Follow CODING_STANDARDS: read resource state after create/update operations

Per CODING_STANDARDS.md line 39, the final state should be derived from a read
request following a mutative request. Updated both exception_list and exception_item
resources to perform a read after create and update operations, using the read
response to build the final state rather than the mutative response.

This ensures state consistency and avoids dirty plans after apply.

Co-authored-by: nick-benoit <[email protected]>

Author: Copilot

internal/kibana/security/exception_item/create.go

@@ -141,8 +141,28 @@ func (r *ExceptionItemResource) Create(ctx context.Context, req resource.CreateR
 		return
 	}
 
-	// Update state with create response
-	diags = r.updateStateFromAPIResponse(ctx, &plan, createResp.JSON200)
+	/*
+	 * In create/update paths we typically follow the write operation with a read, and then set the state from the read.
+	 * We want to avoid a dirty plan immediately after an apply.
+	 */
+	// Read back the created resource to get the final state
+	readParams := &kbapi.ReadExceptionListItemParams{
+		Id: (*kbapi.SecurityExceptionsAPIExceptionListItemId)(&createResp.JSON200.Id),
+	}
+
+	readResp, diags := kibana_oapi.GetExceptionListItem(ctx, client, readParams)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if readResp == nil || readResp.JSON200 == nil {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	// Update state with read response
+	diags = r.updateStateFromAPIResponse(ctx, &plan, readResp.JSON200)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return

internal/kibana/security/exception_item/update.go

@@ -132,8 +132,28 @@ func (r *ExceptionItemResource) Update(ctx context.Context, req resource.UpdateR
 		return
 	}
 
-	// Update state with response
-	diags = r.updateStateFromAPIResponse(ctx, &plan, updateResp.JSON200)
+	/*
+	 * In create/update paths we typically follow the write operation with a read, and then set the state from the read.
+	 * We want to avoid a dirty plan immediately after an apply.
+	 */
+	// Read back the updated resource to get the final state
+	readParams := &kbapi.ReadExceptionListItemParams{
+		Id: (*kbapi.SecurityExceptionsAPIExceptionListItemId)(&updateResp.JSON200.Id),
+	}
+
+	readResp, diags := kibana_oapi.GetExceptionListItem(ctx, client, readParams)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if readResp == nil || readResp.JSON200 == nil {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	// Update state with read response
+	diags = r.updateStateFromAPIResponse(ctx, &plan, readResp.JSON200)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return

internal/kibana/security/exception_list/create.go

@@ -94,8 +94,28 @@ func (r *ExceptionListResource) Create(ctx context.Context, req resource.CreateR
 		return
 	}
 
-	// Update state with create response
-	diags = r.updateStateFromAPIResponse(ctx, &plan, createResp.JSON200)
+	/*
+	 * In create/update paths we typically follow the write operation with a read, and then set the state from the read.
+	 * We want to avoid a dirty plan immediately after an apply.
+	 */
+	// Read back the created resource to get the final state
+	readParams := &kbapi.ReadExceptionListParams{
+		Id: (*kbapi.SecurityExceptionsAPIExceptionListId)(&createResp.JSON200.Id),
+	}
+
+	readResp, diags := kibana_oapi.GetExceptionList(ctx, client, readParams)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if readResp == nil || readResp.JSON200 == nil {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	// Update state with read response
+	diags = r.updateStateFromAPIResponse(ctx, &plan, readResp.JSON200)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return

internal/kibana/security/exception_list/update.go

@@ -95,8 +95,28 @@ func (r *ExceptionListResource) Update(ctx context.Context, req resource.UpdateR
 		return
 	}
 
-	// Update state with response
-	diags = r.updateStateFromAPIResponse(ctx, &plan, updateResp.JSON200)
+	/*
+	 * In create/update paths we typically follow the write operation with a read, and then set the state from the read.
+	 * We want to avoid a dirty plan immediately after an apply.
+	 */
+	// Read back the updated resource to get the final state
+	readParams := &kbapi.ReadExceptionListParams{
+		Id: (*kbapi.SecurityExceptionsAPIExceptionListId)(&updateResp.JSON200.Id),
+	}
+
+	readResp, diags := kibana_oapi.GetExceptionList(ctx, client, readParams)
+	resp.Diagnostics.Append(diags...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	if readResp == nil || readResp.JSON200 == nil {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+
+	// Update state with read response
+	diags = r.updateStateFromAPIResponse(ctx, &plan, readResp.JSON200)
 	resp.Diagnostics.Append(diags...)
 	if resp.Diagnostics.HasError() {
 		return