Skip to content

Commit 63c9d73

Browse files
ecmadaoecmadao
authored
fix: get sensitive input-only data from local state (#75)
* chore: update * chore: update * fix: get sensitive input-only data from local state * fix: test * fix: test * fix: test
1 parent b318a6a commit 63c9d73

File tree

4 files changed

+50
-16
lines changed

4 files changed

+50
-16
lines changed

‎VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.0.1
1+
1.0.2

‎provider/data_source_instance.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -85,21 +85,25 @@ func dataSourceInstance() *schema.Resource {
8585
"password": {
8686
Type: schema.TypeString,
8787
Computed: true,
88+
Sensitive: true,
8889
Description: "The connection user password used by Bytebase to perform DDL and DML operations.",
8990
},
9091
"ssl_ca": {
9192
Type: schema.TypeString,
9293
Computed: true,
94+
Sensitive: true,
9395
Description: "The CA certificate. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
9496
},
9597
"ssl_cert": {
9698
Type: schema.TypeString,
9799
Computed: true,
100+
Sensitive: true,
98101
Description: "The client certificate. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
99102
},
100103
"ssl_key": {
101104
Type: schema.TypeString,
102105
Computed: true,
106+
Sensitive: true,
103107
Description: "The client key. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
104108
},
105109
},

‎provider/data_source_instance_list.go

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -96,21 +96,25 @@ func dataSourceInstanceList() *schema.Resource {
9696
"password": {
9797
Type: schema.TypeString,
9898
Computed: true,
99+
Sensitive: true,
99100
Description: "The connection user password used by Bytebase to perform DDL and DML operations.",
100101
},
101102
"ssl_ca": {
102103
Type: schema.TypeString,
103104
Computed: true,
105+
Sensitive: true,
104106
Description: "The CA certificate. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
105107
},
106108
"ssl_cert": {
107109
Type: schema.TypeString,
108110
Computed: true,
111+
Sensitive: true,
109112
Description: "The client certificate. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
110113
},
111114
"ssl_key": {
112115
Type: schema.TypeString,
113116
Computed: true,
117+
Sensitive: true,
114118
Description: "The client key. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
115119
},
116120
},
@@ -149,9 +153,14 @@ func dataSourceInstanceListRead(ctx context.Context, d *schema.ResourceData, m i
149153
ins["name"] = instance.Name
150154
ins["engine"] = instance.Engine
151155
ins["external_link"] = instance.ExternalLink
152-
ins["data_sources"] = flattenDataSourceList(instance.DataSources)
153156
ins["environment"] = instance.Environment
154157

158+
dataSources, err := flattenDataSourceList(d, instance.DataSources)
159+
if err != nil {
160+
return diag.FromErr(err)
161+
}
162+
ins["data_sources"] = dataSources
163+
155164
instances = append(instances, ins)
156165
}
157166

‎provider/resource_instance.go

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -106,25 +106,29 @@ func resourceInstance() *schema.Resource {
106106
"password": {
107107
Type: schema.TypeString,
108108
Optional: true,
109+
Sensitive: true,
109110
Default: "",
110111
Description: "The connection user password used by Bytebase to perform DDL and DML operations.",
111112
},
112113
"ssl_ca": {
113114
Type: schema.TypeString,
114115
Optional: true,
115116
Default: "",
117+
Sensitive: true,
116118
Description: "The CA certificate. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
117119
},
118120
"ssl_cert": {
119121
Type: schema.TypeString,
120122
Optional: true,
121123
Default: "",
124+
Sensitive: true,
122125
Description: "The client certificate. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
123126
},
124127
"ssl_key": {
125128
Type: schema.TypeString,
126129
Optional: true,
127130
Default: "",
131+
Sensitive: true,
128132
Description: "The client key. Optional, you can set this if the engine type is MYSQL, POSTGRES, TIDB or CLICKHOUSE.",
129133
},
130134
"host": {
@@ -155,7 +159,7 @@ func resourceInstance() *schema.Resource {
155159
func resourceInstanceCreate(ctx context.Context, d *schema.ResourceData, m interface{}) diag.Diagnostics {
156160
c := m.(api.Client)
157161

