update terraform-json and terraform-exec dependencies and update query checks to be consistent with existing statechecks

Author: stephybun

go.mod

@@ -13,8 +13,8 @@ require (
 	github.com/hashicorp/hc-install v0.9.2
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/hashicorp/logutils v1.0.0
-	github.com/hashicorp/terraform-exec v0.23.2-0.20250903143921-c05687bce503
-	github.com/hashicorp/terraform-json v0.26.1-0.20250829125600-5c1a00f3ccc4
+	github.com/hashicorp/terraform-exec v0.24.0
+	github.com/hashicorp/terraform-json v0.27.2
 	github.com/hashicorp/terraform-plugin-go v0.29.0-beta.1
 	github.com/hashicorp/terraform-plugin-log v0.9.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0

go.sum

@@ -76,10 +76,10 @@ github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQx
 github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/terraform-exec v0.23.2-0.20250903143921-c05687bce503 h1:A/cbqqEjJmPouKHgWlIBQOBPROLO4ubPmHFl7yKZ+As=
-github.com/hashicorp/terraform-exec v0.23.2-0.20250903143921-c05687bce503/go.mod h1:rG9V56jmBbB5hXCo4MpZTr6tYKLaykUONa8mX01yBhg=
-github.com/hashicorp/terraform-json v0.26.1-0.20250829125600-5c1a00f3ccc4 h1:qErXY0TfojskxvAlCiqS4IMmXulQ4TfApiO8IlKkImc=
-github.com/hashicorp/terraform-json v0.26.1-0.20250829125600-5c1a00f3ccc4/go.mod h1:GzPLJ1PLdUG5xL6xn1OXWIjteQRT2CNT9o/6A9mi9hE=
+github.com/hashicorp/terraform-exec v0.24.0 h1:mL0xlk9H5g2bn0pPF6JQZk5YlByqSqrO5VoaNtAf8OE=
+github.com/hashicorp/terraform-exec v0.24.0/go.mod h1:lluc/rDYfAhYdslLJQg3J0oDqo88oGQAdHR+wDqFvo4=
+github.com/hashicorp/terraform-json v0.27.2 h1:BwGuzM6iUPqf9JYM/Z4AF1OJ5VVJEEzoKST/tRDBJKU=
+github.com/hashicorp/terraform-json v0.27.2/go.mod h1:GzPLJ1PLdUG5xL6xn1OXWIjteQRT2CNT9o/6A9mi9hE=
 github.com/hashicorp/terraform-plugin-go v0.29.0-beta.1 h1:xeHlRQYev3iMXwX2W7+D1bSfLRBs9jojZXqE6hmNxMI=
 github.com/hashicorp/terraform-plugin-go v0.29.0-beta.1/go.mod h1:5pww/UULn9C2tItq6o5sbScEkJxBUt9X9kI4DkeRsIw=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=

helper/resource/query/query_test.go

@@ -78,13 +78,16 @@ func TestQuery(t *testing.T) {
 						"location": knownvalue.StringExact("westeurope3"),
 					}),
 					querycheck.ExpectIdentity("examplecloud_containerette.test2", map[string]knownvalue.Check{
-						"id": knownvalue.StringExact("westeurope/somevalue1"),
+						"id":       knownvalue.StringExact("westeurope/somevalue1"),
+						"location": knownvalue.StringExact("westeurope"),
 					}),
 					querycheck.ExpectIdentity("examplecloud_containerette.test2", map[string]knownvalue.Check{
-						"id": knownvalue.StringExact("westeurope/somevalue2"),
+						"id":       knownvalue.StringExact("westeurope/somevalue2"),
+						"location": knownvalue.StringExact("westeurope"),
 					}),
 					querycheck.ExpectIdentity("examplecloud_containerette.test2", map[string]knownvalue.Check{
-						"id": knownvalue.StringExact("westeurope/somevalue3"),
+						"id":       knownvalue.StringExact("westeurope/somevalue3"),
+						"location": knownvalue.StringExact("westeurope"),
 					}),
 				},
 			},

internal/plugintest/working_dir.go

@@ -6,13 +6,11 @@ package plugintest
 import (
 	"context"
 	"fmt"
+	"github.com/hashicorp/terraform-exec/tfexec"
+	tfjson "github.com/hashicorp/terraform-json"
 	"io"
 	"os"
 	"path/filepath"
-	"strings"
-
-	"github.com/hashicorp/terraform-exec/tfexec"
-	tfjson "github.com/hashicorp/terraform-json"
 
