refactor: share AuthenticationObj across muxed providers - #194
Closed
badarsebard wants to merge 1 commit into
Closed
refactor: share AuthenticationObj across muxed providers#194badarsebard wants to merge 1 commit into
badarsebard wants to merge 1 commit into
Conversation
One signin in Configure, one signout in main, shared cookie jar. Fixes 401s caused by framework and sdkv2 each owning their own jar.
9 tasks
Contributor
|
Replaced by: #196 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose of the PR
Share a single
AuthenticationObj(and therefore a single cookie jar / session) across both muxed providers so cross-provider Terraform applies stop hitting 401s.Linked JIRA issue(s)
Summary of changes
This provider muxes
provider_framework(terraform-plugin-framework) andprovider_sdkv2(terraform-plugin-sdk/v2) into a single binary. Before this change each provider built its own*AuthenticationObjinConfigure, each with its ownhttp.Client/ cookie jar. A package-level refcount inproviders/utilsshort-circuited the second provider's signin — but only to skip the API call, not to share the cookie. The result: whichever provider signed in second had the valid session; the other made API calls with an invalidated cookie and got 401s.This PR replaces that machinery with a single shared session built lazily in
Configureand torn down inmain:providers/utils/session.go(new):InitSharedAuth(cacheKey, build)builds the*AuthenticationObj, performsGetPasswordSafeAuthentication, and caches both under a mutex. Both providers'Configuremethods call it; since they compute the same cacheKey from the provider block they hit the cache and reuse one session.ShutdownSharedAuth()signs that session out.ResetSharedAuthForTest()is a test-only escape hatch.httptestURLs between cases naturally produce a different key and trigger a clean re-init — no per-test plumbing required.providers/utils/methods.go: removedAuthenticate,SignOut,AuthMu,SignInCount,signAppinResponse, andDeleteAssetByID. File is now justTestResourceConfig+ValidateChangeFrequencyDays.providers/provider_framework/provider.go:ConfigurecallsInitSharedAuthinstead of building + signing in inline.providers/provider_sdkv2/provider.go+common.go:providerConfigurecallsInitSharedAuthand returns a new*providerMeta{authObj, signAppin}instead of a raw*AuthenticationObj. The oldauthenticate(d, m)/signOut(d, m)wrappers incommon.goare gone.main.go: callsutils.ShutdownSharedAuth()aftertf5server.Servereturns (before anylog.Fatal).utils.Authenticate(...)andutils.SignOut(...)calls. They now use the sharedauthenticationObjdirectly. SDKv2 sites changedm.(*auth.AuthenticationObj)→m.(*providerMeta)and read.authObj/.signAppin.providers/provider_framework/assets_resource.go:utils.DeleteAssetByIDis gone; the 3 delete sites now callassets.NewAssetObj+DeleteAssetByIdinline.providers/provider_framework/managed_systems_by_database_resource.go:getManagedSystemObjno longer signs in;APISignOutremoved entirely and its 3 call sites cleaned up.providers/utils/methods_test.gorewritten — oldTestAuthenticate/TestSignOut/TestDeleteAssetByIDremoved, newTestInitSharedAuth_*andTestShutdownSharedAuth_*added. SDKv2 resource tests wrap their raw*AuthenticationObjin&providerMeta{authObj: …}.provider_test.goswitched to a mock signin server sinceproviderConfigurenow performs the handshake.Impacted areas: provider auth lifecycle (all resources/data sources across both providers). No user-facing schema changes; HCL is unchanged.
Checklist
Release
Testing
go build ./...,go vet ./..., andTF_ACC=1 go test ./...all green locally (utils, provider_framework, provider_sdkv2)terraform plan/applyagainst a real Password Safe instance that mixes framework and sdkv2 resources in one config to confirm 401s are goneAutomation