delete pdc fields from json_data when generating updated state (#2439)

* delete pdc fields from json_data when generating updated state

* explicitly set PDC fields as reserved in jsondata

Author: dafydd-t

internal/resources/grafana/resource_data_source.go

@@ -19,6 +19,11 @@ import (
 	"github.com/grafana/terraform-provider-grafana/v4/internal/common"
 )
 
+const (
+	pdcEnableSecureSocksProxy   = "enableSecureSocksProxy"
+	pdcSecureSocksProxyUsername = "secureSocksProxyUsername"
+)
+
 func resourceDataSource() *common.Resource {
 	schema := &schema.Resource{
 
@@ -167,6 +172,17 @@ func datasourceJSONDataAttribute() *schema.Schema {
 					errors.New("teamHttpHeaders is a reserved key and cannot be used in JSON data. Use the data_source_config_lbac_rules resource instead"),
 				}
 			}
+
+			if strings.Contains(i.(string), pdcEnableSecureSocksProxy) {
+				return nil, []error{
+					errors.New(pdcEnableSecureSocksProxy + " is a reserved key and cannot be used in JSON data"),
+				}
+			}
+			if strings.Contains(i.(string), pdcSecureSocksProxyUsername) {
+				return nil, []error{
+					errors.New(pdcSecureSocksProxyUsername + " is a reserved key and cannot be used in JSON data"),
+				}
+			}
 			return validation.StringIsJSON(i, s)
 		},
 		StateFunc: func(v any) string {
@@ -182,8 +198,8 @@ func datasourceJSONDataAttribute() *schema.Schema {
 			json.Unmarshal([]byte(newValue), &newValueUnmarshalled)
 			pdcNetworkID := d.Get("private_data_source_connect_network_id")
 			if pdcNetworkID != "" {
-				newValueUnmarshalled["enableSecureSocksProxy"] = true
-				newValueUnmarshalled["secureSocksProxyUsername"] = pdcNetworkID
+				newValueUnmarshalled[pdcEnableSecureSocksProxy] = true
+				newValueUnmarshalled[pdcSecureSocksProxyUsername] = pdcNetworkID
 			}
 			newValue, _ = structure.FlattenJsonToString(newValueUnmarshalled)
 
@@ -333,6 +349,14 @@ func datasourceToState(d *schema.ResourceData, dataSource *models.DataSource) di
 
 func datasourceConfigToState(d *schema.ResourceData, dataSource *models.DataSource) diag.Diagnostics {
 	gottenJSONData, gottenHeaders := removeHeadersFromJSONData(dataSource.JSONData.(map[string]any))
+
+	// These PDC fields are added by the provider, so we should remove them from
+	// the state so that the state matches the user config. The consequence of
+	// having a diff here is suppressed in the DiffSuppressFunc, but there is
+	// a risk that the encoding of the map provides an inconsistent result.
+	delete(gottenJSONData, pdcEnableSecureSocksProxy)
+	delete(gottenJSONData, pdcSecureSocksProxyUsername)
+
 	encodedJSONData, err := json.Marshal(gottenJSONData)
 	if err != nil {
 		return diag.Errorf("Failed to marshal JSON data: %s", err)
@@ -390,8 +414,8 @@ func stateToDatasourceConfig(d *schema.ResourceData) (map[string]any, map[string
 	pdcNetworkID := d.Get("private_data_source_connect_network_id")
 	if pdcNetworkID != nil {
 		if id := pdcNetworkID.(string); id != "" {
-			jd["enableSecureSocksProxy"] = true
-			jd["secureSocksProxyUsername"] = pdcNetworkID
+			jd[pdcEnableSecureSocksProxy] = true
+			jd[pdcSecureSocksProxyUsername] = pdcNetworkID
 		}
 	}
 

internal/resources/grafana/resource_data_source_test.go

@@ -341,6 +341,83 @@ func TestAccDataSource_ValidateHttpHeaders(t *testing.T) {
 	})
 }
 
+func TestAccDataSource_PDCReservedProperties(t *testing.T) {
+	testutils.CheckOSSTestsEnabled(t)
+
+	t.Run("enableSecureSocksProxy", func(t *testing.T) {
+		resource.ParallelTest(t, resource.TestCase{
+			ProtoV5ProviderFactories: testutils.ProtoV5ProviderFactories,
+			Steps: []resource.TestStep{
+				{
+					Config: `
+					resource "grafana_data_source" "influx" {
+						type         = "influxdb"
+						name         = "anything"
+						url          = "http://acc-test.invalid/"
+						json_data_encoded = jsonencode({
+							enableSecureSocksProxy = true
+						})
+					}`,
+					ExpectError: regexp.MustCompile(`enableSecureSocksProxy is a reserved key and cannot be used in JSON data`),
+				},
+			},
+		})
+	})
+
+	t.Run("secureSocksProxyUsername", func(t *testing.T) {
+		resource.ParallelTest(t, resource.TestCase{
+			ProtoV5ProviderFactories: testutils.ProtoV5ProviderFactories,
+			Steps: []resource.TestStep{
+				{
+					Config: `
+					resource "grafana_data_source" "influx" {
+						type         = "influxdb"
+						name         = "anything"
+						url          = "http://acc-test.invalid/"
+						json_data_encoded = jsonencode({
+							secureSocksProxyUsername = "pdc-network-id"
+						})
+					}`,
+					ExpectError: regexp.MustCompile(`secureSocksProxyUsername is a reserved key and cannot be used in JSON data`),
+				},
+			},
+		})
+	})
+}
+
+func TestAccDatasource_PDCPropertiesRemovedFromState(t *testing.T) {
+	testutils.CheckOSSTestsEnabled(t)
+
+	var dataSource models.DataSource
+	var org models.OrgDetailsDTO
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV5ProviderFactories: testutils.ProtoV5ProviderFactories,
+		CheckDestroy:             datasourceCheckExists.destroyed(&dataSource, &org),
+		Steps: []resource.TestStep{
+			{
+				Config: `
+				resource "grafana_data_source" "pdc" {
+					type         = "influxdb"
+					name         = "pdc"
+					url          = "http://acc-test.invalid/"
+					json_data_encoded = jsonencode({
+						organization        = "organization"
+						tlsAuth             = false
+					})
+					private_data_source_connect_network_id = "pdc-network-id"
+				}`,
+				Check: resource.ComposeTestCheckFunc(
+					// Check that the datasource is in the correct organization
+					datasourceCheckExists.exists("grafana_data_source.pdc", &dataSource),
+					// Check that the PDC-related fields are not in the state json data
+					resource.TestCheckResourceAttr("grafana_data_source.pdc", "json_data_encoded", "{\"organization\":\"organization\",\"tlsAuth\":false}"),
+				),
+			},
+		},
+	})
+}
+
 func TestAccDataSource_SeparateConfig(t *testing.T) {
 	testutils.CheckOSSTestsEnabled(t, ">=v9.0.0")