{random_suffix}"
+  }
+  deletion_protection = false
+}
+data "google_project" "project" {}
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+resource "google_alloydb_user" "user1" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "user1%{random_suffix}"
+  user_type = "ALLOYDB_BUILT_IN"
+  password_wo = "tf_test_user_secret%{random_suffix}"
+  password_wo_version = 1
+  database_roles = ["alloydbsuperuser"]
+  depends_on = [google_alloydb_instance.default]
+}`, context)
+}
+
+func TestAccAlloydbUser_alloydbUserBuiltinWithPasswordWo_update(t *testing.T) {
+	t.Parallel()
+
+	context := map[string]interface{}{
+		"network_name":  acctest.BootstrapSharedServiceNetworkingConnection(t, "alloydb-1"),
+		"random_suffix": acctest.RandString(t, 10),
+	}
+
+	acctest.VcrTest(t, resource.TestCase{
+		PreCheck:                 func() { acctest.AccTestPreCheck(t) },
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories(t),
+		CheckDestroy:             testAccCheckAlloydbUserDestroyProducer(t),
+		Steps: []resource.TestStep{
+			{
+				Config: testAccAlloydbUser_alloydbUserBuiltinWithPasswordWo(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_alloydb_user.user1", "password_wo"),
+					resource.TestCheckResourceAttr("google_alloydb_user.user1", "password_wo_version", "1"),
+				),
+			},
+			{
+				Config: testAccAlloydbUser_alloydbUserBuiltinWithPasswordWo_update(context),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckNoResourceAttr("google_alloydb_user.user1", "password_wo"),
+					resource.TestCheckResourceAttr("google_alloydb_user.user1", "password_wo_version", "2"),
+				),
+			},
+		},
+	})
+}
+
+func testAccAlloydbUser_alloydbUserBuiltinWithPasswordWo_update(context map[string]interface{}) string {
+	return acctest.Nprintf(`
+resource "google_alloydb_instance" "default" {
+  cluster       = google_alloydb_cluster.default.name
+  instance_id   = "tf-test-alloydb-instance%{random_suffix}"
+  instance_type = "PRIMARY"
+}
+resource "google_alloydb_cluster" "default" {
+  cluster_id = "tf-test-alloydb-cluster%{random_suffix}"
+  location   = "us-central1"
+  network_config {
+    network = data.google_compute_network.default.id
+  }
+  initial_user {
+    password = "tf_test_cluster_secret%{random_suffix}"
+  }
+  deletion_protection = false
+}
+data "google_project" "project" {}
+data "google_compute_network" "default" {
+  name = "%{network_name}"
+}
+resource "google_alloydb_user" "user1" {
+  cluster = google_alloydb_cluster.default.name
+  user_id = "user1%{random_suffix}"
+  user_type = "ALLOYDB_BUILT_IN"
+  password_wo = "tf_test_user_updated_secret%{random_suffix}"
+  password_wo_version = 2
+  database_roles = ["alloydbsuperuser"]
+  depends_on = [google_alloydb_instance.default]
+}`, context)
+}