DRAFT: give clear error messages on gateway policy drift

.github/workflows/acceptance-tests.yml

@@ -61,15 +61,13 @@ jobs:
         run: ./scripts/run-ci-tests magic acceptance
         env:
           TF_ACC: 1
-          NO_GRIT: true
         continue-on-error: true
 
       - name: Run Magic Migration Tests
         id: magic_migration_tests
         run: ./scripts/run-ci-tests magic migration
         env:
           TF_ACC: 1
-          NO_GRIT: true
         continue-on-error: true
 
       ######## Everything Else ########
@@ -78,15 +76,13 @@ jobs:
         run: ./scripts/run-ci-tests default acceptance
         env:
           TF_ACC: 1
-          NO_GRIT: true
         continue-on-error: true
 
       - name: Run Default Migration Tests
         id: default_migration_tests
         run: ./scripts/run-ci-tests default migration
         env:
          TF_ACC: 1
-         NO_GRIT: true
         continue-on-error: true
 
       - name: Check Test Status

.stats.yml

@@ -1,4 +1,4 @@
-configured_endpoints: 1809
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-77d61495fecd0d26b9adff1af0ab3510b06a3cc2c6781b9a40aabcad2f10588a.yml
-openapi_spec_hash: 95dee3be411dda77306a41dc7d49eb35
-config_hash: ac04197a992afb1d8c3b416fc46e8c8e
+configured_endpoints: 1822
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/cloudflare%2Fcloudflare-ca8fbfa82d19dca400ec61b8c93392de1acd157860e435419f9a5e9ec8c586e0.yml
+openapi_spec_hash: 77d55c70bc3824ac61bd056e2319ee18
+config_hash: 107e0f1f8a98b007260b319226b88b3c

cmd/migrate/access_application.go

@@ -34,17 +34,24 @@ func isAccessApplicationResource(block *hclwrite.Block) bool {
 // Phase 3 - Remove unsupported attributes and convert blocks to attributes:
 // Before: domain_type = "public" (removed - not supported in v5)
 // Before: destinations { ... } (converted from blocks to list attribute)
+//
+// Phase 4 - Add default type if missing:
+// Before: (no type attribute)
+// After: type = "self_hosted"
 func transformAccessApplicationBlock(block *hclwrite.Block, diags ast.Diagnostics) {
-	// STEP 1: Auto-populate policies from collected access_policy mappings
+	// STEP 1: Add default type attribute if missing (v4 defaulted to "self_hosted")
+	addDefaultTypeAttribute(block)
+
+	// STEP 2: Auto-populate policies from collected access_policy mappings
 	injectCollectedPolicies(block, diags)
-	
-	// STEP 2: Remove unsupported attributes
+
+	// STEP 3: Remove unsupported attributes
 	removeUnsupportedAttributes(block)
-	
-	// STEP 3: Convert destinations blocks to list attribute
+
+	// STEP 4: Convert destinations blocks to list attribute
 	convertDestinationsBlocksToAttribute(block, diags)
-	
-	// STEP 4: Transform existing attribute formats
+
+	// STEP 5: Transform existing attribute formats
 	transforms := map[string]ast.ExprTransformer{
 		"policies":       transformPoliciesAttribute,
 		"allowed_idps":   transformSetToListAttribute,
@@ -53,6 +60,20 @@ func transformAccessApplicationBlock(block *hclwrite.Block, diags ast.Diagnostic
 	ast.ApplyTransformToAttributes(ast.Block{Block: block}, transforms, diags)
 }
 
+// addDefaultTypeAttribute adds type = "self_hosted" if the type attribute is missing
+// This is needed because v4 had a default value of "self_hosted" for the type attribute,
+// but v5 requires it to be explicitly set
+func addDefaultTypeAttribute(block *hclwrite.Block) {
+	body := block.Body()
+
+	// Check if type attribute exists
+	typeAttr := body.GetAttribute("type")
+	if typeAttr == nil {
+		// Add default type = "self_hosted" as this was the v4 default
+		body.SetAttributeValue("type", cty.StringVal("self_hosted"))
+	}
+}
+
 // transformPoliciesAttribute transforms a policies list from strings/references to objects
 //
 // Example transformations:
@@ -333,6 +354,6 @@ func convertDestinationBlockToObject(block *hclwrite.Block) string {
 
