Fix permissions for 'models'

acceptance/bundle/resources/permissions/models/current_can_manage/databricks.yml

@@ -0,0 +1,13 @@
+resources:
+  models:
+    foo:
+      name: test-model
+      permissions:
+        - level: CAN_READ
+          user_name: [email protected]
+        - level: CAN_MANAGE
+          group_name: data-team
+        - level: CAN_MANAGE
+          service_principal_name: f37d18cd-98a8-4db5-8112-12dd0a6bfe38
+        - level: CAN_MANAGE
+          user_name: [email protected]

acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.direct-exp.json

@@ -0,0 +1,12 @@
+{
+  "plan": {
+    "resources.models.foo": {
+      "action": "create",
+      "new_state": {
+        "config": {
+          "name": "test-model"
+        }
+      }
+    }
+  }
+}

acceptance/bundle/resources/permissions/models/current_can_manage/out.plan.terraform.json

@@ -0,0 +1,7 @@
+{
+  "plan": {
+    "resources.models.foo": {
+      "action": "create"
+    }
+  }
+}

acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.deploy.terraform.json

@@ -0,0 +1,24 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/test-model",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_READ",
+        "user_name": "[email protected]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "group_name": "data-team",
+        "permission_level": "CAN_MANAGE"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/models/current_can_manage/out.requests.destroy.terraform.json

@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/test-model",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/models/current_can_manage/output.txt

@@ -0,0 +1,35 @@
+
+>>> [CLI] bundle validate -o json
+[
+  {
+    "level": "CAN_READ",
+    "user_name": "[email protected]"
+  },
+  {
+    "group_name": "data-team",
+    "level": "CAN_MANAGE"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "user_name": "[USERNAME]"
+  }
+]
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete model foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Deleting files...
+Destroy complete!

acceptance/bundle/resources/permissions/models/current_can_manage/script

@@ -0,0 +1 @@
+source $TESTDIR/../../_script

acceptance/bundle/resources/permissions/models/other_can_manage/databricks.yml

@@ -0,0 +1,7 @@
+resources:
+  models:
+    foo:
+      name: test-model
+      permissions:
+        - level: CAN_MANAGE
+          service_principal_name: f37d18cd-98a8-4db5-8112-12dd0a6bfe38

acceptance/bundle/resources/permissions/models/other_can_manage/out.plan.direct-exp.json

@@ -0,0 +1,12 @@
+{
+  "plan": {
+    "resources.models.foo": {
+      "action": "create",
+      "new_state": {
+        "config": {
+          "name": "test-model"
+        }
+      }
+    }
+  }
+}

acceptance/bundle/resources/permissions/models/other_can_manage/out.plan.terraform.json

@@ -0,0 +1,7 @@
+{
+  "plan": {
+    "resources.models.foo": {
+      "action": "create"
+    }
+  }
+}

acceptance/bundle/resources/permissions/models/other_can_manage/out.requests.deploy.terraform.json

@@ -0,0 +1,16 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/test-model",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "service_principal_name": "[UUID]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/models/other_can_manage/out.requests.destroy.terraform.json

@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/test-model",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/models/other_can_manage/output.txt

@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle validate -o json
+[
+  {
+    "level": "CAN_MANAGE",
+    "service_principal_name": "[UUID]"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "user_name": "[USERNAME]"
+  }
+]
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete model foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Deleting files...
+Destroy complete!

acceptance/bundle/resources/permissions/models/other_can_manage/script

@@ -0,0 +1 @@
+source $TESTDIR/../../_script

acceptance/bundle/resources/permissions/models/test.toml

@@ -0,0 +1 @@
+Env.RESOURCE = "models"  # for ../_script

acceptance/bundle/resources/permissions/models/viewer/databricks.yml

@@ -0,0 +1,7 @@
+resources:
+  models:
+    foo:
+      name: test-model
+      permissions:
+        - level: CAN_READ
+          user_name: [email protected]

acceptance/bundle/resources/permissions/models/viewer/out.plan.direct-exp.json

@@ -0,0 +1,12 @@
+{
+  "plan": {
+    "resources.models.foo": {
+      "action": "create",
+      "new_state": {
+        "config": {
+          "name": "test-model"
+        }
+      }
+    }
+  }
+}

acceptance/bundle/resources/permissions/models/viewer/out.plan.terraform.json

@@ -0,0 +1,7 @@
+{
+  "plan": {
+    "resources.models.foo": {
+      "action": "create"
+    }
+  }
+}

acceptance/bundle/resources/permissions/models/viewer/out.requests.deploy.terraform.json

@@ -0,0 +1,16 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/test-model",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_READ",
+        "user_name": "[email protected]"
+      },
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/models/viewer/out.requests.destroy.terraform.json

@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/registered-models/test-model",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "CAN_MANAGE",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/models/viewer/output.txt

@@ -0,0 +1,27 @@
+
+>>> [CLI] bundle validate -o json
+[
+  {
+    "level": "CAN_READ",
+    "user_name": "[email protected]"
+  },
+  {
+    "level": "CAN_MANAGE",
+    "user_name": "[USERNAME]"
+  }
+]
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete model foo
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/test-bundle/default
+
+Deleting files...
+Destroy complete!

acceptance/bundle/resources/permissions/models/viewer/script

@@ -0,0 +1 @@
+source $TESTDIR/../../_script

bundle/deploy/terraform/tfdyn/convert_model.go

@@ -38,7 +38,7 @@ func (modelConverter) Convert(ctx context.Context, key string, vin dyn.Value, ou
 
 	// Configure permissions for this resource.
 	if permissions := convertPermissionsResource(ctx, vin); permissions != nil {
-		permissions.RegisteredModelId = fmt.Sprintf("${databricks_mlflow_model.%s.registered_model_id}", key)
+		permissions.RegisteredModelId = fmt.Sprintf("${databricks_mlflow_model.%s.id}", key)
 		out.Permissions["mlflow_model_"+key] = permissions
 	}