Folder: Add option to prevent deletion if not empty (#897)

* Folder: Add option to prevent deletion if not empty
Closes #855
This will allow Terraform to take on folders that potentially have manually-created dashboards in them, without the risk of destroying them without warning

Also, in this condition we can handle the case of alert rules

* Generate docs

* Ignore import verify for the `prevent_destroy_if_not_empty` attribute

* Use folder ID

Author: julienduchesne

docs/resources/folder.md

@@ -43,6 +43,7 @@ resource "grafana_folder" "test_folder_with_uid" {
 
 ### Optional
 
+- `prevent_destroy_if_not_empty` (Boolean) Prevent deletion of the folder if it is not empty (contains dashboards or alert rules). Defaults to `false`.
 - `uid` (String) Unique identifier.
 
 ### Read-Only

go.mod

@@ -5,7 +5,7 @@ go 1.18
 require (
 	github.com/Masterminds/semver/v3 v3.2.1
 	github.com/grafana/amixr-api-go-client v0.0.7
-	github.com/grafana/grafana-api-golang-client v0.19.0
+	github.com/grafana/grafana-api-golang-client v0.19.1
 	github.com/grafana/machine-learning-go-client v0.5.0
 	github.com/grafana/synthetic-monitoring-agent v0.14.4
 	github.com/grafana/synthetic-monitoring-api-go-client v0.7.0

go.sum

@@ -72,8 +72,8 @@ github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
 github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grafana/amixr-api-go-client v0.0.7 h1:U6W6yKxMMybI+Qz4zl+Vih48o6CczLaU/vjk2m7omvU=
 github.com/grafana/amixr-api-go-client v0.0.7/go.mod h1:N6x26XUrM5zGtK5zL5vNJnAn2JFMxLFPPLTw/6pDkFE=
-github.com/grafana/grafana-api-golang-client v0.19.0 h1:4z8voB2nv/bMiP4WbCKdhCym2mltSDFUzOrDqzohrw0=
-github.com/grafana/grafana-api-golang-client v0.19.0/go.mod h1:24W29gPe9yl0/3A9X624TPkAOR8DpHno490cPwnkv8E=
+github.com/grafana/grafana-api-golang-client v0.19.1 h1:eKekLtjX+dSYcxJIsMpz0HkTk2QxUkXf1pyLtZCuxNk=
+github.com/grafana/grafana-api-golang-client v0.19.1/go.mod h1:24W29gPe9yl0/3A9X624TPkAOR8DpHno490cPwnkv8E=
 github.com/grafana/machine-learning-go-client v0.5.0 h1:Q1K+MPSy8vfMm2jsk3WQ7O77cGr2fM5hxwtPSoPc5NU=
 github.com/grafana/machine-learning-go-client v0.5.0/go.mod h1:QFfZz8NkqVF8++skjkKQXJEZfpCYd8S0yTWJUpsLLTA=
 github.com/grafana/synthetic-monitoring-agent v0.14.4 h1:amLwPpBvWnqoYHg4Dn2IBdkDy9szcRLr7yCJHMXNhG8=

internal/resources/grafana/resource_folder.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"log"
+	"net/url"
 	"strconv"
 	"strings"
 
@@ -67,6 +68,12 @@ func ResourceFolder() *schema.Resource {
 				Computed:    true,
 				Description: "The full URL of the folder.",
 			},
+			"prevent_destroy_if_not_empty": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Prevent deletion of the folder if it is not empty (contains dashboards or alert rules).",
+			},
 		},
 	}
 }
@@ -138,7 +145,29 @@ func ReadFolder(ctx context.Context, d *schema.ResourceData, meta interface{}) d
 func DeleteFolder(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
 	client := meta.(*common.Client).GrafanaAPI
 
