fix: suppress plan drift for enable_binding_cookie, options_preflight_bypass, cors_headers on mcp type#7121
Open
t0rrant wants to merge 2 commits into
Open
Conversation
…_bypass, cors_headers on mcp type The Cloudflare Access API returns enable_binding_cookie, options_preflight_bypass, and cors_headers for mcp type applications, but the provider's type-based validator (RequiresOtherStringAttributeToBeOneOf with selfHostedAppTypes) rejects any HCL declaration of these attributes when type = "mcp". This creates irreconcilable plan drift: the provider stores the API values in state on import/refresh but cannot reconcile them via config, producing false -> null on every plan. The fix mirrors the existing handling of http_only_cookie_attribute (which already has Computed: true and is handled in modifyPlan): 1. schema.go: add Computed: true to enable_binding_cookie, options_preflight_bypass, and cors_headers. Note: the v500 migration schema already had Computed: true on enable_binding_cookie and options_preflight_bypass, confirming this is a regression introduced when mcp type support was added in PR cloudflare#6326. 2. plan_modifiers.go: for non-selfHosted types (e.g. mcp), copy state values into the plan when config is null, suppressing the false -> null diff. The existing setDefaultAccordingToAppTypes calls handle the unknown -> null/default case for new resources. Fixes: cloudflare#7120
t0rrant
force-pushed
the
t0rrant/fix-mcp-computed-attrs
branch
from
May 22, 2026 12:12
d3292be to
4fdab28
Compare
Contributor
|
Can you attach the acceptance test output? You can run them like so: |
Author
I notice a schema mismatch, let me update the model. |
…rs as computed_optional in model Align model JSON struct tags with the resource schema, which already declares these fields as Computed+Optional. Fixes the TestZeroTrustAccessApplicationModelSchemaParity failure.
Contributor
|
I'm seeing multiple test failures, all with the same message: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #7120
Problem
The Cloudflare Access API returns
enable_binding_cookie,options_preflight_bypass, andcors_headersformcptype applications. However, the provider's type-based validator (RequiresOtherStringAttributeToBeOneOfwithselfHostedAppTypes) rejects any HCL declaration of these attributes whentype = "mcp". This creates irreconcilable plan drift: the provider stores the API values in state on import/refresh but cannot reconcile them via config, producingfalse -> null(and{...} -> nullforcors_headers) on every plan.Fix
Mirrors the existing handling of
http_only_cookie_attribute, which already hasComputed: trueand is handled inmodifyPlan:schema.go: addComputed: truetoenable_binding_cookie,options_preflight_bypass, andcors_headers. Note: the v500 migration schema already hadComputed: trueonenable_binding_cookieandoptions_preflight_bypass, confirming this is a regression introduced whenmcptype support was added in AUTH-7657 Add support for MCP & MCP_PORTAL Access Apps #6326.plan_modifiers.go: for non-selfHostedtypes (e.g.mcp), copy state values into the plan when config is null, suppressing thefalse -> nulldiff. The existingsetDefaultAccordingToAppTypescalls handle theunknown -> null/defaultcase for new resources.resource_test.go: removeenable_binding_cookieandoptions_preflight_bypassfromImportStateVerifyIgnore(they were workarounds for this bug), addExpectNonEmptyPlan: falseto the existingPlanOnlystep to explicitly assert no drift after import.