[Exporter] Added support for Databricks Apps resources (#5208)

## Changes
<!-- Summary of your changes that are easy to understand -->

This change adds exporter support for `databricks_app` and
`databricks_apps_settings_custom_template` resources.

Changes:

* Add exporter support for `databricks_app` resource`
* Add exporter support for `databricks_apps_settings_custom_template`
* Fix Plugin Framework list processing in `codegen.go`:
- Include numeric indices in nested list paths (e.g.,
`resources.0.secret.key`) for consistent reference resolution across
SDKv2 and Plugin Framework resources
- Ensures `IsValidApproximation` functions receive correct paths with
indices
* Refactor and improvements:
  - Export AppResource type in resource_app.go for exporter use
  - Do group caching only if `groups` service is enabled

## Tests
<!--
How is this tested? Please see the checklist below and also describe any
other relevant tests
-->

- [x] `make test` run locally
- [x] relevant change in `docs/` folder
- [ ] covered with integration tests in `internal/acceptance`
- [ ] using Go SDK
- [ ] using TF Plugin Framework
- [x] has entry in `NEXT_CHANGELOG.md` file

Author: alexott

NEXT_CHANGELOG.md

@@ -20,5 +20,6 @@
 * Added support for `databricks_data_quality_monitor` resource ([#5193](https://github.com/databricks/terraform-provider-databricks/pull/5193)).
 * Fix typo in the name of environment variable ([#5158](https://github.com/databricks/terraform-provider-databricks/pull/5158)).
 * Export permission assignments on workspace level ([#5169](https://github.com/databricks/terraform-provider-databricks/pull/5169)).
+* Added support for Databricks Apps resources ([#5208](https://github.com/databricks/terraform-provider-databricks/pull/5208)).
 
 ### Internal Changes

docs/guides/experimental-exporter.md

@@ -174,6 +174,7 @@ Services could be specified in combination with predefined aliases (`all` - for
 
 * `access` -  **listing** [databricks_permissions](../resources/permissions.md), [databricks_instance_profile](../resources/instance_profile.md), [databricks_ip_access_list](../resources/ip_access_list.md), and [databricks_access_control_rule_set](../resources/access_control_rule_set.md).   *Please note that for `databricks_permissions` we list only `authorization = "tokens"`, the permissions for other objects (notebooks, ...) will be emitted when corresponding objects are processed!*
 * `alerts` - **listing** [databricks_alert](../resources/alert.md) and [databricks_alert_v2](../resources/alert_v2.md).
+* `apps` - **listing** [databricks_app](../resources/app.md) and [databricks_apps_settings_custom_template](../resources/apps_settings_custom_template.md).
 * `billing` - **listing** [databricks_budget](../resources/budget.md).
 * `compute` - **listing** [databricks_cluster](../resources/cluster.md).
 * `dashboards` - **listing** [databricks_dashboard](../resources/dashboard.md).
@@ -241,6 +242,8 @@ Exporter aims to generate HCL code for most of the resources within the Databric
 | [databricks_access_control_rule_set](../resources/access_control_rule_set.md) | Yes | No | No | Yes |
 | [databricks_alert](../resources/alert.md) | Yes | Yes | Yes | No |
 | [databricks_alert_v2](../resources/alert_v2.md) | Yes | Yes | Yes | No |
+| [databricks_app](../resources/app.md) | Yes | No | Yes | No |
+| [databricks_apps_settings_custom_template](../resources/apps_settings_custom_template.md) | Yes | No | Yes | No |
 | [databricks_artifact_allowlist](../resources/artifact_allowlist.md) | Yes | No | Yes | No |
 | [databricks_budget](../resources/budget.md) | Yes | Yes | No | Yes |
 | [databricks_catalog](../resources/catalog.md) | Yes | Yes | Yes | No |

exporter/AGENTS.md

@@ -33,7 +33,7 @@ When adding a new resource to Terraform Exporter we need to perform next steps:
 1. Define a new `importable` instance in the `importables.go`.
 2. Specify if it's account-level or workspace-level resource, or both.
 3. Specify a service to which resource belongs to. Either use one of the existing, if it fits, or define a new one (ask user for confirmation).
-4. Implement the `List` function that will be discover and emit instances of the specific resource.
+4. Implement the `List` function that will be discover and emit instances of the specific resource.  When implementing it, prefer to use `List` method of Go SDK instead of `ListAll`.
 5. (Optional) Implement the `Name` function that will extract TF resource name from an instance of a specific resource.
 6. (Recommended) Implement the `Import` function that is responsible for emitting of dependencies for this resource - permissions/grants, etc.
 7. (Optional) Implement the `ShouldOmitField` if some fields should be conditionally omitted.

