pulumi
diff --git a/‎.github/actions/setup-tools/action.yml‎
Lines changed: 5 additions & 0 deletions b/‎.github/actions/setup-tools/action.yml‎
Lines changed: 5 additions & 0 deletions
diff --git a/‎pkg/modprovider/module.go‎
Lines changed: 28 additions & 12 deletions b/‎pkg/modprovider/module.go‎
Lines changed: 28 additions & 12 deletions
diff --git a/‎pkg/modprovider/views.go‎
Lines changed: 19 additions & 18 deletions b/‎pkg/modprovider/views.go‎
Lines changed: 19 additions & 18 deletions
diff --git a/‎pkg/tfsandbox/apply.go‎
Lines changed: 13 additions & 4 deletions b/‎pkg/tfsandbox/apply.go‎
Lines changed: 13 additions & 4 deletions
diff --git a/‎pkg/tfsandbox/details.go‎
Lines changed: 56 additions & 13 deletions b/‎pkg/tfsandbox/details.go‎
Lines changed: 56 additions & 13 deletions
@@ -97,3 +97,8 @@ runs:
       shell: bash
       run: |
         terraform -version
+
+    - name: Show Pulumi Version
+      shell: bash
+      run: |
+        pulumi version
@@ -79,6 +79,8 @@ func (h *moduleHandler) Diff(
 	inferredModule *InferredModuleSchema,
 	executor string,
 ) (*pulumirpc.DiffResponse, error) {
+	urn := urn.URN(req.GetUrn())
+
 	oldInputs, err := plugin.UnmarshalProperties(req.GetOldInputs(), h.marshalOpts())
 	if err != nil {
 		return nil, err
@@ -89,15 +91,13 @@ func (h *moduleHandler) Diff(
 		return nil, err
 	}
 
-	// TODO[pulumi/pulumi-terraform-module#332] detect and correct drift
 	if !oldInputs.DeepEquals(newInputs) {
 		// Inputs have changed, so we need tell the engine that an update is needed.
 		return &pulumirpc.DiffResponse{Changes: pulumirpc.DiffResponse_DIFF_SOME}, nil
 	}
 
 	// Here, inputs have not changes but the underlying module might have changed
 	// perform a plan to see if there were any changes in the module reported by terraform
-	urn := urn.URN(req.GetUrn())
 	oldOutputs, err := plugin.UnmarshalProperties(req.GetOlds(), h.marshalOpts())
 	if err != nil {
 		return nil, fmt.Errorf("failed to unmarshal old outputs: %w", err)
@@ -233,9 +233,11 @@ func (h *moduleHandler) applyModuleOperation(
 
 	logger := newResourceLogger(h.hc, urn)
 
+	// Because of RefreshBeforeUpdate, Pulumi CLI has already refreshed at this point.
+	// so we use plan -refresh=false via tfsandbox.PlanNoRefresh()
 	// Plans are always needed, so this code will run in DryRun and otherwise. In the future we
 	// may be able to reuse the plan from DryRun for the subsequent application.
-	plan, err := tf.Plan(ctx, logger)
+	plan, err := tf.PlanNoRefresh(ctx, logger)
 	if err != nil {
 		return nil, nil, fmt.Errorf("Plan failed: %w", err)
 	}
@@ -251,7 +253,10 @@ func (h *moduleHandler) applyModuleOperation(
 		views = viewStepsPlan(packageName, plan)
 		moduleOutputs = plan.Outputs()
 	} else {
-		tfState, err := tf.Apply(ctx, logger) // TODO[pulumi/pulumi-terraform-module#341] reuse the plan
+		// TODO[pulumi/pulumi-terraform-module#341] reuse the plan
+		tfState, err := tf.Apply(ctx, logger, tfsandbox.RefreshOpts{
+			NoRefresh: true, // we already refreshed before this point
+		})
 		if tfState != nil {
 			msg := fmt.Sprintf("tf.Apply produced the following state: %s", tfState.PrettyPrint())
 			logger.Log(ctx, tfsandbox.Debug, msg)
@@ -380,8 +385,9 @@ func (h *moduleHandler) Create(
 	contract.AssertNoErrorf(err, "plugin.MarshalProperties should not fail")
 
 	return &pulumirpc.CreateResponse{
-		Id:         moduleStateResourceID,
-		Properties: props,
+		Id:                  moduleStateResourceID,
+		Properties:          props,
+		RefreshBeforeUpdate: true,
 	}, nil
 }
 
