feat: add legacy_condition support to cleanup mode

Adilson Somensari · Adilson Somensari · commit 8d675e923756 · 2026-07-10T13:15:50.000-05:00
Cleanup mode can now delete non-NRQL (legacy) alert conditions via the
REST API v2. Adds DeleteLegacyCondition to nrRESTClient, a
LegacyConditionDeleter interface in the cleanup package, and threads the
REST client through Run/deleteAsset. ParseCSV matches migration-notice
rows (empty id_type) and ignores per-entity rows, ensuring each
condition is targeted exactly once.

Usage: --mode cleanup --asset-type legacy_condition --csv findings.csv
diff --git a/cmd/main.go b/cmd/main.go
@@ -268,8 +268,10 @@ NEXT STEPS (after import mode)
 
 	limiter := ratelimit.New(*rateLimit)
 
+	restClient := newNRRESTClient(key, reg.RESTURL)
+
 	if *mode == "cleanup" {
-		runCleanup(ctx, ng, *csvOut, assetTypes, *dryRun)
+		runCleanup(ctx, ng, restClient, *csvOut, assetTypes, *dryRun)
 		return
 	}
 
@@ -319,8 +321,6 @@ NEXT STEPS (after import mode)
 	}
 
 	// ── Mode branch ────────────────────────────────────────────────────────────
-	restClient := newNRRESTClient(key, reg.RESTURL)
-
 	switch *mode {
 	case "import":
 		runImport(ctx, ng, limiter, accounts, skipSet, reg, *outDir, *dryRun, *verbose, *timeout, Version, printf, out)
@@ -504,7 +504,7 @@ func runAudit(
 
 // ── Cleanup mode ─────────────────────────────────────────────────────────────
 
-func runCleanup(ctx context.Context, ng resources.NerdGrapher, csvPath string, assetTypes []string, dryRun bool) {
+func runCleanup(ctx context.Context, ng resources.NerdGrapher, rest cleanup.LegacyConditionDeleter, csvPath string, assetTypes []string, dryRun bool) {
 	if csvPath == "" {
 		fmt.Fprintln(os.Stderr, "error: --csv <file> is required for cleanup mode")
 		os.Exit(1)
@@ -538,7 +538,7 @@ func runCleanup(ctx context.Context, ng resources.NerdGrapher, csvPath string, a
 		os.Exit(1)
 	}
 
-	if err := cleanup.Run(ctx, ng, targets, dryRun, os.Stdout, os.Stdin); err != nil {
+	if err := cleanup.Run(ctx, ng, rest, targets, dryRun, os.Stdout, os.Stdin); err != nil {
 		fmt.Fprintf(os.Stderr, "error: %v\n", err)
 		os.Exit(1)
 	}
diff --git a/cmd/rest_client.go b/cmd/rest_client.go
@@ -27,6 +27,26 @@ func newNRRESTClient(apiKey, baseURL string) *nrRESTClient {
 	}
 }
 
+// DeleteLegacyCondition deletes a single non-NRQL condition via the REST API v2.
+func (c *nrRESTClient) DeleteLegacyCondition(ctx context.Context, conditionID int) error {
+	reqURL := fmt.Sprintf("%s/v2/alerts_conditions/%d.json", c.baseURL, conditionID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodDelete, reqURL, nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Api-Key", c.apiKey)
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		return err
+	}
+	body, _ := io.ReadAll(resp.Body)
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("REST API returned %d: %s", resp.StatusCode, string(body))
+	}
+	return nil
+}
+
 // ListLegacyConditions fetches all non-NRQL conditions for policyID, handling
 // REST API v2 page-based pagination internally.
 func (c *nrRESTClient) ListLegacyConditions(ctx context.Context, policyID int) ([]audit.LegacyCondition, error) {
diff --git a/internal/cleanup/cleanup.go b/internal/cleanup/cleanup.go
@@ -35,6 +35,7 @@ var SupportedAssetTypes = map[string]bool{
 	"workload_entity":    true,
 	"workflow_entity":    true,
 	"synthetics_monitor": true,
+	"legacy_condition":   true,
 }
 
