fix(okta_request_condition): handle priority mismatch after create (#2786)

Author: yoclaire

examples/resources/okta_request_condition/priority.tf

@@ -0,0 +1,27 @@
+resource "okta_request_condition" "test_priority_0" {
+  status               = "ACTIVE"
+  resource_id          = "0oasp3g29b1hqkcYE1d7"
+  approval_sequence_id = "69251ae704a4d0a7fcdb870f"
+  name                 = "test-condition-priority-0"
+  priority             = 0
+  access_scope_settings {
+    type = "RESOURCE_DEFAULT"
+  }
+  requester_settings {
+    type = "EVERYONE"
+  }
+}
+
+resource "okta_request_condition" "test_priority_1" {
+  status               = "ACTIVE"
+  resource_id          = "0oasp3g29b1hqkcYE1d7"
+  approval_sequence_id = "69251ae704a4d0a7fcdb870f"
+  name                 = "test-condition-priority-1"
+  priority             = 1
+  access_scope_settings {
+    type = "RESOURCE_DEFAULT"
+  }
+  requester_settings {
+    type = "EVERYONE"
+  }
+}

okta/services/governance/resource_request_condition.go

@@ -226,7 +226,36 @@ func (r *requestConditionResource) Create(ctx context.Context, req resource.Crea
 		}
 	}
 
+	// The API may ignore the priority field on create and return a default
+	// value (e.g. always 0). Save the planned priority so we can restore it
+	// after applying the API response to state, since even the follow-up
+	// PATCH response returns 0 for this field.
+	plannedPriority := data.Priority
+
+	// If the planned priority differs from what the API returned, issue a
+	// follow-up PATCH to attempt to set the correct value server-side.
+	if !plannedPriority.IsNull() && plannedPriority.ValueInt32() != requestConditionResp.GetPriority() {
+		_, _, err = r.OktaGovernanceClient.OktaGovernanceSDKClient().
+			RequestConditionsAPI.UpdateResourceRequestConditionV2(ctx,
+			data.ResourceId.ValueString(),
+			requestConditionResp.GetId()).RequestConditionPatchable(createRequestConditionPatch(data)).Execute()
+		if err != nil {
+			resp.Diagnostics.AddError(
+				"Error setting priority on Request condition",
+				"Could not update priority after creation: "+err.Error(),
+			)
+			return
+		}
+	}
+
 	resp.Diagnostics.Append(applyRequestConditionToState(ctx, &data, requestConditionResp)...)
+
+	// Restore the planned priority: the API always returns 0 for this field,
+	// even after a successful PATCH, so we preserve the planned value to
+	// avoid a "Provider produced inconsistent result after apply" error.
+	if !plannedPriority.IsNull() && data.Priority.ValueInt32() == 0 && plannedPriority.ValueInt32() != 0 {
+		data.Priority = plannedPriority
+	}
 	if resp.Diagnostics.HasError() {
 		return
 	}
@@ -245,6 +274,11 @@ func (r *requestConditionResource) Read(ctx context.Context, req resource.ReadRe
 		return
 	}
 
+	// Save the prior-state priority: the API always returns 0 for this field
+	// regardless of what was configured, so we preserve the known priority to
+	// avoid a spurious non-empty plan after apply.
+	priorPriority := data.Priority
+
 	// Read API call logic
 	readRequestConditionResp, httpResp, err := r.OktaGovernanceClient.OktaGovernanceSDKClient().RequestConditionsAPI.GetResourceRequestConditionV2(ctx, data.ResourceId.ValueString(), data.Id.ValueString()).Execute()
 	if err != nil {
@@ -265,6 +299,13 @@ func (r *requestConditionResource) Read(ctx context.Context, req resource.ReadRe
 	if resp.Diagnostics.HasError() {
 		return
 	}
+
+	// Restore the prior-state priority when the API returns 0 but the
+	// configuration had a non-zero value.
+	if !priorPriority.IsNull() && data.Priority.ValueInt32() == 0 && priorPriority.ValueInt32() != 0 {
+		data.Priority = priorPriority
+	}
+
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 }
 
@@ -283,6 +324,10 @@ func (r *requestConditionResource) Update(ctx context.Context, req resource.Upda
 		return
 	}
 
+	// Save planned priority before the API call: the update API also returns
+	// 0 for priority in the response, so we preserve the planned value.
+	plannedPriority := data.Priority
+
 	// Update API call logic
 	ctx = context.WithValue(ctx, api.RetryOnStatusCodes, []int{http.StatusConflict})
 	updatedRequestCondition, _, err := r.OktaGovernanceClient.OktaGovernanceSDKClient().RequestConditionsAPI.UpdateResourceRequestConditionV2(ctx, data.ResourceId.ValueString(), state.Id.ValueString()).RequestConditionPatchable(createRequestConditionPatch(data)).Execute()
@@ -333,6 +378,12 @@ func (r *requestConditionResource) Update(ctx context.Context, req resource.Upda
 		return
 	}
 
+	// Restore the planned priority: the update API also returns 0 for this
+	// field, so we preserve the planned value to keep state consistent.
+	if !plannedPriority.IsNull() && data.Priority.ValueInt32() == 0 && plannedPriority.ValueInt32() != 0 {
+		data.Priority = plannedPriority
+	}
+
 	// Save Data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
 }

okta/services/governance/resource_request_condition_test.go

@@ -137,6 +137,31 @@ func TestAccRequestConditionResource_Issue2780(t *testing.T) {
 	})
 }
 
+func TestAccRequestConditionResource_Priority(t *testing.T) {
+	mgr := newFixtureManager("resources", resources.OktaGovernanceRequestCondition, t.Name())
+	config := mgr.GetFixtures("priority.tf", t)
+	resourceName0 := fmt.Sprintf("%s.test_priority_0", resources.OktaGovernanceRequestCondition)
+	resourceName1 := fmt.Sprintf("%s.test_priority_1", resources.OktaGovernanceRequestCondition)
+
+	acctest.OktaResourceTest(t, resource.TestCase{
+		PreCheck:                 acctest.AccPreCheck(t),
+		ErrorCheck:               testAccErrorChecks(t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
+		CheckDestroy:             checkRequestConditionDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName0, "name", "test-condition-priority-0"),
+					resource.TestCheckResourceAttr(resourceName0, "priority", "0"),
+					resource.TestCheckResourceAttr(resourceName1, "name", "test-condition-priority-1"),
+					resource.TestCheckResourceAttr(resourceName1, "priority", "1"),
+				),
+			},
+		},
+	})
+}
+
 // checkRequestConditionDestroy verifies that request conditions have been destroyed
 func checkRequestConditionDestroy(s *terraform.State) error {
 	// Skip destroy check in VCR playback mode