GH-2356 | Normalize Workflow Permission Expansion For okta_admin_role_custom (#2902)

Author: dhiwakar-okta

examples/resources/okta_admin_role_custom/workflow_permission_alias.tf

@@ -0,0 +1,5 @@
+resource "okta_admin_role_custom" "test" {
+  label       = "testAcc_replace_with_uuid"
+  description = "workflow permission alias migration"
+  permissions = ["okta.workflows.flows.read"]
+}

examples/resources/okta_admin_role_custom/workflow_permission_legacy.tf

@@ -0,0 +1,5 @@
+resource "okta_admin_role_custom" "test" {
+  label       = "testAcc_replace_with_uuid"
+  description = "workflow permission alias migration"
+  permissions = ["okta.workflows.read"]
+}

okta/services/idaas/resource_okta_admin_role_custom.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
@@ -135,7 +136,13 @@ func resourceAdminRoleCustomRead(ctx context.Context, d *schema.ResourceData, me
 	if err != nil {
 		return diag.Errorf("failed to list permissions for custom admin role: %v", err)
 	}
-	_ = d.Set("permissions", flattenPermissions(perms.Permissions))
+	// The Okta API can return both the legacy workflow permission labels
+	// (okta.workflows.invoke / okta.workflows.read) and their newer aliases
+	// (okta.workflows.flows.invoke / okta.workflows.flows.read). Keep whichever
+	// form is already recorded in state so we don't introduce perpetual drift.
+	statePermissions := utils.ConvertInterfaceToStringSetNullable(d.Get("permissions"))
+	apiPermissions := reconcileWorkflowPermissions(statePermissions, perms.Permissions)
+	_ = d.Set("permissions", flattenPermissions(apiPermissions))
 	return nil
 }
 
@@ -155,8 +162,33 @@ func resourceAdminRoleCustomUpdate(ctx context.Context, d *schema.ResourceData,
 	oldSet := oldPermissions.(*schema.Set)
 	newSet := newPermissions.(*schema.Set)
 
-	permissionsToAdd := utils.ConvertInterfaceArrToStringArr(newSet.Difference(oldSet).List())
-	permissionsToRemove := utils.ConvertInterfaceArrToStringArr(oldSet.Difference(newSet).List())
+	// okta.workflows.flows.* is an alias of okta.workflows.* for the same
+	// underlying permission. Diffing on the raw labels reports an alias swap
+	// (e.g. okta.workflows.read -> okta.workflows.flows.read) as an add + a
+	// remove that cancel out, deleting the permission and forcing a second
+	// apply. Diff on the de-aliased label so a swap is a no-op.
+	canonical := func(p string) string {
+		return strings.Replace(p, "okta.workflows.flows.", "okta.workflows.", 1)
+	}
+	oldByCanon := map[string]string{}
+	for _, p := range utils.ConvertInterfaceArrToStringArr(oldSet.List()) {
+		oldByCanon[canonical(p)] = p
+	}
+
+	var permissionsToAdd, permissionsToRemove []string
+	newCanon := map[string]bool{}
+	for _, p := range utils.ConvertInterfaceArrToStringArr(newSet.List()) {
+		c := canonical(p)
+		newCanon[c] = true
+		if _, ok := oldByCanon[c]; !ok {
+			permissionsToAdd = append(permissionsToAdd, p)
+		}
+	}
+	for c, p := range oldByCanon {
+		if !newCanon[c] {
+			permissionsToRemove = append(permissionsToRemove, p)
+		}
+	}
 
 	err := addCustomRolePermissions(ctx, client, d.Id(), permissionsToAdd)
 	if err != nil {
@@ -202,6 +234,46 @@ func flattenPermissions(permissions []*sdk.Permission) interface{} {
 	return schema.NewSet(schema.HashString, arr)
 }
 
