chore: support write only (#195)

ecmadao · web-flow · commit f01a5ac34e2e · 2026-05-09T18:07:08.000+08:00
* chore: support write only

* fix: lint

* fix: test
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -43,7 +43,7 @@ jobs:
           go-version-file: "go.mod"
       - uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4.0.0
         with:
-          terraform_version: "1.3.*"
+          terraform_version: "1.11.*"
           terraform_wrapper: false
       - run: |
           go generate ./...
diff --git a/README.md b/README.md
@@ -29,7 +29,7 @@ provider "bytebase" {
 ### Prerequisites
 
 - [Go](https://golang.org/doc/install) (1.19 or later)
-- [Terraform](https://developer.hashicorp.com/terraform/downloads?product_intent=terraform) (1.3.5 or later)
+- [Terraform](https://developer.hashicorp.com/terraform/downloads?product_intent=terraform) (1.11 or later, required for write-only attributes)
 - [Bytebase](https://github.com/bytebase/bytebase) (3.17.1 or later)
 
 > If you have problems running `terraform` in MacOS with Apple Silicon, you can following https://stackoverflow.com/questions/66281882/how-can-i-get-terraform-init-to-run-on-my-apple-silicon-macbook-pro-for-the-go and use the `tfenv`.
@@ -56,6 +56,11 @@ air -c scripts/.air.toml
 # install the provider in your local machine
 cd terraform-provider-bytebase && make install
 
+# build for darwin_arm64
+go build -o terraform-provider-bytebase . && \
+mkdir -p ~/.terraform.d/plugins/terraform.local/bytebase/bytebase/3.17.5/darwin_arm64 && \
+cp terraform-provider-bytebase ~/.terraform.d/plugins/terraform.local/bytebase/bytebase/3.17.5/darwin_arm64/
+
 # test
 # Any BYTEBASE_SERVICE_ACCOUNT/BYTEBASE_SERVICE_KEY/BYTEBASE_URL value should work since the service is mocked
 TF_ACC=1 BYTEBASE_SERVICE_ACCOUNT=test@service.bytebase.com BYTEBASE_SERVICE_KEY=test_secret BYTEBASE_URL=https://bytebase.example.com go test -v ./...
diff --git a/docs/resources/idp.md b/docs/resources/idp.md
@@ -40,7 +40,7 @@ Required:
 
 - `base_dn` (String) The base DN to search for users.
 - `bind_dn` (String) The DN of the user to bind as a service account.
-- `bind_password` (String, Sensitive) The password of the bind user.
+- `bind_password` (String) The password of the bind user.
 - `field_mapping` (Block List, Min: 1, Max: 1) Mapping configuration for user attributes from LDAP response. (see [below for nested schema](#nestedblock--ldap_config--field_mapping))
 - `host` (String) The hostname or IP address of the LDAP server.
 - `user_filter` (String) The filter to search for users, e.g. (uid=%s).
@@ -73,7 +73,7 @@ Required:
 
 - `auth_url` (String) The authorization endpoint URL.
 - `client_id` (String) The OAuth2 client identifier.
-- `client_secret` (String, Sensitive) The OAuth2 client secret.
+- `client_secret` (String) The OAuth2 client secret.
 - `field_mapping` (Block List, Min: 1, Max: 1) Mapping configuration for user attributes. (see [below for nested schema](#nestedblock--oauth2_config--field_mapping))
 - `token_url` (String) The token endpoint URL.
 - `user_info_url` (String) The user information endpoint URL.
@@ -105,7 +105,7 @@ Optional:
 Required:
 
 - `client_id` (String) The OIDC client identifier.
-- `client_secret` (String, Sensitive) The OIDC client secret.
+- `client_secret` (String) The OIDC client secret.
 - `field_mapping` (Block List, Min: 1, Max: 1) Mapping configuration for user attributes from OIDC claims. (see [below for nested schema](#nestedblock--oidc_config--field_mapping))
 - `issuer` (String) The OIDC issuer URL.
 
diff --git a/docs/resources/user.md b/docs/resources/user.md
@@ -22,7 +22,7 @@ The user resource.
 
 ### Optional
 
-- `password` (String, Sensitive) The user login password.
+- `password` (String) The user login password. This value is write-only and will not be stored in Terraform state.
 - `phone` (String) The user phone.
 
