tfprotov5+tfprotov6: Write-only Attribute Implementation

.changes/unreleased/FEATURES-20250121-163456.yaml

@@ -0,0 +1,5 @@
+kind: FEATURES
+body: 'tfprotov5+tfprotov6: Upgraded protocols and added types to support write-only attributes'
+time: 2025-01-21T16:34:56.142885-05:00
+custom:
+    Issue: "462"

.github/workflows/ci-protobuf.yml

@@ -29,7 +29,7 @@ jobs:
           # pinned here to prevent unexpected differences. Follow the
           # https://github.com/protocolbuffers/protobuf repository for protoc
           # release updates.
-          version: '27.3'
+          version: '29.3'
       - run: go mod download
       - run: make tools
       - run: make protoc

internal/logging/keys.go

@@ -80,4 +80,7 @@ const (
 
 	// Whether the DeferralAllowed client capability is enabled
 	KeyClientCapabilityDeferralAllowed = "tf_client_capability_deferral_allowed"
+
+	// Whether the WriteOnlyAttributesAllowed client capability is enabled
+	KeyClientCapabilityWriteOnlyAttributesAllowed = "tf_client_capability_write_only_attributes_allowed"
 )

tfprotov5/client_capabilities.go

@@ -3,6 +3,15 @@
 
 package tfprotov5
 
+// ValidateResourceTypeConfigClientCapabilities allows Terraform to publish information
+// regarding optionally supported protocol features for the ValidateResourceTypeConfig RPC,
+// such as forward-compatible Terraform behavior changes.
+type ValidateResourceTypeConfigClientCapabilities struct {
+	// WriteOnlyAttributesAllowed signals that the client is able to
+	// handle write_only attributes for managed resources.
+	WriteOnlyAttributesAllowed bool
+}
+
 // ConfigureProviderClientCapabilities allows Terraform to publish information
 // regarding optionally supported protocol features for the ConfigureProvider RPC,
 // such as forward-compatible Terraform behavior changes.

tfprotov5/internal/fromproto/client_capabilities.go

@@ -8,6 +8,18 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func ValidateResourceTypeConfigClientCapabilities(in *tfplugin5.ClientCapabilities) *tfprotov5.ValidateResourceTypeConfigClientCapabilities {
+	if in == nil {
+		return nil
+	}
+
+	resp := &tfprotov5.ValidateResourceTypeConfigClientCapabilities{
+		WriteOnlyAttributesAllowed: in.WriteOnlyAttributesAllowed,
+	}
+
+	return resp
+}
+
 func ConfigureProviderClientCapabilities(in *tfplugin5.ClientCapabilities) *tfprotov5.ConfigureProviderClientCapabilities {
 	if in == nil {
 		return nil

tfprotov5/internal/fromproto/client_capabilities_test.go

@@ -7,11 +7,52 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
 )
 
+func TestValidateResourceTypeConfigClientCapabilities(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		in       *tfplugin5.ClientCapabilities
+		expected *tfprotov5.ValidateResourceTypeConfigClientCapabilities
+	}{
+		"nil": {
+			in:       nil,
+			expected: nil,
+		},
+		"zero": {
+			in:       &tfplugin5.ClientCapabilities{},
+			expected: &tfprotov5.ValidateResourceTypeConfigClientCapabilities{},
+		},
+		"WriteOnlyAttributesAllowed": {
+			in: &tfplugin5.ClientCapabilities{
+				WriteOnlyAttributesAllowed: true,
+			},
+			expected: &tfprotov5.ValidateResourceTypeConfigClientCapabilities{
+				WriteOnlyAttributesAllowed: true,
+			},
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			got := fromproto.ValidateResourceTypeConfigClientCapabilities(testCase.in)
+
+			if diff := cmp.Diff(got, testCase.expected); diff != "" {
+				t.Errorf("unexpected difference: %s", diff)
+			}
+		})
+	}
+}
+
 func TestConfigureProviderClientCapabilities(t *testing.T) {
 	t.Parallel()
 

tfprotov5/internal/fromproto/resource.go

@@ -14,8 +14,9 @@ func ValidateResourceTypeConfigRequest(in *tfplugin5.ValidateResourceTypeConfig_
 	}
 
 	resp := &tfprotov5.ValidateResourceTypeConfigRequest{
-		Config:   DynamicValue(in.Config),
-		TypeName: in.TypeName,
+		ClientCapabilities: ValidateResourceTypeConfigClientCapabilities(in.ClientCapabilities),
+		Config:             DynamicValue(in.Config),
+		TypeName:           in.TypeName,
 	}
 
