fix(registeredscript): all changes now trigger replacement instead of update

Webflow API does not support PATCH for registered scripts, which caused
404 errors when Pulumi tried to update them. This change:

- Changes all property diffs to use UpdateReplace instead of Update
- Makes version field required (removes optional workaround)
- Updates Update method to return error as safety net
- Adds deprecation comment to PatchRegisteredScript function
- Adds tests for replacement behavior and Update error

Fixes issues #1 and #4 from ISSUES-TO-FIX.md.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: JDetmar

provider/cmd/pulumi-resource-webflow/schema.json

@@ -942,7 +942,8 @@
         "siteId",
         "displayName",
         "hostedLocation",
-        "integrityHash"
+        "integrityHash",
+        "version"
       ],
       "inputProperties": {
         "canCopy": {
@@ -974,7 +975,8 @@
         "siteId",
         "displayName",
         "hostedLocation",
-        "integrityHash"
+        "integrityHash",
+        "version"
       ]
     },
     "webflow:index:RobotsTxt": {

provider/registeredscript.go

@@ -364,6 +364,11 @@ var patchRegisteredScriptBaseURL = ""
 // PatchRegisteredScript updates an existing registered script for a Webflow site.
 // It calls PATCH /v2/sites/{site_id}/registered_scripts/{script_id} endpoint.
 // Returns the updated script or an error if the request fails.
+//
+// Deprecated: Webflow API does not actually support PATCH for registered scripts.
+// This endpoint returns 404 Not Found. All RegisteredScript changes now trigger
+// replacement (delete + recreate) via the Diff method. This function is kept for
+// backwards compatibility but should not be used.
 func PatchRegisteredScript(
 	ctx context.Context, client *http.Client,
 	siteID, scriptID, displayName, hostedLocation, integrityHash, version string, canCopy bool,

provider/registeredscript_resource.go

@@ -39,8 +39,7 @@ type RegisteredScriptResourceArgs struct {
 	// Version is the Semantic Version (SemVer) string for the script.
 	// Format: "major.minor.patch" (e.g., "1.0.0", "2.3.1")
 	// See https://semver.org/ for more information.
-	// Note: Marked as optional because Webflow's list API doesn't always return this field.
-	Version string `pulumi:"version,optional"`
+	Version string `pulumi:"version"`
 	// CanCopy indicates whether the script can be copied on site duplication.
 	// Default: false
 	CanCopy bool `pulumi:"canCopy,optional"`
@@ -122,57 +121,43 @@ func (state *RegisteredScriptResourceState) Annotate(a infer.Annotator) {
 }
 
 // Diff determines what changes need to be made to the registered script resource.
-// SiteID and DisplayName changes trigger replacement.
-// Other changes trigger in-place update.
+// NOTE: Webflow API does not support updating registered scripts (no PATCH endpoint).
+// All changes require replacement (delete + recreate), similar to Webhook resources.
 func (r *RegisteredScriptResource) Diff(
 	ctx context.Context, req infer.DiffRequest[RegisteredScriptResourceArgs, RegisteredScriptResourceState],
 ) (infer.DiffResponse, error) {
 	diff := infer.DiffResponse{}
 	detailedDiff := map[string]p.PropertyDiff{}
 
-	// Check for siteId change (requires replacement - primary key)
+	// All field changes trigger replacement since Webflow API doesn't support PATCH
 	if req.State.SiteID != req.Inputs.SiteID {
 		detailedDiff["siteId"] = p.PropertyDiff{Kind: p.UpdateReplace}
 	}
 
-	// Check for displayName change (requires replacement - secondary key)
 	if req.State.DisplayName != req.Inputs.DisplayName {
 		detailedDiff["displayName"] = p.PropertyDiff{Kind: p.UpdateReplace}
 	}
 
-	// Check for hostedLocation change (supports update)
 	if req.State.HostedLocation != req.Inputs.HostedLocation {
-		detailedDiff["hostedLocation"] = p.PropertyDiff{Kind: p.Update}
+		detailedDiff["hostedLocation"] = p.PropertyDiff{Kind: p.UpdateReplace}
 	}
 
-	// Check for integrityHash change (supports update)
 	if req.State.IntegrityHash != req.Inputs.IntegrityHash {
-		detailedDiff["integrityHash"] = p.PropertyDiff{Kind: p.Update}
+		detailedDiff["integrityHash"] = p.PropertyDiff{Kind: p.UpdateReplace}
 	}
 
-	// Check for version change (supports update)
-	// Only report change if user explicitly specified a version that differs from state.
-	// This handles the case where req.Inputs.Version may be empty due to deserialization issues
-	// in pulumi-go-provider when the field is marked optional.
-	if req.Inputs.Version != "" && req.State.Version != req.Inputs.Version {
-		detailedDiff["version"] = p.PropertyDiff{Kind: p.Update}
+	if req.State.Version != req.Inputs.Version {
+		detailedDiff["version"] = p.PropertyDiff{Kind: p.UpdateReplace}
 	}
 
