Merge branch 'next' into ruleset/rules-actions

Author: vaishakdinesh

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 1793
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-1f0c1fa90a0cdf9565414a74668e7cd9001db95af2f7f2e074889d41cc8da502.yml
-openapi_spec_hash: d078f398289bf170b9ce9d433bb58187
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-d40243b4192f76fb833e15210572c738f55fa868103caf6995ad710b15bae202.yml
+openapi_spec_hash: 37b7cfe9904bfd4e13a5b269266df631
 config_hash: de4c81cee29cd7dd907279e8916b334f

internal/apiform/tag.go

@@ -18,6 +18,10 @@ type parsedStructTag struct {
 	// otherwise this flag will have no effect
 	// NOTE: won't work if update behavior is 'patch'
 	forceEncode bool
+	// Don't skip this value, even if it's computed (no-op for computed optional fields)
+	// If encodeStateForUnknown is set on a computed field, this flag should also be set;
+	// otherwise this flag will have no effect
+	// NOTE: won't work if update behavior is 'patch'
 }
 
 func parseFormStructTag(field reflect.StructField) (tag parsedStructTag, ok bool) {

internal/services/zero_trust_gateway_policy/data_source_schema.go

@@ -70,15 +70,15 @@ func DataSourceSchema(ctx context.Context) schema.Schema {
 				Computed:    true,
 			},
 			"device_posture": schema.StringAttribute{
-				Description: "The wirefilter expression used for device posture check matching.",
+				Description: "The wirefilter expression used for device posture check matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 				Computed:    true,
 			},
 			"enabled": schema.BoolAttribute{
 				Description: "True if the rule is enabled.",
 				Computed:    true,
 			},
 			"identity": schema.StringAttribute{
-				Description: "The wirefilter expression used for identity matching.",
+				Description: "The wirefilter expression used for identity matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 				Computed:    true,
 			},
 			"name": schema.StringAttribute{
@@ -102,7 +102,7 @@ func DataSourceSchema(ctx context.Context) schema.Schema {
 				Computed:    true,
 			},
 			"traffic": schema.StringAttribute{
-				Description: "The wirefilter expression used for traffic matching.",
+				Description: "The wirefilter expression used for traffic matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 				Computed:    true,
 			},
 			"updated_at": schema.StringAttribute{
@@ -306,7 +306,7 @@ func DataSourceSchema(ctx context.Context) schema.Schema {
 						CustomType:  customfield.NewNestedObjectType[ZeroTrustGatewayPolicyRuleSettingsCheckSessionDataSourceModel](ctx),
 						Attributes: map[string]schema.Attribute{
 							"duration": schema.StringAttribute{
-								Description: "Configure how fresh the session needs to be to be considered valid.",
+								Description: "Configure how fresh the session needs to be to be considered valid. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 								Computed:    true,
 							},
 							"enforce": schema.BoolAttribute{

internal/services/zero_trust_gateway_policy/list_data_source_schema.go

@@ -91,7 +91,7 @@ func ListDataSourceSchema(ctx context.Context) schema.Schema {
 							Computed:    true,
 						},
 						"traffic": schema.StringAttribute{
-							Description: "The wirefilter expression used for traffic matching.",
+							Description: "The wirefilter expression used for traffic matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 							Computed:    true,
 						},
 						"id": schema.StringAttribute{
@@ -112,7 +112,7 @@ func ListDataSourceSchema(ctx context.Context) schema.Schema {
 							Computed:    true,
 						},
 						"device_posture": schema.StringAttribute{
-							Description: "The wirefilter expression used for device posture check matching.",
+							Description: "The wirefilter expression used for device posture check matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 							Computed:    true,
 						},
 						"expiration": schema.SingleNestedAttribute{
@@ -139,7 +139,7 @@ func ListDataSourceSchema(ctx context.Context) schema.Schema {
 							},
 						},
 						"identity": schema.StringAttribute{
-							Description: "The wirefilter expression used for identity matching.",
+							Description: "The wirefilter expression used for identity matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 							Computed:    true,
 						},
 						"not_sharable": schema.BoolAttribute{
@@ -299,7 +299,7 @@ func ListDataSourceSchema(ctx context.Context) schema.Schema {
 									CustomType:  customfield.NewNestedObjectType[ZeroTrustGatewayPoliciesRuleSettingsCheckSessionDataSourceModel](ctx),
 									Attributes: map[string]schema.Attribute{
 										"duration": schema.StringAttribute{
-											Description: "Configure how fresh the session needs to be to be considered valid.",
+											Description: "Configure how fresh the session needs to be to be considered valid. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 											Computed:    true,
 										},
 										"enforce": schema.BoolAttribute{

