Commit WIP re: updated postgresql_role provider.

*Read() and *Update() still need to be updated.

Author: sean-

builtin/providers/postgresql/resource_postgresql_database.go

@@ -104,14 +104,6 @@ func resourcePostgreSQLDatabase() *schema.Resource {
 	}
 }
 
-func validateConnLimit(v interface{}, key string) (warnings []string, errors []error) {
-	value := v.(int)
-	if value < -1 {
-		errors = append(errors, fmt.Errorf("%d can not be less than -1", key))
-	}
-	return
-}
-
 func resourcePostgreSQLDatabaseCreate(d *schema.ResourceData, meta interface{}) error {
 	c := meta.(*Client)
 	conn, err := c.Connect()

builtin/providers/postgresql/resource_postgresql_role.go

@@ -3,64 +3,232 @@ package postgresql
 import (
 	"database/sql"
 	"fmt"
+	"log"
+	"strconv"
+	"strings"
 
 	"github.com/hashicorp/errwrap"
 	"github.com/hashicorp/terraform/helper/schema"
 	"github.com/lib/pq"
 )
 
+const (
+	roleBypassRLSAttr     = "bypass_row_level_security"
+	roleConnLimitAttr     = "connection_limit"
+	roleCreateDBAttr      = "create_database"
+	roleCreateRoleAttr    = "create_role"
+	roleEncryptedPassAttr = "encrypted_password"
+	roleInheritAttr       = "inherit"
+	roleLoginAttr         = "login"
+	roleNameAttr          = "name"
+	rolePasswordAttr      = "password"
+	roleReplicationAttr   = "replication"
+	roleSuperUserAttr     = "superuser"
+	roleValidUntilAttr    = "valid_until"
+
+	// Deprecated options
+	roleDepEncryptedAttr = "encrypted"
+)
+
 func resourcePostgreSQLRole() *schema.Resource {
 	return &schema.Resource{
 		Create: resourcePostgreSQLRoleCreate,
 		Read:   resourcePostgreSQLRoleRead,
 		Update: resourcePostgreSQLRoleUpdate,
 		Delete: resourcePostgreSQLRoleDelete,
+		Importer: &schema.ResourceImporter{
+			State: schema.ImportStatePassthrough,
+		},
 
 		Schema: map[string]*schema.Schema{
-			"name": {
-				Type:     schema.TypeString,
-				Required: true,
-				ForceNew: true,
+			roleNameAttr: {
+				Type:        schema.TypeString,
+				Required:    true,
+				Description: "The name of the role",
+			},
+			rolePasswordAttr: {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Computed:    true,
+				Sensitive:   true,
+				DefaultFunc: schema.EnvDefaultFunc("PGPASSWORD", nil),
+				Description: "Sets the role's password",
+			},
+			roleDepEncryptedAttr: {
+				Type:       schema.TypeString,
+				Optional:   true,
+				Deprecated: fmt.Sprintf("Rename PostgreSQL role resource attribute %q to %q", roleDepEncryptedAttr, roleEncryptedPassAttr),
+			},
+			roleEncryptedPassAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     true,
+				Description: "Control whether the password is stored encrypted in the system catalogs",
+			},
+
+			roleValidUntilAttr: {
+				Type:        schema.TypeString,
+				Optional:    true,
+				Description: "Sets a date and time after which the role's password is no longer valid",
+			},
+			roleConnLimitAttr: {
+				Type:         schema.TypeInt,
+				Optional:     true,
+				Computed:     true,
+				Description:  "How many concurrent connections can be made with this role",
+				ValidateFunc: validateConnLimit,
 			},
-			"login": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				ForceNew: false,
-				Default:  false,
+			roleSuperUserAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: `Determine whether the new role is a "superuser"`,
 			},
-			"password": {
-				Type:     schema.TypeString,
-				Optional: true,
-				ForceNew: false,
+			roleCreateDBAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Define a role's ability to create databases",
 			},
-			"encrypted": {
-				Type:     schema.TypeBool,
-				Optional: true,
-				ForceNew: false,
-				Default:  false,
+			roleCreateRoleAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Determine whether this role will be permitted to create new roles",
+			},
+			roleInheritAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: `Determine whether a role "inherits" the privileges of roles it is a member of`,
+			},
+			roleLoginAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Determine whether a role is allowed to log in",
+			},
+			roleReplicationAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Determine whether a role is allowed to initiate streaming replication or put the system in and out of backup mode",
+			},
+			roleBypassRLSAttr: {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Determine whether a role bypasses every row-level security (RLS) policy",
 			},
 		},
 	}
 }
 
 func resourcePostgreSQLRoleCreate(d *schema.ResourceData, meta interface{}) error {
-	client := meta.(*Client)
-	conn, err := client.Connect()
+	c := meta.(*Client)
+	conn, err := c.Connect()
 	if err != nil {
-		return err
+		return errwrap.Wrapf("Error connecting to PostgreSQL: {{err}}", err)
 	}
 	defer conn.Close()
 
