Resource: Add LBAC for datasources data_source_lbac_rules

internal/resources/grafana/resource_data_source_config_lbac_rules.go

@@ -0,0 +1,236 @@
+package grafana
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"strconv"
+
+	"github.com/grafana/grafana-openapi-client-go/client/enterprise"
+	"github.com/grafana/grafana-openapi-client-go/models"
+	"github.com/grafana/terraform-provider-grafana/v3/internal/common"
+	"github.com/hashicorp/terraform-plugin-framework/path"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-plugin-log/tflog"
+)
+
+var (
+	// Check interface
+	_ resource.ResourceWithImportState = (*resourceDataSourceConfigLBACRules)(nil)
+)
+
+var (
+	resourceDataSourceConfigLBACRulesName = "grafana_data_source_config_lbac_rules"
+	resourceDataSourceConfigLBACRulesID   = common.NewResourceID(
+		common.StringIDField("datasource_uid"),
+	)
+)
+
+func makeResourceDataSourceConfigLBACRules() *common.Resource {
+	resourceStruct := &resourceDataSourceConfigLBACRules{}
+	return common.NewResource(
+		common.CategoryGrafanaEnterprise,
+		resourceDataSourceConfigLBACRulesName,
+		resourceDataSourceConfigLBACRulesID,
+		resourceStruct,
+	)
+}
+
+type LBACRule struct {
+	TeamID types.String   `tfsdk:"team_id"`
+	Rules  []types.String `tfsdk:"rules"`
+}
+
+type resourceDataSourceConfigLBACRulesModel struct {
+	ID            types.String `tfsdk:"id"`
+	DatasourceUID types.String `tfsdk:"datasource_uid"`
+	Rules         types.String `tfsdk:"rules"`
+}
+
+type resourceDataSourceConfigLBACRules struct {
+	client *common.Client
+}
+
+func (r *resourceDataSourceConfigLBACRules) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = resourceDataSourceConfigLBACRulesName
+}
+
+func (r *resourceDataSourceConfigLBACRules) Schema(ctx context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
+	tflog.Info(ctx, "Creating LBAC rules Schema")
+	resp.Schema = schema.Schema{
+		MarkdownDescription: `
+Manages LBAC rules for a data source.
+
+!> Warning: The resource is experimental and will be subject to change. This resource manages the entire LBAC rules tree, and will overwrite any existing rules.
+
+* [Official documentation](https://grafana.com/docs/grafana/latest/administration/data-source-management/teamlbac/)
+* [TODO: HTTP API](no api yet)
+
+This resource requires Grafana >=11.0.0.
+`,
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				Computed: true,
+			},
+			"datasource_uid": schema.StringAttribute{
+				Required:    true,
+				Description: "The UID of the datasource.",
+			},
+			"rules": schema.StringAttribute{
+				Required:    true,
+				Description: "JSON-encoded LBAC rules for the data source. Map of team IDs to lists of rule strings.",
+			},
+		},
+	}
+}
+
+func (r *resourceDataSourceConfigLBACRules) Configure(ctx context.Context, req resource.ConfigureRequest, _ *resource.ConfigureResponse) {
+	tflog.Info(ctx, "Configuring LBAC rules")
+	if req.ProviderData == nil {
+		return
+	}
+	r.client = req.ProviderData.(*common.Client)
+}
+
+func (r *resourceDataSourceConfigLBACRules) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	tflog.Info(ctx, "Creating LBAC rules")
+	var data resourceDataSourceConfigLBACRulesModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	tflog.Info(ctx, "Creating LBAC rules", map[string]interface{}{"datasource_uid": data.DatasourceUID.ValueString()})
+
+	var rulesMap map[string][]string
+	err := json.Unmarshal([]byte(data.Rules.ValueString()), &rulesMap)
+	if err != nil {
+		resp.Diagnostics.AddError("Invalid rules JSON", fmt.Sprintf("Failed to parse rules: %v", err))
+		return
+	}
+
+	apiRules := make([]*models.TeamLBACRule, 0, len(rulesMap))
+	for teamID, rules := range rulesMap {
+		apiRules = append(apiRules, &models.TeamLBACRule{
+			TeamID: teamID,
+			Rules:  rules,
+		})
+	}
+
+	tflog.Info(ctx, "Creating LBAC rules with the new rulesmaps", map[string]interface{}{"rulesmaps": fmt.Sprintf("%+v", apiRules)})
+