internal/services/zero_trust_gateway_policy/schema.go

@@ -87,7 +87,7 @@ func ResourceSchema(ctx context.Context) schema.Schema {
 				ElementType: types.StringType,
 			},
 			"device_posture": schema.StringAttribute{
-				Description: "The wirefilter expression used for device posture check matching.",
+				Description: "The wirefilter expression used for device posture check matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 				Computed:    true,
 				Optional:    true,
 				Default:     stringdefault.StaticString(""),
@@ -99,13 +99,13 @@ func ResourceSchema(ctx context.Context) schema.Schema {
 				Default:     booldefault.StaticBool(false),
 			},
 			"identity": schema.StringAttribute{
-				Description: "The wirefilter expression used for identity matching.",
+				Description: "The wirefilter expression used for identity matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 				Computed:    true,
 				Optional:    true,
 				Default:     stringdefault.StaticString(""),
 			},
 			"traffic": schema.StringAttribute{
-				Description: "The wirefilter expression used for traffic matching.",
+				Description: "The wirefilter expression used for traffic matching. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 				Computed:    true,
 				Optional:    true,
 				Default:     stringdefault.StaticString(""),
@@ -294,7 +294,7 @@ func ResourceSchema(ctx context.Context) schema.Schema {
 						Optional:    true,
 						Attributes: map[string]schema.Attribute{
 							"duration": schema.StringAttribute{
-								Description: "Configure how fresh the session needs to be to be considered valid.",
+								Description: "Configure how fresh the session needs to be to be considered valid. The API automatically formats and sanitizes this expression. This returns a normalized version that may differ from your input and cause Terraform state drift.",
 								Optional:    true,
 							},
 							"enforce": schema.BoolAttribute{

internal/services/zone_setting/resource_test.go

@@ -256,6 +256,53 @@ func TestAccCloudflareZoneSetting_Ciphers(t *testing.T) {
 	})
 }
 
+// Regression test for https://github.com/cloudflare/terraform-provider-cloudflare/issues/5795
+// where certain zone settings have inconsistent "editable" values between plan and apply
+func TestAccCloudflareZoneSetting_EditableInconsistency(t *testing.T) {
+	zoneID := os.Getenv("CLOUDFLARE_ZONE_ID")
+
+	// Test the problematic settings that have editable inconsistency issues
+	problematicSettings := []struct {
+		settingID string
+		value     string
+	}{
+		{"advanced_ddos", "on"},
+		{"http2", "on"},
+		{"long_lived_grpc", "on"},
+		{"origin_error_page_pass_thru", "on"},
+		{"prefetch_preload", "on"},
+		{"proxy_read_timeout", "300"},
+		{"response_buffering", "on"},
+		{"sort_query_string_for_cache", "on"},
+		{"true_client_ip_header", "on"},
+	}
+
+	for _, setting := range problematicSettings {
+		t.Run(setting.settingID, func(t *testing.T) {
+			rnd := utils.GenerateRandomResourceName()
+			resourceName := fmt.Sprintf("cloudflare_zone_setting.%s", rnd)
+
+			valueCheck := knownvalue.StringExact(setting.value)
+
+			resource.Test(t, resource.TestCase{
+				PreCheck:                 func() { acctest.TestAccPreCheck(t) },
+				ProtoV6ProviderFactories: acctest.TestAccProtoV6ProviderFactories,
+				CheckDestroy:             testAccCheckCloudflareZoneSettingDestroy,
+				Steps: []resource.TestStep{
+					{
+						Config: testCloudflareZoneSettingEditableInconsistency(rnd, zoneID, setting.settingID, setting.value),
+						ConfigStateChecks: []statecheck.StateCheck{
+							statecheck.ExpectKnownValue(resourceName, tfjsonpath.New(consts.ZoneIDSchemaKey), knownvalue.StringExact(zoneID)),
+							statecheck.ExpectKnownValue(resourceName, tfjsonpath.New("setting_id"), knownvalue.StringExact(setting.settingID)),
+							statecheck.ExpectKnownValue(resourceName, tfjsonpath.New("value"), valueCheck),
+						},
+					},
+				},
+			})
+		})
+	}
+}
+
 func testCloudflareZoneSettingConfigOnOff(resourceID, zoneID string) string {
 	return acctest.LoadTestCase("on_off.tf", resourceID, zoneID)
 }
@@ -288,6 +335,10 @@ func testCloudflareZoneSettingConfigCiphers(resourceID, zoneID string) string {
 	return acctest.LoadTestCase("ciphers.tf", resourceID, zoneID)
 }
 
+func testCloudflareZoneSettingEditableInconsistency(resourceID, zoneID, settingID, value string) string {
+	return acctest.LoadTestCase("editable_inconsistency.tf", resourceID, zoneID, settingID, value)
+}
+
 func testAccCheckCloudflareZoneSettingDestroy(s *terraform.State) error {
 	client := acctest.SharedClient()
 

internal/services/zone_setting/testdata/editable_inconsistency.tf

@@ -0,0 +1,5 @@
+resource "cloudflare_zone_setting" "%[1]s" {
+  zone_id    = "%[2]s"
+  setting_id = "%[3]s"
+  value      = "%[4]s"
+}