-	roleName := d.Get("name").(string)
-	loginAttr := getLoginStr(d.Get("login").(bool))
-	password := d.Get("password").(string)
+	stringOpts := []struct {
+		hclKey string
+		sqlKey string
+	}{
+		{rolePasswordAttr, "PASSWORD"},
+		{roleValidUntilAttr, "VALID UNTIL"},
+	}
+	intOpts := []struct {
+		hclKey string
+		sqlKey string
+	}{
+		{roleConnLimitAttr, "CONNECTION LIMIT"},
+	}
+	boolOpts := []struct {
+		hclKey        string
+		sqlKeyEnable  string
+		sqlKeyDisable string
+	}{
+		{roleSuperUserAttr, "CREATEDB", "NOCREATEDB"},
+		{roleCreateRoleAttr, "CREATEROLE", "NOCREATEROLE"},
+		{roleInheritAttr, "INHERIT", "NOINHERIT"},
+		{roleLoginAttr, "LOGIN", "NOLOGIN"},
+		{roleReplicationAttr, "REPLICATION", "NOREPLICATION"},
+		{roleBypassRLSAttr, "BYPASSRLS", "NOBYPASSRLS"},
+
+		// roleEncryptedPassAttr is used only when rolePasswordAttr is set.
+		// {roleEncryptedPassAttr, "ENCRYPTED", "UNENCRYPTED"},
+	}
+
+	createOpts := make([]string, 0, len(stringOpts)+len(intOpts)+len(boolOpts))
+
+	for _, opt := range stringOpts {
+		v, ok := d.GetOk(opt.hclKey)
+		if !ok {
+			continue
+		}
+
+		val := v.(string)
+		if val != "" {
+			switch {
+			case opt.hclKey == rolePasswordAttr:
+				if strings.ToUpper(v.(string)) == "NULL" {
+					createOpts = append(createOpts, "PASSWORD NULL")
+				} else {
+					if d.Get(roleEncryptedPassAttr).(bool) {
+						createOpts = append(createOpts, "ENCRYPTED")
+					} else {
+						createOpts = append(createOpts, "UNENCRYPTED")
+					}
+					escapedPassword := strconv.Quote(val)
+					escapedPassword = strings.TrimLeft(escapedPassword, `"`)
+					escapedPassword = strings.TrimRight(escapedPassword, `"`)
+					createOpts = append(createOpts, fmt.Sprintf("%s '%s'", opt.sqlKey, escapedPassword))
+				}
+			case opt.hclKey == roleValidUntilAttr:
+				switch {
+				case v.(string) == "", strings.ToUpper(v.(string)) == "NULL":
+					createOpts = append(createOpts, fmt.Sprintf("%s %s", opt.sqlKey, "'infinity'"))
+				default:
+					createOpts = append(createOpts, fmt.Sprintf("%s %s", opt.sqlKey, pq.QuoteIdentifier(val)))
+				}
+			default:
+				createOpts = append(createOpts, fmt.Sprintf("%s %s", opt.sqlKey, pq.QuoteIdentifier(val)))
+			}
+		}
+	}
+
+	for _, opt := range intOpts {
+		val := d.Get(opt.hclKey).(int)
+		createOpts = append(createOpts, fmt.Sprintf("%s %d", opt.sqlKey, val))
+	}
+
+	for _, opt := range boolOpts {
+		if opt.hclKey == roleEncryptedPassAttr {
+			// This attribute is handled above in the stringOpts
+			// loop.
+			continue
+		}
+		val := d.Get(opt.hclKey).(bool)
 
-	encryptedCfg := getEncryptedStr(d.Get("encrypted").(bool))
+		valStr := opt.sqlKeyDisable
+		if val {
+			valStr = opt.sqlKeyEnable
+		}
+		createOpts = append(createOpts, valStr)
+	}
 