 	// Sort for consistent output
 	sort.Strings(attrStrings)
-	
+
 	return fmt.Sprintf("{\n%s\n  }", strings.Join(attrStrings, "\n"))
 }

cmd/migrate/access_application_test.go

@@ -22,11 +22,9 @@ func TestAccessApplicationPoliciesTransformation(t *testing.T) {
   account_id = "abc123"
   name       = "Test App"
   domain     = "test.example.com"
-
-  policies = [
-    { id = cloudflare_zero_trust_access_policy.allow.id },
-    { id = cloudflare_zero_trust_access_policy.deny.id }
-  ]
+
+  policies = [{ id = cloudflare_zero_trust_access_policy.allow.id }, { id = cloudflare_zero_trust_access_policy.deny.id }]
+  type     = "self_hosted"
 }`},
 		},
 		{
@@ -42,8 +40,9 @@ func TestAccessApplicationPoliciesTransformation(t *testing.T) {
   account_id = "abc123"
   name       = "Test App"
   domain     = "test.example.com"
-  
+
   policies = [{ id = "policy-id-1" }, { id = "policy-id-2" }]
+  type     = "self_hosted"
 }`},
 		},
 		{
@@ -63,12 +62,9 @@ func TestAccessApplicationPoliciesTransformation(t *testing.T) {
   account_id = "abc123"
   name       = "Test App"
   domain     = "test.example.com"
-
-  policies = [
-    { id = cloudflare_zero_trust_access_policy.allow.id },
-    { id = "literal-policy-id" },
-    { id = cloudflare_zero_trust_access_policy.deny.id }
-  ]
+
+  policies = [{ id = cloudflare_zero_trust_access_policy.allow.id }, { id = "literal-policy-id" }, { id = cloudflare_zero_trust_access_policy.deny.id }]
+  type     = "self_hosted"
 }`},
 		},
 		{
@@ -86,12 +82,13 @@ func TestAccessApplicationPoliciesTransformation(t *testing.T) {
   account_id = "abc123"
   name       = "Test App"
   domain     = "test.example.com"
-
-  policies = [ { id = cloudflare_zero_trust_access_policy.old_style.id } ]
+
+  policies = [{ id = cloudflare_zero_trust_access_policy.old_style.id }]
+  type     = "self_hosted"
 }`},
 		},
 		{
-			Name: "no policies attribute",
+			Name: "no policies attribute but add default type",
 			Config: `resource "cloudflare_zero_trust_access_application" "test" {
   account_id = "abc123"
   name       = "Test App"
@@ -101,6 +98,7 @@ func TestAccessApplicationPoliciesTransformation(t *testing.T) {
   account_id = "abc123"
   name       = "Test App"
   domain     = "test.example.com"
+  type       = "self_hosted"
 }`},
 		},
 	}
@@ -424,7 +422,7 @@ func TestAccessApplicationSkipAppLauncherLoginPageRemoval(t *testing.T) {
 }`},
 		},
 		{
-			Name: "remove skip_app_launcher_login_page when no type attribute",
+			Name: "remove skip_app_launcher_login_page when no type attribute and add default type",
 			Config: `resource "cloudflare_zero_trust_access_application" "test" {
   account_id                  = "abc123"
   name                        = "Test App"
@@ -435,6 +433,7 @@ func TestAccessApplicationSkipAppLauncherLoginPageRemoval(t *testing.T) {
   account_id = "abc123"
   name       = "Test App"
   domain     = "test.example.com"
+  type       = "self_hosted"
 }`},
 		},
 		{

cmd/migrate/cloudflare_ruleset_hcl.go

@@ -45,17 +45,29 @@ func transformCloudflareRulesetBlock(block *hclwrite.Block, diags ast.Diagnostic
 // transformDynamicRulesBlocks converts dynamic "rules" blocks to for expressions
 // V4: dynamic "rules" { for_each = local.rule_configs; content { ... } }
 // V5: rules = [for rule in local.rule_configs : { ... }]
+// When mixed with static rules blocks (already converted to list), use concat()
 func transformDynamicRulesBlocks(block *hclwrite.Block, diags ast.Diagnostics) {
 	body := block.Body()
 	dynamicRulesBlocks := []*hclwrite.Block{}
 
+	// Check if there's already a rules attribute (from converted static blocks)
+	existingRulesAttr := body.GetAttribute("rules")
+
 	// Find all dynamic blocks with label "rules"
 	for _, childBlock := range body.Blocks() {
 		if childBlock.Type() == "dynamic" && len(childBlock.Labels()) > 0 && childBlock.Labels()[0] == "rules" {
 			dynamicRulesBlocks = append(dynamicRulesBlocks, childBlock)
 		}
 	}
 
+	// If no dynamic blocks, nothing to do
+	if len(dynamicRulesBlocks) == 0 {
+		return
+	}
+
+	// Collect all dynamic block expressions
+	var dynamicExpressions []hclwrite.Tokens
+
 	// Process each dynamic rules block
 	for _, dynBlock := range dynamicRulesBlocks {
 		// Extract the for_each expression
@@ -138,37 +150,8 @@ func transformDynamicRulesBlocks(block *hclwrite.Block, diags ast.Diagnostics) {
 		// Handle nested blocks within content (e.g., action_parameters, ratelimit, etc.)
 		// These need to be converted to attribute format as well
 		for _, nestedBlock := range contentBlock.Body().Blocks() {
-			blockType := nestedBlock.Type()
-
-			// Add the block as an attribute with object value
-			tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte("    " + blockType)})
-			tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenEqual, Bytes: []byte(" = ")})
-			tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenOBrace, Bytes: []byte("{")})
-			tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenNewline, Bytes: []byte("\n")})
-
-			// Process nested block attributes
-			nestedAttrs := nestedBlock.Body().Attributes()
-			nestedAttrNames := make([]string, 0, len(nestedAttrs))
-			for name := range nestedAttrs {
-				nestedAttrNames = append(nestedAttrNames, name)
-			}
-			sort.Strings(nestedAttrNames)
-
-			for _, name := range nestedAttrNames {
-				attr := nestedAttrs[name]
-				tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte("      " + name)})
-				tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenEqual, Bytes: []byte(" = ")})
-
-				attrTokens := attr.Expr().BuildTokens(nil)
-				processedTokens := replaceRulesIteratorReferences(attrTokens, iteratorName)
-				tokens = append(tokens, processedTokens...)
-
-				tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenNewline, Bytes: []byte("\n")})
-			}
-
-			// Close the nested object
-			tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte("    }")})
-			tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenNewline, Bytes: []byte("\n")})
+			blockTokens := convertBlockToAttributeTokens(nestedBlock, iteratorName, 2)
+			tokens = append(tokens, blockTokens...)
 		}
 
