fix: allow set all databases for masking exception policy (#143)

ecmadao · web-flow · commit 83f894c19c6d · 2025-08-05T00:42:33.000-07:00
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-3.8.7
+3.9.0
diff --git a/examples/database/main.tf b/examples/database/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/database_group/main.tf b/examples/database_group/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/environments/main.tf b/examples/environments/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/groups/main.tf b/examples/groups/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/iamPolicy/main.tf b/examples/iamPolicy/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/instances/main.tf b/examples/instances/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/policies/main.tf b/examples/policies/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.1"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/projects/main.tf b/examples/projects/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/risk/main.tf b/examples/risk/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/roles/main.tf b/examples/roles/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/settings/main.tf b/examples/settings/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/setup/main.tf b/examples/setup/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.7"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/sql_review/main.tf b/examples/sql_review/main.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/examples/users/main.tf b/examples/users/main.tf
@@ -2,7 +2,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }
diff --git a/provider/data_source_policy.go b/provider/data_source_policy.go
@@ -93,10 +93,14 @@ func getMaskingExceptionPolicySchema(computed bool) *schema.Schema {
 					Elem: &schema.Resource{
 						Schema: map[string]*schema.Schema{
 							"database": {
-								Type:         schema.TypeString,
-								Required:     true,
-								ValidateFunc: validation.StringIsNotEmpty,
-								Description:  "The database full name in instances/{instance resource id}/databases/{database name} format",
+								Type:     schema.TypeString,
+								Computed: computed,
+								Optional: true,
+								ValidateDiagFunc: internal.ResourceNameValidation(
+									// database name format
+									fmt.Sprintf("^%s%s/%s%s$", internal.InstanceNamePrefix, internal.ResourceIDPattern, internal.DatabaseIDPrefix, internal.ResourceIDPattern),
+								),
+								Description: "The database full name in instances/{instance resource id}/databases/{database name} format",
 							},
 							"schema": {
 								Type:     schema.TypeString,
@@ -476,10 +480,9 @@ func flattenMaskingExceptionPolicy(p *v1pb.MaskingExceptionPolicy) ([]interface{
 				)
 			}
 		}
-		if instanceID == "" || databaseName == "" {
-			return nil, errors.Errorf("invalid exception policy condition: %v", exception.Condition.Expression)
+		if instanceID != "" && databaseName != "" {
+			raw["database"] = fmt.Sprintf("%s%s/%s%s", internal.InstanceNamePrefix, instanceID, internal.DatabaseIDPrefix, databaseName)
 		}
-		raw["database"] = fmt.Sprintf("%s%s/%s%s", internal.InstanceNamePrefix, instanceID, internal.DatabaseIDPrefix, databaseName)
 		exceptionList = append(exceptionList, raw)
 	}
 	policy := map[string]interface{}{
diff --git a/provider/resource_database.go b/provider/resource_database.go
@@ -28,19 +28,31 @@ func resourceDatabase() *schema.Resource {
 		},
 		Schema: map[string]*schema.Schema{
 			"name": {
-				Type:        schema.TypeString,
-				Required:    true,
+				Type:     schema.TypeString,
+				Required: true,
+				ValidateDiagFunc: internal.ResourceNameValidation(
+					// database name format
+					fmt.Sprintf("^%s%s/%s%s$", internal.InstanceNamePrefix, internal.ResourceIDPattern, internal.DatabaseIDPrefix, internal.ResourceIDPattern),
+				),
 				Description: "The database full name in instances/{instance}/databases/{database} format",
 			},
 			"project": {
-				Type:        schema.TypeString,
-				Required:    true,
+				Type:     schema.TypeString,
+				Required: true,
+				ValidateDiagFunc: internal.ResourceNameValidation(
+					// project name format
+					fmt.Sprintf("^%s%s$", internal.ProjectNamePrefix, internal.ResourceIDPattern),
+				),
 				Description: "The project full name for the database in projects/{project} format.",
 			},
 			"environment": {
-				Type:        schema.TypeString,
-				Optional:    true,
-				Computed:    true,
+				Type:     schema.TypeString,
+				Optional: true,
+				Computed: true,
+				ValidateDiagFunc: internal.ResourceNameValidation(
+					// environment name format
+					fmt.Sprintf("^%s%s$", internal.EnvironmentNamePrefix, internal.ResourceIDPattern),
+				),
 				Description: "The database environment, will follow the instance environment by default",
 			},
 			"state": {
diff --git a/provider/resource_database_group.go b/provider/resource_database_group.go
@@ -18,7 +18,7 @@ import (
 func resourceDatabaseGroup() *schema.Resource {
 	return &schema.Resource{
 		Description:   "The database group resource.",
-		ReadContext:   resourceDatabaseGroupRead,
+		ReadContext:   internal.ResourceRead(resourceDatabaseGroupRead),
 		DeleteContext: internal.ResourceDelete,
 		CreateContext: resourceDatabaseGroupCreate,
 		UpdateContext: resourceDatabaseGroupUpdate,
diff --git a/provider/resource_policy.go b/provider/resource_policy.go
@@ -349,25 +349,30 @@ func convertToMaskingExceptionPolicy(d *schema.ResourceData) (*v1pb.MaskingExcep
 	for _, exception := range exceptionList.List() {
 		rawException := exception.(map[string]interface{})
 