-	query := fmt.Sprintf("CREATE ROLE %s %s %s PASSWORD '%s'", pq.QuoteIdentifier(roleName), loginAttr, encryptedCfg, password)
+	roleName := d.Get(roleNameAttr).(string)
+	createStr := strings.Join(createOpts, " ")
+	if len(createOpts) > 0 {
+		createStr = " WITH " + createStr
+	}
+
+	query := fmt.Sprintf("CREATE ROLE %s%s", pq.QuoteIdentifier(roleName), createStr)
 	_, err = conn.Query(query)
 	if err != nil {
-		return errwrap.Wrapf("Error creating role: {{err}}", err)
+		return errwrap.Wrapf(fmt.Sprintf("Error creating role %s: {{err}}", roleName), err)
 	}
 
 	d.SetId(roleName)
@@ -76,7 +244,7 @@ func resourcePostgreSQLRoleDelete(d *schema.ResourceData, meta interface{}) erro
 	}
 	defer conn.Close()
 
-	roleName := d.Get("name").(string)
+	roleName := d.Get(roleNameAttr).(string)
 
 	query := fmt.Sprintf("DROP ROLE %s", pq.QuoteIdentifier(roleName))
 	_, err = conn.Query(query)
@@ -90,25 +258,32 @@ func resourcePostgreSQLRoleDelete(d *schema.ResourceData, meta interface{}) erro
 }
 
 func resourcePostgreSQLRoleRead(d *schema.ResourceData, meta interface{}) error {
-	client := meta.(*Client)
-	conn, err := client.Connect()
+	c := meta.(*Client)
+	conn, err := c.Connect()
 	if err != nil {
 		return err
 	}
 	defer conn.Close()
 
-	roleName := d.Get("name").(string)
+	roleName := d.Get(roleNameAttr).(string)
+	if roleName == "" {
+		roleName = d.Id()
+	}
 
-	var canLogin bool
-	err = conn.QueryRow("SELECT rolcanlogin FROM pg_roles WHERE rolname=$1", roleName).Scan(&canLogin)
+	var roleCanLogin bool
+	err = conn.QueryRow("SELECT rolcanlogin FROM pg_roles WHERE rolname=$1", roleName).Scan(&roleCanLogin)
 	switch {
 	case err == sql.ErrNoRows:
+		log.Printf("[WARN] PostgreSQL database (%s) not found", d.Id())
 		d.SetId("")
 		return nil
 	case err != nil:
 		return errwrap.Wrapf("Error reading role: {{err}}", err)
 	default:
-		d.Set("login", canLogin)
+		d.Set(roleNameAttr, roleName)
+		d.Set(roleLoginAttr, roleCanLogin)
+		d.Set("encrypted", true)
+		d.SetId(roleName)
 		return nil
 	}
 }
@@ -123,21 +298,21 @@ func resourcePostgreSQLRoleUpdate(d *schema.ResourceData, meta interface{}) erro
 
 	d.Partial(true)
 
-	roleName := d.Get("name").(string)
+	roleName := d.Get(roleNameAttr).(string)
 
-	if d.HasChange("login") {
-		loginAttr := getLoginStr(d.Get("login").(bool))
+	if d.HasChange(roleLoginAttr) {
+		loginAttr := getLoginStr(d.Get(roleLoginAttr).(bool))
 		query := fmt.Sprintf("ALTER ROLE %s %s", pq.QuoteIdentifier(roleName), pq.QuoteIdentifier(loginAttr))
 		_, err := conn.Query(query)
 		if err != nil {
 			return errwrap.Wrapf("Error updating login attribute for role: {{err}}", err)
 		}
 
-		d.SetPartial("login")
+		d.SetPartial(roleLoginAttr)
 	}
 
-	password := d.Get("password").(string)
-	if d.HasChange("password") {
+	password := d.Get(rolePasswordAttr).(string)
+	if d.HasChange(rolePasswordAttr) {
 		encryptedCfg := getEncryptedStr(d.Get("encrypted").(bool))
 
 		query := fmt.Sprintf("ALTER ROLE %s %s PASSWORD '%s'", pq.QuoteIdentifier(roleName), encryptedCfg, password)
@@ -146,7 +321,7 @@ func resourcePostgreSQLRoleUpdate(d *schema.ResourceData, meta interface{}) erro
 			return errwrap.Wrapf("Error updating password attribute for role: {{err}}", err)
 		}
 
-		d.SetPartial("password")
+		d.SetPartial(rolePasswordAttr)
 	}
 
 	if d.HasChange("encrypted") {