+// reconcileWorkflowPermissions removes a redundant workflow permission alias
+// from the API response when state already tracks the other form. The Okta API
+// exposes 2 variations of the same workflow permission
+//
+//	okta.workflows.invoke <-> okta.workflows.flows.invoke
+//	okta.workflows.read   <-> okta.workflows.flows.read
+func reconcileWorkflowPermissions(statePermissions []string, apiPermissions []*sdk.Permission) []*sdk.Permission {
+	inState := make(map[string]bool, len(statePermissions))
+	for _, p := range statePermissions {
+		inState[p] = true
+	}
+
+	existingToNew := map[string]string{
+		"okta.workflows.invoke": "okta.workflows.flows.invoke",
+		"okta.workflows.read":   "okta.workflows.flows.read",
+	}
+
+	discard := make(map[string]bool)
+	for legacy, modern := range existingToNew {
+		switch {
+		case inState[legacy]:
+			discard[modern] = true // state uses the legacy label, discard the newer alias from the API response
+		case inState[modern]:
+			discard[legacy] = true // state uses the newer alias, discard the legacy label from the API response
+		}
+	}
+	if len(discard) == 0 {
+		return apiPermissions
+	}
+
+	filtered := make([]*sdk.Permission, 0, len(apiPermissions))
+	for _, p := range apiPermissions {
+		if p != nil && discard[p.Label] {
+			continue
+		}
+		filtered = append(filtered, p)
+	}
+	return filtered
+}
+
 func addCustomRolePermissions(ctx context.Context, client *sdk.APISupplement, roleIdOrLabel string, permissions []string) error {
 	for _, permission := range permissions {
 		_, _, err := client.AddCustomRolePermission(ctx, roleIdOrLabel, permission)

okta/services/idaas/resource_okta_admin_role_custom_test.go

@@ -43,6 +43,46 @@ func TestAccResourceOktaAdminRoleCustom_crud(t *testing.T) {
 		})
 }
 
+func TestAccResourceOktaAdminRoleCustom_workflowPermissionAliasMigration(t *testing.T) {
+	mgr := newFixtureManager("resources", resources.OktaIDaaSAdminRoleCustom, t.Name())
+	legacy := mgr.GetFixtures("workflow_permission_legacy.tf", t)
+	alias := mgr.GetFixtures("workflow_permission_alias.tf", t)
+	resourceName := fmt.Sprintf("%s.test", resources.OktaIDaaSAdminRoleCustom)
+	acctest.OktaResourceTest(
+		t, resource.TestCase{
+			PreCheck:                 acctest.AccPreCheck(t),
+			ErrorCheck:               testAccErrorChecks(t),
+			ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
+			CheckDestroy:             checkResourceDestroy(resources.OktaIDaaSAdminRoleCustom, doesAdminRoleCustomExist),
+			Steps: []resource.TestStep{
+				{
+					Config: legacy,
+					Check: resource.ComposeTestCheckFunc(
+						resource.TestCheckResourceAttr(resourceName, "permissions.#", "1"),
+						resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*", "okta.workflows.read"),
+					),
+				},
+				{
+					// Swap to the alias label. Post-apply the framework runs a
+					// refresh + plan and fails on a non-empty plan, which is
+					// exactly the regression: the old logic deleted the
+					// permission here, requiring a second apply to re-add it.
+					Config: alias,
+					Check: resource.ComposeTestCheckFunc(
+						resource.TestCheckResourceAttr(resourceName, "permissions.#", "1"),
+						resource.TestCheckTypeSetElemAttr(resourceName, "permissions.*", "okta.workflows.flows.read"),
+					),
+				},
+				{
+					// Explicit no-drift assertion after the migration.
+					Config:             alias,
+					PlanOnly:           true,
+					ExpectNonEmptyPlan: false,
+				},
+			},
+		})
+}
+
 func doesAdminRoleCustomExist(id string) (bool, error) {
 	client := iDaaSAPIClientForTestUtil.OktaSDKSupplementClient()
 	_, response, err := client.GetCustomRole(context.Background(), id)