 ### Read-Only
diff --git a/docs/resources/workspace.md b/docs/resources/workspace.md
@@ -17,7 +17,7 @@ The workspace resource.
 
 ### Optional
 
-- `license` (String, Sensitive) The license key for the workspace. Upload to activate a subscription plan.
+- `license` (String) The license key for the workspace. Upload to activate a subscription plan. This value is write-only and will not be stored in Terraform state.
 - `logo` (String) The branding logo as a data URI (e.g. data:image/png;base64,...).
 - `title` (String) The workspace title.
 
diff --git a/examples/approval/main.tf b/examples/approval/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/database/main.tf b/examples/database/main.tf
@@ -1,5 +1,6 @@
 # Examples for query the database
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/database_group/main.tf b/examples/database_group/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/environments/main.tf b/examples/environments/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/groups/main.tf b/examples/groups/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/iamPolicy/main.tf b/examples/iamPolicy/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/instances/main.tf b/examples/instances/main.tf
@@ -1,5 +1,6 @@
 # Examples for creating instances with different authentication types and engine-specific configurations
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/policies/main.tf b/examples/policies/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/projects/main.tf b/examples/projects/main.tf
@@ -1,5 +1,6 @@
 # Examples for query the project
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/roles/main.tf b/examples/roles/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/settings/main.tf b/examples/settings/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/setup/main.tf b/examples/setup/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/sql_review/main.tf b/examples/sql_review/main.tf
@@ -1,4 +1,5 @@
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/examples/users/main.tf b/examples/users/main.tf
@@ -1,5 +1,6 @@
 # Examples for query the user
 terraform {
+  required_version = ">= 1.11"
   required_providers {
     bytebase = {
       version = "3.17.4"
diff --git a/provider/resource_idp.go b/provider/resource_idp.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 
 	v1pb "buf.build/gen/go/bytebase/bytebase/protocolbuffers/go/v1"
+	"github.com/hashicorp/go-cty/cty"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -119,7 +120,7 @@ func getOAuth2ConfigSchema() *schema.Schema {
 				"client_secret": {
 					Type:        schema.TypeString,
 					Required:    true,
-					Sensitive:   true,
+					WriteOnly:   true,
 					Description: "The OAuth2 client secret.",
 				},
 				"scopes": {
@@ -175,7 +176,7 @@ func getOIDCConfigSchema() *schema.Schema {
 				"client_secret": {
 					Type:        schema.TypeString,
 					Required:    true,
-					Sensitive:   true,
+					WriteOnly:   true,
 					Description: "The OIDC client secret.",
 				},
 				"scopes": {
@@ -246,7 +247,7 @@ func getLDAPConfigSchema() *schema.Schema {
 				"bind_password": {
 					Type:        schema.TypeString,
 					Required:    true,
-					Sensitive:   true,
+					WriteOnly:   true,
 					Description: "The password of the bind user.",
 				},
 				"base_dn": {
@@ -414,10 +415,16 @@ func getIdentityProviderFromSchema(d *schema.ResourceData, idpName string) (*v1p
 			TokenUrl:      raw["token_url"].(string),
 			UserInfoUrl:   raw["user_info_url"].(string),
 			ClientId:      raw["client_id"].(string),
-			ClientSecret:  raw["client_secret"].(string),
 			SkipTlsVerify: raw["skip_tls_verify"].(bool),
 			AuthStyle:     v1pb.OAuth2AuthStyle(v1pb.OAuth2AuthStyle_value[raw["auth_style"].(string)]),
 		}
+		oauth2ClientSecret, diags := d.GetRawConfigAt(cty.GetAttrPath("oauth2_config").IndexInt(0).GetAttr("client_secret"))
+		if diags.HasError() {
+			return nil, diags
+		}
+		if !oauth2ClientSecret.IsNull() {
+			oauth2Config.ClientSecret = oauth2ClientSecret.AsString()
+		}
 		for _, s := range raw["scopes"].([]interface{}) {
 			oauth2Config.Scopes = append(oauth2Config.Scopes, s.(string))
 		}
@@ -433,10 +440,16 @@ func getIdentityProviderFromSchema(d *schema.ResourceData, idpName string) (*v1p
 		oidcConfig := &v1pb.OIDCIdentityProviderConfig{
 			Issuer:        raw["issuer"].(string),
 			ClientId:      raw["client_id"].(string),
-			ClientSecret:  raw["client_secret"].(string),
 			SkipTlsVerify: raw["skip_tls_verify"].(bool),
 			AuthStyle:     v1pb.OAuth2AuthStyle(v1pb.OAuth2AuthStyle_value[raw["auth_style"].(string)]),
 		}