@@ -447,7 +453,8 @@ func (h *moduleHandler) Update(
 	contract.AssertNoErrorf(err, "plugin.MarshalProperties should not fail")
 
 	return &pulumirpc.UpdateResponse{
-		Properties: props,
+		Properties:          props,
+		RefreshBeforeUpdate: true,
 	}, nil
 }
 
@@ -575,7 +582,7 @@ func (h *moduleHandler) Read(
 		executor,
 	)
 	if err != nil {
-		return nil, fmt.Errorf("Failed preparing tofu sandbox: %w", err)
+		return nil, fmt.Errorf("failed preparing tofu sandbox: %w", err)
 	}
 
 	plan, err := tf.PlanRefreshOnly(ctx, logger)
@@ -587,7 +594,7 @@ func (h *moduleHandler) Read(
 	state, err := tf.Refresh(ctx, logger)
 	if err != nil {
 		logger.Log(ctx, tfsandbox.Debug, fmt.Sprintf("error running refresh: %v", err))
-		return nil, fmt.Errorf("Module refresh failed: %w", err)
+		return nil, fmt.Errorf("module refresh failed: %w", err)
 	}
 
 	outputs, err := h.outputs(ctx, tf, state)
@@ -613,10 +620,19 @@ func (h *moduleHandler) Read(
 		return nil, err
 	}
 
+	// inputs never change on refresh
+	freshInputs := moduleInputs
+
+	freshInputsStruct, err := plugin.MarshalProperties(freshInputs, h.marshalOpts())
+	if err != nil {
+		return nil, err
+	}
+
 	return &pulumirpc.ReadResponse{
-		Id:         moduleResourceID,
-		Properties: properties,
-		Inputs:     req.GetInputs(), // inputs never change on refresh
+		Id:                  moduleResourceID,
+		Properties:          properties,
+		Inputs:              freshInputsStruct,
+		RefreshBeforeUpdate: true,
 	}, nil
 }
 
 
@@ -57,7 +57,6 @@ func viewStepsGeneric(
 	preview bool,
 ) []*pulumirpc.ViewStep {
 	var steps []*pulumirpc.ViewStep
-	priorState, hasPriorState := plan.PriorState()
 	hasFinalState := finalState != nil
 
 	counter := 0
@@ -73,14 +72,7 @@ func viewStepsGeneric(
 		// TODO[pulumi/pulumi-terraform-module#61] sometimes addresses change but identity remains the same.
 		addr := rplan.Address()
 
-		var priorRState, finalRState *tfsandbox.ResourceState
-
-		if hasPriorState {
-			s, ok := priorState.FindResourceState(addr)
-			if ok {
-				priorRState = s
-			}
-		}
+		var finalRState *tfsandbox.ResourceState
 
 		if hasFinalState {
 			s, ok := finalState.FindResourceState(addr)
@@ -89,7 +81,7 @@ func viewStepsGeneric(
 			}
 		}
 
-		rSteps := viewStepsForResource(packageName, rplan, priorRState, finalRState, preview)
+		rSteps := viewStepsForResource(packageName, rplan, finalRState, preview)
 		steps = append(steps, rSteps...)
 	})
 
@@ -121,11 +113,21 @@ func viewStepsGeneric(
 	return steps
 }
 
-func viewStepOp(changeKind tfsandbox.ChangeKind) []pulumirpc.ViewStep_Op {
+func viewStepOp(changeKind tfsandbox.ChangeKind, _ bool /*drift*/) []pulumirpc.ViewStep_Op {
 	switch changeKind {
 	case tfsandbox.NoOp:
 		return []pulumirpc.ViewStep_Op{pulumirpc.ViewStep_SAME}
 	case tfsandbox.Update:
+		// TODO this does not seem to work, per Justin:
+		//
+		//  will not work with the current implementation… If you sent an Op UPDATE for the view, I think it will.
+		//
+		//
+		// Need to figure out if this is temporary or final.
+		//
+		// if drift {
+		// 	return []pulumirpc.ViewStep_Op{pulumirpc.ViewStep_REFRESH}
+		// }
 		return []pulumirpc.ViewStep_Op{pulumirpc.ViewStep_UPDATE}
 	case tfsandbox.Replace:
 		return []pulumirpc.ViewStep_Op{
@@ -141,8 +143,6 @@ func viewStepOp(changeKind tfsandbox.ChangeKind) []pulumirpc.ViewStep_Op {
 		}
 	case tfsandbox.Create:
 		return []pulumirpc.ViewStep_Op{pulumirpc.ViewStep_CREATE}
-	case tfsandbox.Read:
-		return []pulumirpc.ViewStep_Op{pulumirpc.ViewStep_REFRESH}
 	case tfsandbox.Delete:
 		return []pulumirpc.ViewStep_Op{pulumirpc.ViewStep_DELETE}
 	case tfsandbox.Forget:
@@ -211,7 +211,6 @@ func viewStepForSameResource(
 func viewStepsForResource(
 	packageName packageName,
 	rplan ResourcePlan,
-	priorState ResourceState, // may be nil in operations such as create
 	finalState ResourceState, // may be nil when planning or failed to create
 	preview bool,
 ) []*pulumirpc.ViewStep {
@@ -221,7 +220,7 @@ func viewStepsForResource(
 	ty := childResourceTypeToken(packageName, rplan.Type()).String()
 	name := childResourceName(addr)
 
