Providers fails to update team permissions

[galdor]

Updating the units_map field of forgejo_team resources to change permissions from read to write fails with the following errors:

╷
│ Error: Provider produced inconsistent result after apply
│ 
│ When applying changes to forgejo_team.normal["ml-engineering"], provider "provider[\"registry.opentofu.org/svalabs/forgejo\"]" produced an unexpected new value: .permission: was cty.StringVal("read"), but now
│ cty.StringVal("write").
│ 
│ This is a bug in the provider, which should be reported in the provider's own issue tracker.
╵

Tested with these resources:

resource "forgejo_team" "main" {
  for_each = local.forgejo_teams

  description     = each.value.title
  name            = each.key
  organization_id = forgejo_organization.normal.id
  units_map = {
    "repo.actions"  = "write"
    "repo.code"     = "write"
    "repo.issues"   = "write"
    "repo.packages" = "write"
    "repo.projects" = "write"
    "repo.pulls"    = "write"
    "repo.releases" = "write"
    "repo.wiki"     = "write"
  }
}

• Forgejo 15.
• Forgejo provider v1.4.4.

[acch]

Hi @galdor, thanks for your interest in the provider, and many thanks for filing this issue!

I was able to reproduce the problem. You can work around the bug by adding the permission = "write" attribute to your configuration:

resource "forgejo_team" "main" {
  for_each = local.forgejo_teams

  ...
  permission = "write"
  units_map = {...}
}

There are certain dependencies between the units_map attribute and the permission attribute. These are not yet properly documented, let alone validated during terraform plan.

We do need to add proper documentation. Also, this would be another use case for a custom attribute validator (#59).

Please let me know if adding permission = "write" to your configuration solves the immediate problem for the time being!

[galdor]

Actually adding permission = "write" yields a new error on apply for all teams:

╷
│ Error: Unable to update team
│ 
│   with forgejo_team.normal["ml-engineering"],
│   on teams.tf line 7, in resource "forgejo_team" "normal":
│    7: resource "forgejo_team" "normal" {
│ 
│ Unknown error (status 500): recalculateTeamAccesses: insert new accesses: unique constraint violation: ERROR: duplicate key value violates unique constraint "UQE_access_s" (SQLSTATE 23505)
╵

[acch]

Thanks for the update. I'm afraid that I can't reproduce the second issue...

1. Running terraform apply with your original configuration, without the permission attribute, results in the original error:

   resource "forgejo_team" "main" {
     name            = "foo"
     description     = "bar"
     organization_id = forgejo_organization.owner.id
   
     units_map = {
       "repo.actions"  = "write"
       "repo.code"     = "write"
       "repo.issues"   = "write"
       "repo.packages" = "write"
       "repo.projects" = "write"
       "repo.pulls"    = "write"
       "repo.releases" = "write"
       "repo.wiki"     = "write"
     }
   }

   $ terraform apply -auto-approve
   ...
   ╷
   │ Error: Provider produced inconsistent result after apply
   │
   │ When applying changes to forgejo_team.main, provider "provider[\"registry.terraform.io/svalabs/forgejo\"]" produced an unexpected new value: .permission: was cty.StringVal("read"), but now cty.StringVal("write").
   │
   │ This is a bug in the provider, which should be reported in the provider's own issue tracker.
   ╵
   ...

2. Adding the correct permission attribute and re-running terraform apply succeeds without errors:

   resource "forgejo_team" "main" {
     name            = "foo"
     description     = "bar"
     organization_id = forgejo_organization.owner.id
     permission      = "write"
   
     units_map = {
       "repo.actions"  = "write"
       "repo.code"     = "write"
       "repo.issues"   = "write"
       "repo.packages" = "write"
       "repo.projects" = "write"
       "repo.pulls"    = "write"
       "repo.releases" = "write"
       "repo.wiki"     = "write"
     }
   }

   $ terraform apply -auto-approve
   ...
     # forgejo_team.main is tainted, so must be replaced
   ...
   Apply complete! Resources: 1 added, 0 changed, 1 destroyed.

This is Terraform v1.15.4 with Forgejo 15.0.1.

[kad-hollac1]

Actually adding permission = "write" yields a new error on apply for all teams:

Yeah, I've seen that too, however, the result is still as desired. A rerun of Terraform results in no changes and, as far as we can see, the teams are updated properly. I've searched for this behaviour in the Forgejo code, but couldn't find anything about it. We're using Terraform v1.9.8 and Forgejo 15.0.1. (Although I think i've last seen the error on Forgejo 14.)