 // configFindingTypes map a virtual asset type to the asset_type column value it
@@ -43,6 +44,7 @@ var configFindingTypes = map[string]string{
 	"nrql_condition":     "nrql_condition",
 	"alert_policy":       "alert_policy",
 	"synthetics_monitor": "synthetics_monitor",
+	"legacy_condition":   "legacy_condition",
 }
 
 // ParseCSV reads an audit CSV, filters rows to those matching assetTypes,
@@ -128,7 +130,7 @@ func matchRow(row []string, col map[string]int, activeTypes []string) (Target, b
 
 	for _, vt := range activeTypes {
 		switch vt {
-		case "nrql_condition", "alert_policy", "synthetics_monitor":
+		case "nrql_condition", "alert_policy", "synthetics_monitor", "legacy_condition":
 			if idType == "" && csvAssetType == configFindingTypes[vt] {
 				return Target{
 					AccountID:   accountID,
@@ -173,8 +175,9 @@ func matchRow(row []string, col map[string]int, activeTypes []string) (Target, b
 
 // Run prints the operation plan, confirms with the user (unless dryRun), and
 // executes each operation sequentially. Progress is written to out; the
-// confirmation token is read from in.
-func Run(ctx context.Context, ng resources.NerdGrapher, targets []Target, dryRun bool, out io.Writer, in io.Reader) error {
+// confirmation token is read from in. rest may be nil when REST API access is
+// unavailable; legacy_condition targets will error at execution time if so.
+func Run(ctx context.Context, ng resources.NerdGrapher, rest LegacyConditionDeleter, targets []Target, dryRun bool, out io.Writer, in io.Reader) error {
 	if len(targets) == 0 {
 		fmt.Fprintln(out, "No assets matched the filter — nothing to delete.")
 		return nil
@@ -232,7 +235,7 @@ func Run(ctx context.Context, ng resources.NerdGrapher, targets []Target, dryRun
 	fmt.Fprintln(out)
 	var succeeded, failed int
 	for _, t := range targets {
-		if err := deleteAsset(ctx, ng, t); err != nil {
+		if err := deleteAsset(ctx, ng, rest, t); err != nil {
 			if t.IDValue != "" {
 				fmt.Fprintf(out, "  FAIL  [%s] %q (remove %s): %v\n", t.AssetType, t.AssetName, t.IDValue, err)
 			} else {
diff --git a/internal/cleanup/cleanup_test.go b/internal/cleanup/cleanup_test.go
@@ -258,7 +258,7 @@ func TestParseCSV_EntityDeduplication_DifferentGUIDs(t *testing.T) {
 func TestRun_NoTargets(t *testing.T) {
 	mock := &mockNG{}
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, nil, false, &out, strings.NewReader("")); err != nil {
+	if err := Run(context.Background(), mock, nil, nil, false, &out, strings.NewReader("")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if mock.callCount() != 0 {
@@ -272,7 +272,7 @@ func TestRun_DryRun(t *testing.T) {
 	}
 	mock := &mockNG{}
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, targets, true, &out, strings.NewReader("")); err != nil {
+	if err := Run(context.Background(), mock, nil, targets, true, &out, strings.NewReader("")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if mock.callCount() != 0 {
@@ -289,7 +289,7 @@ func TestRun_WrongConfirmation(t *testing.T) {
 	}
 	mock := &mockNG{}
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, targets, false, &out, strings.NewReader("yes\n")); err == nil {
+	if err := Run(context.Background(), mock, nil, targets, false, &out, strings.NewReader("yes\n")); err == nil {
 		t.Fatal("expected error for wrong confirmation, got nil")
 	}
 	if mock.callCount() != 0 {
@@ -303,7 +303,7 @@ func TestRun_CorrectConfirmation_NRQLCondition(t *testing.T) {
 	}
 	mock := &mockNG{}
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
+	if err := Run(context.Background(), mock, nil, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if mock.callCount() != 1 {
@@ -324,7 +324,7 @@ func TestRun_CorrectConfirmation_AlertPolicy(t *testing.T) {
 	}
 	mock := &mockNG{}
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
+	if err := Run(context.Background(), mock, nil, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	vars := mock.callVars(0)
@@ -342,7 +342,7 @@ func TestRun_CorrectConfirmation_WorkloadEntity(t *testing.T) {
 		`{}`, // update response
 	)
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
+	if err := Run(context.Background(), mock, nil, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if mock.callCount() != 2 {
@@ -362,7 +362,7 @@ func TestRun_CorrectConfirmation_WorkflowEntity(t *testing.T) {
 	}
 	mock := newMock(workflowFetchResp("wf-1", predicates), workflowUpdateOKResp())
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
+	if err := Run(context.Background(), mock, nil, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if mock.callCount() != 2 {
@@ -380,7 +380,7 @@ func TestRun_PartialFailure_ReportsError(t *testing.T) {
 	}
 	mock := &mockNG{err: errors.New("API unavailable")}
 	var out bytes.Buffer
-	err := Run(context.Background(), mock, targets, false, &out, strings.NewReader("delete 2 assets\n"))
+	err := Run(context.Background(), mock, nil, targets, false, &out, strings.NewReader("delete 2 assets\n"))
 	if err == nil {
 		t.Fatal("expected error when deletions fail")
 	}
@@ -565,7 +565,7 @@ func TestRemoveWorkflowEntity_WorkflowNotFound(t *testing.T) {
 