 	"github.com/hashicorp/terraform-plugin-testing/config"
 	"github.com/hashicorp/terraform-plugin-testing/internal/logging"
@@ -527,38 +525,32 @@ func (wd *WorkingDir) Schemas(ctx context.Context) (*tfjson.ProviderSchemas, err
 
 func (wd *WorkingDir) Query(ctx context.Context) ([]tfjson.LogMsg, error) {
 	var messages []tfjson.LogMsg
-	var logEmit *tfexec.LogMsgEmitter
-	var execErr, err error
-	var message tfjson.LogMsg
-	var related bool
+	var diags []tfjson.LogMsg
 
 	logging.HelperResourceTrace(ctx, "Calling Terraform CLI providers query command")
 
 	args := []tfexec.QueryOption{tfexec.Reattach(wd.reattachInfo)}
 
-	logEmit, execErr = wd.tf.QueryJSON(context.Background(), args...)
+	logs, err := wd.tf.QueryJSON(context.Background(), args...)
 
-	if execErr != nil {
-		return nil, fmt.Errorf("Error running terraform query command: %w", err)
-	}
-
-	message, related, err = logEmit.NextMessage()
-
-	if !related && err != nil {
-		return nil, fmt.Errorf("Error no messages found from terraform query command: %w", err)
+	if err != nil {
+		return nil, fmt.Errorf("running terraform query command: %w", err)
 	}
 
-	for err != nil || message != nil {
-		message, related, err = logEmit.NextMessage()
-		messages = append(messages, message)
-
-		if message != nil && strings.Contains(message.Message(), "Invalid provider configuration") {
-			return nil, fmt.Errorf("Provider requires explicit configuration. Add a provider block to the root module and configure the provider's required arguments as described in the provider documentation.")
+	for msg := range logs {
+		if msg.Err != nil {
+			return nil, fmt.Errorf("retrieving next message: %w", msg.Err)
+		}
+		if msg.Msg.Level() == tfjson.Error {
+			// TODO reimplement missing .tf config error
+			diags = append(diags, msg.Msg)
+			continue
 		}
+		messages = append(messages, msg.Msg)
 	}
 
-	if related {
-		return nil, fmt.Errorf("Error running terraform query command: %w", err)
+	if len(diags) > 0 {
+		return nil, fmt.Errorf("running terraform query command returned diagnostics: %+v", diags)
 	}
 
 	logging.HelperResourceTrace(ctx, "Called Terraform CLI providers query command")

querycheck/expect_identity.go

@@ -5,67 +5,82 @@ package querycheck
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
+	"sort"
+	"strings"
 
 	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
+	"github.com/hashicorp/terraform-plugin-testing/statecheck"
 )
 
 var _ QueryResultCheck = expectIdentity{}
 
 type expectIdentity struct {
-	resourceAddress string
-	check           map[string]knownvalue.Check
+	listResourceAddress string
+	check               map[string]knownvalue.Check
 }
 
 // CheckQuery implements the query check logic.
-func (e expectIdentity) CheckQuery(ctx context.Context, req CheckQueryRequest, resp *CheckQueryResponse) {
+func (e expectIdentity) CheckQuery(_ context.Context, req CheckQueryRequest, resp *CheckQueryResponse) {
 	for _, res := range *req.Query {
 		var errCollection []error
 
-		for attribute := range e.check {
-			var val any
-			var unmarshalledVal any
+		if e.listResourceAddress != strings.TrimPrefix(res.Address, "list.") {
+			continue
+		}
 
