resource_fastly_tls_subscription.go

package fastly

import (
	"context"
	"fmt"
	"strings"
	"time"

	"github.com/fastly/go-fastly/v5/fastly"
	gofastly "github.com/fastly/go-fastly/v5/fastly"
	"github.com/hashicorp/go-cty/cty"
	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
)

func resourceFastlyTLSSubscription() *schema.Resource {
	return &schema.Resource{
		CreateContext: resourceFastlyTLSSubscriptionCreate,
		ReadContext:   resourceFastlyTLSSubscriptionRead,
		UpdateContext: resourceFastlyTLSSubscriptionUpdate,
		DeleteContext: resourceFastlyTLSSubscriptionDelete,
		Importer: &schema.ResourceImporter{
			StateContext: schema.ImportStatePassthroughContext,
		},
		// Subscription can only be updated when in "issued" state, otherwise needs to delete/recreate
		CustomizeDiff: customdiff.All(
			customdiff.ForceNewIf("configuration_id", resourceFastlyTLSSubscriptionStateNotIssued),
			customdiff.ForceNewIf("domains", resourceFastlyTLSSubscriptionStateNotIssued),
			customdiff.ForceNewIf("common_name", resourceFastlyTLSSubscriptionStateNotIssued),
			customdiff.ValidateValue("domains", resourceFastlyTLSSubscriptionValidateDomains),
			customdiff.ValidateValue("common_name", resourceFastlyTLSSubscriptionValidateCommonName),
			resourceFastlyTLSSubscriptionSetNewComputed,
		),
		Schema: map[string]*schema.Schema{
			"domains": {
				Type:        schema.TypeSet,
				Description: "List of domains on which to enable TLS.",
				Required:    true,
				Elem:        &schema.Schema{Type: schema.TypeString},
				MinItems:    1,
			},
			"common_name": {
				Type:        schema.TypeString,
				Description: "The common name associated with the subscription generated by Fastly TLS. If you do not pass a common name on create, we will default to the first TLS domain included. If provided, the domain chosen as the common name must be included in TLS domains.",
				Optional:    true,
				Computed:    true,
			},
			"certificate_authority": {
				Type:         schema.TypeString,
				Description:  "The entity that issues and certifies the TLS certificates for your subscription. Valid values are `lets-encrypt` or `globalsign`.",
				Required:     true,
				ForceNew:     true,
				ValidateFunc: validation.StringInSlice([]string{"lets-encrypt", "globalsign"}, false),
			},
			"configuration_id": {
				Type:        schema.TypeString,
				Description: "The ID of the set of TLS configuration options that apply to the enabled domains on this subscription.",
				Optional:    true,
				Computed:    true,
			},
			"created_at": {
				Type:        schema.TypeString,
				Description: "Timestamp (GMT) when the subscription was created.",
				Computed:    true,
			},
			"updated_at": {
				Type:        schema.TypeString,
				Description: "Timestamp (GMT) when the subscription was updated.",
				Computed:    true,
			},
			"state": {
				Type:        schema.TypeString,
				Description: "The current state of the subscription. The list of possible states are: `pending`, `processing`, `issued`, and `renewing`.",
				Computed:    true,
			},
			"managed_dns_challenge": {
				Type:        schema.TypeMap,
				Description: "The details required to configure DNS to respond to ACME DNS challenge in order to verify domain ownership.",
				Computed:    true,
				Elem:        &schema.Schema{Type: schema.TypeString},
				Deprecated:  "Use 'managed_dns_challenges' attribute instead",
			},
			"managed_dns_challenges": {
				Type:        schema.TypeSet,
				Description: "A list of options for configuring DNS to respond to ACME DNS challenge in order to verify domain ownership.",
				Computed:    true,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"record_name": {
							Type:        schema.TypeString,
							Description: "The name of the DNS record to add. For example `_acme-challenge.example.com`.",
							Computed:    true,
						},
						"record_type": {
							Type:        schema.TypeString,
							Description: "The type of DNS record to add, e.g. `A`, or `CNAME`.",
							Computed:    true,
						},
						"record_value": {
							Type:        schema.TypeString,
							Description: "The value to which the DNS record should point, e.g. `xxxxx.fastly-validations.com`.",
							Computed:    true,
						},
					},
				},
			},
			"managed_http_challenges": {
				Type:        schema.TypeSet,
				Description: "A list of options for configuring DNS to respond to ACME HTTP challenge in order to verify domain ownership. Best accessed through a `for` expression to filter the relevant record.",
				Computed:    true,
				Elem: &schema.Resource{
					Schema: map[string]*schema.Schema{
						"record_type": {
							Type:        schema.TypeString,
							Description: "The type of DNS record to add, e.g. `A`, or `CNAME`.",
							Computed:    true,
						},
						"record_name": {
							Type:        schema.TypeString,
							Description: "The name of the DNS record to add. For example `example.com`. Best accessed through a `for` expression to filter the relevant record.",
							Computed:    true,
						},
						"record_values": {
							Type:        schema.TypeSet,
							Description: "A list with the value(s) to which the DNS record should point.",
							Computed:    true,
							Elem:        &schema.Schema{Type: schema.TypeString},
						},
					},
				},
			},
			"force_destroy": {
				Type:        schema.TypeBool,
				Description: "Force delete the subscription even if it has active domains. Warning: this can disable production traffic if used incorrectly. Defaults to false.",
				Optional:    true,
				Default:     false,
			},
			"force_update": {
				Type:        schema.TypeBool,
				Description: "Force update the subscription even if it has active domains. Warning: this can disable production traffic if used incorrectly.",
				Optional:    true,
				Default:     false,
			},
		},
	}
}

func resourceFastlyTLSSubscriptionCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	var configuration *fastly.TLSConfiguration
	if v, ok := d.GetOk("configuration_id"); ok {
		configuration = &fastly.TLSConfiguration{ID: v.(string)}
	}

	var domains []*fastly.TLSDomain
	var domainStrings []string
	for _, domain := range d.Get("domains").(*schema.Set).List() {
		domains = append(domains, &fastly.TLSDomain{ID: domain.(string)})
		domainStrings = append(domainStrings, domain.(string))
	}

	var commonName *fastly.TLSDomain
	if v, ok := d.GetOk("common_name"); ok {
		if !contains(domainStrings, v.(string)) {
			return diag.Errorf("Domain specified as common_name (%s) must also be in domains (%v)", v, domainStrings)
		}

		commonName = &fastly.TLSDomain{ID: v.(string)}
	}

	subscription, err := conn.CreateTLSSubscription(&fastly.CreateTLSSubscriptionInput{
		CertificateAuthority: d.Get("certificate_authority").(string),
		Configuration:        configuration,
		Domains:              domains,
		CommonName:           commonName,
	})
	if err != nil {
		return diag.FromErr(err)
	}

	d.SetId(subscription.ID)

	return resourceFastlyTLSSubscriptionRead(ctx, d, meta)
}

func resourceFastlyTLSSubscriptionRead(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	include := "tls_authorizations"
	subscription, err := conn.GetTLSSubscription(&fastly.GetTLSSubscriptionInput{
		ID:      d.Id(),
		Include: &include,
	})
	if err, ok := err.(*gofastly.HTTPError); ok && err.IsNotFound() {
		id := d.Id()
		d.SetId("")
		return diag.Diagnostics{
			diag.Diagnostic{
				Severity:      diag.Warning,
				Summary:       fmt.Sprintf("TLS subscription (%s) not found - removing from state", id),
				AttributePath: cty.Path{cty.GetAttrStep{Name: id}},
			},
		}
	} else if err != nil {
		return diag.FromErr(err)
	}

	var domains []string
	for _, domain := range subscription.Domains {
		domains = append(domains, domain.ID)
	}

	var managedHTTPChallenges []map[string]interface{}
	var managedDNSChallenges []map[string]interface{}
	for _, domain := range subscription.Authorizations {
		for _, challenge := range domain.Challenges {
			if challenge.Type == "managed-dns" {
				if len(challenge.Values) < 1 {
					return diag.Errorf("Fastly API returned no record values for Managed DNS Challenges")
				}

				managedDNSChallenges = append(managedDNSChallenges, map[string]interface{}{
					"record_type":  challenge.RecordType,
					"record_name":  challenge.RecordName,
					"record_value": challenge.Values[0],
				})
			} else {
				managedHTTPChallenges = append(managedHTTPChallenges, map[string]interface{}{
					"record_type":   challenge.RecordType,
					"record_name":   challenge.RecordName,
					"record_values": challenge.Values,
				})
			}
		}
	}

