Add acceptance tests for the password policy framework implementation

internal/framework/base/base.go

@@ -13,12 +13,24 @@ import (
 )
 
 // BaseModel describes common fields for all of the Terraform resource data models
+//
+// Ideally this struct would be imbedded into all Resources and DataSources.
+// However, the Terraform Plugin Framework doesn't support unmarshalling nested
+// structs. See https://github.com/hashicorp/terraform-plugin-framework/issues/242
+// So for now, we must duplicate all fields.
 type BaseModel struct {
+	ID        types.String `tfsdk:"id"`
 	Namespace types.String `tfsdk:"namespace"`
 }
 
 func baseSchema() map[string]schema.Attribute {
 	return map[string]schema.Attribute{
+		// Required for acceptance testing
+		// https://developer.hashicorp.com/terraform/plugin/framework/acctests#no-id-found-in-attributes
+		"id": schema.StringAttribute{
+			Computed:            true,
+			MarkdownDescription: "ID required by the testing framework",
+		},
 		consts.FieldNamespace: schema.StringAttribute{
 			Optional: true,
 			PlanModifiers: []planmodifier.String{

internal/provider/fwprovider/provider.go

@@ -12,7 +12,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
 
 	"github.com/hashicorp/terraform-provider-vault/internal/consts"
-	"github.com/hashicorp/terraform-provider-vault/internal/sys"
+	"github.com/hashicorp/terraform-provider-vault/internal/vault/sys"
 )
 
 // Ensure the implementation satisfies the provider.Provider interface
@@ -47,7 +47,7 @@ func (p *fwprovider) Metadata(ctx context.Context, req provider.MetadataRequest,
 //
 // Schema is called during validate, plan and apply.
 func (p *fwprovider) Schema(ctx context.Context, req provider.SchemaRequest, resp *provider.SchemaResponse) {
-	// TODO(JM): This schema must match exactly to the SDKv2 provider's schema
+	// This schema must match exactly to the SDKv2 provider's schema
 	resp.Schema = schema.Schema{
 		Attributes: map[string]schema.Attribute{
 			// Not `Required` but must be set via config or env. Otherwise we

internal/providertest/providertest.go

@@ -0,0 +1,40 @@
+package providertest
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
+	"github.com/hashicorp/terraform-provider-vault/vault"
+)
+
+// ProtoV5ProviderFactories is a static map containing only the main provider instance
+var (
+	ProtoV5ProviderFactories map[string]func() (tfprotov5.ProviderServer, error) = protoV5ProviderFactoriesInit(context.Background(), "vault")
+)
+
+// testAccProtoV5ProviderFactories will return a map of provider servers
+// suitable for use as a resource.TestStep.ProtoV5ProviderFactories.
+//
+// When multiplexing providers, the schema and configuration handling must
+// exactly match between all underlying providers of the mux server. Mismatched
+// schemas will result in a runtime error.
+// see: https://developer.hashicorp.com/terraform/plugin/framework/migrating/mux
+//
+// Any tests that use this function will serve as a smoketest to verify the
+// provider schemas match 1-1 so that we may catch runtime errors.
+func protoV5ProviderFactoriesInit(ctx context.Context, providerNames ...string) map[string]func() (tfprotov5.ProviderServer, error) {
+	factories := make(map[string]func() (tfprotov5.ProviderServer, error), len(providerNames))
+
+	for _, name := range providerNames {
+		factories[name] = func() (tfprotov5.ProviderServer, error) {
+			providerServerFactory, _, err := vault.ProtoV5ProviderServerFactory(ctx)
+			if err != nil {
+				return nil, err
+			}
+
+			return providerServerFactory(), nil
+		}
+	}
+
+	return factories
+}

internal/vault/auth/README.md

@@ -0,0 +1,3 @@
+# Vault Auth Methods
+
+This package contains Vault [auth method API](https://developer.hashicorp.com/vault/api-docs/auth) resources and datasources.