exporter/codegen.go

@@ -762,7 +762,9 @@ func (ic *importContext) pluginFrameworkFieldToHcl(imp importable, path []string
 					}
 
 					if nestedData, ok := item.(map[string]interface{}); ok {
-						objTokens := ic.pluginFrameworkNestedObjectToTokens(imp, append(path, fieldName), nestedSchema, nestedData, res)
+						// Include the index in the path for proper reference resolution
+						nestedPath := append(path, fieldName, strconv.Itoa(i))
+						objTokens := ic.pluginFrameworkNestedObjectToTokens(imp, nestedPath, nestedSchema, nestedData, res)
 						listTokens = append(listTokens, objTokens...)
 					}
 				}

exporter/exporter_test.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/databricks/databricks-sdk-go/apierr"
+	"github.com/databricks/databricks-sdk-go/service/apps"
 	sdk_uc "github.com/databricks/databricks-sdk-go/service/catalog"
 	sdk_compute "github.com/databricks/databricks-sdk-go/service/compute"
 	sdk_dashboards "github.com/databricks/databricks-sdk-go/service/dashboards"
@@ -33,6 +34,7 @@ import (
 	"github.com/databricks/terraform-provider-databricks/commands"
 	"github.com/databricks/terraform-provider-databricks/common"
 	"github.com/databricks/terraform-provider-databricks/internal/service/workspace_tf"
+	"github.com/databricks/terraform-provider-databricks/permissions/entity"
 	"github.com/databricks/terraform-provider-databricks/qa"
 	"github.com/databricks/terraform-provider-databricks/repos"
 	"github.com/databricks/terraform-provider-databricks/scim"
@@ -345,6 +347,24 @@ var emptyGitCredentials = qa.HTTPFixture{
 	},
 }
 