-	if err := client.DeleteFolder(d.Get("uid").(string)); err != nil {
+	deleteParams := []url.Values{}
+	if d.Get("prevent_destroy_if_not_empty").(bool) {
+		// Search for dashboards and fail if any are found
+		dashboards, err := client.FolderDashboardSearch(url.Values{
+			"type":      []string{"dash-db"},
+			"folderIds": []string{d.Id()},
+		})
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		if len(dashboards) > 0 {
+			var dashboardNames []string
+			for _, dashboard := range dashboards {
+				dashboardNames = append(dashboardNames, dashboard.Title)
+			}
+			return diag.Errorf("folder %s is not empty and prevent_destroy_if_not_empty is set. It contains the following dashboards: %v", d.Get("uid").(string), dashboardNames)
+		}
+	} else {
+		// If we're not preventing destroys, then we can force delete folders that have alert rules
+		deleteParams = append(deleteParams, gapi.ForceDeleteFolderRules())
+	}
+
+	if err := client.DeleteFolder(d.Get("uid").(string), deleteParams...); err != nil {
 		return diag.FromErr(err)
 	}
 

internal/resources/grafana/resource_folder_test.go

@@ -47,14 +47,16 @@ func TestAccFolder_basic(t *testing.T) {
 				),
 			},
 			{
-				ResourceName:      "grafana_folder.test_folder",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "grafana_folder.test_folder",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"prevent_destroy_if_not_empty"},
 			},
 			{
-				ResourceName:      "grafana_folder.test_folder_with_uid",
-				ImportState:       true,
-				ImportStateVerify: true,
+				ResourceName:            "grafana_folder.test_folder_with_uid",
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"prevent_destroy_if_not_empty"},
 			},
 			// Change the title of one folder, change the UID of the other. They shouldn't change IDs (the folder doesn't have to be recreated)
 			{
@@ -99,6 +101,58 @@ func TestAccFolder_basic(t *testing.T) {
 	})
 }
 
+func TestAccFolder_PreventDeletion(t *testing.T) {
+	testutils.CheckOSSTestsEnabled(t)
+
+	name := acctest.RandStringFromCharSet(10, acctest.CharSetAlpha)
+	var folder gapi.Folder
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProviderFactories: testutils.ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccFolderExample_PreventDeletion(name, true), // Create protected folder
+			},
+			{
+				Config:  testAccFolderExample_PreventDeletion(name, true), // Create protected folder
+				Destroy: true,
+			},
+			{
+				Config: testAccFolderExample_PreventDeletion(name, true), // Create protected folder again
+				Check: resource.ComposeTestCheckFunc(
+					testAccFolderCheckExists("grafana_folder.test_folder", &folder),
+					// Create a dashboard in the protected folder
+					func(s *terraform.State) error {
+						client := testutils.Provider.Meta().(*common.Client).GrafanaAPI
+						_, err := client.NewDashboard(gapi.Dashboard{
+							FolderUID: folder.UID,
+							FolderID:  folder.ID,
+							Model: map[string]interface{}{
+								"uid":   name + "-dashboard",
+								"title": name + "-dashboard",
+							}})
+						return err
+					},
+				),
+			},
+			{
+				Config:  testAccFolderExample_PreventDeletion(name, true),
+				Destroy: true, // Try to delete the protected folder
+				ExpectError: regexp.MustCompile(
+					fmt.Sprintf(`.+folder %s is not empty and prevent_destroy_if_not_empty is set.+`, name),
+				), // Fail because it's protected
+			},
+			{
+				Config: testAccFolderExample_PreventDeletion(name, false), // Remove protected flag
+			},
+			{
+				Config:  testAccFolderExample_PreventDeletion(name, false),
+				Destroy: true, // No error if the folder is not protected
+			},
+		},
+	})
+}
+
 // This is a bug in Grafana, not the provider. It was fixed in 9.2.7+ and 9.3.0+, this test will check for regressions
 func TestAccFolder_createFromDifferentRoles(t *testing.T) {
 	testutils.CheckOSSTestsEnabled(t)
@@ -218,3 +272,18 @@ func testAccFolderCheckDestroy(folder *gapi.Folder) resource.TestCheckFunc {
 		return nil
 	}
 }
+
+func testAccFolderExample_PreventDeletion(name string, preventDeletion bool) string {
+	preventDeletionStr := ""
+	if preventDeletion {
+		preventDeletionStr = "prevent_destroy_if_not_empty = true"
+	}
+
+	return fmt.Sprintf(`
+		resource "grafana_folder" "test_folder" {
+			uid      = "%[1]s"
+			title    = "%[1]s"
+			%[2]s
+		}
+	`, name, preventDeletionStr)
+}