158-
dataSourceList, err := convertDataSourceCreateList(d)
162+
dataSourceList, err := convertDataSourceCreateList(d, true /* validate */)
159163
if err != nil {
160164
return diag.FromErr(err)
161165
}
@@ -309,7 +313,7 @@ func resourceInstanceUpdate(ctx context.Context, d *schema.ResourceData, m inter
309313
patch.ExternalLink = &v
310314
}
311315
if d.HasChange("data_sources") {
312-
dataSourceList, err := convertDataSourceCreateList(d)
316+
dataSourceList, err := convertDataSourceCreateList(d, true /* validate */)
313317
if err != nil {
314318
return diag.FromErr(err)
315319
}
@@ -374,14 +378,28 @@ func setInstanceMessage(d *schema.ResourceData, instance *api.InstanceMessage) d
374378
if err := d.Set("external_link", instance.ExternalLink); err != nil {
375379
return diag.Errorf("cannot set external_link for instance: %s", err.Error())
376380
}
377-
if err := d.Set("data_sources", flattenDataSourceList(instance.DataSources)); err != nil {
381+
382+
dataSources, err := flattenDataSourceList(d, instance.DataSources)
383+
if err != nil {
384+
return diag.FromErr(err)
385+
}
386+
if err := d.Set("data_sources", dataSources); err != nil {
378387
return diag.Errorf("cannot set data_sources for instance: %s", err.Error())
379388
}
380389

381390
return nil
382391
}
383392

384-
func flattenDataSourceList(dataSourceList []*api.DataSourceMessage) []interface{} {
393+
func flattenDataSourceList(d *schema.ResourceData, dataSourceList []*api.DataSourceMessage) ([]interface{}, error) {
394+
oldDataSourceList, err := convertDataSourceCreateList(d, false)
395+
if err != nil {
396+
return nil, err
397+
}
398+
oldDataSourceMap := make(map[string]*api.DataSourceMessage)
399+
for _, ds := range oldDataSourceList {
400+
oldDataSourceMap[ds.ID] = ds
401+
}
402+
385403
res := []interface{}{}
386404
for _, dataSource := range dataSourceList {
387405
raw := map[string]interface{}{}
@@ -390,17 +408,21 @@ func flattenDataSourceList(dataSourceList []*api.DataSourceMessage) []interface{
390408
raw["username"] = dataSource.Username
391409
raw["host"] = dataSource.Host
392410
raw["port"] = dataSource.Port
393-
raw["password"] = dataSource.Password
394-
raw["ssl_ca"] = dataSource.SslCa
395-
raw["ssl_cert"] = dataSource.SslCert
396-
raw["ssl_key"] = dataSource.SslKey
397411
raw["database"] = dataSource.Database
412+
413+
// These sensitive fields won't returned in the API. Propagate state value.
414+
if ds, ok := oldDataSourceMap[dataSource.ID]; ok {
415+
raw["password"] = ds.Password
416+
raw["ssl_ca"] = ds.SslCa
417+
raw["ssl_cert"] = ds.SslCert
418+
raw["ssl_key"] = ds.SslKey
419+
}
398420
res = append(res, raw)
399421
}
400-
return res
422+
return res, nil
401423
}
402424

403-
func convertDataSourceCreateList(d *schema.ResourceData) ([]*api.DataSourceMessage, error) {
425+
func convertDataSourceCreateList(d *schema.ResourceData, validate bool) ([]*api.DataSourceMessage, error) {
404426
var dataSourceList []*api.DataSourceMessage
405427
if rawList, ok := d.Get("data_sources").([]interface{}); ok {
406428
dataSourceTypeMap := map[api.DataSourceType]bool{}
@@ -410,9 +432,8 @@ func convertDataSourceCreateList(d *schema.ResourceData) ([]*api.DataSourceMessa
410432
ID: obj["id"].(string),
411433
Type: api.DataSourceType(obj["type"].(string)),
412434
}
413-
414-
if dataSourceTypeMap[dataSource.Type] {
415-
return nil, errors.Errorf("duplicate data source type %s", dataSource.Type)
435+
if dataSourceTypeMap[dataSource.Type] && dataSource.Type == api.DataSourceAdmin {
436+
return nil, errors.Errorf("duplicate data source type ADMIN")
416437
}
417438
dataSourceTypeMap[dataSource.Type] = true
418439

@@ -443,7 +464,7 @@ func convertDataSourceCreateList(d *schema.ResourceData) ([]*api.DataSourceMessa
443464
dataSourceList = append(dataSourceList, dataSource)
444465
}
445466

446-
if !dataSourceTypeMap[api.DataSourceAdmin] {
467+
if !dataSourceTypeMap[api.DataSourceAdmin] && validate {
447468
return nil, errors.Errorf("data source \"%v\" is required", api.DataSourceAdmin)
448469
}
449470
}

0 commit comments

Comments
 (0)