okta_push_group: tolerate 404 (remove from state on read, idempotent delete)

When an okta_push_group mapping (or its source group) is deleted outside
Terraform, Read returned the 404 as a fatal error, so plan/refresh failed and
the resource was never dropped from state — the only recovery was a manual
`terraform state rm`. Delete had the same gap: it would error if the mapping
was already gone.

Read now removes the resource from state on a 404; Delete now treats a 404 as
already-deleted. Both match the idiom used by other framework resources
(okta_identity_source_group, okta_group_owners). Non-404 errors are unchanged.

Adds TestAccResourceOktaPushGroup_disappears covering the out-of-band deletion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: akemner-figma

okta/services/idaas/resource_okta_push_group.go

@@ -3,6 +3,7 @@ package idaas
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"strings"
 
 	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
@@ -224,8 +225,12 @@ func (r *pushGroupResource) Read(ctx context.Context, req resource.ReadRequest,
 		return
 	}
 
-	groupPushMapping, _, err := r.config.OktaIDaaSClient.OktaSDKClientV6().GroupPushMappingAPI.GetGroupPushMapping(ctx, state.AppId.ValueString(), state.ID.ValueString()).Execute()
+	groupPushMapping, httpResp, err := r.config.OktaIDaaSClient.OktaSDKClientV6().GroupPushMappingAPI.GetGroupPushMapping(ctx, state.AppId.ValueString(), state.ID.ValueString()).Execute()
 	if err != nil {
+		if httpResp != nil && httpResp.StatusCode == http.StatusNotFound {
+			resp.State.RemoveResource(ctx)
+			return
+		}
 		resp.Diagnostics.AddError("Error reading Okta push group mapping ", err.Error())
 		return
 	}
@@ -290,17 +295,23 @@ func (r *pushGroupResource) Delete(ctx context.Context, req resource.DeleteReque
 	}
 
 	if state.Status.ValueString() != "INACTIVE" {
-		_, _, err := r.config.OktaIDaaSClient.OktaSDKClientV6().GroupPushMappingAPI.UpdateGroupPushMapping(ctx, state.AppId.ValueString(), state.ID.ValueString()).Body(v6okta.UpdateGroupPushMappingRequest{
+		_, httpResp, err := r.config.OktaIDaaSClient.OktaSDKClientV6().GroupPushMappingAPI.UpdateGroupPushMapping(ctx, state.AppId.ValueString(), state.ID.ValueString()).Body(v6okta.UpdateGroupPushMappingRequest{
 			Status: "INACTIVE",
 		}).Execute()
 		if err != nil {
+			if httpResp != nil && httpResp.StatusCode == http.StatusNotFound {
+				return
+			}
 			resp.Diagnostics.AddError("failed to delete push group mapping: ", err.Error())
 			return
 		}
 	}
 
-	_, err := r.config.OktaIDaaSClient.OktaSDKClientV6().GroupPushMappingAPI.DeleteGroupPushMapping(ctx, state.AppId.ValueString(), state.ID.ValueString()).DeleteTargetGroup(state.DeleteTargetGroupOnDestroy.ValueBool()).Execute()
+	httpResp, err := r.config.OktaIDaaSClient.OktaSDKClientV6().GroupPushMappingAPI.DeleteGroupPushMapping(ctx, state.AppId.ValueString(), state.ID.ValueString()).DeleteTargetGroup(state.DeleteTargetGroupOnDestroy.ValueBool()).Execute()
 	if err != nil {
+		if httpResp != nil && httpResp.StatusCode == http.StatusNotFound {
+			return
+		}
 		resp.Diagnostics.AddError("failed to delete push group mapping: ", err.Error())
 		return
 	}

okta/services/idaas/resource_okta_push_group_test.go

@@ -1,10 +1,13 @@
 package idaas_test
 
 import (
+	"context"
 	"fmt"
 	"testing"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+	v6okta "github.com/okta/okta-sdk-golang/v6/okta"
 	"github.com/okta/terraform-provider-okta/okta/acctest"
 	"github.com/okta/terraform-provider-okta/okta/resources"
 )
@@ -45,6 +48,66 @@ func TestAccResourceOktaPushGroup_crud(t *testing.T) {
 	})
 }
 
+// TestAccResourceOktaPushGroup_disappears verifies that when a push group
+// mapping is removed outside Terraform, the next refresh drops it from state
+// and plans to recreate it, rather than failing the plan with a 404 read error.
+func TestAccResourceOktaPushGroup_disappears(t *testing.T) {
+	resourceName := fmt.Sprintf("%s.sample", resources.OktaIDaaSPushGroup)
+	mgr := newFixtureManager("resources", resources.OktaIDaaSPushGroup, t.Name())
+	config := mgr.GetFixtures("okta_push_group.tf", t)
+
+	acctest.OktaResourceTest(t, resource.TestCase{
+		PreCheck:                 acctest.AccPreCheck(t),
+		ErrorCheck:               testAccErrorChecks(t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
+		CheckDestroy:             nil,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(resourceName, "id"),
+					resource.TestCheckResourceAttrSet(resourceName, "app_id"),
+				),
+			},
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					clickOpsDeletePushGroupMapping(resourceName),
+				),
+				ExpectNonEmptyPlan: true,
+			},
+		},
+	})
+}
+
+// clickOpsDeletePushGroupMapping deletes the push group mapping directly via the
+// API, simulating the mapping (or its source group) being removed outside
+// Terraform. The Okta API requires the mapping to be INACTIVE before deletion.
+// The pushed target group is deleted too so it isn't orphaned across runs (the
+// resource's own Delete never runs once state self-heals on the 404).
+func clickOpsDeletePushGroupMapping(resourceName string) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[resourceName]
+		if !ok {
+			return fmt.Errorf("resource not found: %s", resourceName)
+		}
+		appID := rs.Primary.Attributes["app_id"]
+		mappingID := rs.Primary.ID
+		client := iDaaSAPIClientForTestUtil.OktaSDKClientV6()
+		ctx := context.Background()
+
+		if _, _, err := client.GroupPushMappingAPI.UpdateGroupPushMapping(ctx, appID, mappingID).
+			Body(v6okta.UpdateGroupPushMappingRequest{Status: "INACTIVE"}).Execute(); err != nil {
+			return fmt.Errorf("API: unable to deactivate push group mapping %q: %+v", mappingID, err)
+		}
+		if _, err := client.GroupPushMappingAPI.DeleteGroupPushMapping(ctx, appID, mappingID).
+			DeleteTargetGroup(true).Execute(); err != nil {
+			return fmt.Errorf("API: unable to delete push group mapping %q: %+v", mappingID, err)
+		}
+		return nil
+	}
+}
+
 func TestAccResourceOktaPushGroup_ad(t *testing.T) {
 	resourceName := fmt.Sprintf("%s.sample", resources.OktaIDaaSPushGroup)
 	mgr := newFixtureManager("resources", resources.OktaIDaaSPushGroup, t.Name())