+	client := r.client.GrafanaAPI
+
+	_, err = client.Enterprise.UpdateTeamLBACRulesAPI(&enterprise.UpdateTeamLBACRulesAPIParams{
+		UID:     data.DatasourceUID.ValueString(),
+		Context: ctx,
+		Body:    &models.UpdateTeamLBACCommand{Rules: apiRules},
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Failed to create LBAC rules", err.Error())
+		return
+	}
+
+	tflog.Info(ctx, "LBAC rules created successfully", map[string]interface{}{"datasource_uid": data.DatasourceUID.ValueString()})
+
+	data.ID = types.StringValue(data.DatasourceUID.ValueString())
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+func (r *resourceDataSourceConfigLBACRules) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var data resourceDataSourceConfigLBACRulesModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	datasourceUID := data.ID.ValueString()
+	client := r.client.GrafanaAPI
+
+	getResp, err := client.Enterprise.GetTeamLBACRulesAPI(datasourceUID)
+	if err != nil {
+		resp.Diagnostics.AddError("Failed to get LBAC rules", err.Error())
+		return
+	}
+
+	rulesMap := make(map[string][]string)
+	for _, rule := range getResp.Payload.Rules {
+		rulesMap[rule.TeamID] = rule.Rules
+	}
+
+	rulesJSON, err := json.Marshal(rulesMap)
+	if err != nil {
+		resp.Diagnostics.AddError("Failed to encode rules", err.Error())
+		return
+	}
+
+	data.Rules = types.StringValue(string(rulesJSON))
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+func (r *resourceDataSourceConfigLBACRules) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	tflog.Info(ctx, "Updating LBAC rules")
+	var data resourceDataSourceConfigLBACRulesModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &data)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	tflog.Info(ctx, "Updating LBAC rules", map[string]interface{}{"datasource_uid": data.DatasourceUID.ValueString()})
+
+	rulesMap := make(map[string][]string)
+	err := json.Unmarshal([]byte(data.Rules.ValueString()), &rulesMap)
+	if err != nil {
+		resp.Diagnostics.AddError("Invalid rules JSON", fmt.Sprintf("Failed to parse rules: %v", err))
+		return
+	}
+
+	apiRules := make([]*models.TeamLBACRule, 0, len(rulesMap))
+	for teamID, rules := range rulesMap {
+		_, err := strconv.ParseInt(teamID, 10, 64)
+		if err != nil {
+			resp.Diagnostics.AddError("Invalid team ID", fmt.Sprintf("Team ID %s is not a valid integer", teamID))
+			return
+		}
+		apiRules = append(apiRules, &models.TeamLBACRule{
+			TeamID: teamID,
+			Rules:  rules,
+		})
+	}
+	tflog.Info(ctx, "Updating LBAC rules with the new rulesmaps", map[string]interface{}{"rulesmaps": fmt.Sprintf("%v+", apiRules)})
+
+	datasourceUID := data.ID.ValueString()
+	client := r.client.GrafanaAPI
+
+	_, err = client.Enterprise.UpdateTeamLBACRulesAPI(&enterprise.UpdateTeamLBACRulesAPIParams{
+		UID:     datasourceUID,
+		Context: ctx,
+		Body:    &models.UpdateTeamLBACCommand{Rules: apiRules},
+	})
+	if err != nil {
+		resp.Diagnostics.AddError("Failed to update LBAC rules", err.Error())
+		return
+	}
+
+	tflog.Info(ctx, "LBAC rules updated successfully", map[string]interface{}{"datasource_uid": data.DatasourceUID.ValueString()})
+
+	data.ID = types.StringValue(datasourceUID)
+	data.DatasourceUID = types.StringValue(datasourceUID)
+	resp.Diagnostics.Append(resp.State.Set(ctx, &data)...)
+}
+
+func (r *resourceDataSourceConfigLBACRules) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	tflog.Warn(ctx, "Delete operation not supported for LBAC rules")
+	resp.Diagnostics.AddWarning("Operation not supported", "Delete operation is not supported for LBAC rules")
+}
+
+func (r *resourceDataSourceConfigLBACRules) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	tflog.Info(ctx, "Importing LBAC rules", map[string]interface{}{"id": req.ID})
+
+	datasourceUID := req.ID
+
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("id"), datasourceUID)...)
+	resp.Diagnostics.Append(resp.State.SetAttribute(ctx, path.Root("datasource_uid"), datasourceUID)...)
+}