+		oidcClientSecret, diags := d.GetRawConfigAt(cty.GetAttrPath("oidc_config").IndexInt(0).GetAttr("client_secret"))
+		if diags.HasError() {
+			return nil, diags
+		}
+		if !oidcClientSecret.IsNull() {
+			oidcConfig.ClientSecret = oidcClientSecret.AsString()
+		}
 		for _, s := range raw["scopes"].([]interface{}) {
 			oidcConfig.Scopes = append(oidcConfig.Scopes, s.(string))
 		}
@@ -454,10 +467,16 @@ func getIdentityProviderFromSchema(d *schema.ResourceData, idpName string) (*v1p
 			Port:          int32(raw["port"].(int)),
 			SkipTlsVerify: raw["skip_tls_verify"].(bool),
 			BindDn:        raw["bind_dn"].(string),
-			BindPassword:  raw["bind_password"].(string),
 			BaseDn:        raw["base_dn"].(string),
 			UserFilter:    raw["user_filter"].(string),
 		}
+		ldapBindPassword, diags := d.GetRawConfigAt(cty.GetAttrPath("ldap_config").IndexInt(0).GetAttr("bind_password"))
+		if diags.HasError() {
+			return nil, diags
+		}
+		if !ldapBindPassword.IsNull() {
+			ldapConfig.BindPassword = ldapBindPassword.AsString()
+		}
 		if v := raw["security_protocol"].(string); v != "" {
 			ldapConfig.SecurityProtocol = v1pb.LDAPIdentityProviderConfig_SecurityProtocol(
 				v1pb.LDAPIdentityProviderConfig_SecurityProtocol_value[v],
@@ -550,7 +569,6 @@ func flattenOAuth2Config(c *v1pb.OAuth2IdentityProviderConfig) []interface{} {
 			"token_url":       c.TokenUrl,
 			"user_info_url":   c.UserInfoUrl,
 			"client_id":       c.ClientId,
-			"client_secret":   c.ClientSecret,
 			"scopes":          c.Scopes,
 			"field_mapping":   flattenFieldMapping(c.FieldMapping),
 			"skip_tls_verify": c.SkipTlsVerify,
@@ -564,7 +582,6 @@ func flattenOIDCConfig(c *v1pb.OIDCIdentityProviderConfig) []interface{} {
 		map[string]interface{}{
 			"issuer":          c.Issuer,
 			"client_id":       c.ClientId,
-			"client_secret":   c.ClientSecret,
 			"scopes":          c.Scopes,
 			"field_mapping":   flattenFieldMapping(c.FieldMapping),
 			"skip_tls_verify": c.SkipTlsVerify,
@@ -581,7 +598,6 @@ func flattenLDAPConfig(c *v1pb.LDAPIdentityProviderConfig) []interface{} {
 			"port":              int(c.Port),
 			"skip_tls_verify":   c.SkipTlsVerify,
 			"bind_dn":           c.BindDn,
-			"bind_password":     c.BindPassword,
 			"base_dn":           c.BaseDn,
 			"user_filter":       c.UserFilter,
 			"security_protocol": c.SecurityProtocol.String(),
diff --git a/provider/resource_user.go b/provider/resource_user.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 
 	v1pb "buf.build/gen/go/bytebase/bytebase/protocolbuffers/go/v1"
+	"github.com/hashicorp/go-cty/cty"
 	"github.com/hashicorp/terraform-plugin-log/tflog"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -45,36 +46,9 @@ func resourceUser() *schema.Resource {
 			},
 			"password": {
 				Type:        schema.TypeString,
-				Sensitive:   true,
 				Optional:    true,
-				Description: "The user login password.",
-				DiffSuppressFunc: func(_, oldValue, newValue string, d *schema.ResourceData) bool {
-					// During creation, never suppress
-					if d.Id() == "" {
-						return false
-					}
-
-					// Get the raw config value to see if password is set
-					rawConfig := d.GetRawConfig()
-					sensitiveConfig := rawConfig.GetAttr("password")
-
-					// If password is not in config, suppress the diff
-					if sensitiveConfig.IsNull() {
-						return true
-					}
-
-					// If password is in config, we need to hash it and compare
-					// The 'new' value here is already hashed by StateFunc
-					// The 'old' value is the hash from state
-
-					// If both are hashes and they're equal, suppress (no change)
-					if oldValue != "" && newValue != "" && oldValue == newValue {
-						return true
-					}
-
-					// Otherwise allow the diff (password changed)
-					return false
-				},
+				WriteOnly:   true,
+				Description: "The user login password. This value is write-only and will not be stored in Terraform state.",
 			},
 			"service_key": {
 				Type:        schema.TypeString,
@@ -148,7 +122,7 @@ func resourceUserCreate(ctx context.Context, d *schema.ResourceData, m interface
 	user := &v1pb.User{
 		Name:     userName,
 		Title:    d.Get("title").(string),
-		Password: d.Get("password").(string),
+		Password: getWriteOnlyString(d, "password"),
 		Phone:    d.Get("phone").(string),
 		Email:    email,
 		State:    v1pb.State_ACTIVE,
@@ -227,7 +201,7 @@ func resourceUserUpdate(ctx context.Context, d *schema.ResourceData, m interface
 	title := d.Get("title").(string)
 	phone := d.Get("phone").(string)
 	email := d.Get("email").(string)
-	password := d.Get("password").(string)
+	password := getWriteOnlyString(d, "password")
 