 func TestDeleteAsset_UnsupportedType(t *testing.T) {
 	mock := newMock()
-	err := deleteAsset(context.Background(), mock, Target{
+	err := deleteAsset(context.Background(), mock, nil, Target{
 		AssetType: "unsupported_type",
 		AssetID:   "123",
 	})
@@ -635,7 +635,7 @@ func TestRun_CorrectConfirmation_SyntheticsMonitor(t *testing.T) {
 	}
 	mock := newMock(`{"syntheticsDeleteMonitor":{"deletedGuid":"MON-GUID-42"}}`)
 	var out bytes.Buffer
-	if err := Run(context.Background(), mock, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
+	if err := Run(context.Background(), mock, nil, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
 	if mock.callCount() != 1 {
@@ -649,3 +649,84 @@ func TestRun_CorrectConfirmation_SyntheticsMonitor(t *testing.T) {
 		t.Errorf("expected OK in output, got: %q", out.String())
 	}
 }
+
+// ── Legacy condition deletion tests ──────────────────────────────────────────
+
+type mockRESTClient struct {
+	calls []int
+	err   error
+}
+
+func (m *mockRESTClient) DeleteLegacyCondition(_ context.Context, conditionID int) error {
+	m.calls = append(m.calls, conditionID)
+	return m.err
+}
+
+func TestParseCSV_LegacyCondition(t *testing.T) {
+	csv := makeCSV(
+		// migration-notice row (id_type empty) — should be matched
+		configRow("1", "Prod", "legacy_condition", "10:55", "Apdex", "Legacy apm_app_metric condition"),
+		// entity-ID row (id_type non-empty) — should be skipped
+		"1,Prod,legacy_condition,10:55,Apdex,,monitored entities list,appId,111111,false,,,",
+	)
+	targets, err := ParseCSV(strings.NewReader(csv), []string{"legacy_condition"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(targets) != 1 {
+		t.Fatalf("got %d targets, want 1 (only migration-notice row)", len(targets))
+	}
+	if targets[0].AssetType != "legacy_condition" {
+		t.Errorf("AssetType = %q, want legacy_condition", targets[0].AssetType)
+	}
+	if targets[0].AssetID != "10:55" {
+		t.Errorf("AssetID = %q, want 10:55", targets[0].AssetID)
+	}
+}
+
+func TestDeleteLegacyCondition_Success(t *testing.T) {
+	rest := &mockRESTClient{}
+	if err := deleteLegacyCondition(context.Background(), rest, "10:55"); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(rest.calls) != 1 || rest.calls[0] != 55 {
+		t.Errorf("expected DeleteLegacyCondition(55), got calls=%v", rest.calls)
+	}
+}
+
+func TestDeleteLegacyCondition_NilRest(t *testing.T) {
+	if err := deleteLegacyCondition(context.Background(), nil, "10:55"); err == nil {
+		t.Fatal("expected error when REST client is nil")
+	}
+}
+
+func TestDeleteLegacyCondition_BadAssetID(t *testing.T) {
+	rest := &mockRESTClient{}
+	if err := deleteLegacyCondition(context.Background(), rest, "no-colon"); err == nil {
+		t.Fatal("expected error for malformed asset_id")
+	}
+	if len(rest.calls) != 0 {
+		t.Errorf("expected no REST calls on bad asset_id, got %d", len(rest.calls))
+	}
+}
+
+func TestRun_LegacyCondition(t *testing.T) {
+	targets := []Target{
+		{AccountID: 1, AccountName: "Prod", AssetType: "legacy_condition", AssetID: "10:55", AssetName: "Apdex"},
+	}
+	ng := &mockNG{}
+	rest := &mockRESTClient{}
+	var out bytes.Buffer
+	if err := Run(context.Background(), ng, rest, targets, false, &out, strings.NewReader("delete 1 assets\n")); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ng.callCount() != 0 {
+		t.Errorf("expected 0 NerdGraph calls for legacy_condition, got %d", ng.callCount())
+	}
+	if len(rest.calls) != 1 || rest.calls[0] != 55 {
+		t.Errorf("expected REST DeleteLegacyCondition(55), got calls=%v", rest.calls)
+	}
+	if !strings.Contains(out.String(), "OK") {
+		t.Errorf("expected OK in output, got: %q", out.String())
+	}
+}
diff --git a/internal/cleanup/deleter.go b/internal/cleanup/deleter.go
@@ -3,13 +3,20 @@ package cleanup
 import (
 	"context"
 	"fmt"
+	"strconv"
 	"strings"
 
