fix(cockpit): handle permission errors gracefully in alert manager read

Author: jremy42

internal/services/cockpit/alert_manager.go

@@ -165,57 +165,60 @@ func ResourceCockpitAlertManagerRead(ctx context.Context, d *schema.ResourceData
 	_ = d.Set("project_id", projectID)
 
 	// Get enabled preconfigured alerts and separate user-requested vs API-default alerts
+	// Handle permission errors gracefully to allow the resource to work without cockpit read permissions
+	var userRequestedIDs []string
+	var defaultEnabledIDs []string
+
 	alerts, err := api.ListAlerts(&cockpit.RegionalAPIListAlertsRequest{
 		Region:          region,
 		ProjectID:       projectID,
 		IsPreconfigured: scw.BoolPtr(true),
 	}, scw.WithContext(ctx), scw.WithAllPages())
 	if err != nil {
-		return diag.FromErr(err)
-	}
-
-	// Build a map of alert statuses
-	alertStatusMap := make(map[string]cockpit.AlertStatus)
-	for _, alert := range alerts.Alerts {
-		if alert.PreconfiguredData != nil && alert.PreconfiguredData.PreconfiguredRuleID != "" {
-			alertStatusMap[alert.PreconfiguredData.PreconfiguredRuleID] = alert.RuleStatus
+		// If we can't read alerts (e.g., permission denied), just set empty arrays
+		// This allows the resource to work even without cockpit read permissions
+		_ = d.Set("preconfigured_alert_ids", userRequestedIDs)
+		_ = d.Set("default_preconfigured_alert_ids", defaultEnabledIDs)
+	} else {
+		// Build a map of alert statuses
+		alertStatusMap := make(map[string]cockpit.AlertStatus)
+		for _, alert := range alerts.Alerts {
+			if alert.PreconfiguredData != nil && alert.PreconfiguredData.PreconfiguredRuleID != "" {
+				alertStatusMap[alert.PreconfiguredData.PreconfiguredRuleID] = alert.RuleStatus
+			}
 		}
-	}
-
-	// Separate user-requested alerts from API-default alerts
-	var userRequestedIDs []string
-	var defaultEnabledIDs []string
 
-	if v, ok := d.GetOk("preconfigured_alert_ids"); ok {
-		requestedIDs := expandStringSet(v.(*schema.Set))
-		requestedMap := make(map[string]bool)
-		for _, id := range requestedIDs {
-			requestedMap[id] = true
-		}
+		if v, ok := d.GetOk("preconfigured_alert_ids"); ok {
+			requestedIDs := expandStringSet(v.(*schema.Set))
+			requestedMap := make(map[string]bool)
+			for _, id := range requestedIDs {
+				requestedMap[id] = true
+			}
 
-		// Check all enabled/enabling alerts
-		for ruleID, status := range alertStatusMap {
-			if status == cockpit.AlertStatusEnabled || status == cockpit.AlertStatusEnabling {
-				if requestedMap[ruleID] {
-					// This alert was explicitly requested by the user
-					userRequestedIDs = append(userRequestedIDs, ruleID)
-				} else {
-					// This alert was enabled automatically by the API
-					defaultEnabledIDs = append(defaultEnabledIDs, ruleID)
+			// Check all enabled/enabling alerts
+			for ruleID, status := range alertStatusMap {
+				if status == cockpit.AlertStatusEnabled || status == cockpit.AlertStatusEnabling {
+					if requestedMap[ruleID] {
+						// This alert was explicitly requested by the user
+						userRequestedIDs = append(userRequestedIDs, ruleID)
+					} else {
+						// This alert was enabled automatically by the API
+						defaultEnabledIDs = append(defaultEnabledIDs, ruleID)
+					}
 				}
 			}
-		}
-	} else {
-		// No alerts explicitly requested, all enabled alerts are API defaults
-		for ruleID, status := range alertStatusMap {
-			if status == cockpit.AlertStatusEnabled || status == cockpit.AlertStatusEnabling {
-				defaultEnabledIDs = append(defaultEnabledIDs, ruleID)
+		} else {
+			// No alerts explicitly requested, all enabled alerts are API defaults
+			for ruleID, status := range alertStatusMap {
+				if status == cockpit.AlertStatusEnabled || status == cockpit.AlertStatusEnabling {
+					defaultEnabledIDs = append(defaultEnabledIDs, ruleID)
+				}
 			}
 		}
-	}
 
-	_ = d.Set("preconfigured_alert_ids", userRequestedIDs)
-	_ = d.Set("default_preconfigured_alert_ids", defaultEnabledIDs)
+		_ = d.Set("preconfigured_alert_ids", userRequestedIDs)
+		_ = d.Set("default_preconfigured_alert_ids", defaultEnabledIDs)
+	}
 
 	contactPoints, err := api.ListContactPoints(&cockpit.RegionalAPIListContactPointsRequest{
 		Region:    region,