resource/gitlab_instance_variable: better error message for invalid masked variable values. Closes #371

Author: timofurrer

internal/provider/resource_gitlab_instance_variable.go

@@ -81,7 +81,7 @@ func resourceGitlabInstanceVariableCreate(ctx context.Context, d *schema.Resourc
 
 	_, _, err := client.InstanceVariables.CreateVariable(&options, gitlab.WithContext(ctx))
 	if err != nil {
-		return diag.FromErr(err)
+		return augmentVariableClientError(d, err)
 	}
 
 	d.SetId(key)
@@ -103,7 +103,7 @@ func resourceGitlabInstanceVariableRead(ctx context.Context, d *schema.ResourceD
 			d.SetId("")
 			return nil
 		}
-		return diag.FromErr(err)
+		return augmentVariableClientError(d, err)
 	}
 
 	d.Set("key", v.Key)
@@ -133,7 +133,7 @@ func resourceGitlabInstanceVariableUpdate(ctx context.Context, d *schema.Resourc
 
 	_, _, err := client.InstanceVariables.UpdateVariable(key, options, gitlab.WithContext(ctx))
 	if err != nil {
-		return diag.FromErr(err)
+		return augmentVariableClientError(d, err)
 	}
 	return resourceGitlabInstanceVariableRead(ctx, d, meta)
 }
@@ -145,7 +145,7 @@ func resourceGitlabInstanceVariableDelete(ctx context.Context, d *schema.Resourc
 
 	_, err := client.InstanceVariables.RemoveVariable(key, gitlab.WithContext(ctx))
 	if err != nil {
-		return diag.FromErr(err)
+		return augmentVariableClientError(d, err)
 	}
 
 	return nil

internal/provider/resource_gitlab_instance_variable_test.go

@@ -2,6 +2,7 @@ package provider
 
 import (
 	"fmt"
+	"regexp"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
@@ -54,6 +55,46 @@ func TestAccGitlabInstanceVariable_basic(t *testing.T) {
 					}),
 				),
 			},
+			// Update the instance variable to enable "masked" for a value that does not meet masking requirements, and expect an error with no state change.
+			// ref: https://docs.gitlab.com/ce/ci/variables/README.html#masked-variable-requirements
+			{
+				Config: testAccGitlabInstanceVariableUpdateConfigMaskedBad(rString),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGitlabInstanceVariableExists("gitlab_instance_variable.foo", &instanceVariable),
+					testAccCheckGitlabInstanceVariableAttributes(&instanceVariable, &testAccGitlabInstanceVariableExpectedAttributes{
+						Key:   fmt.Sprintf("key_%s", rString),
+						Value: fmt.Sprintf("value-%s", rString),
+					}),
+				),
+				ExpectError: regexp.MustCompile(regexp.QuoteMeta(
+					"Invalid value for a masked variable. Check the masked variable requirements: https://docs.gitlab.com/ee/ci/variables/#masked-variable-requirements",
+				)),
+			},
+			// Update the instance variable to to enable "masked" and meet masking requirements
+			// ref: https://docs.gitlab.com/ce/ci/variables/README.html#masked-variable-requirements
+			{
+				Config: testAccGitlabInstanceVariableUpdateConfigMaskedGood(rString),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGitlabInstanceVariableExists("gitlab_instance_variable.foo", &instanceVariable),
+					testAccCheckGitlabInstanceVariableAttributes(&instanceVariable, &testAccGitlabInstanceVariableExpectedAttributes{
+						Key:    fmt.Sprintf("key_%s", rString),
+						Value:  fmt.Sprintf("value-%s", rString),
+						Masked: true,
+					}),
+				),
+			},
+			// Update the instance variable to toggle the options back
+			{
+				Config: testAccGitlabInstanceVariableConfig(rString),
+				Check: resource.ComposeTestCheckFunc(
+					testAccCheckGitlabInstanceVariableExists("gitlab_instance_variable.foo", &instanceVariable),
+					testAccCheckGitlabInstanceVariableAttributes(&instanceVariable, &testAccGitlabInstanceVariableExpectedAttributes{
+						Key:       fmt.Sprintf("key_%s", rString),
+						Value:     fmt.Sprintf("value-%s", rString),
+						Protected: false,
+					}),
+				),
+			},
 		},
 	})
 }
@@ -129,3 +170,26 @@ resource "gitlab_instance_variable" "foo" {
 }
 	`, rString, rString)
 }
+
+func testAccGitlabInstanceVariableUpdateConfigMaskedBad(rString string) string {
+	return fmt.Sprintf(`
+resource "gitlab_instance_variable" "foo" {
+  key = "key_%s"
+  value = <<EOF
+value-%s"
+i am multiline
+EOF
+  masked = true
+}
+	`, rString, rString)
+}
+
+func testAccGitlabInstanceVariableUpdateConfigMaskedGood(rString string) string {
+	return fmt.Sprintf(`
+resource "gitlab_instance_variable" "foo" {
+  key = "key_%s"
+  value = "value-%s"
+  masked = true
+}
+	`, rString, rString)
+}