+		expressions := []string{}
 		databaseFullName := rawException["database"].(string)
-		instanceID, databaseName, err := internal.GetInstanceDatabaseID(databaseFullName)
-		if err != nil {
-			return nil, errors.Wrapf(err, "invalid database full name: %v", databaseFullName)
+		if databaseFullName != "" {
+			instanceID, databaseName, err := internal.GetInstanceDatabaseID(databaseFullName)
+			if err != nil {
+				return nil, errors.Wrapf(err, "invalid database full name: %v", databaseFullName)
+			}
+			expressions = append(
+				expressions,
+				fmt.Sprintf(`resource.instance_id == "%s"`, instanceID),
+				fmt.Sprintf(`resource.database_name == "%s"`, databaseName),
+			)
+
+			if schema, ok := rawException["schema"].(string); ok && schema != "" {
+				expressions = append(expressions, fmt.Sprintf(`resource.schema_name == "%s"`, schema))
+			}
+			if table, ok := rawException["table"].(string); ok && table != "" {
+				expressions = append(expressions, fmt.Sprintf(`resource.table_name == "%s"`, table))
+			}
+			if column, ok := rawException["column"].(string); ok && column != "" {
+				expressions = append(expressions, fmt.Sprintf(`resource.column_name == "%s"`, column))
+			}
 		}
 
-		expressions := []string{
-			fmt.Sprintf(`resource.instance_id == "%s"`, instanceID),
-			fmt.Sprintf(`resource.database_name == "%s"`, databaseName),
-		}
-		if schema, ok := rawException["schema"].(string); ok && schema != "" {
-			expressions = append(expressions, fmt.Sprintf(`resource.schema_name == "%s"`, schema))
-		}
-		if table, ok := rawException["table"].(string); ok && table != "" {
-			expressions = append(expressions, fmt.Sprintf(`resource.table_name == "%s"`, table))
-		}
-		if column, ok := rawException["column"].(string); ok && column != "" {
-			expressions = append(expressions, fmt.Sprintf(`resource.column_name == "%s"`, column))
-		}
 		if expire, ok := rawException["expire_timestamp"].(string); ok && expire != "" {
 			formattedTime, err := time.Parse(time.RFC3339, expire)
 			if err != nil {
diff --git a/tutorials/0-provider.tf b/tutorials/0-provider.tf
@@ -1,7 +1,7 @@
 terraform {
   required_providers {
     bytebase = {
-      version = "3.8.2"
+      version = "3.9.0"
       # For local development, please use "terraform.local/bytebase/bytebase" instead
       source = "registry.terraform.io/bytebase/bytebase"
     }

Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,7 @@`
`2`	`2`	`terraform {`
`3`	`3`	`required_providers {`
`4`	`4`	`bytebase = {`
`5`		`- version = "3.8.2"`
	`5`	`+ version = "3.9.0"`
`6`	`6`	`# For local development, please use "terraform.local/bytebase/bytebase" instead`
`7`	`7`	`source = "registry.terraform.io/bytebase/bytebase"`
`8`	`8`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1,7 +1,7 @@`
`1`	`1`	`terraform {`
`2`	`2`	`required_providers {`
`3`	`3`	`bytebase = {`
`4`		`- version = "3.8.2"`
	`4`	`+ version = "3.9.0"`
`5`	`5`	`# For local development, please use "terraform.local/bytebase/bytebase" instead`
`6`	`6`	`source = "registry.terraform.io/bytebase/bytebase"`
`7`	`7`	`}`