-			val, ok := res.Identity[attribute]
-			if !ok {
-				resp.Error = fmt.Errorf("%s - expected attribute %q not in actual identity object", e.resourceAddress, attribute)
-				return
+		if len(res.Identity) != len(e.check) {
+			deltaMsg := ""
+			if len(res.Identity) > len(e.check) {
+				deltaMsg = statecheck.CreateDeltaString(res.Identity, e.check, "actual identity has extra attribute(s): ")
+			} else {
+				deltaMsg = statecheck.CreateDeltaString(e.check, res.Identity, "actual identity is missing attribute(s): ")
 			}
 
-			rawMessage, ok := val.(json.RawMessage)
-			if !ok {
-				resp.Error = fmt.Errorf("%s - expected json.RawMessage but got %T", e.resourceAddress, val)
-				return
-			}
-			err := json.Unmarshal(rawMessage, &unmarshalledVal)
+			resp.Error = fmt.Errorf("%s - Expected %d attribute(s) in the actual identity object, got %d attribute(s): %s", e.listResourceAddress, len(e.check), len(res.Identity), deltaMsg)
+			return
+		}
+
+		var keys []string
 
-			if err != nil {
-				resp.Error = fmt.Errorf("%s - Error decoding message type: %s", e.resourceAddress, err)
+		for k := range e.check {
+			keys = append(keys, k)
+		}
+
+		sort.SliceStable(keys, func(i, j int) bool {
+			return keys[i] < keys[j]
+		})
+
+		for _, k := range keys {
+			actualIdentityVal, ok := res.Identity[k]
+
+			if !ok {
+				resp.Error = fmt.Errorf("%s - missing attribute %q in actual identity object", e.listResourceAddress, k)
 				return
 			}
 
-			if err = e.check[attribute].CheckValue(unmarshalledVal); err != nil {
-				errCollection = append(errCollection, fmt.Errorf("%s - %q identity attribute: %s\n", e.resourceAddress, e.check, err))
+			if err := e.check[k].CheckValue(actualIdentityVal); err != nil {
+				errCollection = append(errCollection, fmt.Errorf("%s - %q identity attribute: %s", e.listResourceAddress, k, err))
 			}
 		}
+
 		if errCollection == nil {
 			return
 		}
 	}
 
 	var errCollection []error
-
-	errCollection = append(errCollection, fmt.Errorf("An identity with the following attributes was not found:"))
+	errCollection = append(errCollection, fmt.Errorf("an identity with the following attributes was not found"))
 
 	// wrap errors for each check
 	for attr, check := range e.check {
-		errCollection = append(errCollection, fmt.Errorf("Attribute %s: %s", attr, check))
+		errCollection = append(errCollection, fmt.Errorf("attribute %q: %s", attr, check))
 	}
-	errCollection = append(errCollection, fmt.Errorf("Address: %s\n", e.resourceAddress))
-
+	errCollection = append(errCollection, fmt.Errorf("address: %s\n", e.listResourceAddress))
 	resp.Error = errors.Join(errCollection...)
+
+	return
 }
 
 // ExpectIdentity returns a query check that asserts that the identity at the given resource matches a known object, where each
@@ -74,7 +89,7 @@ func (e expectIdentity) CheckQuery(ctx context.Context, req CheckQueryRequest, r
 // This query check can only be used with managed resources that support resource identity and query. Query is only supported in Terraform v1.14+
 func ExpectIdentity(resourceAddress string, identity map[string]knownvalue.Check) QueryResultCheck {
 	return expectIdentity{
-		resourceAddress: resourceAddress,
-		check:           identity,
+		listResourceAddress: resourceAddress,
+		check:               identity,
 	}
 }

querycheck/expect_known_value.go

@@ -5,7 +5,6 @@ package querycheck
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"strings"
 
@@ -32,36 +31,18 @@ func (e expectKnownValue) CheckQuery(_ context.Context, req CheckQueryRequest, r
 				return
 			}
 
