Using validation in existing grant resource

Snowflake-Labs · Dec 14, 2023 · ad761c8 · ad761c8
1 parent 2d856b3
commit ad761c8
Show file tree

Hide file tree

Showing 2 changed files with 73 additions and 34 deletions.
diff --git a/pkg/resources/grant_privileges_to_role.go b/pkg/resources/grant_privileges_to_role.go
@@ -69,9 +69,10 @@ var grantPrivilegesToRoleSchema = map[string]*schema.Schema{
 					}, true),
 				},
 				"object_name": {
-					Type:        schema.TypeString,
-					Required:    true,
-					Description: "The fully qualified name of the object on which privileges will be granted.",
+					Type:             schema.TypeString,
+					Required:         true,
+					Description:      "The fully qualified name of the object on which privileges will be granted.",
+					ValidateDiagFunc: IsValidIdentifier[sdk.AccountObjectIdentifier](),
 				},
 			},
 		},
@@ -86,11 +87,12 @@ var grantPrivilegesToRoleSchema = map[string]*schema.Schema{
 		Elem: &schema.Resource{
 			Schema: map[string]*schema.Schema{
 				"schema_name": {
-					Type:          schema.TypeString,
-					Optional:      true,
-					Description:   "The fully qualified name of the schema.",
-					ConflictsWith: []string{"on_schema.0.all_schemas_in_database", "on_schema.0.future_schemas_in_database"},
-					ForceNew:      true,
+					Type:             schema.TypeString,
+					Optional:         true,
+					Description:      "The fully qualified name of the schema.",
+					ConflictsWith:    []string{"on_schema.0.all_schemas_in_database", "on_schema.0.future_schemas_in_database"},
+					ValidateDiagFunc: IsValidIdentifier[sdk.DatabaseObjectIdentifier](),
+					ForceNew:         true,
 				},
 				"all_schemas_in_database": {
 					Type:          schema.TypeString,
@@ -151,12 +153,13 @@ var grantPrivilegesToRoleSchema = map[string]*schema.Schema{
 					}, true),
 				},
 				"object_name": {
-					Type:          schema.TypeString,
-					Optional:      true,
-					Description:   "The fully qualified name of the object on which privileges will be granted.",
-					RequiredWith:  []string{"on_schema_object.0.object_type"},
-					ConflictsWith: []string{"on_schema_object.0.all", "on_schema_object.0.future"},
-					ForceNew:      true,
+					Type:             schema.TypeString,
+					Optional:         true,
+					Description:      "The fully qualified name of the object on which privileges will be granted.",
+					RequiredWith:     []string{"on_schema_object.0.object_type"},
+					ConflictsWith:    []string{"on_schema_object.0.all", "on_schema_object.0.future"},
+					ValidateDiagFunc: IsValidIdentifier[sdk.SchemaObjectIdentifier](),
+					ForceNew:         true,
 				},
 				"all": {
 					Type:        schema.TypeList,
@@ -197,18 +200,20 @@ var grantPrivilegesToRoleSchema = map[string]*schema.Schema{
 								}, true),
 							},
 							"in_database": {
-								Type:          schema.TypeString,
-								Optional:      true,
-								Description:   "The fully qualified name of the database.",
-								ConflictsWith: []string{"on_schema_object.0.all.in_schema"},
-								ForceNew:      true,
+								Type:             schema.TypeString,
+								Optional:         true,
+								Description:      "The fully qualified name of the database.",
+								ConflictsWith:    []string{"on_schema_object.0.all.in_schema"},
+								ValidateDiagFunc: IsValidIdentifier[sdk.AccountObjectIdentifier](),
+								ForceNew:         true,
 							},
 							"in_schema": {
-								Type:          schema.TypeString,
-								Optional:      true,
-								Description:   "The fully qualified name of the schema.",
-								ConflictsWith: []string{"on_schema_object.0.all.in_database"},
-								ForceNew:      true,
+								Type:             schema.TypeString,
+								Optional:         true,
+								Description:      "The fully qualified name of the schema.",
+								ConflictsWith:    []string{"on_schema_object.0.all.in_database"},
+								ValidateDiagFunc: IsValidIdentifier[sdk.DatabaseObjectIdentifier](),
+								ForceNew:         true,
 							},
 						},
 					},
@@ -252,18 +257,20 @@ var grantPrivilegesToRoleSchema = map[string]*schema.Schema{
 								}, true),
 							},
 							"in_database": {
-								Type:          schema.TypeString,
-								Optional:      true,
-								Description:   "The fully qualified name of the database.",
-								ConflictsWith: []string{"on_schema_object.0.all.in_schema"},
-								ForceNew:      true,
+								Type:             schema.TypeString,
+								Optional:         true,
+								Description:      "The fully qualified name of the database.",
+								ConflictsWith:    []string{"on_schema_object.0.all.in_schema"},
+								ValidateDiagFunc: IsValidIdentifier[sdk.AccountObjectIdentifier](),
+								ForceNew:         true,
 							},
 							"in_schema": {
-								Type:          schema.TypeString,
-								Optional:      true,
-								Description:   "The fully qualified name of the schema.",
-								ConflictsWith: []string{"on_schema_object.0.all.in_database"},
-								ForceNew:      true,
+								Type:             schema.TypeString,
+								Optional:         true,
+								Description:      "The fully qualified name of the schema.",
+								ConflictsWith:    []string{"on_schema_object.0.all.in_database"},
+								ValidateDiagFunc: IsValidIdentifier[sdk.DatabaseObjectIdentifier](),
+								ForceNew:         true,
 							},
 						},
 					},

diff --git a/pkg/resources/grant_privileges_to_role_acceptance_test.go b/pkg/resources/grant_privileges_to_role_acceptance_test.go
@@ -2,6 +2,7 @@ package resources_test
 
 import (
 	"fmt"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -899,3 +900,34 @@ resource "snowflake_grant_privileges_to_role" "grant" {
 		},
 	})
 }
+
+func TestAcc_GrantPrivilegesToRole_ValidatedIdentifiers(t *testing.T) {
+	resource.Test(t, resource.TestCase{
+		ProtoV6ProviderFactories: acc.TestAccProtoV6ProviderFactories,
+		PreCheck:                 func() { acc.TestAccPreCheck(t) },
+		TerraformVersionChecks: []tfversion.TerraformVersionCheck{
+			tfversion.RequireAbove(tfversion.Version1_5_0),
+		},
+		CheckDestroy: nil,
+		Steps: []resource.TestStep{
+			{
+				Config: fmt.Sprintf(`
+resource "snowflake_role" "role" {
+  name = "TEST_ROLE_123"
+}
+
+resource "snowflake_grant_privileges_to_role" "test_invalidation" {
+  role_name  = snowflake_role.role.name
+  privileges = ["SELECT"]
+  on_schema_object {
+    future {
+      object_type_plural = "ICEBERG TABLES"
+      in_schema          = "%s"
+    }
+  }
+}`, acc.TestSchemaName),
+				ExpectError: regexp.MustCompile(".*Expected DatabaseObjectIdentifier identifier type.*"),
+			},
+		},
+	})
+}