internal/vault/secrets/README.md

@@ -0,0 +1,3 @@
+# Vault Secrets Engine
+
+This package contains Vault [secrets engine API](https://developer.hashicorp.com/vault/api-docs/secret) resources and datasources.

internal/vault/sys/README.md

@@ -0,0 +1,3 @@
+# Vault System Backend
+
+This package contains Vault [system backend API](https://developer.hashicorp.com/vault/api-docs/system) resources and datasources.

internal/sys/password_policy.go → internal/vault/sys/password_policy.go

@@ -26,14 +26,17 @@ type PasswordPolicyResource struct {
 }
 
 func (r *PasswordPolicyResource) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
-	resp.TypeName = req.ProviderTypeName + "_password_policy_fw"
+	resp.TypeName = req.ProviderTypeName + "_password_policy"
 }
 
 // PasswordPolicyModel describes the Terraform resource data model to match the
 // resource schema.
 type PasswordPolicyModel struct {
+	// common fields to all resources
+	ID        types.String `tfsdk:"id"`
 	Namespace types.String `tfsdk:"namespace"`
 
+	// fields specific to this resource
 	Name   types.String `tfsdk:"name"`
 	Policy types.String `tfsdk:"policy"`
 }
@@ -109,6 +112,9 @@ func (r *PasswordPolicyResource) Create(ctx context.Context, req resource.Create
 		return
 	}
 
+	// write the ID to state which is required for acceptance testing
+	plan.ID = types.StringValue(path)
+
 	// Save data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
 }
@@ -177,6 +183,9 @@ func (r *PasswordPolicyResource) Read(ctx context.Context, req resource.ReadRequ
 
 	state.Policy = types.StringValue(readResp.Policy)
 
+	// write the ID to state which is required for acceptance testing
+	state.ID = types.StringValue(path)
+
 	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
 }
 
@@ -213,6 +222,9 @@ func (r *PasswordPolicyResource) Update(ctx context.Context, req resource.Update
 		return
 	}
 
+	// write the ID to state which is required for acceptance testing
+	plan.ID = types.StringValue(path)
+
 	// Save data into Terraform state
 	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
 }

internal/vault/sys/password_policy_test.go

@@ -0,0 +1,49 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package sys_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-provider-vault/internal/providertest"
+	"github.com/hashicorp/terraform-provider-vault/testutil"
+)
+
+func TestAccPasswordPolicy(t *testing.T) {
+	policyName := acctest.RandomWithPrefix("test-policy")
+	resourceName := "vault_password_policy.test"
+	resource.Test(t, resource.TestCase{
+		PreCheck:                 func() { testutil.TestAccPreCheck(t) },
+		ProtoV5ProviderFactories: providertest.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccPasswordPolicyConfig(policyName, "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\n"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", policyName),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+			{
+				Config: testAccPasswordPolicyConfig(policyName, "length = 20\nrule \"charset\" {\n  charset = \"abcde\"\n}\nrule \"charset\" {\n  charset = \"1234567890\"\nmin-chars = 1\n}\n"),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttr(resourceName, "name", policyName),
+					resource.TestCheckResourceAttrSet(resourceName, "policy"),
+				),
+			},
+		},
+	})
+}
+
+func testAccPasswordPolicyConfig(policyName string, policy string) string {
+	return fmt.Sprintf(`
+resource "vault_password_policy" "test" {
+  name = "%s"
+   policy = <<EOT
+%s
+EOT
+}`, policyName, policy)
+}

vault/provider.go

@@ -553,10 +553,6 @@ var (
 			Resource:      UpdateSchemaResource(rabbitMQSecretBackendRoleResource()),
 			PathInventory: []string{"/rabbitmq/roles/{name}"},
 		},
-		"vault_password_policy": {
-			Resource:      UpdateSchemaResource(passwordPolicyResource()),
-			PathInventory: []string{"/sys/policy/password/{name}"},
-		},
 		"vault_pki_secret_backend_cert": {
 			Resource:      UpdateSchemaResource(pkiSecretBackendCertResource()),
 			PathInventory: []string{"/pki/issue/{role}"},