Merge pull request #254 from hashicorp/add_hash_to_random_password

Add a hash to random_password with StateUpgrader

Author: bendbennett

CHANGELOG.md

@@ -1,3 +1,16 @@
+## 3.2.0 (May 18, 2022)
+
+NEW FEATURES:
+
+* resource/random_password: New attribute `bcrypt_hash`, which is the hashed password ([73](https://github.com/hashicorp/terraform-provider-random/pull/73), [102](https://github.com/hashicorp/terraform-provider-random/issues/102), [254](https://github.com/hashicorp/terraform-provider-random/pull/254))
+
+NOTES:
+
+* Adds or updates DESIGN.md, README.md, CONTRIBUTING.md and SUPPORT.md docs ([176](https://github.com/hashicorp/terraform-provider-random/issues/176), [235](https://github.com/hashicorp/terraform-provider-random/issues/235), [242](https://github.com/hashicorp/terraform-provider-random/pull/242)).
+* Removes usage of deprecated fields, types and functions ([243](https://github.com/hashicorp/terraform-provider-random/issues/243), [244](https://github.com/hashicorp/terraform-provider-random/pull/244)).
+* Tests all minor Terraform versions ([238](https://github.com/hashicorp/terraform-provider-random/issues/238), [241](https://github.com/hashicorp/terraform-provider-random/pull/241))
+* Switches to linting with golangci-lint ([237](https://github.com/hashicorp/terraform-provider-random/issues/237), [240](https://github.com/hashicorp/terraform-provider-random/pull/240)).
+
 ## 3.1.3 (April 22, 2022)
 
 BUG FIXES:

docs/resources/password.md

@@ -53,6 +53,7 @@ resource "aws_db_instance" "example" {
 
 ### Read-Only
 
+- `bcrypt_hash` (String, Sensitive) A bcrypt hash of the generated random string.
 - `id` (String) A static value used internally by Terraform, this should not be referenced in configurations.
 - `result` (String, Sensitive) The generated random string.
 

internal/provider/resource_password.go

@@ -1,7 +1,12 @@
 package provider
 
 import (
+	"context"
+	"fmt"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"golang.org/x/crypto/bcrypt"
 )
 
 func resourcePassword() *schema.Resource {
@@ -11,12 +16,92 @@ func resourcePassword() *schema.Resource {
 			"data handling in the [Terraform documentation](https://www.terraform.io/docs/language/state/sensitive-data.html).\n" +
 			"\n" +
 			"This resource *does* use a cryptographic random number generator.",
-		CreateContext: createStringFunc(true),
+		CreateContext: createPassword,
 		ReadContext:   readNil,
 		DeleteContext: RemoveResourceFromState,
-		Schema:        stringSchemaV1(true),
+		Schema:        passwordSchemaV1(),
 		Importer: &schema.ResourceImporter{
-			StateContext: importStringFunc(true),
+			StateContext: importPasswordFunc,
+		},
+		SchemaVersion: 1,
+		StateUpgraders: []schema.StateUpgrader{
+			{
+				Version: 0,
+				Type:    resourcePasswordV0().CoreConfigSchema().ImpliedType(),
+				Upgrade: resourcePasswordStateUpgradeV0,
+			},
 		},
 	}
 }
+
+func createPassword(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	diags := createStringFunc(true)(ctx, d, meta)
+	if diags.HasError() {
+		return diags
+	}
+
+	hash, err := generateHash(d.Get("result").(string))
+	if err != nil {
+		diags = append(diags, diag.Errorf("err: %s", err)...)
+		return diags
+	}
+
+	if err := d.Set("bcrypt_hash", hash); err != nil {
+		diags = append(diags, diag.Errorf("err: %s", err)...)
+		return diags
+	}
+
+	return nil
+}
+
+func importPasswordFunc(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+	val := d.Id()
+	d.SetId("none")
+
+	if err := d.Set("result", val); err != nil {
+		return nil, fmt.Errorf("resource password import failed, error setting result: %w", err)
+	}
+
+	hash, err := generateHash(val)
+	if err != nil {
+		return nil, fmt.Errorf("resource password import failed, generate hash error: %w", err)
+	}
+
+	if err := d.Set("bcrypt_hash", hash); err != nil {
+		return nil, fmt.Errorf("resource password import failed, error setting bcrypt_hash: %w", err)
+	}
+
+	return []*schema.ResourceData{d}, nil
+}
+
+func resourcePasswordV0() *schema.Resource {
+	return &schema.Resource{
+		Schema: passwordSchemaV0(),
+	}
+}
+
+func resourcePasswordStateUpgradeV0(_ context.Context, rawState map[string]interface{}, _ interface{}) (map[string]interface{}, error) {
+	if rawState == nil {
+		return nil, fmt.Errorf("resource password state upgrade failed, state is nil")
+	}
+
+	result, ok := rawState["result"].(string)
+	if !ok {
+		return nil, fmt.Errorf("resource password state upgrade failed, result could not be asserted as string: %T", rawState["result"])
+	}
+
+	hash, err := generateHash(result)
+	if err != nil {
+		return nil, fmt.Errorf("resource password state upgrade failed, generate hash error: %w", err)
+	}
+
+	rawState["bcrypt_hash"] = hash
+
+	return rawState, nil
+}
+
+func generateHash(toHash string) (string, error) {
+	hash, err := bcrypt.GenerateFromPassword([]byte(toHash), bcrypt.DefaultCost)
+
+	return string(hash), err
+}