 		// Close object
@@ -180,9 +163,101 @@ func transformDynamicRulesBlocks(block *hclwrite.Block, diags ast.Diagnostics) {
 		// Remove the dynamic block
 		body.RemoveBlock(dynBlock)
 
-		// Add the new attribute with the for expression
-		body.SetAttributeRaw("rules", tokens)
+		// Store the dynamic expression for later combination
+		dynamicExpressions = append(dynamicExpressions, tokens)
+	}
+
+	// Now combine all expressions
+	if len(dynamicExpressions) == 0 {
+		return
 	}
+
+	// Build the final rules expression
+	var finalTokens hclwrite.Tokens
+
+	// If we have existing rules (from static blocks), use concat()
+	if existingRulesAttr != nil {
+		// Start with concat(
+		finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte("concat")})
+		finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenOParen, Bytes: []byte("(")})
+
+		// Add existing rules expression
+		finalTokens = append(finalTokens, existingRulesAttr.Expr().BuildTokens(nil)...)
+
+		// Add each dynamic expression
+		for _, dynTokens := range dynamicExpressions {
+			finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenComma, Bytes: []byte(", ")})
+			finalTokens = append(finalTokens, dynTokens...)
+		}
+
+		// Close concat
+		finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenCParen, Bytes: []byte(")")})
+	} else if len(dynamicExpressions) == 1 {
+		// Just one dynamic expression, use it directly
+		finalTokens = dynamicExpressions[0]
+	} else {
+		// Multiple dynamic expressions without static rules, use concat()
+		finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte("concat")})
+		finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenOParen, Bytes: []byte("(")})
+
+		for i, dynTokens := range dynamicExpressions {
+			if i > 0 {
+				finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenComma, Bytes: []byte(", ")})
+			}
+			finalTokens = append(finalTokens, dynTokens...)
+		}
+
+		finalTokens = append(finalTokens, &hclwrite.Token{Type: hclsyntax.TokenCParen, Bytes: []byte(")")})
+	}
+
+	// Set the final rules attribute
+	body.SetAttributeRaw("rules", finalTokens)
+}
+
+// convertBlockToAttributeTokens recursively converts a block and all its nested blocks to attribute format
+func convertBlockToAttributeTokens(block *hclwrite.Block, iteratorName string, indentLevel int) hclwrite.Tokens {
+	var tokens hclwrite.Tokens
+	indent := strings.Repeat("  ", indentLevel)
+
+	blockType := block.Type()
+
+	// Add the block as an attribute with object value
+	tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte(indent + blockType)})
+	tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenEqual, Bytes: []byte(" = ")})
+	tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenOBrace, Bytes: []byte("{")})
+	tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenNewline, Bytes: []byte("\n")})
+
+	// Process attributes
+	attrs := block.Body().Attributes()
+	attrNames := make([]string, 0, len(attrs))
+	for name := range attrs {
+		attrNames = append(attrNames, name)
+	}
+	sort.Strings(attrNames)
+
+	for _, name := range attrNames {
+		attr := attrs[name]
+		tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte(indent + "  " + name)})
+		tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenEqual, Bytes: []byte(" = ")})
+
+		attrTokens := attr.Expr().BuildTokens(nil)
+		processedTokens := replaceRulesIteratorReferences(attrTokens, iteratorName)
+		tokens = append(tokens, processedTokens...)
+
+		tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenNewline, Bytes: []byte("\n")})
+	}
+
+	// Recursively process nested blocks
+	for _, nestedBlock := range block.Body().Blocks() {
+		nestedTokens := convertBlockToAttributeTokens(nestedBlock, iteratorName, indentLevel+1)
+		tokens = append(tokens, nestedTokens...)
+	}
+
+	// Close the object
+	tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenIdent, Bytes: []byte(indent + "}")})
+	tokens = append(tokens, &hclwrite.Token{Type: hclsyntax.TokenNewline, Bytes: []byte("\n")})
+
+	return tokens
 }
 
 // replaceRulesIteratorReferences replaces iterator.value references with just iterator