 	existedUser, err := c.GetUser(ctx, userName)
 	if err != nil {
@@ -261,7 +235,7 @@ func resourceUserUpdate(ctx context.Context, d *schema.ResourceData, m interface
 	if d.HasChange("phone") {
 		paths = append(paths, "phone")
 	}
-	if d.HasChange("password") && password != "" {
+	if password != "" {
 		paths = append(paths, "password")
 	}
 
@@ -295,3 +269,11 @@ func resourceUserDelete(ctx context.Context, d *schema.ResourceData, m interface
 	c := m.(api.Client)
 	return internal.ResourceDelete(ctx, d, c.DeleteUser)
 }
+
+func getWriteOnlyString(d *schema.ResourceData, attr string) string {
+	val, diags := d.GetRawConfigAt(cty.GetAttrPath(attr))
+	if diags.HasError() || val.IsNull() {
+		return ""
+	}
+	return val.AsString()
+}
diff --git a/provider/resource_workspace.go b/provider/resource_workspace.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	v1pb "buf.build/gen/go/bytebase/bytebase/protocolbuffers/go/v1"
+	"github.com/hashicorp/go-cty/cty"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 
@@ -41,8 +42,8 @@ func resourceWorkspace() *schema.Resource {
 			"license": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Sensitive:   true,
-				Description: "The license key for the workspace. Upload to activate a subscription plan.",
+				WriteOnly:   true,
+				Description: "The license key for the workspace. Upload to activate a subscription plan. This value is write-only and will not be stored in Terraform state.",
 			},
 			"subscription": {
 				Type:        schema.TypeList,
@@ -145,8 +146,13 @@ func resourceWorkspaceUpdate(ctx context.Context, d *schema.ResourceData, m inte
 		}
 	}
 
-	if d.HasChange("license") {
-		license := d.Get("license").(string)
+	// license is write-only, must read from raw config
+	licenseVal, licDiags := d.GetRawConfigAt(cty.GetAttrPath("license"))
+	if licDiags.HasError() {
+		return licDiags
+	}
+	if !licenseVal.IsNull() {
+		license := licenseVal.AsString()
 		if license != "" {
 			if _, err := c.UploadLicense(ctx, license); err != nil {
 				return diag.FromErr(err)
diff --git a/tutorials/0-provider.tf b/tutorials/0-provider.tf

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,5 @@`
`1`	`1`	`terraform {`
	`2`	`+ required_version = ">= 1.11"`
`2`	`3`	`required_providers {`
`3`	`4`	`bytebase = {`
`4`	`5`	`version = "3.17.4"`