internal/provider/resource_pasword_test.go

@@ -1,10 +1,12 @@
 package provider
 
 import (
+	"context"
 	"fmt"
 	"regexp"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
@@ -15,7 +17,9 @@ func TestAccResourcePasswordBasic(t *testing.T) {
 		ProviderFactories: testAccProviders,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccResourcePasswordBasic,
+				Config: `resource "random_password" "basic" {
+							length = 12
+						}`,
 				Check: resource.ComposeTestCheckFunc(
 					testAccResourceStringCheck("random_password.basic", &customLens{
 						customLen: 12,
@@ -41,7 +45,7 @@ func TestAccResourcePasswordBasic(t *testing.T) {
 				},
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"length", "lower", "number", "special", "upper", "min_lower", "min_numeric", "min_special", "min_upper", "override_special"},
+				ImportStateVerifyIgnore: []string{"bcrypt_hash", "length", "lower", "number", "special", "upper", "min_lower", "min_numeric", "min_special", "min_upper", "override_special"},
 			},
 		},
 	})
@@ -53,7 +57,13 @@ func TestAccResourcePasswordOverride(t *testing.T) {
 		ProviderFactories: testAccProviders,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccResourcePasswordOverride,
+				Config: `resource "random_password" "override" {
+							length = 4
+							override_special = "!"
+							lower = false
+							upper = false
+							number = false
+						}`,
 				Check: resource.ComposeTestCheckFunc(
 					testAccResourceStringCheck("random_password.override", &customLens{
 						customLen: 4,
@@ -71,7 +81,14 @@ func TestAccResourcePasswordMin(t *testing.T) {
 		ProviderFactories: testAccProviders,
 		Steps: []resource.TestStep{
 			{
-				Config: testAccResourcePasswordMin,
+				Config: `resource "random_password" "min" {
+							length = 12
+							override_special = "!#@"
+							min_lower = 2
+							min_upper = 3
+							min_special = 1
+							min_numeric = 4
+						}`,
 				Check: resource.ComposeTestCheckFunc(
 					testAccResourceStringCheck("random_password.min", &customLens{
 						customLen: 12,
@@ -86,29 +103,51 @@ func TestAccResourcePasswordMin(t *testing.T) {
 	})
 }
 
-const (
-	testAccResourcePasswordBasic = `
-resource "random_password" "basic" {
-  length = 12
-}`
+func TestResourcePasswordStateUpgradeV0(t *testing.T) {
+	cases := []struct {
+		name            string
+		stateV0         map[string]interface{}
+		shouldError     bool
+		errMsg          string
+		expectedStateV1 map[string]interface{}
+	}{
+		{
+			name:        "result is not string",
+			stateV0:     map[string]interface{}{"result": 0},
+			shouldError: true,
+			errMsg:      "resource password state upgrade failed, result could not be asserted as string: int",
+		},
+		{
+			name:            "success",
+			stateV0:         map[string]interface{}{"result": "abc123"},
+			shouldError:     false,
+			expectedStateV1: map[string]interface{}{"result": "abc123", "bcrypt_hash": "123"},
+		},
+	}
 
-	testAccResourcePasswordOverride = `
-resource "random_password" "override" {
-length = 4
-override_special = "!"
-lower = false
-upper = false
-number = false
-}
-`
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			actualStateV1, err := resourcePasswordStateUpgradeV0(context.Background(), c.stateV0, nil)
 
-	testAccResourcePasswordMin = `
-resource "random_password" "min" {
-length = 12
-override_special = "!#@"
-min_lower = 2
-min_upper = 3
-min_special = 1
-min_numeric = 4
-}`
-)
+			if c.shouldError {
+				if !cmp.Equal(c.errMsg, err.Error()) {
+					t.Errorf("expected: %q, got: %q", c.errMsg, err)
+				}
+				if !cmp.Equal(c.expectedStateV1, actualStateV1) {
+					t.Errorf("expected: %+v, got: %+v", c.expectedStateV1, err)
+				}
+			} else {
+				if err != nil {
+					t.Errorf("err should be nil, actual: %v", err)
+				}
+
+				for k := range c.expectedStateV1 {
+					_, ok := actualStateV1[k]
+					if !ok {
+						t.Errorf("expected key: %s is missing from state", k)
+					}
+				}
+			}
+		})
+	}
+}

internal/provider/resource_string.go

@@ -1,6 +1,9 @@
 package provider
 
 import (
+	"context"
+	"fmt"
+
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
@@ -21,9 +24,19 @@ func resourceString() *schema.Resource {
 		// [SDK documentation](https://github.com/hashicorp/terraform-plugin-sdk/blob/main/helper/schema/resource.go#L91).
 		MigrateState:  resourceRandomStringMigrateState,
 		SchemaVersion: 1,
-		Schema:        stringSchemaV1(false),
+		Schema:        stringSchemaV1(),
 		Importer: &schema.ResourceImporter{
-			StateContext: importStringFunc(false),
+			StateContext: importStringFunc,
 		},
 	}
 }
+
+func importStringFunc(ctx context.Context, d *schema.ResourceData, meta interface{}) ([]*schema.ResourceData, error) {
+	val := d.Id()
+
+	if err := d.Set("result", val); err != nil {
+		return nil, fmt.Errorf("error setting result: %w", err)
+	}
+
+	return []*schema.ResourceData{d}, nil
+}