add validation for older terraform client versions

Author: austinvalle

internal/fwserver/attribute_validation.go

@@ -130,6 +130,19 @@ func AttributeValidate(ctx context.Context, a fwschema.Attribute, req ValidateAt
 		)
 	}
 
+	// If the client doesn't support write-only attributes (first supported in Terraform v1.11.0), then we raise an early validation error
+	// to avoid a confusing data consistency error when the provider attempts to return "null" for a write-only attribute in the planned/final state.
+	//
+	// Write-only attributes can only be successfully used with a supporting client, so the only option for a practitoner to utilize a write-only attribute
+	// is to upgrade their Terraform CLI version to v1.11.0 or later.
+	if !req.ClientCapabilities.WriteOnlyAttributesAllowed && a.IsWriteOnly() && !attributeConfig.IsNull() {
+		resp.Diagnostics.AddAttributeError(
+			req.AttributePath,
+			"WriteOnly Attribute Not Allowed",
+			fmt.Sprintf("The resource contains a non-null value for WriteOnly attribute %s. Write-only attributes are only supported in Terraform 1.11 and later.", req.AttributePath.String()),
+		)
+	}
+
 	req.AttributeConfig = attributeConfig
 
 	switch attributeWithValidators := a.(type) {

internal/fwserver/attribute_validation_test.go

@@ -1702,6 +1702,9 @@ func TestAttributeValidate(t *testing.T) {
 		},
 		"write-only-attr-with-required": {
 			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
 				AttributePath: path.Root("test"),
 				Config: tfsdk.Config{
 					Raw: tftypes.NewValue(tftypes.Object{
@@ -1726,6 +1729,9 @@ func TestAttributeValidate(t *testing.T) {
 		},
 		"write-only-attr-with-required-null-value": {
 			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
 				AttributePath: path.Root("test"),
 				Config: tfsdk.Config{
 					Raw: tftypes.NewValue(tftypes.Object{
@@ -1750,6 +1756,9 @@ func TestAttributeValidate(t *testing.T) {
 		},
 		"write-only-attr-with-optional": {
 			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
 				AttributePath: path.Root("test"),
 				Config: tfsdk.Config{
 					Raw: tftypes.NewValue(tftypes.Object{
@@ -1774,6 +1783,9 @@ func TestAttributeValidate(t *testing.T) {
 		},
 		"write-only-attr-with-computed": {
 			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
 				AttributePath: path.Root("test"),
 				Config: tfsdk.Config{
 					Raw: tftypes.NewValue(tftypes.Object{
@@ -1806,6 +1818,9 @@ func TestAttributeValidate(t *testing.T) {
 		},
 		"write-only-attr-missing-required-and-optional": {
 			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
 				AttributePath: path.Root("test"),
 				Config: tfsdk.Config{
 					Raw: tftypes.NewValue(tftypes.Object{
@@ -1837,6 +1852,9 @@ func TestAttributeValidate(t *testing.T) {
 		},
 		"write-only-attr-with-required-and-optional": {
 			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
 				AttributePath: path.Root("test"),
 				Config: tfsdk.Config{
 					Raw: tftypes.NewValue(tftypes.Object{
@@ -1870,6 +1888,9 @@ func TestAttributeValidate(t *testing.T) {
 		},
 		"write-only-attr-with-computed-required-and-optional": {
 			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
 				AttributePath: path.Root("test"),
 				Config: tfsdk.Config{
 					Raw: tftypes.NewValue(tftypes.Object{
@@ -1907,6 +1928,43 @@ func TestAttributeValidate(t *testing.T) {
 				},
 			},
 		},
+		"write-only-attr-set-no-client-capability": {
+			req: ValidateAttributeRequest{
+				ClientCapabilities: validator.ValidateSchemaClientCapabilities{
+					// Client indicating it doesn't support write-only attributes
+					WriteOnlyAttributesAllowed: false,
+				},
+				AttributePath: path.Root("test"),
+				Config: tfsdk.Config{
+					Raw: tftypes.NewValue(tftypes.Object{
+						AttributeTypes: map[string]tftypes.Type{
+							"test": tftypes.String,
+						},
+					}, map[string]tftypes.Value{
+						"test": tftypes.NewValue(tftypes.String, "hello world!"),
+					}),
+					Schema: testschema.Schema{
+						Attributes: map[string]fwschema.Attribute{
+							"test": testschema.Attribute{
+								Required:  true,
+								WriteOnly: true,
+								Type:      types.StringType,
+							},
+						},
+					},
+				},
+			},
+			resp: ValidateAttributeResponse{
+				Diagnostics: diag.Diagnostics{
+					diag.NewAttributeErrorDiagnostic(
+						path.Root("test"),
+						"WriteOnly Attribute Not Allowed",
+						"The resource contains a non-null value for WriteOnly attribute test. "+
+							"Write-only attributes are only supported in Terraform 1.11 and later.",
+					),
+				},
+			},
+		},
 	}
 
 	for name, tc := range testCases {