-			// Ideally we can do the check like below which is identical to the expect known value state check but... terraform-json hasn't
-			// defined the resource object as a map[string]interface, we so we need to iterate over it manually
-			//resource, err := tfjsonpath.Traverse(res.ResourceObject, e.attributePath)
-			//if err != nil {
-			//	resp.Error = err
-			//	return
-			//}
-			//
-			//if err := e.knownValue.CheckValue(resource); err != nil {
-			//	diags = append(diags, fmt.Errorf("error checking value for attribute at path: %s for resource %s, err: %s", e.attributePath.String(), e.resourceName, err))
-			//}
-			//
-			//if diags == nil {
-			//	return
-			//}
-
-			for k, v := range res.ResourceObject {
-				if k == e.attributePath.String() {
-					var val any
+			resource, err := tfjsonpath.Traverse(res.ResourceObject, e.attributePath)
+			if err != nil {
+				resp.Error = err
+				return
+			}
 
-					err := json.Unmarshal(v, &val)
-					if err != nil {
-						resp.Error = fmt.Errorf("%s - Error decoding message type: %s", e.listResourceAddress, err)
-						return
-					}
+			if err := e.knownValue.CheckValue(resource); err != nil {
+				diags = append(diags, fmt.Errorf("error checking value for attribute at path: %s for resource %s, err: %s", e.attributePath.String(), e.resourceName, err))
+			}
 
-					if err := e.knownValue.CheckValue(val); err != nil {
-						diags = append(diags, fmt.Errorf("error checking value for attribute at path: %s for resource %s, err: %s", e.attributePath.String(), e.resourceName, err))
-					}
-				}
+			if diags == nil {
+				return
 			}
 		}
 
@@ -78,6 +59,11 @@ func (e expectKnownValue) CheckQuery(_ context.Context, req CheckQueryRequest, r
 	resp.Error = fmt.Errorf("%s - the resource %s was not found", e.listResourceAddress, e.resourceName)
 }
 
+// ExpectKnownValue returns a query check that asserts the specified attribute values are present for a given resource object
+// returned by a list query. The resource object can only be identified by providing the list resource address as well as the
+// resource name (display name).
+//
+// This query check can only be used with managed resources that support resource identity and query. Query is only supported in Terraform v1.14+
 func ExpectKnownValue(listResourceAddress string, resourceName string, attributePath tfjsonpath.Path, knownValue knownvalue.Check) QueryResultCheck {
 	return expectKnownValue{
 		listResourceAddress: listResourceAddress,

statecheck/expect_identity.go

@@ -67,9 +67,9 @@ func (e expectIdentity) CheckState(ctx context.Context, req CheckStateRequest, r
 	if len(resource.IdentityValues) != len(e.identity) {
 		deltaMsg := ""
 		if len(resource.IdentityValues) > len(e.identity) {
-			deltaMsg = createDeltaString(resource.IdentityValues, e.identity, "actual identity has extra attribute(s): ")
+			deltaMsg = CreateDeltaString(resource.IdentityValues, e.identity, "actual identity has extra attribute(s): ")
 		} else {
-			deltaMsg = createDeltaString(e.identity, resource.IdentityValues, "actual identity is missing attribute(s): ")
+			deltaMsg = CreateDeltaString(e.identity, resource.IdentityValues, "actual identity is missing attribute(s): ")
 		}
 
 		resp.Error = fmt.Errorf("%s - Expected %d attribute(s) in the actual identity object, got %d attribute(s): %s", e.resourceAddress, len(e.identity), len(resource.IdentityValues), deltaMsg)
@@ -113,8 +113,8 @@ func ExpectIdentity(resourceAddress string, identity map[string]knownvalue.Check
 	}
 }
 
-// createDeltaString prints the map keys that are present in mapA and not present in mapB
-func createDeltaString[T any, V any](mapA map[string]T, mapB map[string]V, msgPrefix string) string {
+// CreateDeltaString prints the map keys that are present in mapA and not present in mapB
+func CreateDeltaString[T any, V any](mapA map[string]T, mapB map[string]V, msgPrefix string) string {
 	deltaMsg := ""
 
 	deltaMap := make(map[string]T, len(mapA))