GH-1834 | okta_event_hook_verification Not Re-Verifying After an Update (#2723)

Author: dhiwakar-okta

docs/resources/event_hook_verification.md

@@ -46,5 +46,6 @@ resource "okta_event_hook_verification" "example" {
 ### Read-Only
 
 - `id` (String) The ID of this resource.
+- `verification_status` (String) The verification status of the event hook.
 
 

examples/resources/okta_event_hook_verification/basic.tf

@@ -0,0 +1,23 @@
+resource "okta_event_hook" "example" {
+  name = "testAcc_replace_with_uuid"
+  events = [
+    "user.lifecycle.create",
+    "user.lifecycle.delete.initiated",
+  ]
+
+  channel = {
+    type    = "HTTP"
+    version = "1.0.0"
+    uri     = "https://eoj5lz4z8m0m1jk.m.pipedream.net"
+  }
+
+  auth = {
+    type  = "HEADER"
+    key   = "Authorization"
+    value = "value"
+  }
+}
+
+resource "okta_event_hook_verification" "user_assigned" {
+  event_hook_id = okta_event_hook.example.id
+}

examples/resources/okta_event_hook_verification/basic_updated.tf

@@ -0,0 +1,23 @@
+resource "okta_event_hook" "example" {
+  name = "testAcc_replace_with_uuid"
+  events = [
+    "user.lifecycle.create",
+    "user.lifecycle.delete.initiated",
+  ]
+
+  channel = {
+    type    = "HTTP"
+    version = "1.0.0"
+    uri     = "https://eo4afyqp3adkxpk.m.pipedream.net"
+  }
+
+  auth = {
+    type  = "HEADER"
+    key   = "Authorization"
+    value = "value"
+  }
+}
+
+resource "okta_event_hook_verification" "user_assigned" {
+  event_hook_id = okta_event_hook.example.id
+}

okta/services/idaas/resource_okta_event_hook_verification.go

@@ -11,26 +11,64 @@ import (
 func resourceEventHookVerification() *schema.Resource {
 	return &schema.Resource{
 		CreateContext: resourceEventHookVerificationCreate,
-		ReadContext:   utils.ResourceFuncNoOp,
+		ReadContext:   resourceEventHookVerificationRead,
+		UpdateContext: resourceEventHookVerificationUpdate,
 		DeleteContext: utils.ResourceFuncNoOp,
 		Importer:      nil,
 		Description:   "Verifies the Event Hook. The resource won't be created unless the URI provided in the event hook returns a valid JSON object with verification. See [Event Hooks](https://developer.okta.com/docs/concepts/event-hooks/#one-time-verification-request) documentation for details.",
+		CustomizeDiff: func(ctx context.Context, d *schema.ResourceDiff, meta interface{}) error {
+			// When the API reports the hook as UNVERIFIED, force a planned diff so that
+			// UpdateContext is invoked on the next apply to re-trigger verification.
+			if d.Id() != "" && d.Get("verification_status").(string) == "UNVERIFIED" {
+				return d.SetNew("verification_status", "VERIFIED")
+			}
+			return nil
+		},
 		Schema: map[string]*schema.Schema{
 			"event_hook_id": {
 				Type:        schema.TypeString,
 				Required:    true,
-				ForceNew:    true,
 				Description: "Event hook ID",
 			},
+			"verification_status": {
+				Type:        schema.TypeString,
+				Computed:    true,
+				Description: "Verification status of the Event hook",
+			},
 		},
 	}
 }
 
 func resourceEventHookVerificationCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
-	_, _, err := getOktaClientFromMetadata(meta).EventHook.VerifyEventHook(ctx, d.Get("event_hook_id").(string))
+	hook, _, err := getOktaV6ClientFromMetadata(meta).EventHookAPI.VerifyEventHook(ctx, d.Get("event_hook_id").(string)).Execute()
+	if err != nil {
+		return diag.Errorf("failed to verify event hook sender: %v", err)
+	}
+	d.SetId(d.Get("event_hook_id").(string))
+	_ = d.Set("verification_status", hook.VerificationStatus)
+	return nil
+}
+
+func resourceEventHookVerificationRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	hook, resp, err := getOktaV6ClientFromMetadata(meta).EventHookAPI.GetEventHook(ctx, d.Id()).Execute()
+	if err := utils.SuppressErrorOn404_V6(resp, err); err != nil {
+		return diag.Errorf("failed to get event hook: %v", err)
+	}
+	if hook == nil {
+		d.SetId("")
+		return nil
+	}
+	d.SetId(d.Get("event_hook_id").(string))
+	_ = d.Set("verification_status", hook.VerificationStatus)
+	return nil
+}
+
+func resourceEventHookVerificationUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	hook, _, err := getOktaV6ClientFromMetadata(meta).EventHookAPI.VerifyEventHook(ctx, d.Get("event_hook_id").(string)).Execute()
 	if err != nil {
 		return diag.Errorf("failed to verify event hook sender: %v", err)
 	}
 	d.SetId(d.Get("event_hook_id").(string))
+	_ = d.Set("verification_status", hook.VerificationStatus)
 	return nil
 }

okta/services/idaas/resource_okta_event_hook_verification_test.go

@@ -0,0 +1,50 @@
+package idaas_test
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/okta/terraform-provider-okta/okta/acctest"
+	"github.com/okta/terraform-provider-okta/okta/resources"
+)
+
+func TestAccResourceOktaEventHookVerification_crud(t *testing.T) {
+	resourceName := "okta_event_hook_verification.user_assigned"
+	mgr := newFixtureManager("resources", resources.OktaIDaaSEventHookVerification, t.Name())
+	config := mgr.GetFixtures("basic.tf", t)
+	updatedConfig := mgr.GetFixtures("basic_updated.tf", t)
+
+	acctest.OktaResourceTest(t, resource.TestCase{
+		PreCheck:                 acctest.AccPreCheck(t),
+		ErrorCheck:               testAccErrorChecks(t),
+		ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactoriesForTestAcc(t),
+		CheckDestroy:             nil,
+		Steps: []resource.TestStep{
+			{
+				Config: config,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "verification_status", "VERIFIED"),
+				),
+			},
+			{
+				Config: updatedConfig,
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "verification_status", "VERIFIED"),
+				),
+				// After apply, ReadContext fetches UNVERIFIED from the API and
+				// CustomizeDiff forces the plan to VERIFIED, so a non-empty plan
+				// is expected on the post-step refresh.
+				ExpectNonEmptyPlan: true,
+			},
+			{
+				// ReadContext fetches the hook and sets verification_status=UNVERIFIED
+				// in state (e.g. the hook was reset externally between applies).
+				// CustomizeDiff then detects UNVERIFIED and calls
+				// d.SetNew("verification_status", "VERIFIED"), so the plan must show ...
+				Config:             updatedConfig,
+				PlanOnly:           true,
+				ExpectNonEmptyPlan: true, // ... at least one change — Terraform will schedule an Update to re-verify.
+			},
+		},
+	})
+}