	// TODO: This block of code contains a bug where the state file will only include
	// the first domain's challenge data in the case of multi-SAN cert subscriptions.
	// Users should use the new "managed_dns_challenges" attribute instead.
	// We're leaving this for backward compatibility but is planned to be removed in v1.0.0.
	// https://github.com/fastly/terraform-provider-fastly/pull/435
	{
		var managedDNSChallengeOld map[string]string
		for _, challenge := range subscription.Authorizations[0].Challenges {
			if challenge.Type == "managed-dns" {
				if len(challenge.Values) < 1 {
					return diag.Errorf("Fastly API returned no record values for Managed DNS Challenge")
				}

				managedDNSChallengeOld = map[string]string{
					"record_type":  challenge.RecordType,
					"record_name":  challenge.RecordName,
					"record_value": challenge.Values[0],
				}
			}
		}

		err = d.Set("managed_dns_challenge", managedDNSChallengeOld)
		if err != nil {
			return diag.FromErr(err)
		}
	}

	err = d.Set("domains", domains)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("common_name", subscription.CommonName.ID)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("certificate_authority", subscription.CertificateAuthority)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("configuration_id", subscription.Configuration.ID)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("created_at", subscription.CreatedAt.Format(time.RFC3339))
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("updated_at", subscription.UpdatedAt.Format(time.RFC3339))
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("state", subscription.State)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("managed_dns_challenges", managedDNSChallenges)
	if err != nil {
		return diag.FromErr(err)
	}
	err = d.Set("managed_http_challenges", managedHTTPChallenges)
	if err != nil {
		return diag.FromErr(err)
	}

	return nil
}

func resourceFastlyTLSSubscriptionUpdate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	updates := &fastly.UpdateTLSSubscriptionInput{
		ID:    d.Id(),
		Force: d.Get("force_update").(bool),
	}

	if d.HasChange("domains") {
		var domains []*fastly.TLSDomain
		for _, domain := range d.Get("domains").(*schema.Set).List() {
			domains = append(domains, &fastly.TLSDomain{ID: domain.(string)})
		}
		updates.Domains = domains
	}
	if d.HasChange("common_name") {
		updates.CommonName = &fastly.TLSDomain{ID: d.Get("common_name").(string)}
	}
	if d.HasChange("configuration_id") {
		updates.Configuration = &fastly.TLSConfiguration{ID: d.Get("configuration_id").(string)}
	}

	_, err := conn.UpdateTLSSubscription(updates)
	if err != nil {
		return diag.FromErr(err)
	}

	return resourceFastlyTLSSubscriptionRead(ctx, d, meta)
}

func resourceFastlyTLSSubscriptionDelete(_ context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
	conn := meta.(*FastlyClient).conn

	err := conn.DeleteTLSSubscription(&fastly.DeleteTLSSubscriptionInput{
		ID:    d.Id(),
		Force: d.Get("force_destroy").(bool),
	})
	return diag.FromErr(err)
}

func resourceFastlyTLSSubscriptionStateNotIssued(_ context.Context, d *schema.ResourceDiff, _ interface{}) bool {
	return d.Get("state").(string) != "issued"
}

func resourceFastlyTLSSubscriptionSetNewComputed(_ context.Context, d *schema.ResourceDiff, _ interface{}) error {
	// NOTE: This is a workaround for a bug in Terraform core (hashicorp/terraform-plugin-sdk#195)
	// where TypeSet computed attributes are not being updated with the new values upon applying (in an update action).
	// This means that they will not be updated until the second "refresh" or "apply" after the first apply.
	// We should work around this and set the new values immediately upon applying so that other resources
	// that are dependent on this resource can properly see the diff and trigger updates accordingly upon applying.
	if d.HasChange("domains") {
		d.SetNewComputed("managed_dns_challenges")
		d.SetNewComputed("managed_http_challenges")
	}

	return nil
}

// NOTE: Although the RFC spec says it’s case-insensitive, the implementation is varied depending on the software.
// For example, Let's Encrypt doesn't allow uppercase letters. For this reason, Fastly TLS also doesn't support
// uppercase letters in domains. But, Fastly API accepts such inputs and silently converts them to lowercase.
// This would cause state mismatch and diff loop, so we explicitly raise an error to eliminate any confusion.
func resourceFastlyTLSSubscriptionValidateDomains(_ context.Context, v, _ interface{}) error {
	for _, domain := range v.(*schema.Set).List() {
		if domain.(string) != strings.ToLower(domain.(string)) {
			return fmt.Errorf("TLS subscription 'domains' must not contain uppercase letters: %s", v.(*schema.Set).List())
		}
	}
	return nil
}

func resourceFastlyTLSSubscriptionValidateCommonName(_ context.Context, v, _ interface{}) error {
	if v.(string) != strings.ToLower(v.(string)) {
		return fmt.Errorf("TLS subscription 'common_name' must not contain uppercase letters: %s", v.(string))
	}
	return nil
}