fix(cli): preflight listing of resources (#293)

Author: vaishakdinesh

cmd/tf-migrate/preflight.go

@@ -11,6 +11,7 @@ import (
 	"github.com/hashicorp/hcl/v2/hclwrite"
 
 	"github.com/cloudflare/tf-migrate/internal/transform"
+	tfhcl "github.com/cloudflare/tf-migrate/internal/transform/hcl"
 )
 
 // resourceClassification describes how a resource will be handled during migration.
@@ -157,6 +158,11 @@ func classifyResource(block *hclwrite.Block, file string, providers transform.Mi
 
 	// Check if this resource will be renamed
 	if newType, ok := renames[resourceType]; ok {
+		// Conditional renames: some v4 types map to one of two v5 types
+		// depending on block attributes. Override the static rename target
+		// with the per-instance target based on attribute inspection.
+		newType = resolveConditionalRename(resourceType, newType, block)
+
 		return &scannedResource{
 			File:         file,
 			ResourceType: resourceType,
@@ -176,6 +182,51 @@ func classifyResource(block *hclwrite.Block, file string, providers transform.Mi
 	}
 }
 
+// resolveConditionalRename overrides the static rename target for resource types
+// where the v5 target depends on per-instance block attributes.
+//
+// Currently handles:
+//   - cloudflare_zero_trust_device_profiles / cloudflare_device_settings_policy:
+//     Routes to cloudflare_zero_trust_device_custom_profile when the block has
+//     match + precedence and is not explicitly default=true.
+//   - cloudflare_zero_trust_local_fallback_domain / cloudflare_fallback_domain:
+//     Routes to cloudflare_zero_trust_device_custom_profile_local_domain_fallback
+//     when the block has a non-empty policy_id.
+func resolveConditionalRename(resourceType, staticNewType string, block *hclwrite.Block) string {
+	body := block.Body()
+
+	switch resourceType {
+	case "cloudflare_zero_trust_device_profiles", "cloudflare_device_settings_policy":
+		// Mirror the routing logic from zero_trust_device_profiles TransformConfig:
+		// custom if !default && match && precedence, else default.
+		isExplicitDefault := false
+		if attr := body.GetAttribute("default"); attr != nil {
+			val, ok := tfhcl.ExtractBoolFromAttribute(attr)
+			if ok {
+				isExplicitDefault = val
+			}
+		}
+		hasMatch := body.GetAttribute("match") != nil
+		hasPrecedence := body.GetAttribute("precedence") != nil
+
+		if !isExplicitDefault && hasMatch && hasPrecedence {
+			return "cloudflare_zero_trust_device_custom_profile"
+		}
+
+	case "cloudflare_zero_trust_local_fallback_domain", "cloudflare_fallback_domain":
+		// Mirror the routing logic from zero_trust_local_fallback_domain TransformConfig:
+		// custom if policy_id is present and non-empty, else default.
+		if attr := body.GetAttribute("policy_id"); attr != nil {
+			val := tfhcl.ExtractStringFromAttribute(attr)
+			if val != "" || tfhcl.IsExpressionAttribute(attr) {
+				return "cloudflare_zero_trust_device_custom_profile_local_domain_fallback"
+			}
+		}
+	}
+
+	return staticNewType
+}
+
 // parseMovedBlock extracts from/to information from a moved block.
 func parseMovedBlock(block *hclwrite.Block, file string) *existingMovedBlock {
 	body := block.Body()

cmd/tf-migrate/preflight_test.go

@@ -381,6 +381,96 @@ func TestRunPreMigrationScan_EmptyDirectory(t *testing.T) {
 	}
 }
 
+// TestPreflightScan_ConditionalRenames verifies that the pre-migration scan
+// correctly distinguishes default vs custom device profiles and fallback domains.
+// Regression test for https://github.com/cloudflare/tf-migrate/issues/290.
+func TestPreflightScan_ConditionalRenames(t *testing.T) {
+	tmpDir := t.TempDir()
+
+	content := `
+resource "cloudflare_zero_trust_device_profiles" "default_profile" {
+  account_id = "abc123"
+  default    = true
+}
+
+resource "cloudflare_zero_trust_device_profiles" "custom_profile" {
+  account_id = "abc123"
+  name       = "Custom"
+  match      = "identity.email == \"user@example.com\""
+  precedence = 100
+  default    = false
+}
+
+resource "cloudflare_zero_trust_device_profiles" "custom_implicit" {
+  account_id = "abc123"
+  name       = "Custom Implicit"
+  match      = "identity.email == \"other@example.com\""
+  precedence = 200
+}
+
+resource "cloudflare_fallback_domain" "default_fallback" {
+  account_id = "abc123"
+  domains {
+    suffix = "example.com"
+  }
+}
+
+resource "cloudflare_fallback_domain" "custom_fallback" {
+  account_id = "abc123"
+  policy_id  = cloudflare_zero_trust_device_profiles.custom_profile.id
+  domains {
+    suffix = "example.com"
+  }
+}
+`
+	if err := os.WriteFile(filepath.Join(tmpDir, "main.tf"), []byte(content), 0644); err != nil {
+		t.Fatal(err)
+	}
+
+	log := hclog.NewNullLogger()
+	cfg := config{
+		configDir:     tmpDir,
+		sourceVersion: "v4",
+		targetVersion: "v5",
+	}
+
+	report, err := runPreMigrationScan(log, cfg)
+	if err != nil {
+		t.Fatalf("runPreMigrationScan error: %v", err)
+	}
+
+	// Build a map of resource name → NewType for renamed resources
+	renames := make(map[string]string)
+	for _, r := range report.Resources {
+		if r.Class == classRenamed {
+			renames[r.ResourceName] = r.NewType
+		}
+	}
+
+	tests := []struct {
+		name     string
+		expected string
+	}{
+		{"default_profile", "cloudflare_zero_trust_device_default_profile"},
+		{"custom_profile", "cloudflare_zero_trust_device_custom_profile"},
+		{"custom_implicit", "cloudflare_zero_trust_device_custom_profile"},
+		{"default_fallback", "cloudflare_zero_trust_device_default_profile_local_domain_fallback"},
+		{"custom_fallback", "cloudflare_zero_trust_device_custom_profile_local_domain_fallback"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, ok := renames[tt.name]
+			if !ok {
+				t.Fatalf("Resource %q not found in rename results", tt.name)
+			}
+			if got != tt.expected {
+				t.Errorf("Resource %q: got NewType=%q, want %q", tt.name, got, tt.expected)
+			}
+		})
+	}
+}
+
 func contains(s, substr string) bool {
 	return len(s) >= len(substr) && searchString(s, substr)
 }