Fix permissions: [] to add default IS_OWNER instead of being treated as absent

.nextchanges/bundles/permissions-empty-list.md

@@ -0,0 +1 @@
+An explicit `permissions: []` on a resource is now managed like a non-empty list: the current user is added as the default owner (`IS_OWNER`), matching Terraform. Previously an empty list was treated as if the block were absent.

acceptance/bundle/resources/grants/schemas/empty_list/databricks.yml.tmpl

@@ -0,0 +1,12 @@
+bundle:
+  name: schema-grants-empty-list-$UNIQUE_NAME
+
+resources:
+  schemas:
+    grants_schema:
+      name: schema_grants_empty_list_$UNIQUE_NAME
+      catalog_name: main
+      # Unlike permissions, grants have no default owner: an empty list grants
+      # nothing. Note the engines diverge on create: direct emits a no-op PATCH
+      # with an empty body, terraform emits no request at all.
+      grants: []

acceptance/bundle/resources/grants/schemas/empty_list/out.plan.direct.txt

@@ -0,0 +1,33 @@
+{
+  "plan_version": 2,
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "create",
+      "new_state": {
+        "value": {
+          "catalog_name": "main",
+          "name": "schema_grants_empty_list_[UNIQUE_NAME]"
+        }
+      }
+    },
+    "resources.schemas.grants_schema.grants": {
+      "depends_on": [
+        {
+          "node": "resources.schemas.grants_schema",
+          "label": "${resources.schemas.grants_schema.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "securable_type": "schema",
+          "full_name": ""
+        },
+        "vars": {
+          "full_name": "${resources.schemas.grants_schema.id}"
+        }
+      }
+    }
+  }
+}

acceptance/bundle/resources/grants/schemas/empty_list/out.plan.terraform.txt

@@ -0,0 +1,8 @@
+{
+  "cli_version": "[CLI_VERSION]",
+  "plan": {
+    "resources.schemas.grants_schema": {
+      "action": "create"
+    }
+  }
+}

acceptance/bundle/resources/grants/schemas/empty_list/out.requests.deploy.direct.json

@@ -0,0 +1,5 @@
+{
+  "method": "PATCH",
+  "path": "/api/2.1/unity-catalog/permissions/schema/main.schema_grants_empty_list_[UNIQUE_NAME]",
+  "body": {}
+}

acceptance/bundle/resources/grants/schemas/empty_list/output.txt

@@ -0,0 +1,21 @@
+
+>>> [CLI] bundle validate -o json
+[]
+
+>>> [CLI] bundle deploy
+Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/schema-grants-empty-list-[UNIQUE_NAME]/default/files...
+Deploying resources...
+Updating deployment state...
+Deployment complete!
+
+>>> errcode [CLI] bundle destroy --auto-approve
+The following resources will be deleted:
+  delete resources.schemas.grants_schema
+
+This action will result in the deletion of the following UC schemas. Any underlying data may be lost:
+  delete resources.schemas.grants_schema
+
+All files and directories at the following location will be deleted: /Workspace/Users/[USERNAME]/.bundle/schema-grants-empty-list-[UNIQUE_NAME]/default
+
+Deleting files...
+Destroy complete!

acceptance/bundle/resources/grants/schemas/empty_list/script

@@ -0,0 +1,15 @@
+envsubst < databricks.yml.tmpl > databricks.yml
+
+cleanup() {
+    trace errcode $CLI bundle destroy --auto-approve
+    rm -f out.requests.txt
+}
+trap cleanup EXIT
+
+trace $CLI bundle validate -o json | jq .resources.schemas.grants_schema.grants
+
+errcode $CLI bundle plan -o json &> out.plan.$DATABRICKS_BUNDLE_ENGINE.txt
+rm -f out.requests.txt
+
+trace $CLI bundle deploy
+print_requests.py //permissions > out.requests.deploy.$DATABRICKS_BUNDLE_ENGINE.json

acceptance/bundle/resources/grants/schemas/empty_list/test.toml

@@ -0,0 +1 @@
+Timeout = "5m"

acceptance/bundle/resources/permissions/jobs/empty_list/databricks.yml

@@ -10,5 +10,5 @@ resources:
           notebook_task:
             notebook_path: /Workspace/Users/user@example.com/notebook
             source: WORKSPACE
-      # this is interpreted the same as nil, but it's IMO a bug; it should do default IS_OWNER setting
+      # An explicit empty list is managed: FixPermissions adds the default IS_OWNER for the current user.
       permissions: []

acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.direct.json

@@ -28,6 +28,29 @@
           ]
         }
       }
+    },
+    "resources.jobs.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.jobs.foo",
+          "label": "${resources.jobs.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/jobs/${resources.jobs.foo.id}"
+        }
+      }
     }
   }
 }

acceptance/bundle/resources/permissions/jobs/empty_list/out.plan.terraform.json

@@ -3,6 +3,9 @@
   "plan": {
     "resources.jobs.foo": {
       "action": "create"
+    },
+    "resources.jobs.foo.permissions": {
+      "action": "create"
     }
   }
 }

acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.direct.json

@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.deploy.terraform.json

@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/jobs/empty_list/out.requests.destroy.terraform.json

@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[NUMID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/jobs/empty_list/output.txt

@@ -1,6 +1,11 @@
 
 >>> [CLI] bundle validate -o json
-null
+[
+  {
+    "level": "IS_OWNER",
+    "user_name": "[USERNAME]"
+  }
+]
 
 >>> [CLI] bundle deploy
 Uploading bundle files to /Workspace/Users/[USERNAME]/.bundle/test-bundle/default/files...

acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.direct.json

@@ -78,7 +78,18 @@
           "label": "${resources.jobs.job_with_permissions.id}"
         }
       ],
-      "action": "delete",
+      "action": "update",
+      "new_state": {
+        "value": {
+          "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        }
+      },
       "remote_state": {
         "object_id": "/jobs/[JOB_WITH_PERMISSIONS_ID]",
         "__embed__": [
@@ -95,6 +106,30 @@
             "user_name": "[USERNAME]"
           }
         ]
+      },
+      "changes": {
+        "[group_name='data-team']": {
+          "action": "update",
+          "old": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          },
+          "remote": {
+            "level": "CAN_MANAGE",
+            "group_name": "data-team"
+          }
+        },
+        "[user_name='viewer@example.com']": {
+          "action": "update",
+          "old": {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          },
+          "remote": {
+            "level": "CAN_VIEW",
+            "user_name": "viewer@example.com"
+          }
+        }
       }
     }
   }

acceptance/bundle/resources/permissions/jobs/update/out.plan_set_empty.terraform.json

@@ -5,7 +5,7 @@
       "action": "skip"
     },
     "resources.jobs.job_with_permissions.permissions": {
-      "action": "delete"
+      "action": "update"
     }
   }
 }

acceptance/bundle/resources/permissions/jobs/update/out.requests_destroy.terraform.json

@@ -1,3 +1,15 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}
 {
   "method": "POST",
   "path": "/api/2.2/jobs/delete",

acceptance/bundle/resources/permissions/jobs/update/out.requests_set_empty.direct.json

@@ -0,0 +1,12 @@
+{
+  "method": "PUT",
+  "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]",
+  "body": {
+    "access_control_list": [
+      {
+        "permission_level": "IS_OWNER",
+        "user_name": "[USERNAME]"
+      }
+    ]
+  }
+}

acceptance/bundle/resources/permissions/output.txt

@@ -180,7 +180,24 @@ DIFF  jobs/delete_one/out.requests_destroy.direct.json
      "body": {
        "job_id": "[JOB_WITH_PERMISSIONS_ID]"
 EXACT jobs/empty_list/out.requests.deploy.direct.json
-EXACT jobs/empty_list/out.requests.destroy.direct.json
+DIFF  jobs/empty_list/out.requests.destroy.direct.json
+--- jobs/empty_list/out.requests.destroy.direct.json
++++ jobs/empty_list/out.requests.destroy.terraform.json
+@@ -1 +1,14 @@
+-[]+[
++  {
++    "body": {
++      "access_control_list": [
++        {
++          "permission_level": "IS_OWNER",
++          "user_name": "[USERNAME]"
++        }
++      ]
++    },
++    "method": "PUT",
++    "path": "/api/2.0/permissions/jobs/[NUMID]"
++  }
++]
 MATCH jobs/other_can_manage/out.requests.deploy.direct.json
 DIFF  jobs/other_can_manage/out.requests.destroy.direct.json
 --- jobs/other_can_manage/out.requests.destroy.direct.json
@@ -257,12 +274,11 @@ DIFF  jobs/update/out.requests_delete_all.direct.json
 +    "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]"
 +  }
 +]
-EXACT jobs/update/out.requests_destroy.direct.json
-DIFF  jobs/update/out.requests_set_empty.direct.json
---- jobs/update/out.requests_set_empty.direct.json
-+++ jobs/update/out.requests_set_empty.terraform.json
-@@ -1 +1,14 @@
--[]+[
+DIFF  jobs/update/out.requests_destroy.direct.json
+--- jobs/update/out.requests_destroy.direct.json
++++ jobs/update/out.requests_destroy.terraform.json
+@@ -1,4 +1,16 @@
+ [
 +  {
 +    "body": {
 +      "access_control_list": [
@@ -274,8 +290,11 @@ DIFF  jobs/update/out.requests_set_empty.direct.json
 +    },
 +    "method": "PUT",
 +    "path": "/api/2.0/permissions/jobs/[JOB_WITH_PERMISSIONS_ID]"
-+  }
-+]
++  },
+   {
+     "body": {
+       "job_id": "[JOB_WITH_PERMISSIONS_ID]"
+EXACT jobs/update/out.requests_set_empty.direct.json
 MATCH jobs/viewers/out.requests.deploy.direct.json
 DIFF  jobs/viewers/out.requests.destroy.direct.json
 --- jobs/viewers/out.requests.destroy.direct.json

acceptance/bundle/resources/permissions/pipelines/empty_list/databricks.yml

@@ -5,5 +5,5 @@ resources:
   pipelines:
     foo:
       name: foo
-      # this is interpreted the same as nil, but it's IMO a bug; it should do default IS_OWNER setting
+      # An explicit empty list is managed: FixPermissions adds the default IS_OWNER for the current user.
       permissions: []

acceptance/bundle/resources/permissions/pipelines/empty_list/out.plan.direct.json

@@ -15,6 +15,29 @@
           "name": "foo"
         }
       }
+    },
+    "resources.pipelines.foo.permissions": {
+      "depends_on": [
+        {
+          "node": "resources.pipelines.foo",
+          "label": "${resources.pipelines.foo.id}"
+        }
+      ],
+      "action": "create",
+      "new_state": {
+        "value": {
+          "object_id": "",
+          "__embed__": [
+            {
+              "level": "IS_OWNER",
+              "user_name": "[USERNAME]"
+            }
+          ]
+        },
+        "vars": {
+          "object_id": "/pipelines/${resources.pipelines.foo.id}"
+        }
+      }
     }
   }
 }