-	var oldViewState, newViewState *pulumirpc.ViewStepState
+	var newViewState *pulumirpc.ViewStepState
 	if finalState != nil {
 		newViewState = viewStepState(packageName, addr, tfType, finalState.AttributeValues())
 	} else {
@@ -231,13 +230,15 @@ func viewStepsForResource(
 		}
 	}
 
-	if priorState != nil {
-		oldViewState = viewStepState(packageName, addr, tfType, priorState.AttributeValues())
+	var oldViewState *pulumirpc.ViewStepState
+	before, hasBefore := rplan.Before()
+	if hasBefore {
+		oldViewState = viewStepState(packageName, addr, tfType, before)
 	}
 
 	steps := []*pulumirpc.ViewStep{}
 
-	for _, op := range viewStepOp(rplan.ChangeKind()) {
+	for _, op := range viewStepOp(rplan.ChangeKind(), rplan.Drift()) {
 		newViewStateToSend := newViewState
 		if op == pulumirpc.ViewStep_DELETE_REPLACED {
 			newViewStateToSend = nil
 
@@ -13,8 +13,8 @@ import (
 // Apply can return both a non-nil State and a non-nil error. If the apply
 // fails, but some resources were created and written to the TF State we will return
 // the state and the apply error.
-func (t *ModuleRuntime) Apply(ctx context.Context, logger Logger) (*State, error) {
-	state, applyErr := t.apply(ctx, logger)
+func (t *ModuleRuntime) Apply(ctx context.Context, logger Logger, opts RefreshOpts) (*State, error) {
+	state, applyErr := t.apply(ctx, logger, opts)
 	s, err := NewState(state)
 	if err != nil {
 		return nil, err
@@ -23,11 +23,20 @@ func (t *ModuleRuntime) Apply(ctx context.Context, logger Logger) (*State, error
 }
 
 // Apply runs the terraform apply command and returns the final state
-func (t *ModuleRuntime) apply(ctx context.Context, logger Logger) (*tfjson.State, error) {
+func (t *ModuleRuntime) apply(ctx context.Context, logger Logger, opts RefreshOpts) (*tfjson.State, error) {
 	logWriter := newJSONLogPipe(ctx, logger)
 	defer logWriter.Close()
 
-	applyErr := t.tf.ApplyJSON(ctx, logWriter, t.applyOptions()...)
+	aOpts := []tfexec.ApplyOption{}
+
+	if opts.NoRefresh {
+		aOpts = append(aOpts, tfexec.Refresh(false))
+	}
+	if opts.RefreshOnly {
+		aOpts = append(aOpts, tfexec.RefreshOnly(true))
+	}
+
+	applyErr := t.tf.ApplyJSON(ctx, logWriter, t.applyOptions(aOpts...)...)
 	// if the apply failed just log it to debug logs and continue
 	// we want to return and process the partial state from a failed apply
 	if applyErr != nil {
 
@@ -36,9 +36,11 @@ const (
 	Replace
 	ReplaceDestroyBeforeCreate
 	Create
-	Read
 	Delete
 
+	// Need to pin down when Read is used, might not be in use; possibly only for data sources.
+	Read
+
 	// Need to pin down when Forget operations arise.
 	// Likely during https://developer.hashicorp.com/terraform/cli/commands/state/rm
 	// Roughly but possibly not exactly equivalent to
@@ -51,6 +53,12 @@ type ResourcePlan struct {
 	resourceChange *tfjson.ResourceChange
 
 	plannedState *tfjson.StateResource // may be nil when planning removal
+
+	drift bool // when true, the change comes from ResourceDrift, e.g. refresh
+}
+
+func (p *ResourcePlan) Drift() bool {
+	return p.drift
 }
 
