group_settings: remove from state on 404 instead of erroring during read

When the underlying group is deleted outside Terraform, resourceGroupSettingsRead
returned the 404 as a fatal error, so plan/refresh failed and the resource was
never dropped from state — the only recovery was a manual `terraform state rm`.

Route the group Get 404 through handleNotFoundError (which does d.SetId("")),
matching the existing behavior of resource_group. Non-404 errors are unchanged.

Adds TestAccResourceGroupSettings_disappears covering out-of-band group deletion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: akemner-figma

internal/provider/resource_group_settings.go

@@ -472,7 +472,9 @@ func resourceGroupSettingsRead(ctx context.Context, d *schema.ResourceData, meta
 
 	group, err := groupsService.Get(d.Id()).Do()
 	if err != nil {
-		return diag.FromErr(err)
+		// If the underlying group is gone, drop the settings from state instead
+		// of erroring on the 404, matching resource_group's behavior.
+		return handleNotFoundError(err, d, d.Get("email").(string))
 	}
 
 	// Convert strings to bools

internal/provider/resource_group_settings_test.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 )
 
 func TestAccResourceGroupSettings_basic(t *testing.T) {
@@ -42,6 +43,76 @@ func TestAccResourceGroupSettings_basic(t *testing.T) {
 	})
 }
 
+// TestAccResourceGroupSettings_disappears verifies that when the underlying
+// group is deleted outside Terraform, the group_settings resource is dropped
+// from state on the next refresh instead of failing the plan on a 404.
+func TestAccResourceGroupSettings_disappears(t *testing.T) {
+	t.Parallel()
+
+	domainName := os.Getenv("GOOGLEWORKSPACE_DOMAIN")
+
+	if domainName == "" {
+		t.Skip("GOOGLEWORKSPACE_DOMAIN needs to be set to run this test")
+	}
+
+	testGroupVals := map[string]interface{}{
+		"domainName": domainName,
+		"email":      fmt.Sprintf("tf-test-%s", acctest.RandString(10)),
+	}
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccPreCheck(t) },
+		ProviderFactories: providerFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccResourceGroupSettings_basic(testGroupVals),
+			},
+			{
+				// Delete the group outside Terraform. On refresh, group_settings
+				// must self-heal (remove from state) and plan to recreate,
+				// instead of erroring on the 404.
+				Config: testAccResourceGroupSettings_basic(testGroupVals),
+				Check: resource.ComposeTestCheckFunc(
+					testAccDeleteGroupOutOfBand("googleworkspace_group.my-group"),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+// testAccDeleteGroupOutOfBand deletes the referenced group directly via the API,
+// simulating the group being removed outside Terraform.
+func testAccDeleteGroupOutOfBand(resourceName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("%s key not found in state", resourceName)
+		}
+
+		client, err := googleworkspaceTestClient()
+		if err != nil {
+			return err
+		}
+
+		directoryService, diags := client.NewDirectoryService()
+		if diags.HasError() {
+			return fmt.Errorf("error creating directory service %+v", diags)
+		}
+
+		groupsService, diags := GetGroupsService(directoryService)
+		if diags.HasError() {
+			return fmt.Errorf("error getting groups service %+v", diags)
+		}
+
+		if err := groupsService.Delete(rs.Primary.ID).Do(); err != nil {
+			return fmt.Errorf("error deleting group out of band (%s): %w", rs.Primary.ID, err)
+		}
+
+		return nil
+	}
+}
+
 func TestAccResourceGroupSettings_full(t *testing.T) {
 	t.Parallel()