 	return resp

tfprotov5/internal/fromproto/resource_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/fromproto"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tfplugin5"
@@ -471,6 +472,18 @@ func TestValidateResourceTypeConfigRequest(t *testing.T) {
 			in:       &tfplugin5.ValidateResourceTypeConfig_Request{},
 			expected: &tfprotov5.ValidateResourceTypeConfigRequest{},
 		},
+		"ClientCapabilities": {
+			in: &tfplugin5.ValidateResourceTypeConfig_Request{
+				ClientCapabilities: &tfplugin5.ClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
+			},
+			expected: &tfprotov5.ValidateResourceTypeConfigRequest{
+				ClientCapabilities: &tfprotov5.ValidateResourceTypeConfigClientCapabilities{
+					WriteOnlyAttributesAllowed: true,
+				},
+			},
+		},
 		"Config": {
 			in: &tfplugin5.ValidateResourceTypeConfig_Request{
 				Config: testTfplugin5DynamicValue(),

tfprotov5/internal/tf5serverlogging/client_capabilities.go

@@ -10,6 +10,20 @@ import (
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
 )
 
+// ValidateResourceTypeConfigClientCapabilities generates a TRACE "Announced client capabilities" log.
+func ValidateResourceTypeConfigClientCapabilities(ctx context.Context, capabilities *tfprotov5.ValidateResourceTypeConfigClientCapabilities) {
+	if capabilities == nil {
+		logging.ProtocolTrace(ctx, "No announced client capabilities", map[string]interface{}{})
+		return
+	}
+
+	responseFields := map[string]interface{}{
+		logging.KeyClientCapabilityWriteOnlyAttributesAllowed: capabilities.WriteOnlyAttributesAllowed,
+	}
+
+	logging.ProtocolTrace(ctx, "Announced client capabilities", responseFields)
+}
+
 // ConfigureProviderClientCapabilities generates a TRACE "Announced client capabilities" log.
 func ConfigureProviderClientCapabilities(ctx context.Context, capabilities *tfprotov5.ConfigureProviderClientCapabilities) {
 	if capabilities == nil {

tfprotov5/internal/tf5serverlogging/client_capabilities_test.go

@@ -9,13 +9,83 @@ import (
 	"testing"
 
 	"github.com/google/go-cmp/cmp"
+	"github.com/hashicorp/terraform-plugin-log/tfsdklog"
+	"github.com/hashicorp/terraform-plugin-log/tfsdklogtest"
+
 	"github.com/hashicorp/terraform-plugin-go/internal/logging"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
 	"github.com/hashicorp/terraform-plugin-go/tfprotov5/internal/tf5serverlogging"
-	"github.com/hashicorp/terraform-plugin-log/tfsdklog"
-	"github.com/hashicorp/terraform-plugin-log/tfsdklogtest"
 )
 
+func TestValidateResourceTypeConfigClientCapabilities(t *testing.T) {
+	t.Parallel()
+
+	testCases := map[string]struct {
+		capabilities *tfprotov5.ValidateResourceTypeConfigClientCapabilities
+		expected     []map[string]interface{}
+	}{
+		"nil": {
+			capabilities: nil,
+			expected: []map[string]interface{}{
+				{
+					"@level":   "trace",
+					"@message": "No announced client capabilities",
+					"@module":  "sdk.proto",
+				},
+			},
+		},
+		"empty": {
+			capabilities: &tfprotov5.ValidateResourceTypeConfigClientCapabilities{},
+			expected: []map[string]interface{}{
+				{
+					"@level":   "trace",
+					"@message": "Announced client capabilities",
+					"@module":  "sdk.proto",
+					"tf_client_capability_write_only_attributes_allowed": false,
+				},
+			},
+		},
+		"write_only_attributes_allowed": {
+			capabilities: &tfprotov5.ValidateResourceTypeConfigClientCapabilities{
+				WriteOnlyAttributesAllowed: true,
+			},
+			expected: []map[string]interface{}{
+				{
+					"@level":   "trace",
+					"@message": "Announced client capabilities",
+					"@module":  "sdk.proto",
+					"tf_client_capability_write_only_attributes_allowed": true,
+				},
+			},
+		},
+	}
+
+	for name, testCase := range testCases {
+		name, testCase := name, testCase
+
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			var output bytes.Buffer
+
+			ctx := tfsdklogtest.RootLogger(context.Background(), &output)
+			ctx = logging.ProtoSubsystemContext(ctx, tfsdklog.Options{})
+
+			tf5serverlogging.ValidateResourceTypeConfigClientCapabilities(ctx, testCase.capabilities)
+
+			entries, err := tfsdklogtest.MultilineJSONDecode(&output)
+
+			if err != nil {
+				t.Fatalf("unable to read multiple line JSON: %s", err)
+			}
+
+			if diff := cmp.Diff(entries, testCase.expected); diff != "" {
+				t.Errorf("unexpected difference: %s", diff)
+			}
+		})
+	}
+}
+
 func TestConfigureProviderClientCapabilities(t *testing.T) {
 	t.Parallel()