 // TODO sometimes address changes while identity remains the same, e.g see PreviousAddress. The call sites need to be
@@ -73,6 +81,31 @@ func (p *ResourcePlan) PlannedValues() (resource.PropertyMap, bool) {
 	return extractPropertyMapFromPlan(*p.plannedState, p.resourceChange), true
 }
 
+// The values before the change. For some change such as creating the resource these values are not available. Note
+// also that for some changes such as refreshing a resource that has drifted, the Before values will be different from
+// values found in the resource's prior state. The Before() values will be the fresh values detected by Read.
+func (p *ResourcePlan) Before() (resource.PropertyMap, bool) {
+	change := p.resourceChange.Change
+	if change == nil {
+		return nil, false
+	}
+	before := change.Before
+	if before == nil {
+		return nil, false
+	}
+	beforeMap, ok := before.(map[string]any)
+	if !ok {
+		return nil, false
+	}
+	pm := extractPropertyMapFromAttributeValues(beforeMap)
+	if change.BeforeSensitive != nil {
+		obj := resource.NewObjectProperty(pm)
+		upd := updateResourceValue(obj, change.BeforeSensitive, resourceMakeSecretConservative)
+		pm = upd.ObjectValue()
+	}
+	return pm, true
+}
+
 // Describes what change is being planned.
 func (p *ResourcePlan) ChangeKind() ChangeKind {
 	contract.Assertf(p.resourceChange != nil, "cannot determine ChangeKind")
@@ -115,8 +148,13 @@ func (s *ResourceState) AttributeValues() resource.PropertyMap {
 type Plan struct {
 	rawPlan   *tfjson.Plan
 	byAddress map[ResourceAddress]*ResourcePlan
+	hasDrift  bool
 }
 
+//func (p *Plan) HasDrift() bool {
+//	return p.hasDrift
+//}
+
 func (p *Plan) VisitResourcePlans(visitor func(*ResourcePlan)) {
 	for _, rp := range p.byAddress {
 		visitor(rp)
@@ -134,15 +172,29 @@ func NewPlan(rawPlan *tfjson.Plan) (*Plan, error) {
 		return nil, fmt.Errorf("unexpected error extracting planned values from *tfjson.Plan: %w", err)
 	}
 
-	p := &Plan{rawPlan: rawPlan, byAddress: map[ResourceAddress]*ResourcePlan{}}
+	if len(rawPlan.ResourceDrift) > 0 && len(rawPlan.ResourceChanges) > 0 {
+		contract.Failf("Currently cannot handle plans with both resource_drift and resource_changes.\n" +
+			"Make sure plans are obtained with -refresh-only (no changes) or -refresh=false (no drift)")
+	}
+
+	drift := len(rawPlan.ResourceDrift) > 0
+
+	p := &Plan{
+		rawPlan:   rawPlan,
+		byAddress: map[ResourceAddress]*ResourcePlan{},
+		hasDrift:  drift,
+	}
 
-	for _, ch := range rawPlan.ResourceChanges {
+	for _, ch := range append(rawPlan.ResourceChanges, rawPlan.ResourceDrift...) {
 		// Exclude entries pertaining to data source look-ups, only interested in resources proper.
 		if ch.Mode == tfjson.DataResourceMode {
 			continue
 		}
 
-		plan := &ResourcePlan{resourceChange: ch}
+		plan := &ResourcePlan{
+			resourceChange: ch,
+			drift:          drift,
+		}
 		addr := ResourceAddress(ch.Address)
 		plannedState, ok := resourcePlannedValues[addr]
 		if ok {
@@ -191,15 +243,6 @@ func (p *Plan) Outputs() resource.PropertyMap {
 	return outputs
 }
 
-func (p *Plan) PriorState() (*State, bool) {
-	if p.rawPlan.PriorState == nil {
-		return nil, false
-	}
-	st, err := NewState(p.rawPlan.PriorState)
-	contract.AssertNoErrorf(err, "newState failed when processing PriorState")
-	return st, true
-}
-
 // RawPlan returns the raw tfjson.Plan
 // NOTE: this is exposed for testing purposes only
 func (p *Plan) RawPlan() *tfjson.Plan {