-	// Check for canCopy change (supports update)
 	if req.State.CanCopy != req.Inputs.CanCopy {
-		detailedDiff["canCopy"] = p.PropertyDiff{Kind: p.Update}
+		detailedDiff["canCopy"] = p.PropertyDiff{Kind: p.UpdateReplace}
 	}
 
-	// If any changes were detected, populate the diff response
+	// If any changes were detected, all require replacement
 	if len(detailedDiff) > 0 {
 		diff.HasChanges = true
-		// Only set DeleteBeforeReplace if any replacement changes are needed
-		for _, change := range detailedDiff {
-			if change.Kind == p.UpdateReplace {
-				diff.DeleteBeforeReplace = true
-				break
-			}
-		}
+		diff.DeleteBeforeReplace = true
 		diff.DetailedDiff = detailedDiff
 	}
 
@@ -357,76 +342,17 @@ func (r *RegisteredScriptResource) Read(
 	}, nil
 }
 
-// Update modifies an existing registered script.
+// Update is not supported by Webflow API for registered scripts.
+// All changes trigger replacement via Diff, so this method should never be called.
+// This is a safety net that returns an error if somehow invoked.
 func (r *RegisteredScriptResource) Update(
-	ctx context.Context, req infer.UpdateRequest[RegisteredScriptResourceArgs, RegisteredScriptResourceState],
+	_ context.Context, _ infer.UpdateRequest[RegisteredScriptResourceArgs, RegisteredScriptResourceState],
 ) (infer.UpdateResponse[RegisteredScriptResourceState], error) {
-	// Validate inputs BEFORE making API calls
-	if err := ValidateSiteID(req.Inputs.SiteID); err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{},
-			fmt.Errorf("validation failed for RegisteredScript resource: %w", err)
-	}
-	if err := ValidateScriptDisplayName(req.Inputs.DisplayName); err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{},
-			fmt.Errorf("validation failed for RegisteredScript resource: %w", err)
-	}
-	if err := ValidateHostedLocation(req.Inputs.HostedLocation); err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{},
-			fmt.Errorf("validation failed for RegisteredScript resource: %w", err)
-	}
-	if err := ValidateIntegrityHash(req.Inputs.IntegrityHash); err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{},
-			fmt.Errorf("validation failed for RegisteredScript resource: %w", err)
-	}
-	if err := ValidateVersion(req.Inputs.Version); err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{},
-			fmt.Errorf("validation failed for RegisteredScript resource: %w", err)
-	}
-
-	state := RegisteredScriptResourceState{
-		RegisteredScriptResourceArgs: req.Inputs,
-		ScriptID:                     req.State.ScriptID,  // Preserve the script ID from current state
-		CreatedOn:                    req.State.CreatedOn, // Preserve the creation timestamp from current state
-		LastUpdated:                  "",                  // Will be updated from API response
-	}
-
-	// During preview, return expected state without making API calls
-	if req.DryRun {
-		state.LastUpdated = time.Now().Format(time.RFC3339)
-		return infer.UpdateResponse[RegisteredScriptResourceState]{
-			Output: state,
-		}, nil
-	}
-
-	// Extract the Webflow script ID from the Pulumi resource ID
-	_, scriptID, err := ExtractIDsFromRegisteredScriptResourceID(req.ID)
-	if err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{}, fmt.Errorf("invalid resource ID: %w", err)
-	}
-
-	// Get HTTP client
-	client, err := GetHTTPClient(ctx, providerVersion)
-	if err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{}, fmt.Errorf("failed to create HTTP client: %w", err)
-	}
-
-	// Call Webflow API
-	response, err := PatchRegisteredScript(
-		ctx, client, req.Inputs.SiteID, scriptID,
-		req.Inputs.DisplayName, req.Inputs.HostedLocation, req.Inputs.IntegrityHash,
-		req.Inputs.Version, req.Inputs.CanCopy,
-	)
-	if err != nil {
-		return infer.UpdateResponse[RegisteredScriptResourceState]{},
-			fmt.Errorf("failed to update registered script: %w", err)
-	}
-
-	// Update state with values from API response
-	state.LastUpdated = response.LastUpdated
-
-	return infer.UpdateResponse[RegisteredScriptResourceState]{
-		Output: state,
-	}, nil
+	return infer.UpdateResponse[RegisteredScriptResourceState]{},
+		errors.New("registered scripts cannot be updated in-place: " +
+			"Webflow API does not support PATCH for registered scripts. " +
+			"All changes require replacement (delete + recreate). " +
+			"If you see this error, please report it as a provider bug")
 }
 
 // Delete removes a registered script from the Webflow site.

provider/registeredscript_resource_test.go

@@ -16,6 +16,7 @@ import (
 	"testing"
 	"time"
 
+	p "github.com/pulumi/pulumi-go-provider"
 	"github.com/pulumi/pulumi-go-provider/infer"
 )
 
