resource(vpc_firewall_rules): add schema upgrade

Implement the `ResourceWithStateUpgrade` interface on
`vpcFirewallRulesResource` to support upgrading existing Terraform
states to the new schema implemented in #474.

One important note is that this does not allow users to use new versions
of the provider with previous versions of the Oxide API. It only updates
existing Terraform states to avoid errors when users upgrade their
clusters to a version that contains API changes.

Author: lgfa29

internal/provider/resource_vpc_firewall_rules.go

@@ -29,8 +29,9 @@ import (
 
 // Ensure the implementation satisfies the expected interfaces.
 var (
-	_ resource.Resource              = (*vpcFirewallRulesResource)(nil)
-	_ resource.ResourceWithConfigure = (*vpcFirewallRulesResource)(nil)
+	_ resource.Resource                 = (*vpcFirewallRulesResource)(nil)
+	_ resource.ResourceWithConfigure    = (*vpcFirewallRulesResource)(nil)
+	_ resource.ResourceWithUpgradeState = (*vpcFirewallRulesResource)(nil)
 )
 
 // NewVPCFirewallRulesResource is a helper function to simplify the provider implementation.
@@ -112,10 +113,41 @@ func (r *vpcFirewallRulesResource) ImportState(ctx context.Context, req resource
 	resource.ImportStatePassthroughID(ctx, path.Root("vpc_id"), req, resp)
 }
 
+// UpgradeState upgrades the Terraform state for the oxide_vpc_firewall_rules
+// resource from a previous schema version to the current version.
+//
+// Schema upgrades are not expected to be applied sequentially, since users are
+// allowed to jump to whatever new version they choose. When adding a new
+// version, you must ensure that each of the existing StateUpgrader functios
+// are also updated to handle the new schema.
+func (r *vpcFirewallRulesResource) UpgradeState(ctx context.Context) map[int64]resource.StateUpgrader {
+	return map[int64]resource.StateUpgrader{
+		0: {
+			PriorSchema: r.schemaV0(ctx),
+			StateUpgrader: func(ctx context.Context, req resource.UpgradeStateRequest, resp *resource.UpgradeStateResponse) {
+				var v0State vpcFirewallRulesResourceModelV0
+				resp.Diagnostics.Append(req.State.Get(ctx, &v0State)...)
+				if resp.Diagnostics.HasError() {
+					return
+				}
+
+				newState, diags := v0State.upgrade(ctx)
+				resp.Diagnostics.Append(diags...)
+				if resp.Diagnostics.HasError() {
+					return
+				}
+
+				resp.Diagnostics.Append(resp.State.Set(ctx, newState)...)
+			},
+		},
+	}
+}
+
 // Schema defines the schema for the resource.
 func (r *vpcFirewallRulesResource) Schema(ctx context.Context, _ resource.SchemaRequest, resp *resource.SchemaResponse) {
 	// TODO: Make sure users can define a single block per VPC ID, not many, is this even possible?
 	resp.Schema = schema.Schema{
+		Version: 1,
 		Attributes: map[string]schema.Attribute{
 			"vpc_id": schema.StringAttribute{
 				Required:    true,

internal/provider/resource_vpc_firewall_rules_test.go

@@ -7,6 +7,10 @@ package provider
 import (
 	"context"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -611,3 +615,119 @@ func testAccFirewallRulesDestroy(s *terraform.State) error {
 
 	return nil
 }
+
+func TestFirewallRules_r15_r16_upgrade(t *testing.T) {
+	var version atomic.Int32
+	version.Store(15)
+
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+		var respFile string
+		switch version.Load() {
+		case 15:
+			respFile = "r15_get_vpc_firewall_rules.json"
+		case 16:
+			respFile = "r16_get_vpc_firewall_rules.json"
+		}
+
+		respPath := filepath.Join("test-fixtures", "resource_vpc_firewall_rules", respFile)
+		f, err := testFixtures.ReadFile(respPath)
+		if err != nil {
+			t.Errorf("failed to read file %q: %v", respPath, err)
+			http.Error(w, "failed to read file", http.StatusInternalServerError)
+			return
+		}
+
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write(f)
+	}))
+	t.Cleanup(func() {
+		ts.Close()
+	})
+
+	resource.Test(t, resource.TestCase{
+		IsUnitTest: true,
+		Steps: []resource.TestStep{
+			{
+				ExternalProviders: map[string]resource.ExternalProvider{
+					"oxide": {
+						Source:            "oxidecomputer/oxide",
+						VersionConstraint: "0.12.0",
+					},
+				},
+				//lintignore:AT004
+				// Configuration must reach local test server.
+				Config: fmt.Sprintf(`
+provider "oxide" {
+  host  = "%s"
+  token = "fake"
+}
+
+resource "oxide_vpc_firewall_rules" "test" {
+  vpc_id = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+  rules = [
+    {
+      action      = "allow"
+      name        = "allow-ssh"
+      description = "SSH rule."
+      direction   = "inbound"
+      priority    = 65535
+      status      = "enabled"
+      filters = {
+        ports     = ["22"]
+        protocols = ["TCP"]
+      }
+      targets = [
+        {
+          type  = "subnet"
+          value = "default"
+        }
+      ]
+    }
+  ]
+}
+`, ts.URL),
+			},
+			{
+				ExternalProviders:        map[string]resource.ExternalProvider{},
+				ProtoV6ProviderFactories: testAccProtoV6ProviderFactories(),
+				PreConfig: func() {
+					version.Store(16)
+				},
+				//lintignore:AT004
+				// Configuration must reach local test server.
+				Config: fmt.Sprintf(`
+provider "oxide" {
+  host  = "%s"
+  token = "fake"
+}
+
+resource "oxide_vpc_firewall_rules" "test" {
+  vpc_id = "3fa85f64-5717-4562-b3fc-2c963f66afa6"
+  rules = [
+    {
+      action      = "allow"
+      name        = "allow-ssh"
+      description = "SSH rule."
+      direction   = "inbound"
+      priority    = 65535
+      status      = "enabled"
+      filters = {
+        ports = ["22"]
+        protocols = [
+          { type : "tcp" }
+        ]
+      }
+      targets = [
+        {
+          type  = "subnet"
+          value = "default"
+        }
+      ]
+    }
+  ]
+}
+`, ts.URL),
+			},
+		},
+	})
+}