internal/resources/grafana/resource_data_source_config_lbac_rules_test.go

@@ -0,0 +1,107 @@
+package grafana_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/grafana/grafana-openapi-client-go/models"
+	"github.com/grafana/terraform-provider-grafana/v3/internal/testutils"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/acctest"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+)
+
+func TestAccDataSourceConfigLBACRules_basic(t *testing.T) {
+	testutils.CheckEnterpriseTestsEnabled(t, ">=11.0.0")
+
+	var ds models.DataSource
+	name := acctest.RandString(10)
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV5ProviderFactories: testutils.ProtoV5ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccDataSourceConfigLBACRules(name),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					datasourceCheckExists.exists("grafana_data_source.test", &ds),
+					resource.TestCheckResourceAttrSet("grafana_data_source_config_lbac_rules.test", "rules"),
+					resource.TestCheckResourceAttrWith("grafana_data_source_config_lbac_rules.test", "rules", func(value string) error {
+						var rulesMap map[string][]string
+						err := json.Unmarshal([]byte(value), &rulesMap)
+						if err != nil {
+							return fmt.Errorf("failed to parse rules JSON: %v", err)
+						}
+
+						expectedRules := []string{
+							"{ foo != \"bar\", foo !~ \"baz\" }",
+							"{ foo = \"qux\" }",
+						}
+
+						if len(rulesMap) != 1 {
+							return fmt.Errorf("expected 1 team id of rules, got %d", len(rulesMap))
+						}
+
+						for teamID, teamRules := range rulesMap {
+							t.Logf("teamID: %s", teamID)
+							if !strings.HasPrefix(teamID, "1:") {
+								return fmt.Errorf("unexpected team ID format: %s", teamID)
+							}
+							if !reflect.DeepEqual(teamRules, expectedRules) {
+								return fmt.Errorf("for team %s, expected rules %v, got %v", teamID, expectedRules, teamRules)
+							}
+						}
+
+						return nil
+					}),
+					resource.TestCheckResourceAttrWith("grafana_data_source.test", "json_data_encoded", func(value string) error {
+						var jsonData map[string]interface{}
+						err := json.Unmarshal([]byte(value), &jsonData)
+						if err != nil {
+							return fmt.Errorf("failed to parse json_data_encoded: %v", err)
+						}
+						return nil
+					}),
+				),
+			},
+		},
+	})
+}
+
+func testAccDataSourceConfigLBACRules(name string) string {
+	return fmt.Sprintf(`
+resource "grafana_data_source" "test" {
+	name = "%[1]s"
+	type = "loki"
+
+	basic_auth_enabled = true
+	basic_auth_username = "admin"
+
+	# FIXME: we need to ignore the attr "teamHttpHeaders" lifecycle inside of the json_data_encoded, if the lbacRules are
+	# provisioned using the config_lbac_rules
+
+	# potentially use: DiffSuppressFunc
+	# to do: if someone uses json_data to configure the json_data, they do not overwrite the lbacRules, do this in grafana side
+
+	lifecycle {
+    	ignore_changes = [json_data_encoded]
+	}
+}
+
+resource "grafana_team" "test" {
+	name = "test"
+}
+
+resource "grafana_data_source_config_lbac_rules" "test" {
+    datasource_uid = grafana_data_source.test.uid
+	org_id = grafana_team.test.org_id
+    rules = jsonencode({
+        "${grafana_team.test.id}" = [
+            "{ foo != \"bar\", foo !~ \"baz\" }",
+            "{ foo = \"qux\" }"
+        ]
+    })
+}
+`, name)
+}

internal/resources/grafana/resources.go

@@ -105,6 +105,7 @@ var Resources = addValidationToResources(
 	makeResourceFolderPermissionItem(),
 	makeResourceDashboardPermissionItem(),
 	makeResourceDatasourcePermissionItem(),
+	makeResourceDataSourceConfigLBACRules(),
 	makeResourceRoleAssignmentItem(),
 	makeResourceServiceAccountPermissionItem(),
 	resourceAnnotation(),