@@ -660,3 +661,134 @@ func TestRegisteredScriptDiff_VersionFromFallback_NoChange(t *testing.T) {
 		t.Errorf("DetailedDiff: %+v", diffResp.DetailedDiff)
 	}
 }
+
+// TestRegisteredScriptDiff_ChangesRequireReplacement tests that all property changes
+// trigger UpdateReplace since Webflow API doesn't support PATCH for registered scripts.
+func TestRegisteredScriptDiff_ChangesRequireReplacement(t *testing.T) {
+	resource := &RegisteredScriptResource{}
+
+	baseInputs := RegisteredScriptResourceArgs{
+		SiteID:         "site123",
+		DisplayName:    "TestScript",
+		HostedLocation: "https://cdn.example.com/script.js",
+		IntegrityHash:  "sha384-abc123",
+		Version:        "1.0.0",
+		CanCopy:        false,
+	}
+
+	baseState := RegisteredScriptResourceState{
+		RegisteredScriptResourceArgs: baseInputs,
+	}
+
+	tests := []struct {
+		name      string
+		modifyFn  func(args *RegisteredScriptResourceArgs)
+		fieldName string
+	}{
+		{
+			name: "hostedLocation change",
+			modifyFn: func(args *RegisteredScriptResourceArgs) {
+				args.HostedLocation = "https://cdn.example.com/script-v2.js"
+			},
+			fieldName: "hostedLocation",
+		},
+		{
+			name: "integrityHash change",
+			modifyFn: func(args *RegisteredScriptResourceArgs) {
+				args.IntegrityHash = "sha384-def456"
+			},
+			fieldName: "integrityHash",
+		},
+		{
+			name: "version change",
+			modifyFn: func(args *RegisteredScriptResourceArgs) {
+				args.Version = "2.0.0"
+			},
+			fieldName: "version",
+		},
+		{
+			name: "canCopy change",
+			modifyFn: func(args *RegisteredScriptResourceArgs) {
+				args.CanCopy = true
+			},
+			fieldName: "canCopy",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Create modified inputs
+			modifiedInputs := baseInputs
+			tt.modifyFn(&modifiedInputs)
+
+			diffReq := infer.DiffRequest[RegisteredScriptResourceArgs, RegisteredScriptResourceState]{
+				Inputs: modifiedInputs,
+				State:  baseState,
+			}
+
+			diffResp, err := resource.Diff(context.Background(), diffReq)
+			if err != nil {
+				t.Fatalf("Diff() error = %v", err)
+			}
+
+			// Changes should be detected
+			if !diffResp.HasChanges {
+				t.Errorf("Diff() should detect changes for %s", tt.fieldName)
+			}
+
+			// DeleteBeforeReplace should be true (all changes require replacement)
+			if !diffResp.DeleteBeforeReplace {
+				t.Errorf("Diff() DeleteBeforeReplace should be true for %s", tt.fieldName)
+			}
+
+			// Field should be marked as UpdateReplace, not Update
+			if diff, ok := diffResp.DetailedDiff[tt.fieldName]; ok {
+				if diff.Kind != p.UpdateReplace {
+					t.Errorf("Diff() %s should be UpdateReplace, got %v", tt.fieldName, diff.Kind)
+				}
+			} else {
+				t.Errorf("Diff() DetailedDiff should contain %s", tt.fieldName)
+			}
+		})
+	}
+}
+
+// TestRegisteredScriptUpdate_ReturnsError tests that Update method returns an error
+// since Webflow API doesn't support PATCH for registered scripts.
+func TestRegisteredScriptUpdate_ReturnsError(t *testing.T) {
+	resource := &RegisteredScriptResource{}
+
+	updateReq := infer.UpdateRequest[RegisteredScriptResourceArgs, RegisteredScriptResourceState]{
+		ID: "site123/registered_scripts/script456",
+		Inputs: RegisteredScriptResourceArgs{
+			SiteID:         "site123",
+			DisplayName:    "TestScript",
+			HostedLocation: "https://cdn.example.com/script.js",
+			IntegrityHash:  "sha384-abc123",
+			Version:        "1.0.0",
+		},
+		State: RegisteredScriptResourceState{
+			RegisteredScriptResourceArgs: RegisteredScriptResourceArgs{
+				SiteID:         "site123",
+				DisplayName:    "TestScript",
+				HostedLocation: "https://cdn.example.com/old-script.js",
+				IntegrityHash:  "sha384-old",
+				Version:        "0.9.0",
+			},
+		},
+	}
+
+	_, err := resource.Update(context.Background(), updateReq)
+
+	if err == nil {
+		t.Fatal("Update() should return an error")
+	}
+
+	if !containsStr(err.Error(), "cannot be updated in-place") {
+		t.Errorf("Update() error should mention updates not supported, got: %v", err)
+	}
+
+	if !containsStr(err.Error(), "PATCH") {
+		t.Errorf("Update() error should mention PATCH not supported, got: %v", err)
+	}
+}