 	"github.com/asomensari-es/nr-tf-util/internal/resources"
 )
 
-// deleteAsset dispatches to the correct NerdGraph operation based on virtual asset type.
-func deleteAsset(ctx context.Context, ng resources.NerdGrapher, t Target) error {
+// LegacyConditionDeleter deletes a single non-NRQL alert condition via the
+// New Relic REST API v2. Implemented by nrRESTClient in cmd/.
+type LegacyConditionDeleter interface {
+	DeleteLegacyCondition(ctx context.Context, conditionID int) error
+}
+
+// deleteAsset dispatches to the correct operation based on virtual asset type.
+func deleteAsset(ctx context.Context, ng resources.NerdGrapher, rest LegacyConditionDeleter, t Target) error {
 	switch t.AssetType {
 	case "nrql_condition":
 		// asset_id format: "accountId:conditionId"
@@ -33,11 +40,30 @@ func deleteAsset(ctx context.Context, ng resources.NerdGrapher, t Target) error
 		// asset_id is the monitor entity GUID
 		return deleteSyntheticsMonitor(ctx, ng, t.AssetID)
 
+	case "legacy_condition":
+		// asset_id format: "policyId:conditionId"
+		return deleteLegacyCondition(ctx, rest, t.AssetID)
+
 	default:
 		return fmt.Errorf("unsupported asset type: %q", t.AssetType)
 	}
 }
 
+func deleteLegacyCondition(ctx context.Context, rest LegacyConditionDeleter, assetID string) error {
+	if rest == nil {
+		return fmt.Errorf("REST client not configured — cannot delete legacy conditions")
+	}
+	parts := strings.SplitN(assetID, ":", 2)
+	if len(parts) != 2 {
+		return fmt.Errorf("unexpected asset_id format for legacy_condition: %q", assetID)
+	}
+	conditionID, err := strconv.Atoi(parts[1])
+	if err != nil {
+		return fmt.Errorf("invalid condition ID in asset_id %q: %w", assetID, err)
+	}
+	return rest.DeleteLegacyCondition(ctx, conditionID)
+}
+
 // ── Full deletions ────────────────────────────────────────────────────────────
 
 func deleteNRQLCondition(ctx context.Context, ng resources.NerdGrapher, accountID int, conditionID string) error {