+var emptyAppsSettingsCustomTemplates = qa.HTTPFixture{
+	Method:   "GET",
+	Resource: "/api/2.0/apps-settings/templates?",
+	Response: apps.ListCustomTemplatesResponse{
+		Templates: []apps.CustomTemplate{},
+	},
+	ReuseRequest: true,
+}
+
+var emptyApps = qa.HTTPFixture{
+	Method:   "GET",
+	Resource: "/api/2.0/apps?",
+	Response: apps.ListAppsResponse{
+		Apps: []apps.App{},
+	},
+	ReuseRequest: true,
+}
+
 var emptyModelServing = qa.HTTPFixture{
 	Method:   "GET",
 	Resource: "/api/2.0/serving-endpoints",
@@ -527,6 +547,8 @@ func TestImportingUsersGroupsSecretScopes(t *testing.T) {
 		[]qa.HTTPFixture{
 			emptyDestinationNotficationsList,
 			noCurrentMetastoreAttached,
+			emptyApps,
+			emptyAppsSettingsCustomTemplates,
 			emptyLakeviewList,
 			emptyMetastoreList,
 			meAdminFixture,
@@ -798,6 +820,8 @@ func TestImportingNoResourcesError(t *testing.T) {
 					Groups: []scim.ComplexValue{},
 				},
 			},
+			emptyApps,
+			emptyAppsSettingsCustomTemplates,
 			emptyDataQualityMonitors,
 			emptyUsersList,
 			emptySpnsList,
@@ -3386,3 +3410,216 @@ func TestDataQualityMonitorsExport(t *testing.T) {
 }`))
 	})
 }
+
+func TestAppExport(t *testing.T) {
+	qa.HTTPFixturesApply(t, []qa.HTTPFixture{
+		meAdminFixture,
+		noCurrentMetastoreAttached,
+		emptyAppsSettingsCustomTemplates,
+		{
+			Method:   "GET",
+			Resource: "/api/2.0/apps?",
+			Response: apps.ListAppsResponse{
+				Apps: []apps.App{
+					{
+						Name:        "test-app",
+						Description: "Test app",
+						Resources: []apps.AppResource{
+							{
+								Name: "sql-warehouse",
+								SqlWarehouse: &apps.AppResourceSqlWarehouse{
+									Id:         "warehouse-123",
+									Permission: "CAN_MANAGE",
+								},
+							},
+							{
+								Name: "serving-endpoint",
+								ServingEndpoint: &apps.AppResourceServingEndpoint{
+									Name:       "endpoint-abc",
+									Permission: "CAN_QUERY",
+								},
+							},
+							{
+								Name: "job",
+								Job: &apps.AppResourceJob{
+									Id:         "job-456",
+									Permission: "CAN_VIEW",
+								},
+							},
+							{
+								Name: "secret",
+								Secret: &apps.AppResourceSecret{
+									Scope:      "my-scope",
+									Key:        "my-key",
+									Permission: "READ",
+								},
+							},
+							{
+								Name: "uc-volume",
+								UcSecurable: &apps.AppResourceUcSecurable{
+									SecurableType:     "VOLUME",
+									SecurableFullName: "catalog.schema.my_volume",
+									Permission:        "READ_VOLUME",
+								},
+							},
+						},
+						BudgetPolicyId: "budget-789",
+					},
+				},
+			},
+		},
+		{
+			Method:   "GET",
+			Resource: "/api/2.0/apps/test-app?",
+			Response: apps.App{
+				Name:        "test-app",
+				Description: "Test app",
+				Resources: []apps.AppResource{
+					{
+						Name: "sql-warehouse",
+						SqlWarehouse: &apps.AppResourceSqlWarehouse{
+							Id:         "warehouse-123",
+							Permission: "CAN_MANAGE",
+						},
+					},
+					{
+						Name: "serving-endpoint",
+						ServingEndpoint: &apps.AppResourceServingEndpoint{
+							Name:       "endpoint-abc",
+							Permission: "CAN_QUERY",
+						},
+					},
+					{
+						Name: "job",
+						Job: &apps.AppResourceJob{
+							Id:         "job-456",
+							Permission: "CAN_VIEW",
+						},
+					},
+					{
+						Name: "secret",
+						Secret: &apps.AppResourceSecret{
+							Scope:      "my-scope",
+							Key:        "my-key",
+							Permission: "READ",
+						},
+					},
+					{
+						Name: "uc-volume",
+						UcSecurable: &apps.AppResourceUcSecurable{
+							SecurableType:     "VOLUME",
+							SecurableFullName: "catalog.schema.my_volume",
+							Permission:        "READ_VOLUME",
+						},
+					},
+				},
+				BudgetPolicyId: "budget-789",
+			},
+		},
+		{
+			Method:   "GET",
+			Resource: "/api/2.0/permissions/apps/test-app",
+			Response: entity.PermissionsEntity{
+				ObjectType:        "apps",
+				AccessControlList: []iam.AccessControlRequest{},
+			},
+		},
+	}, func(ctx context.Context, client *common.DatabricksClient) {
+		tmpDir := fmt.Sprintf("/tmp/tf-%s", qa.RandomName())
+		defer os.RemoveAll(tmpDir)
+
+		ic := newImportContext(client)
+		ic.enableServices("apps")
+		ic.enableListing("apps")
+		ic.Directory = tmpDir
+		ic.noFormat = true
+
+		err := ic.Run()
+		assert.NoError(t, err)
+
+		// Verify that the app and its dependencies were generated in the Terraform code
+		content, err := os.ReadFile(tmpDir + "/apps.tf")
+		assert.NoError(t, err)
+		contentStr := normalizeWhitespace(string(content))
+
+		// Check that the app resource is generated
+		assert.Contains(t, contentStr, `resource "databricks_app" "test_app"`)
+		assert.Contains(t, contentStr, `name = "test-app"`)
+		assert.Contains(t, contentStr, `description = "Test app"`)
+	})
+}
+
+func TestAppsSettingsCustomTemplateExport(t *testing.T) {
+	qa.HTTPFixturesApply(t, []qa.HTTPFixture{
+		meAdminFixture,
+		noCurrentMetastoreAttached,
+		{
+			Method:   "GET",
+			Resource: "/api/2.0/apps?",
+			Response: apps.ListAppsResponse{
+				Apps: []apps.App{},
+			},
+		},
+		{
+			Method:   "GET",
+			Resource: "/api/2.0/apps-settings/templates?",
+			Response: apps.ListCustomTemplatesResponse{
+				Templates: []apps.CustomTemplate{
+					{
+						Name:        "my-custom-template",
+						Description: "Test template",
+						GitRepo:     "https://github.com/example/repo.git",
+						GitProvider: "github",
+						Path:        "templates/app",
+						Creator:     "[email protected]",
+					},
+				},
+			},
+		},
+		{
+			Method:   "GET",
+			Resource: "/api/2.0/apps-settings/templates/my-custom-template?",
+			Response: apps.CustomTemplate{
+				Name:        "my-custom-template",
+				Description: "Test template",
+				GitRepo:     "https://github.com/example/repo.git",
+				GitProvider: "github",
+				Path:        "templates/app",
+				Creator:     "[email protected]",
+			},
+		},
+		{
+			Method:   "GET",
+			Resource: "/api/2.0/permissions/apps/templates/my-custom-template",
+			Response: entity.PermissionsEntity{
+				ObjectType:        "apps/templates",
+				AccessControlList: []iam.AccessControlRequest{},
+			},
+		},
+	}, func(ctx context.Context, client *common.DatabricksClient) {
+		tmpDir := fmt.Sprintf("/tmp/tf-%s", qa.RandomName())
+		defer os.RemoveAll(tmpDir)
+
+		ic := newImportContext(client)
+		ic.enableServices("apps")
+		ic.enableListing("apps")
+		ic.Directory = tmpDir
+		ic.noFormat = true
+
+		err := ic.Run()
+		assert.NoError(t, err)
+
+		// Verify that the custom template was generated in the Terraform code
+		content, err := os.ReadFile(tmpDir + "/apps.tf")
+		assert.NoError(t, err)
+		contentStr := normalizeWhitespace(string(content))
+
+		// Check that the custom template resource is generated
+		assert.Contains(t, contentStr, `resource "databricks_apps_settings_custom_template" "my_custom_template"`)
+		assert.Contains(t, contentStr, `name = "my-custom-template"`)
+		assert.Contains(t, contentStr, `description = "Test template"`)
+		assert.Contains(t, contentStr, `git_repo = "https://github.com/example/repo.git"`)
+		assert.Contains(t, contentStr, `git_provider = "github"`)
+		assert.Contains(t, contentStr, `path = "templates/app"`)
+	})
+}